diff options
Diffstat (limited to 'content')
| -rw-r--r-- | content/blog/2019-01-07-useful-css.org | 63 | ||||
| -rw-r--r-- | content/blog/2019-09-09-audit-analytics.org | 64 | ||||
| -rw-r--r-- | content/blog/2019-12-03-the-ansoff-matrix.org | 32 | ||||
| -rw-r--r-- | content/blog/2019-12-16-password-security.org | 50 |
4 files changed, 105 insertions, 104 deletions
diff --git a/content/blog/2019-01-07-useful-css.org b/content/blog/2019-01-07-useful-css.org index abf3967..59a982f 100644 --- a/content/blog/2019-01-07-useful-css.org +++ b/content/blog/2019-01-07-useful-css.org @@ -5,14 +5,15 @@ * Introduction to CSS -[[https://en.wikipedia.org/wiki/CSS][CSS]], the language used to markup HTML code and make it "pretty", is one of the -most effective ways to increase the attractiveness of a website. It can also -lead to increased user engagement, retention, and satisfaction. In fact, there -are whole career fields are dedicated to the improvement of user experiences, -known as UI design and UX design. - -Some web developers are used to the common CSS properties, such as element -sizing, fonts, colors, etc., but are not as well versed in less-used properties +Cascading Style Sheets ([[https://en.wikipedia.org/wiki/CSS][CSS]]), the language used to mark up HTML code and give it +a visual style, is one of the most effective ways to increase the attractiveness +of a website. It can also lead to increased user engagement, retention, and +satisfaction. In fact, there are whole career fields dedicated to the +improvement of user experiences, known as User Interface (UI) design and User +Experience (UX) design. + +Some web developers are familiar with the common CSS properties, such as element +sizing, fonts, and colors, but are not as well versed in less-used properties and values such as =flexbox=, =clip-path=, and =transform=. This article will provide some insight into the less-used and unique CSS properties. @@ -23,10 +24,10 @@ developers. CSS variables allow you to give your website a well-defined structure, where you can easily reuse CSS properties throughout the project. You can use variables to define things, such as color palettes. Then, you can -use these colors for backgrounds anywhere else in the HTML. This could be -extended, where extra variables could be defined for =primary-text=, -=quoted-text=, etc. Variables can also be used to define spacing (e.g. =32px= or -=2rem=), which can then be applied to margins, padding, font sizes, and more. +use these colors for backgrounds anywhere else in the HTML. You can expand this +and define variables for =primary-text=, =quoted-text=, etc. You can also use +variables to define spacing (e.g. =32px= or =2rem=), which you can then apply to +margins, padding, font sizes, and more. For example, here are some variables defined at the root of the website, which allows for any subsequent CSS rules to use those variables: @@ -47,11 +48,11 @@ body { Box shadows were once my mortal enemy. No matter how hard I tried, I just couldn't get them to work how I wanted. Because of this, my favorite discovery -has been CSSMatic's [[https://www.cssmatic.com/box-shadow][box shadow generator]]. It provides an excellent tool to -generate box shadows using their simple sliders. Surprisingly, this is the -reason I learned how box shadows work! You can use the sliders and watch how the -CSS code changes in the image that is displayed. Through this, you should -understand that the basic structure for box shadows is: +has been CSSMatic's [[https://www.cssmatic.com/box-shadow][box shadow generator]]. It provides a tool to generate box +shadows using their simple sliders. Surprisingly, this is the reason I learned +how box shadows work! You can use the sliders and watch how the CSS code changes +in the image that the tool displays. Through this, you should understand that +the basic structure for box shadows is: #+begin_src css box-shadow: inset horizontal vertical blur spread color; @@ -118,19 +119,19 @@ with the code, experiment, and learn. Try these box shadows out on your own and see how changing each shadow value works. -* CSS Flexbox +* CSS Flex Box -Now, let's move on to the best part of this article: flexbox. The flexbox is by +Now, let's move on to the best part of this article: flex box. The flex box is by far my favorite new toy. I originally stumbled across this solution after looking for more efficient ways of centering content horizontally AND -vertically. I had used a few hack-ish methods before, but flexbox throws those -out the window. The best part of it all is that flexbox is /dead simple/. +vertically. I had used other methods before, but flex box throws those out the +window. The best part of it all is that flex box is /dead simple/. -Flexbox pertains to the parent div of any element. You want the parent to be the -flexbox in which items are