By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 8th March 2010 Copyright Bloor Research © 2010

On Wednesday 3 March 2010 I attended the inspiring launch of Apps for Good in Tulse Hill, Lambeth, South London.

Apps for Good is a project that will provide an environment for young people in the community to analyse issues that effect their lives and then design and develop digital applications to improve their reality.

The program is being run by CDI Europe based on techniques developed over the last 15 years. CDI started in deprived communities in Rio de Janeiro and now has hundreds of centres across South America, the Middle East, North Africa and now Europe, and is planning to expand into southern Africa and India.

The project is expected to have multiple beneficial effects:

• The availability of useful applications relevant to the needs of the local community.
• Increased understanding of the issues that effect young people and the wider community.
• Encourage the use of information technology within the community by demonstrating the benefits and thereby increase digital inclusion.
• The participants will gain transferable skills related to working in groups, working in projects, analysis, design, development and promotion of solutions.
• Improve the self awareness and motivation of the participants.
• Proof that the process works in the UK environment with the intent that it will be replicated in other centres across the UK and Europe.

I am excited by this project because I recognise the importance of digital technology to the UK and the need to ensure that young people are enthused and involved. On a personal level I realise that, as I move into retirement, the quality of my life will become dependent on both younger people around me and the innovative and effective use of technology.

As my regular readers will know my main interest is in accessibility: computing for people with disabilities. I see Apps for Good having the potential to address issues in this area in two ways. Either the young people will recognise the issue of digital exclusion of people with disabilities (along with the elderly, or people whose first language is not English) and create applications to help them. Or centres will be set up specifically for people with disabilities to create their own solutions. This has already happened in South America.

Congratulations and good luck to everyone involved in the instigation and running of this project:

• High Trees Development Trust in Tulse Hill, South London where the first UK centre is housed.
• CDI Europe who provide the knowledge and skills in running similar projects.
• Dell YouthConnect that supplied the computers and some professional support.

If this first pilot in High Trees goes welland I am convinced that it willthen there will be a demand and a desire to replicate it rapidly around the UK and other European countries. I urge everyone in the British ICT community to think how they could support this initiative: by providing equipment or volunteers to help with the project, but also thinking how they can provide support to the young people to build on the skills and solutions they have developed.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Peter Abrahams (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 4th March 2010 Copyright Interarbor Solutions © 2010

If you want a realistic view of cloud computing adoption—along with an understanding of what motivates IT executives to invest the cloud, what concerns remain, and what initiatives are planned—you can’t limit your frame to a single industry. The full picture only becomes clear through a cross section of research, manufacturing, government and education fields.

That’s the approach Platform Computing took at a recent supercomputing conference. The company late last year surveyed 95 IT executives across a number of fields to offer insight into how organizations are experimenting with cloud computing and how they view the value of private clouds. [Disclosure: Platform Computing is a sponsor of BriefingsDirect podcasts.]

The results: Nearly 85 percent intend to keep their cloud initiatives within their own firewall.

“When deploying a private cloud, organizations will need a management framework that can leverage existing hardware and software investments and support key business applications,” says Peter Nichol, general manager of the HPC Business Unit at Platform Computing. “This survey reaffirms the benefits that private clouds offer—a more flexible and dynamic infrastructure with greater levels of self-service and enterprise application support.”

Most organizations surveyed are experimenting with cloud computing—and experimenting is the key word. Eighty-two percent don’t foresee cloud bursting initiatives any time soon. This suggests an appreciation for private cloud management platforms that are independent of location and ownership, and can provide the needed security in a world of strict regulations around transparency and privacy.

Security is chief concern
Forty-nine percent cite security as a chief concern with cloud computing. Another 31 percent pointed to the complexity of managing clouds, while only 15 percent said cost was an issue. Indeed, security concerns are a force driving many IT execs toward private rather than public clouds. Forty-five percent of organizations considering establishing private clouds as they experiment with ways to improve efficiency, increase their resource pool and build a more flexible infrastructure.

. . . The adoption of cloud computing should follow a sequence of evolutionary steps rather than an overnight revolution.

There seems to be some naïveté over the cloud. Nearly three-quarters of those surveyed don’t expect their IT organization infrastructure to change in the face of cloud computing. But that is not a realistic expectation. The move to cloud computing is an evolutionary one and IT organizations must themselves evolve to meet the demands of the organizations and their users. Ultimately, a willingness to evolve begins with an appreciation of the cloud’s value.

“Cloud computing has provided the impetus for IT to make a much needed shift, but many in the industry are still struggling to understand the value of the cloud,” says Randy Clark, chief marketing officer at Platform Computing. “As organizations continue to experiment with cloud to move toward better efficiency and cost-savings, it is best to bear in mind that to ensure success, the adoption of cloud computing should follow a sequence of evolutionary steps rather than an overnight revolution.”

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 4th March 2010 Copyright Bloor Research © 2010

This article will explore how database activity monitoring deals with other types of data attacks.

Temporary Accounts
Temporary accounts have a perfectly legitimate part to play in any database system as they can provide flexibility for the DBA wanting to create short term access for contract workers or for managing some database activities. Unfortunately they are also a vector for hackers, especially if the administration account can be compromised and the temporary account assigned roles and privileges that could result in data being stolen.

By setting up a temporary account a hacker can start to create a better level of anonymity and bury their true identity at the end of a long chain of other accounts designed to throw investigators off their path. A database activity monitoring solution will raise an alert if an unusual temporary account or set of accounts has been create that do not fit into the normal pattern of behaviour for an application.

Sensitive Data
Not all data in a database is sensitive. For example you may have a table that contains a list of the products you sell on your website, all of which is public. On the other hand you may have a table that contains customer discount rates, which is highly confidential and could seriously compromise your business relationships if it was made public. Then of course we have payroll and salary data, often deemed to be the most sensitive information and organisation keeps.

During the setup phase for the database monitoring system the DBA would normally work alongside the security team and the business to categorise the data being held and determine what data is the most sensitive. It will then need to be decided what database actions are permitted on this data. For example it may be perfectly acceptable for a payroll clerk to SELECT data from the salary table for the monthly cheque run but it is completely unacceptable for them to be able to UPDATE the same data and give themselves a pay rise. Once finalised, the database activity monitoring tool will see what activities are being attempted against the various sensitive data sets and raise warnings if necessary.

Out of Course Data Access
Out of course data access is when a user attempts to access data by bypassing their usual client application. For example if an organisation has created a client server application that uses a front end Visual Basic screen to retrieve data they may decide to try and connect to the backend database using Microsoft Access or Excel. If the user was able to connect using a tool such as MS Access, the simplicity of the tool will enable most users to download huge amounts of data by pointing and clicking. The database activity monitoring tool can be configured to audit connections from clients other than the approved Visual Basic tool and raise an alert for any out of course connection attempts.