arranged to use the flex methods. It's easier to see -this in action that explained, so let's see an example. +Flex Box pertains to the parent div of any element. You want the parent to be the +flex box and the children's behavior modified by the parent's attributes. It's +easier to see this in action that explained, so let's see an example. -*Flexbox* +*Flex Box* #+begin_src html <div class="flex-examples"> @@ -166,13 +167,13 @@ this in action that explained, so let's see an example. You may notice that we no longer need to use the =top= property for the =h3= elements in our code. This is because we set the display box to be a flex container for the small boxes, AND we made the small boxes flex containers for -their elements (the h3 tags). Flex boxes can be nested like this to center -content that is inside centered content. +their elements (the h3 tags). You can nest flex boxes to center content that is +inside centered content. For the example above, we designated the =justify-content= property to be -=flex-start= so that the boxes stack from the left side of the screen. This -property can be changed to =center= to make the boxes appear in the center of -the screen. +=flex-start= so that the boxes stack from the left side of the screen. You can +change this property to =center= to make the boxes appear in the center of the +screen. For an interactive example, [[https://codepen.io/LandonSchropp/pen/KpzzGo][check out this CodePen]] from [[https://codepen.io/LandonSchropp/][LandonScropp]]. Resize the window with dice to see how they collapse and re-align. @@ -180,4 +181,4 @@ window with dice to see how they collapse and re-align. * Even More CSS For more inspiration, you can visit [[https://www.codepen.io][CodePen]], [[https://dribbble.com][Dribbble]], or [[https://uimovement.com][UI Movement]] to browse -the collections of many amazing web designers. +the collections of amazing web designers. diff --git a/content/blog/2019-09-09-audit-analytics.org b/content/blog/2019-09-09-audit-analytics.org index 400e6fd..5984b5d 100644 --- a/content/blog/2019-09-09-audit-analytics.org +++ b/content/blog/2019-09-09-audit-analytics.org @@ -23,8 +23,8 @@ fact, data analytics are only a small part of the process. See *Figure 1* for a more accurate representation of where data analysis sits within the full process. This means that data analysis does not include querying or extracting data, selecting samples, or performing audit tests. These steps -can be necessary for an audit (and may even be performed by the same -associates), but they are not data analytics. +can be necessary for an audit (and the same associates may perform these steps), +but they are not data analytics. * Current Use of Analytics in Auditing @@ -32,8 +32,8 @@ While data analysis has been an integral part of most businesses and departments for the better part of the last century, only recently have internal audit functions been adopting this practice. The internal audit function works exclusively to provide assurance and consulting services to the business areas -within the firm (except for internal auditing firms who are hired by different -companies to perform their roles). +within the firm (except for internal auditing firms hired by different companies +to perform their roles). #+begin_quote Internal Auditing helps an organization accomplish its objectives by bringing a @@ -66,15 +66,15 @@ most common places to start is to research some data analysis models currently available. For this post, we'll take a look at the DELTA model. You can take a look at *Figure 2* for a quick overview of the model. -The DELTA model sets a few guidelines for areas wanting to implement data -analytics so that the results can be as comprehensive as possible: +The DELTA model sets guidelines for areas wanting to implement data analytics so +that the results can be as comprehensive as possible: - *Data*: Must be clean, accessible, and (usually) unique. - *Enterprise-Wide Focus*: Key data systems and analytical resources must be available for use (by the Internal Audit Function). - *Leaders*: Must promote a data analytics approach and show the value of analytical results. -- *Targets*: Must be set for key areas and risks that the analytics can be +- *Targets*: Must be defined for key areas and risks that the analytics can be compared against (KPIs). - *Analysts*: There must be auditors willing and able to perform data analytics or else the system cannot be sustained. @@ -91,9 +91,9 @@ auditors can use data analytics to assess and report on these KPIs. This allows the person performing the analytics the freedom to express opinions on the results, whereas the results are ambiguous if no KPIs exist. -It should be noted that tracking KPIs in the department can help ensure you have -a rigorous Quality Assurance and Improvement Program (QAIP) in