Unusual Activity
This is often a catchall for activities that fall outside the norm for a particular database. Typical unusual activities include users accessing more data than normalfor example selecting all the data from the customer table rather than just those for their sales region. It could be someone accessing the data out of hours, maybe at the weekend and maybe from home. What is unusual for one database may be usual for another, so this will need a higher degree of customisation and learning for the activity monitoring solution to prevent legitimate users getting annoyed, but it can be a powerful data protection tool.

More obscure activities should also be tracked; for example users trying to start or stop services, trying to run extended stored procedures or meddling with database backups. Any of these could be legitimate but at least you will be alerted and will have the ability to investigate what is happening.

Connection Pooling
Connection pooling has been implemented by a number of vendors of enterprise software as a way of optimising the performance of a database. For example a system may only have one shared connection under a single database account that is used for updating customer data by all users. Of course the users don't know they are using this single accountthis is a process that happens underneath the covers of the application. From an information security perspective this presents us with a problem as it is more complicated to work out who the actual user was for a specific transaction if the connection was pooled. Some database activity monitoring products are able to see if connection pooling has been implemented and then track transactions back to the client application and discover who the actual user was for each discrete transaction, a feature which is very useful with such pooled connection implementations.

The next article will cover compliance issues and the way in which a database activity monitoring solution can be architectured for best effect.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 3rd March 2010 Copyright Interarbor Solutions © 2010

Security. It's one of the major issues that keeps cloud computing from working its way deeper and more quickly into the enterprise IT mainstream.

But what are the potential threats around using cloud services? How can companies make sure business processes and data remain secured in the cloud? And how can CIOs accurately assess the risks and benefits of cloud adoption strategies?

Hewlett-Packard (HP) and the Cloud Security Alliance (CSA) answer these and other questions in a new research report entitled, "Top Threats to Cloud Computing Report."

The report, which was highlighted during the Cloud Security Summit at the RSA conference this week, taps the knowledge of information security experts at 29 enterprises, solutions providers and consulting firms that deal with demanding and complex cloud environments. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Mastering next-gen IT
As Cloud Security Alliance Founder Jim Reavis sees it, cloud services are the next generation of IT that enterprises must master—and it's imperative that companies understand and mitigate security threats that accompany the cloud.

"The objective of this report was to not only identify those threats which are most germane to IT organizations but also help organizations understand how to proactively protect themselves," Reavis said. "This is the first deliverable in our cloud threat research initiative, which will feature regular updates to reflect participation from a greater number of experts and to keep pace with the dynamic nature of new threats."

Cloud computing abuse
The Top Threats to Cloud Computing Report shines a light on vulnerabilities that threaten to hinder cloud service offerings from reaching their full potential. HP and the Cloud Security Alliance warn companies to be aware of the abuse and nefarious use of cloud computing. The report specifically points to the Zeus botnet and InfoStealing Trojan horses as a prime examples of malicious software that has compromised sensitive private resources in cloud environments.

Cloud services are the next generation of IT that enterprises must master—and it's imperative that companies understand and mitigate security threats that accompany the cloud.

Beyond malicious software, the report pegs sites that rely on multiple application programming interfaces (APIs) as typically representing the weakest security link. That's because one insecure API can impact a larger set of members using the evolving social Web, which presents data from disparate sources.

Rounding out the list of common cloud threats covered in the report are malicious insiders, shared technology vulnerabilities, data loss and leakage and account/service and traffic hijacking.

The RSA-debuted full report is available on the CSA Web site.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 2nd March 2010 Copyright Interarbor Solutions © 2010

The latest BriefingsDirect podcast discussion comes in conjunction with The Open Group’s Enterprise Architecture Practitioners Conference held earlier this month in Seattle.

We assembled a panel to examine service oriented architecture (SOA) and cloud computing—the relationships, the inter-reliance and the realities. Three years ago, the IT transformation poster child was SOA, and now we're well into the hype curve around cloud computing, but has one actually given way to the other? Are they linear in their relationship, or perhaps mutually dependent in some ways, and to what degree?

We’ll explore now whether SOA has found new value and relevance as a foundation and perhaps catalyst for cloud computing, especially for so-called private clouds. And, we'll see how the emergence of SOA and cloud may be happening in different places inside of enterprises. Shouldn’t one hand get to quickly know what the other is up to and perhaps even work together?

Here with us now, however, to plumb the depths of how SOA and cloud computing do or don’t come together, are Dr. Chris Harding, director of the SOA Work Group at The Open Group; Stephen G. Bennett, Senior Enterprise Architect at Oracle, and Peter Coffee, Director of Platform Search for Salesforce.com. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Harding: Five years ago, when we started getting into SOA, there was a huge amount of excitement and a great deal of buzz about it. Now, we can see that the hype cycle has run its course, but we're still seeing a great deal of technical interest in SOA and we're also seeing that companies are using it and are increasing their use of it. So, there is a steady uptake in the use of SOA, although the excitement about it has died down.

It’s very interesting that service orientation is very much a business concept, and SOA has been about the application of that business concept to the technology. Cloud computing, on the other hand, is very much a technical concept. It’s about what you can do with technology over the Internet.

It is a technical concept, but it has had a really big impact on the business structure. So you can see them as complementary. SOA has been the application of business principles into the technology. Cloud is a technical concept, which has had a huge impact on the business. So, yes, there probably are different parts of the organizations looking at cloud and looking at SOA, but there is a big dynamic that says they should be working together on both of them.

Coffee: I've been covering SOA for a long time. I'd say the people who adopted SOA in the previous decade got considerable upside, but those who did not didn’t really suffer any penalty for not doing so.

In the situation we're in now, where the economics of cloud computing are becoming quite compelling, the downside of not having a SOA is becoming quite apparent. If you don’t have a service environment, then your ability to extend your current assets and integrate them with cloud services is going to be somewhat hampered.

So, people are realizing now that the wait-and-see option is more perilous than it used to be. This is accelerating the actual adoption of what we would call SOA, except that’s no longer the label du jour.

It seems to me that SOA very quickly became a label of products that vendors wanted to sell. So, you saw a lot of things like enterprise service bus (ESB) products and so on.

It became dangerously easy to think that you were doing SOA, if you were buying the tools and failing to appreciate how much of a cultural and management achievement it was to get people to think of themselves not as owners of and the gatekeepers to an IT asset, but instead being publishers of and supporters of a service to other parts of the business.

It’s absolutely critical to understand that you can view SOA as simply a way of integrating the stuff you have, or you can move to the next level and start to think of it as the way you do your business. The way your business units interact with and support each other with the technology is just the enabler for that.

The same is true of the cloud. It's possible to take the existing IT model of isolated applications, each with their own data stores, and replicate that model in the cloud with elastic scalability of capacity. That would be the level of the cloud industry that’s typically called infrastructure as a service (IaaS).

Or, it's possible to use the cloud as a much more interesting and fluid medium for interaction among much more granular and business-oriented services at the level that’s traditionally been called in the industry either platform as a service (PaaS) or software as a service (SaaS). It depends on the level at which you choose to consume other people’s application work, instead of doing new application development yourself.

It’s possible to do SOA without the cloud. It’s possible to do better SOA with it. It is also possible to do an isolated silo-oriented architecture locally and also to do that in a cloud environment. Neither one necessarily implies or impels the other.

Bennett: The majority of large enterprises today are doing SOA in one fashion or another at different levels of maturity, whether that’s from the quite immature approach of seeing it as a pure integration play all the way up to seeing it more as a business agility kind of play.

So, it's becoming a norm and, therefore, we don’t need to keep hyping it or pushing it. We need to use the characteristics it offers with other supporting technology strategies such as cloud.

I actually see recession as an opportunity within IT, because it gives you opportunity to reset thinking and reset IT's approach to actually delivering IT to the business.

It's a combination of technologies that are finally ready for prime time, and an ecosystem that’s ready to support those technologies well.

Coffee: The economics of being able to have elastically scalable capacity to be able to handle peak loads without needing to own the peak capacity and wind up with very low utilization rates on your capacity are becoming so compelling that people are asking how they're going to take advantage of this opportunity of this cloud environment.

It's a combination of technologies that are finally ready for prime time, and an ecosystem that’s ready to support those technologies well—providers of services and providers of expert assistance in using those services.

That’s a very important enabling ware, when your major system integration firms begin fully to understand how they can incorporate cloud services into the portfolio of technologies that they make available to their customers. When you put that all together, the downside of not moving to an SOA becomes an embarrassing lack of ability to take advantages of these incredible economies.

... The combination of SOA, which makes your various business units able to cooperate more effectively, with cloud environments, which allow you to handle very "bursty" workloads and conduct very cost-effective pilot projects and scale the ones that work very rapidly, increase the ROI of IT spending.

The IT budget, as a line item, is not conspicuously bigger. In fact, it may actually shrink, because the IT department now is a composer and integrator of stuff that may now be getting done with the operating budget by personnel, who are on the payroll as members of a business unit, instead of members of an IT organization.

Bennett: What people are talking about is the opportunity to redirect costs to area such as business architecture, and business architecture is part of enterprise architecture (EA). That's not purely IT focused, but the wider concern—investing stuff like business capability maps to understand exactly where I should utilize SOA and cloud with my organization—is going to be key.

This will, in turn, enable the consuming enterprises to concentrate on the things that they are particularly good at.

Harding: That certainly must be one of the factors that will enable cloud computing to make enterprises more efficient—the elasticity and the take-up effect. It also has a major effect on the risk that an enterprise needs to take on. But, there is a bigger factor, which is meant to drive down cost, and that is competition.

If you take service orientation and cloud in combination, you’re seeing the ability of people to buy services from different suppliers, for those suppliers to compete, and for those suppliers to concentrate on the services that they are particularly good at. This will, in turn, enable the consuming enterprises to concentrate on the things that they are particularly good at.

So, you don’t need to dissipate your efforts on running an inefficient IT department, which is not your core business. You can outsource that, get a specialist to do it much better, and concentrate on what you're good at. That is the real dynamic that will improve things economically.

Now, from an Open Group perspective, there is a danger that you may become locked into a particular supplier. Part of our role in promoting open systems is to push for the standards to be in place so that that doesn’t happen. Provided we can prevent that locking, it’s altogether a very healthy situation.

Coffee: The granularity of this marketplace is quite surprising to many people who haven’t looked at it closely. We see already people building applications, in which they have shopped the marketplace and found a cloud storage proposition from one provider, a cloud application development platform from another, social networking algorithms and facilities from yet a third provider and have built some really interesting strategic business solutions. It’s quite startling to many people to realize what a supermarket of services has already come into being.

Bennett: The combination of cloud and SOA obviously brings together kind of speed and modularity. Those basic principles are going to allow us to take evolutionary technologies and approaches and probably revolutionize the way that IT actually interacts with the business.

So, in terms of IT being siloed—"please develop and look after this application"—it’s going to be more a move toward collaboration of how we can actually deliver business solutions to the ever-changing business dynamics.

Coffee: Finally, we have an environment in which connectivity and real-time linkage and integration of data and function instead of being costly, brittle, and time-consuming are now nearly free, very resilient, and can be done almost more quickly than they can be described.

This means that people are going to be doing more challenging work and working more closely with business units instead of having their time consumed by arduous, necessary, but relatively low-value tests of infrastructure maintenance.

So the ROI will rise. The relevance to the business of IT will increase. The sophistication of the skills of the person who does IT for a living will be greater 10 years from now than it was 10 years ago or even today, but we’ll all be pretty happy with the results.

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 1st March 2010 Copyright Interarbor Solutions © 2010

In a move to tap into the small- to mid-sized business (SMB) data center market, Hewlett-Packard (HP) just rolled out a set of services aimed at helping smaller outfits drive the same IT efficiencies as larger enterprises.

The portfolio is designed to improve efficiency and increase IT budget flexibility, while mitigating risks and maximizing return on investment (ROI) from existing IT skills and assets. The services also target dealing with rapid change and the simplifying of management of multi-vendor environments. HP also launched procurement options for custom integration operations and improvement services. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

“Our new services are based on drivers that impact owners of small- to mid-sized data centers,” said Ian Jagger, worldwide marketing manager of Infrastructure and Operations for HP’s Technology Services Group. “These services help our customers deal with the challenge of managing IT complexity and sprawl, space and infrastructure limitations, and limited IT budgets and staff.”

Improving operational efficiency
Recognizing the SMB organizations' requirements around speed, efficiency and 24/7 resource accessibility with shared virtual IT services, HP is delivering four new services designed to help clients gain tighter environment-wide control and broader, deeper visibility into support-related functions.

HP Multivendor Support Services works to help clients increase service levels and reduce the complexity and costs of managing heterogeneous IT environments. By exercising global buying power among vendors and suppliers, HP said it can effectively lower the cost of support contracts.

These services are entirely differentiated because only licensed engineers can deliver these services and HP’s competitors don’t have licensed engineers.