accordance with -some applicable standards, such as IPPF Standard 1300. +Note that tracking KPIs in the department can help ensure you have a rigorous +Quality Assurance and Improvement Program (QAIP) in accordance with some +applicable standards, such as IPPF Standard 1300. #+begin_quote The chief audit executive must develop and maintain a quality assurance and @@ -143,36 +143,36 @@ colleagues. * Data Analysis Tools Finally, to be able to analyze and report on the data analysis, auditors need to -evaluate the tools at their disposal. There are many options available, but a -few of the most common ones can easily get the job done. For example, almost -every auditor already has access to Microsoft Excel. Excel is more powerful than -most people give it credit for and can accomplish a lot of basic statistics -without much work. If you don't know a lot about statistics but still want to -see some of the more basic results, Excel is a great option. +evaluate the tools at their disposal. There are options available, but the most +common ones can easily get the job done. For example, almost every auditor +already has access to Microsoft Excel. Excel is more powerful than most people +give it credit for and can accomplish a lot of basic statistics without much +work. If you don't know a lot about statistics but still want to see some of the +more basic results, Excel is a great option. To perform more in-depth statistical analysis or to explore large datasets that Excel cannot handle, auditors will need to explore other options. The big three -that have had a lot of success in recent years are Python, R, and ACL. ACL can -be used as either a graphical tool (point and click) or as a scripting tool, -where the auditor must write the scripts manually. Python and the R-language are -solely scripting languages. +that have had a lot of success in recent years are Python, R, and ACL Analytics +(ACL). You can use ACL as either a graphical tool (point and click) or as a +scripting tool, where the auditor must write the scripts manually. Python and +the R-language are solely scripting languages. The general trend in the data analytics environment is that if the tool allows you to do everything by clicking buttons or dragging elements, you won't be able -to fully utilize the analytics you need. The most robust solutions are created -by those who understand how to write the scripts manually. It should be noted -that as the utility of a tool increases, it usually means that the learning -curve for that tool will also be higher. It will take auditors longer to learn -how to utilize Python, R, or ACL versus learning how to utilize Excel. +to fully utilize the analytics you need. To create the most robust solutions, +you should write the scripts manually. Note that as the utility of a tool +increases, it usually means that the learning curve for that tool will also be +higher. It will take auditors longer to learn how to utilize Python, R, or ACL +versus learning how to utilize Excel. * Visualization Once an auditor has finally found the right data, KPIs, and tools, they must -report these results so that actions can be taken. Performing in-depth data -analysis is only useful if the results are understood by the audiences of the -data. The best way to create this understanding is to visualize the results of -the data. Let's take a look at some of the best options to visualize and report -the results you've found. +report these results so that readers of their results can take action. +Performing in-depth data analysis is only useful if the audience can understand +the results. The best way to create this understanding is to visualize the +results of the data. Let's take a look at some of the best options to visualize +and report the results you've found. Some of the most popular commercial tools for visualization are Microsoft PowerBI and Tableau Desktop. However, other tools exist such as JMP, Plotly, @@ -180,8 +180,8 @@ Qlikview, Alteryx, or D3. Some require commercial licenses while others are simply free to use. For corporate data, you may want to make sure that the tool does not communicate any of the data outside the company (such as cloud storage). I won't be going into depth on any of these tools since visualization -is largely a subjective and creative experience, but remember to constantly -explore new options as you repeat the process. +is a subjective and creative experience, but remember to constantly explore new +options as you repeat the process. Lastly, let's take a look at an example of data visualization. This example comes from a [[https://talent.works/2018/03/28/the-science-of-the-job-search-part-iii-61-of-entry-level-jobs-require-3-years-of-experience/][blog post written by Kushal Chakrabarti]] in 2018 about the percent diff --git a/content/blog/2019-12-03-the-ansoff-matrix.org b/content/blog/2019-12-03-the-ansoff-matrix.org index 3370c63..903b6cd 100644 --- a/content/blog/2019-12-03-the-ansoff-matrix.org +++ b/content/blog/2019-12-03-the-ansoff-matrix.org @@ -50,8 +50,8 @@ Market development extends existing products into new markets in an attempt to increase the number of buyers. One interesting way that Coca-Cola used this strategy comes from the stigma that Diet Coke is a woman's drink(2019). Coca-Cola introduced Coca-Cola Zero, which contained the same nutritional -content as Diet Coke, but was packaged in a dark black can to appear more -"manly"(2019). +content as Diet Coke, but the company packaged it in a dark black can to appear +more "manly" (2019). ** Product Development @@ -77,11 +77,11 @@ lines of business(2019). Unrelated diversification is a diversification strategy that does not really relate to the firm's core business but still diversifies their business portfolio. A good example of this would be a coffee company who has decided to -enter the market for bicycle sales. The main purpose of this strategy is to an -extremely diverse company that will not go bankrupt if one market goes through -difficult times. However, this requires a lot of independent skills and heavy -investments since the company most likely cannot easily transfer knowledge -between the markets they compete in. +enter the market for bicycle sales. The main purpose of this strategy is to a +diverse company that will not go bankrupt if one market goes through difficult +times. However, this requires a lot of independent skills and heavy investments +since the company most likely cannot easily transfer knowledge between the +markets they compete in. * Requirements for Success @@ -95,15 +95,15 @@ internal and external perspectives throughout the strategy formulation process. One interesting probability is that companies will be using multiple strategic planning and management frameworks at the same time. While this may sound like it could crowd the management process, there are numerous reasons to do so. For -example, the Ansoff Matrix and the Balanced Scorecard are relatively popular, -and they cover entirely different parts of a company's strategy. Using the -results from the Balanced Scorecard could inform a company of the potential -product and market demands, such as from customer or supplier survey results, to -help the company determine which Ansoff Matrix strategy to pursue. However, a -combined approach at this level would require mature frameworks and focused -managers who are able to strategize at a high level. - -Lastly, it should be noted that the author of the Ansoff matrix, Igor Ansoff, +example, the Ansoff Matrix and the Balanced Scorecard are popular, and they +cover entirely different parts of a company's strategy. Using the results from +the Balanced Scorecard could inform a company of the potential product and +market demands, such as from customer or supplier survey results, to help the +company determine which Ansoff Matrix strategy to pursue. However, a combined +approach at this level would require mature frameworks and focused managers who +are able to strategize at a high level. + +Lastly, please note that the author of the Ansoff matrix, Igor Ansoff, often used the term [[https://en.wikipedia.org/wiki/Analysis_paralysis][paralysis by analysis]] to explain the mistake of companies who overuse analysis and spend too much time planning. Companies need to understand the utility of a strategic management framework while ensuring that diff --git a/content/blog/2019-12-16-password-security.org b/content/blog/2019-12-16-password-security.org index 213fd3f..f44153d 100644 --- a/content/blog/2019-12-16-password-security.org +++ b/content/blog/2019-12-16-password-security.org @@ -11,15 +11,15 @@ Information security, including passwords and identities, has become one of the most important digital highlights of the last decade. With [[https://www.usatoday.com/story/money/2018/12/28/data-breaches-2018-billions-hit-growing-number-cyberattacks/2413411002/][billions of people affected by data breaches each year]], there's a greater need to introduce strong information security systems. If you think you've been part of a breach, or you -want to check and see, you can use [[https://haveibeenpwned.com/][Have I Been Pwned]] to see if your email has -been involved in any public breaches. Remember that there's a possibility that a +want to check and see, you can use [[https://haveibeenpwned.com/][Have I Been Pwned]] to see if any public +breaches have exposed your email(s). Remember that there's a possibility that a company experienced a breach and did not report it to anyone. ** How Do I Protect Myself? The first place to start with any personal security check-up is to gather a list of all the different websites, apps, or programs that require you to have login -credentials. Optionally, once you know where your information is being stored, +credentials. Optionally, once you know where you are storing your information, you can sort the list from the most-important items such as banks or government logins to less important items such as your favorite meme site. You will want to ensure that your critical logins are secure before getting to the others. @@ -36,34 +36,34 @@ Personally, I recommend using a [[https://en.wikipedia.org/wiki/Passphrase][pass password. Instead of using a string of characters (whether random or simple), use a phrase and add in symbols and a number. For example, your vault password could be =Racing-Alphabet-Gourd-Parrot3=. Swap the symbols out for whichever -symbol you want, move the number around, and fine-tune the passphrase until you +symbol you want, move the number around, and fine-tune the pass phrase until you are confident that you can remember it whenever necessary. Once you've stored your passwords, make sure you continually check up on your account and make sure you aren't following bad password practices. Krebs on Security has a great [[https://krebsonsecurity.com/password-dos-and-donts/][blog post on password recommendations]]. Any time that a data -breach happens, make sure you check to see if you were included, and if you need -to reset any account passwords. +breach happens, make sure you check to see if the breach exposed your email, and +if you need to reset any account passwords. * Developers ** What Are the Basic Requirements? -When developing any password-protected application, there are a few basic rules -that anyone should follow even if they do not follow any official guidelines -such as NIST. The foremost practice is to require users to use passwords that -are at least 8 characters and cannot easily be guessed. This sounds extremely -simple, but it requires quite a few different strategies. First, the application -should check the potential passwords against a dictionary of insecure passwords -such =password=, =1234abc=, or =application_name=. - -Next, the application should offer guidance on the strength of passwords being -entered during enrollment. Further, NIST officially recommends *not* -implementing any composition rules that make passwords hard to remember (e.g. -passwords with letters, numbers, and special characters) and instead encouraging -the use of long pass phrases which can include spaces. It should be noted that -to be able to keep spaces within passwords, all unicode characters should be -supported, and passwords should not be truncated. +When developing any password-protected application, there are basic rules that +anyone should follow even if they do not follow any official guidelines such as +NIST. The foremost practice is to require users to use passwords that are at +least 8 characters and bad actors cannot easily guess them. This sounds simple, +but it requires different strategies. First, the application should check the +potential passwords against a dictionary of insecure passwords such =password=, +=1234abc=, or =application_name=. + +Next, the application should offer guidance on the strength of passwords you +enter during enrollment. Further, NIST officially recommends *not* implementing +any composition rules that make passwords hard to remember (e.g. passwords with +letters, numbers, and special characters) and instead encouraging the use of +long pass phrases which can include spaces. Note that to be able to keep spaces +within passwords, you should support all unicode characters, and you should not +truncate spaces. ** What Does NIST Recommend? @@ -87,17 +87,17 @@ NIST offers a lot of guidance on passwords, but I'm going to highlight just a few of the important factors: - Require passwords to be a minimum of 8 characters (6 characters if randomly - generated and be generated using an approved random bit generator). + generated and generate using an approved random bit generator). - Compare potential passwords against a list that contains values known to be commonly-used, expected, or compromised. - Offer guidance on password strength, such as a strength meter. - Implement a rate-limiting mechanism to limit the number of failed authentication attempts for each user account. -- Do not require composition rules for passwords and do not require passwords to - be changed periodically (unless compromised). +- Do not require composition rules for passwords and do not require users to + change their passwords periodically (unless compromised). - Allow pasting of user identification and passwords to facilitate the use of password managers. -- Allow users to view the password as it is being entered. +- Allow users to view the password as they type. - Use secure forms of communication and storage, including salting and hashing passwords using a one-way key derivation function. |