“We have been offering multi-vendor support solutions to our customers,” says Dionne Morgan, worldwide solutions marketing manager for HP’s Technology Services group. “In addition to IBM and Dell servers, we also now support Sun servers and Sun Solaris 10 for HP ProLiant servers. And for HP Integrity servers we’re now supporting Novell, SUSE Linux and Microsoft Windows Server 2008.”

On the operational efficiency front, HP also announced HP Insight Remote Support to monitor a customer’s environment around the clock and provide remote diagnostics, troubleshooting and a support solution. HP added support for VMware virtual environments. Meanwhile, HP Active Chat offers real-time Web chat support for problem and the HP Data Center Training Symposium will move to help companies develop a custom training plan to increase the effectiveness of IT staff.

Increasing computing capacity
HP also announced value assessment services structured for data centers up to 5,000 square feet in size. The services work to help SMBs find ways to increase computing capacity and cut energy costs.

The new services include Basic Capacity Analysis for Smaller Footprints Assessment, Infrastructure Condition and Capacity Analysis for Smaller Footprints Assessment, and Energy Efficiency Analysis for Smaller Footprints Assessment.

“These services are entirely differentiated because only licensed engineers can deliver these services and HP’s competitors don’t have licensed engineers,” Jagger says. “Our competitors have to partner with specialist companies to deliver these services. We’re also restructuring these services to be sold by our channel partners.”

Offering flexible purchase options
Finally, HP promises to make it easier for SMBs to procure value services that will help them better manage limited resources and drive business value from their technology infrastructure through HP Units of Service and HP Proactive Select Services.

“We’ve taken the customized services available from our technical services portfolio and converted them into what we call Units of Service,” Jagger says. “A Unit of Service is a deliverable at a highly granular level. Any given custom service could be made up of multiple Units of Service.”

HP Proactive Select Services let clients move to a variable budget model, acquiring expert resources on-demand to address changing data center needs.

HP Units of Service gives SMBs access to value services from HP through channel partners that aim to maximize ROI and set the stage for business growth. For example, SMBs can tap into HP custom data center consulting services such as relocation, integration, operations and improvement.

HP Proactive Select Services let clients move to a variable budget model, acquiring expert resources on-demand to address changing data center needs. HP has included Server Firmware Update Installation Service, Technical Online Seminars, Virtual Tape Library Health Check and LeftHand SAN/iQ Update Service to its portfolio.

“With these services, companies can focus their IT staff on strategic IT investments that differentiate them in the marketplace,” Jagger says. “What you’re seeing here is more and more services brought to customers at a value level through the channel that allows them to focus where they can drive the greatest ROI from staff.”

The SMB IT services and support market is ripe for efficiency and lower total costs. And the SMB arena is also a prime user for upcoming cloud and hybrid-sourced services. So now everything as a service can go anywhere.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 26th February 2010 Copyright Interarbor Solutions © 2010

In a move to enter the burgeoning SaaS-based IT management market, Citrix Online announced its acquisition of Menlo Park, Calif.-based Paglo Labs on Wednesday. The first fruits of the acquisition is an integrated web-based platform for monitoring, controlling and supporting IT infrastructure.

Dubbed GoToManage, the new service lets Citrix Online tap into the growing demand for software-as-a-service (Saas)-based IT management, a market Forrester Research predicts will reach $4 billion in 2013. Citrix Online is positioning the latest addition to its online services portfolio as an affordable alternative to premise-based software. [Disclosure: Paglo is a sponsor of BriefingsDirect podcasts. Learn more about Paglo's offerings and value.]

I expect that as more enterprises experiment and adopt more mixed-hosted services—including cloud, SaaS, IaaS, and outsourced ecosystems solutions—that web-based management capabilities will become a requirement. In order to manage across boundaries, you need management reach that has mastered those boundaries. On-premises and traditional IT management is clearly not there yet.

Elizabeth Cholawsky, vice president of Products and Services at Citrix Online, explains the reasoning behind the acquisition: “Our customers increasingly tell us they are interested in adding IT management services to our remote support capabilities. With the growing acceptance of SaaS and the increasing use of IT services in small- and medium-sized businesses, we decided IT management reinforced our remote support strategy.”

The Paglo puzzle piece
According to IDC, Citrix Online was the remote support market leader in 2008 with a 34.7 percent global share via its GoToAssist services. IDC also pegs Citrix Online as the third largest SaaS vendor in the world based on 2007 revenue, but Citrix Online needed Paglo-like log analysis technology in order to offer its customers the next puzzle piece in its full SaaS picture.

Paglo has made a name for itself providing SaaS-based IT search and management services. In short, Paglo helps companies harness and analyze the information explosion coming from all their computer, server, network and log data. Paglo helps companies improve operating efficiencies, gain a clearer understanding of true IT costs and meet compliance requirements.

Now, Paglo serves as the foundation for GoToManage. GoToManage creates an IT "system of record" to give businesses with the ability to discover and identify all network devices, monitor critical servers and applications in real-time, manage network usage, and track configuration changes. Like other Citrix Online products, GoToManage can be accessed from anywhere, and doesn’t require costly server infrastructure.

A seamless transition?
With GoToManage, Citrix Online is once again disrupting the traditional IT model. Brian de Haff, CEO of Paglo, expects a seamless integration for Paglo customers and GoToAssist customers that tap into the new service. With behind-the-scenes integration completed, customers can click on a link and instantly access GoToManage. De Haff also expects Paglo customers to adopt GoToAssist and use the two services in tandem.

Bringing these technologies together is a terrific win for the customers of both companies.

“When we look across the Paglo customer base, the integration of monitoring with remote support is by far the number one requested feature that customers are asking for,” de Haff says. “So bringing these technologies together is a terrific win for the customers of both companies.”

Cholawsky declined to comment whether Citrix Online will make additional acquisitions to add to its portfolio, which also includes GoToMyPC, GoToMeeting, GoToAssist, GoToWebinar, GoToTraining and GoView. What she did say is that Citrix Online is witnessing a large growth spurt, which she expects to continue.

“We’re constantly looking at partners and acquisitions,” Cholawsky says. “With the venture capital investments in smaller companies with great technologies over the past couple of years, acquisitions are a terrific way to grow our company. But whether we develop more organically or go out and partner closely or do more acquisitions, we’ll be investing heavily in the SaaS market.”

Financial terms of the Paglo acquisition were not disclosed.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 25th February 2010 Copyright Interarbor Solutions © 2010

Today’s enterprises are creating web-based content at breakneck speed. Much of this digital content becomes bona fide business records that demand document management with regulatory compliance and legal discovery demands in mind.

That’s why Hewlett-Packard (HP) recently rolled out a web-based records management solution specifically designed to help Microsoft SharePoint customers lower business risks. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.)

Dubbed HP Total Records Information Management (TRIM) 7, the latest version of HP’s advanced records management solution aims to help organizations transparently manage Microsoft SharePoint Server records—including documents and information stored on SharePoint Server blogs, wikis, discussions, forms, calendars and workflows—in a single environment.

A Content 2.0 explosion
As HP explains it, TRIM 7 opens the door for consolidation and simplified management of stored content in multiple formats. Using HP TRIM 7, organizations can capture, search and manage physical and electronic files with complete transparency.

“The explosion in Content 2.0 blogs, wikis and discussions creates new information management challenges for organizations trying to meet an escalating set of regulation,” says Jonathan Martin, vice president and general manager of Information Management Solutions at HP. “HP TRIM allows customers to marry records management best practices and governance with dynamic collaboration platforms such as SharePoint.”

An end-to-end solution
HP TRIM 7 offers two modules to address the records management needs of SharePoint products and technologies: HP TRIM Records Management and HP TRIM Archiving.

HP TRIM Records Management aims to improve business records management via transparent access to SharePoint Server content held in HP TRIM directly from the SharePoint Server workspace.

The explosion in Content 2.0 blogs, wikis and discussions creates new information management challenges for organizations trying to meet an escalating set of regulations.

Since the U.S. Department of Defense has awarded HP TRIM its 5015.2 v3 certification, HP notes, organizations are assured the highest levels of records management control for enterprise content. HP has also made improvements that promise faster indexing and search capabilities, along with shorter response times for legal discovery, compliance requests and audits.

Closing the records management loop, HP TRIM Archiving works to help customers lower the risk of data loss while reclaiming storage and system resources from SharePoint Server. This module can either archive specific list objects in SharePoint Server or complete SharePoint Server sites. All this means organizations can take entire SharePoint Server sites offline without losing access to information.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Louella Fernandes, Principal Analyst, Quocirca Posted: 24th February 2010 Copyright Quocirca © 2010

Signs of a rebound in printer sales were evident from HP's latest Q1 2010 results which saw its imaging and printing business revenue grow by 4% year-on-year to $6.2 billion. Total printer unit shipments grew 16%, the largest increase in three years, with consumer and commercial printer unit shipments growing 18% and 11%, respectively. What is most notable is the momentum HP has built in its managed print services (MPS) business, which enjoyed a continued growth in Europe.

Quocirca estimates that 15% of enterprises in Europe have adopted some form of MPS to drive both financial cost savings and decrease environmental impact. In an increasingly commoditised market characterised by thin margins and falling prices, capitalising on long term, high value annuity business (through supplies and service) is key to the strategies of printer and copier companies.

HP's continued momentum in enterprise MPS
HP has streamlined its approach in the MPS market with the launch of its Managed Enterprise Solutions global business unit in September 2009, aimed at boosting new growth in its MPS business. It also announced a strategic alliance with Canon to deliver a wider portfolio of products to MPS customers, filling a gap in HP's existing portfolio. Across the globe, HP's MPS reach is wide—it now has more than 2500 customers worldwide across 170 countries.

In Europe, HP's direct MPS sales force targets 1800 enterprise accounts. HP estimates that 80% of these accounts are multi-country businesses. Its European MPS business performed well in Q1 2010: for example, SCHOTT AG that renewed its MPS contract with HP to include 1200 devices and the supply of service and supplies for 3 years. New signings include a $100m printing deal with the Danish Ministry of Finance, and a deal to manage the Norwegian telco Telenor's distributed print environment over 30 sites.

HP's competitive position in the MPS market has undoubtedly been enhanced by the EDS (now HP Enterprise Services) integration. A significant proportion of HP MPS deals are led by HP Enterprise Services account managers who provide HP with valuable depth of engagement with key customers.

Additionally, HP's Printing PayBack guarantee has further helped it demonstrate its cost-savings commitments to potential customers. Under this scheme, any qualified enterprise that does not make the cost savings that HP projects for them, within 12 months, can receive a cheque refunding the shortfall. Provence Health and Services in the US is one company which has adopted an HP MPS with the Printing PayBack Guarantee, with cost savings expectations between 30% and 35%.

HP's MPS initiatives are clearly bearing fruit. Its modular service offerings, multi-region delivery capabilities and its strategic alliance with Canon position it well to offer a comprehensive MPS portfolio for enterprises.

Capturing the midmarket opportunity with QuickPage
Up to now, MPS has largely been the domain of larger enterprises, due to established direct MPS offerings from vendors such as HP, Lexmark, Ricoh and Xerox. However midsized businesses are also waking up to the MPS opportunity with the emergence of more channel driven MPS packages. These range from device-centric offerings, which are typically inclusive service contracts encompassing service and supplies to some packages including the leasing of devices and may also include support, depending on the capability of individual resellers.

More often than not, the most successful resellers in this space have experience in selling copier or cost per page contracts. For resellers who do roll out an MPS, the opportunities are significant—providing ongoing annuity revenue streams and longer term customer relationships. One of HP's key strategies for 2010 is to build momentum in the midmarket through enhancing its contractual offerings. HP relies on its channel partners to develop their midmarket business, and is actively supporting resellers to move from a transcational to contractual sales process.

Its current portfolio of contractual offerings, which includes Channel-led Pay-per-Usage program (CLPPU), Smart Printing Service (SPS) program and Pay-for-Print (PfP) program, will be completed by the launch of QuickPage. With its introduction, HP is providing resellers with a simple packaged service that includes hardware, supplies and support. QuickPage emulates packages from copier-centric vendors such as Xerox PagePack. However QuickPage's key difference is that it includes a lease rental agreement, giving customers the ability to combine hardware, consumables and maintenance costs into one monthly payment (based on expected print volumes).

Quocirca believes that QuickPage fills a gap in HP's existing channel services porfolio by providing a simple packaged service backed by a portal infrastucture that manges reporting, service and support. Given HP's high pentration amongst IT resellers, who have little experience in selling printing contracts, the simplicty of selling and adminstering QuickPage will be fundamental to its success. For those customers who are uncertain about moving to a QuickPage contractual approach to purchasing printing, the benefits lie in predictable monthly expenses, reduced operational expenditure and less time on dealing with printer support issues.

The market for MPS in the mid-market remains wide open with varied offerings from different manufacturers. For resellers who are embarking on the MPS journey, this often means investing in a disparate set of tools and infrastucture to manage different devices. Xerox has already addressed this through its hosted multivendor MPS for channel partners—Xerox Printing Services. While there will always be benefits from a device-centric service in a standardised environment, adding multvendor capababilties to future versions of QuickPage will enable HP to enhance the value proposition for resellers and customers alike.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Louella Fernandes (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 24th February 2010 Copyright Interarbor Solutions © 2010

Electric Cloud has accelerated the software production management field with improvements to two key products: ElectricAccelerator and ElectricCommander 3.5.

ElectricAccelerator boasts a new feature that provides parallel processing and subbuild technology. Dubbed "Electrify," the patented technology promises to speed development on private or public compute clouds by applying the benefits of parallelization to new development tools and tasks.

With Electrify, developers can conduct parallel testing or data modeling on their desktop, in a private cloud or on a dedicated server. Meanwhile, the subbuild technology works to help developers avoid unnecessary or broken builds by identifying only the components required for the current project. [Disclosure: Electric Cloud is a sponsor of BriefingsDirect podcasts.]

Removing production bottlenecks
“Our goal is to remove the bottlenecks in software production wherever they exist,” explains Electric Cloud CEO Mike Maciag. “ElectricAccelerator speeds Make, NMAKE, Visual Studio, and Ant builds by 10–20x. With Electrify we are broadening the technology to enable these benefits for virtually any compute-intensive development task.”

Maciag offers the example of teams standardizing on tools like SCons. With Electrify, he says, those teams can leverage the benefits of centralization to speed builds, reduce hardware costs and curb server sprawl. The technology also makes way for developers to support multiple configurations through ElectricAccelerator’s virtualization capabilities. All this means more control for developers and fewer headaches for IT.

Commanding the cloud
Electric Cloud's ElectricCommander 3.5 offers a customizable and extensible version of its tool for automating and managing the build-test-deploy process in software development. Developers can customize ElectricCommander 3.5 to extract and display data from the defect tracker along with relevant build and test results. This lets build managers track the status of each fix and receive notification when QA has resolved the issue.

ElectricCommander 3.5 also offers user interface (UI) customization that lets development teams or managers create a custom screen to create and execute a build or test request with the appropriate parameters.

In other words, the UI is purpose-built for the developer’s role or environment. The new version also automates and manages what Electric Cloud calls “error-prone, manual pieces of the build-test-deploy process” to make software production faster and more efficient.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 23rd February 2010 Copyright Interarbor Solutions © 2010

Nowadays, CIOs need to both cut costs and increase performance. Energy has never been more important in working toward this productivity advantage.

It's now time for IT leaders to gain control over energy use—and misuse—in enterprise data centers. More often than not, very little energy capacity analysis and planning is being done on data centers that are five years old or older. Even newer data centers don’t always gather and analyze the available energy data being created amid all of the components.

Finally, smarter, more comprehensive energy planning tools and processes are being directed at this problem. It requires a lifecycle approach from the data centers to more toward fuller automation.

And so automation software for capacity planning and monitoring has been newly designed and improved to best match long-term energy needs and resources in ways that cut total costs, while gaining the available capacity from old and new data centers.

Such data gathering, analysis and planning can break the inefficiency cycle that plagues many data centers where hotspots can mismatch cooling needs, and underused and under-needed servers are burning up energy needlessly. These so-called Smart Grid solutions jointly cut data center energy costs, reduce carbon emissions, and can dramatically free up capacity from overburdened or inefficient infrastructure.

By gaining far more control over energy use and misuse, solutions such as Hewlett Packard's (HP) Smart Grid for Data Center can increase capacity from existing facilities by 30–50 percent.

This podcast features two executives from HP to delve more deeply into the notion of Smart Grid for Data Center. Now join Doug Oathout, Vice President of Green IT Energy Servers and Storage at HP, and John Bennett, Worldwide Director of Data Center Transformation Solutions at HP. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Bennett: Data center transformation (DCT) is focused on three core concepts, and energy is another key focus for that all to work. The drivers behind data center transformation are customers who are trying to reduce their overall IT spending, either flowing it to the bottom-line or, in most cases, trying to shift that spending away from management and maintenance and onto business projects.

We also see increasing mandates to improve sustainability. It might be expressed as energy efficiency in handling energy costs more effectively or addressing green IT.

DCT is really about helping customers build out a data center strategy and an infrastructure strategy. That is aligned to their business plans and goals and objectives. That infrastructure might be a traditional shared infrastructure model. It might be a fabric infrastructure model of which HP’s converged infrastructure is probably the best and most complete example of that in the marketplace today. And, it may indeed be moving to private cloud or, as I believe, some combination of the above for a lot of customers.

The secret is doing so through an integrated roadmap of data-center projects, like consolidation, business continuity, energy, and such technology initiatives as virtualization and automation.

Energy has definitely been a major issue for data-center customers over the past several years. The increased computing capability and demand has increased the power needed in the data center. Many data centers today weren’t designed for modern energy consumption requirements. Even data centers that were designed even five years ago are running out of power, as they move to these dense infrastructures. Of course, older facilities are even further challenged. So, customers can address energy by looking at their facilities.

Increasingly, we're finding that we need to look at management—managing the infrastructure and managing the facilities in order to address the energy cost issues and the increasing role of regulation and to manage energy related risk in the data center.

That brings us not only to energy as a key initiative in DCT, but on Smart Grid for Data Center as a key way of managing it effectively and dynamically.

Oathout: We're really talking about is a problem around energy capacity in data centers. Most IT professionals or IT managers never see an energy bill from the utility. It's usually handled by the facility. They never really concentrate on solving the energy consumption problem.

Where problems have arisen in the past is when a facility person says that they can’t deploy the next server or storage unit, because they're out of capacity to build that new infrastructure to support a line of business. They have to build a new data center. What we're seeing now is customers starting to peel the onion back a little bit, trying to find out where the energy is going, so they can increase the life of their data center.

To date, very few clients have deployed comprehensive software strategies or facility strategies to corral this energy consumption problem. Customers are turning their focus to how much energy is being absorbed by what and then, how do they get the capacity of the data center increase so they can support the new workloads.

What we're seeing today is that software, hardware, and people need to come together in a process that John described in DCT, an energy audit, or energy management.

All those things need to come together, so that customers can now start taking apart their data center, from an analysis perspective, to find out where they are either over-provisioned or under-provisioned, from a capacity standpoint, so they know where all the energy is going. Then, they can then take some steps to get more capability out of their current solution or get more capability out of their installed equipment by measuring and monitoring the whole environment.

The concept of converged infrastructure applies to data center energy management. You can deploy a particular workload onto an IT infrastructure that is optimally designed to run efficiently and optimally designed to continually run in an efficient way, so that you know you're getting the most productive work from the least energy and the more energy efficient equipment infrastructure sitting underneath it.

As workloads grow over time, you then have the auditing capability built into the software ... so that you can add more resources to that pool to run that application. You're not over-provisioning from the start and you're not under-provisioning, but you're getting the optimal settings over time. That's what's really important for energy, as well as efficiency, as well as operating within a data center environment.

You must have tools, software, and hardware that is not only efficient, but can be optimized and run in an optimized way over a long period of time.

The key to that is to understand where the power is going. One of the first things we recommend to a client is to look at how much power is being brought into a data center and then where is it going.

What you want to do is start collecting that information through software to find out how much power is being absorbed by the different pieces of IT equipment and associate that with the workloads that are running on them. Then, you have a better view of what you're doing and how much energy you're using.

Then, you can do some analysis and use some applications like HP SiteScope to do some performance analysis, to say, "Could I match that workload to some other platform in the infrastructure or am I running it in optimal way?"

Over time, what you can do is you can migrate some of your older legacy workloads to more efficient newer IT equipment, and therefore you are basically building up a buffer in your data center, so that you can then go deploy new workloads in that same data center.

You use that software to your benefit, so that you're freeing up capacity, so that you can support the new workload that the businesses need.

The energy curve today is growing at about 11 percent annually, and that's the amount IT is spending on energy in a data center.

Bennett: That's really key, Doug, as a concept, because the more you do at this infrastructure level, the less you need to change the facilities themselves. Of course, the issue with facilities-related work is that it can affect both quality of service and outages and may end up costing you a pretty penny, if you have to retrofit or design new data centers.

Oathout: Smart Grid for Data Centers gives a CIO or a data-center manager a blueprint to manage the energy being consumed within their infrastructure. The first thing that we do with a Data Center Smart Grid is map out what is hooked up to electricity in the data center, everything from PDUs, UPSs, and error handlers to the IT equipment servers, networking and storage. It's really understanding how that all works together and how the whole topology comes together.

The second thing we do is visualize all the data. It's very hard to say that this server, that server, or that piece of facilities equipment uses this much power and has this kind of capacity. You really need to see the holistic picture, so you know where the energy is being used and understand where the issues are within a data center.

It's really about visualizing that data, so you can take action on it. Then, it's about setting up policies and automating those procedures to reduce the energy consumption or to manage energy consumption that you have in the data center.

Today, our servers and our storage are much more efficient than the ones we had three or four years ago, but we also add the capability to power cap a lot of the IT equipment. Not only can you get an analysis that says, "Here is how much energy is being consumed," you can actually set caps on the IT equipment that says you can’t use more than this. Not only can you monitor and manage your power envelope, you can actually get a very predictable one by capping everything in your data center.

You know exactly, how much the max power is going to be for all that equipment. Therefore, you can do much better planning. You get much more efficiency out of your data center, and you get more predictable results, which is one of the things that IT really strives for, from an SLA to getting those predictable results, day in and day out.

So, really Data Center Smart Grid for the infrastructure is about mapping the infrastructure. It's about visualizing it to make decisions. Then, it's about automating and capping what you’ve got, so you have better predictable results and you're managing it, so that you are not having out wires, you're not having problems in your data centers, and you're meeting your SLA.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Andy Hayler, CEO, The Information Difference Posted: 23rd February 2010 Copyright The Information Difference © 2010

On February 22nd Aster Data makes available version 4.5 of their massively-parallel data warehousing and advanced analytics software. Aster Data specialises in complex analytic processing of high data volumes that require near real-time analysis rather than the regular batch data processing and reporting that comprises much of the workload of traditional corporate data warehouses. For example Full Tilt Poker uses Aster Data's technology for fraud detection. Previously this processing was so complex that they could only run it on a sample of the games in operation on their web site; it took 90 minutes to finish and was run weekly. The company are now able to finish the fraud analysis on the complete set of poker games within 90 seconds, and run this analysis every 15 minutes, dramatically reducing their exposure to fraud. Other examples of this kind of complex analysis are retail basket analysis, assessment of stock market trading positions, and click steam analysis. In one case, a telco uses Aster Data to carry out detailed analysis of call patterns in order to discover the usage patterns of various demographic groups (such as teenage girls), and then try to sell these customers additional services that will be particularly relevant to them.

The key to Aster Data's ability to carry out this workload has been their early development of the MapReduce framework (a model for processing large datasets on a distributed platform which was popularized by Google) within their database engine, and tightly coupling it with standard SQL. Actually coding for this type of query is usually the domain of specialists, and in version 4.5 Aster Data has made it easier to invoke such processing by adding an integrated development environment (IDE) for MapReduce. This provides common pre-built functions for analytics, like moving average calculation and time-series analysis, and a series of wizards to allow these functions to be easily incorporated into the database. Aster Data already supported Java, C#, and other common programming interfaces to MapReduce, allowing a wider range of programmers to be able to take advantage these capabilities than most other MPP database vendors.

Additionally, greater speed of analytic execution is provided in version 4.5 by allowing support for solid state storage, and a faster loader allowing practical load rates of up to 4 TB an hour. Another major theme of the release is improved ease of operation, provided in this case by a new management console that allows graphical displays of the queries and other other analytical processes that are running, the activity on the various servers, etc.

In a crowded data warehouse market it is important to stand out from the crowd, and simplistic marketing messages that just say "we are quicker and cheaper than the big boys" are insufficient to enable prospects to distinguish which data warehouse platforms are best suited to which kind of processing use case. By concentrating its messages around its competitive advantage in complex interactive analytics, Aster Data is sensibly trying to carve out a niche for itself, attacking a high-value segment of the market rather than taking a scattergun approach. With a much expanded number of quota-carrying sales reps now in place Aster Data must now see whether this targeted message resonates with the market.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Andy Hayler (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 22nd February 2010 Copyright Interarbor Solutions © 2010

Improved data center productivity now appears to be a natural progression from converged infrastructure. Many enterprise data centers have embraced a shared service management model to some degree, and now converged infrastructure applies the shared service model more broadly to leverage modular system design and open standards, as well as to advance proven architectural frameworks.

The result is a realignment of traditional technology silos into adaptive pools that can be shared by any application, as well as optimized and managed as ongoing services. Under this model, resources are dynamically provisioned efficiently and automatically, gaining more business results productivity. This also helps rebalance IT spending away from a majority of spend on operations and more toward investments, innovations, and business improvements.

This latest BriefingsDirect discussion explores the benefits of a converged infrastructure approach, and now how to better understand attaining a transformed data center environment. We'll see how converged infrastructure provides a stepping stone to private cloud initiatives. But, as with any convergence, there are a lot of moving parts, including people, skills, processes, services, outsourcing options, and partner ecosystems.

We're here with two executives from Hewlett-Packard (HP) to delve deeply into converged infrastructure and to learn more about how to get started and deal with some of the complexity, as well as to know what to expect as payoff. Please welcome Doug Oathout, Vice President, Converged Infrastructure at HP Storage, Servers, and Networking, and John Bennett, Worldwide Director, Data Center Transformation Solutions at HP. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Bennett: I often think of many CIOs as being at the heart of a vise, where, on one side, they have the business pressures. ... They need to support growth. They need to do a faster job of creating acquisitions. They need to spend more on business projects and innovation. They need to exploit technology for business advantage. They need to reduce costs.

On the other side of the vise are the constraints that they have in the environment that get in the way of them successfully addressing the business needs—legacy infrastructure and applications and antiquated methods of managing the infrastructure that make it difficult to be responsive to change, or people with the skills that won’t serve modern technology's needs or environments.

Data-center transformation (DCT) helps enterprises implement a data center and infrastructure strategy that's aligned to their goals and objectives. The key here is that it's customer-driven, and it has to be built around the plans and directions of the targeted organization. This is clearly not a one-size-fits-all type of environment.

For many organizations, those strategies for infrastructure can include traditional shared infrastructure solutions or servers using virtualization and automation with shared storage environments. Increasingly, we've seen a natural evolution into a tighter integration of the capabilities and assets of the data center in the fabric infrastructure.

HP's Converged Infrastructure represents a pretty significant step forward in terms of benefits and capabilities for customers looking at having infrastructure strategy aligned to their future needs. The neat thing is that converged infrastructure can be the foundation for private cloud architectures.

Oathout: About two-thirds, if not 70 percent, of the IT operations budget is spent on maintaining IT and the IT workload within the data center.

When you have a recession, like we just experienced, what happens is that 30 percent spent on innovation or new workload placement gets cut immediately to help manage the budget within an organization. Therefore, in the last 18 months, very little innovation and few new projects were taken on by IT to support new business growth.

Now we have customers who are starting to spend again and who are starting to see the light at the end of the tunnel. They want their IT environment to be more flexible in the future. So, they're looking at their server and storage upgrades, and how they can implement converged infrastructure, so that the new infrastructure is more flexible and can adapt more to the requirements of the business.

As you're going through your technology refresh now, coming out of the recession, you can start implementing better and faster IT equipment. You can also use better and more efficient processes—virtualization, automation, and management. When you put those pools of resources in place, you put them in a virtual environment so they can be shared among applications or can be transferred among applications when needed.

You are in the process now of creating pools of resources, versus dedicated silo resources, like you had prior to the recession, which couldn’t be reused for some of the application, and therefore you couldn’t support business growth.

The opportunity now is to break down those silos, give our customers the ability to share resources in the same footprint they have today, and actually become more efficient, so that when business changes or business needs change, they can adapt to the requirements of the business.

In a converged infrastructure environment, you really don’t want to care about the infrastructure you are putting it on. What you want to care about is that it's resilient, it's optimized, and it's modular, so it can grow and shrink with the application's demand.

Let me give you an example. A server consolidation using virtualization and new server equipment will generally double or triple your capacity within your data center for the same footprint, just by getting the utilization of the servers up, better performance within the servers, and better capabilities within virtual environments. You can basically double or even triple the size of your capacity within your data center.

The same thing holds true for storage. Storage disk drives become twice as dense over a two- or three-year period. The performance of the drives gets better. So, for the same footprint in your data center you can actually fit twice as much storage.

... What you really have is a process change that's required between the IT application managers, the test and development people, and a team that actually runs the infrastructure. They need to talk more about standardization. They need to talk about how their IT comes together.

That's where the Data Center Transformation Workshop that John Bennett's team does helps. It gives you an architecture for future deployments, so that you have a converged infrastructure. You have pools of resources to put new applications down or revamp older applications onto a newer architecture, so it becomes more flexible.

You have to break down that silo or break down that fence between application deployments and what line of businesses are telling the application deployers and the people who run the infrastructure. Customers really do see that as a deployment barrier, but they're working through it, because there are significant benefits on the other side, just due to the fact that you increase agility, lower cost, and you have more money and more people to go do the innovation to support the workloads of future businesses.

Bennett: Good organizations are always rethinking IT. What are the organization's strategy, goals, and objectives? What is it going to take to realize those objectives? What capabilities do we need from IT in order to make those real? And then, how do we make them happen?

This is where the partnership between the technology team and the business team comes into play. The technology team will have more insights into how it can be exploited, and the key thing for the business is to make sure they specify their needs and not specify the answer.

... There's economic return to the organization from being able to roll out a new business service more quickly. There's an economic return to the business from being able to provision more resources when they are needed based on demand, so that demand doesn't disappear. There's a competitive business benefit, which is financial in nature, in being able to respond to competitive threats more quickly.

And a lot of the benefits of this are in the nature of direct cost savings—the consolidation, modernization, and virtualization that Doug spoke to—the savings from energy related projects and investments with Data Center Smart Grid, for example. All are easily quantifiable.

Oathout: A cloud-computing environment is really an application-rich environment that allows you to bring more users on quickly and expand your capabilities and shrink your capabilities as you need them.

Converged infrastructure can be for public cloud, private cloud, or for a web workload or an high-performance computing (HPC) workload or an SAP workload. It doesn't really matter. A converged infrastructure is the optimal deployment of IT to support any kind of application, because it's modular in nature.

It has the flexibility to have more storage, more memory, less CPUs or more CPUs, less storage, or less memory, but it's all modular, so you can put the pieces together as you need them. So, it is a base support for either a cloud environment or a traditional IT environment. It really doesn't matter. It's designed to support both.

A private cloud is the IT department saying, "I'm now going to create a service catalog for my lines of business to develop upfront." You're getting software as a service (SaaS) now sitting on top of either a converged infrastructure or legacy infrastructure. A converged infrastructure is a lot easy to put SaaS on. But, you make that service catalog available to line of businesses, so they can turn on applications as they need them, very quickly.

Then, you can put more users on an enterprise resource planning (ERP) application, an online application, or a Web 2.0 application. IT is there as a support service now, setting that up, taking it down, and optimizing it over time, depending on the business needs.

So, private cloud is kind of that SaaS that sits on either a converged infrastructure or a legacy infrastructure or uniquely designed infrastructures that you get from some of the public cloud providers. Converged infrastructure is the optimal way to develop and deploy that in a standard data-center environment, and it's in support of a private cloud.

When you start bringing a storage and server and networking platforms together through a flexible fabric, the economies of scale of a shared resources and open systems is going to drive down the cost of acquiring IT. Then, with the software and the services capabilities that companies bring to market, they're going to bring the efficiencies along with them.

So, it is inevitable, starting with the simplest of workloads, moving to some of the hardest of workloads, that you are going to have a converged infrastructure. You are going to have application as a service, whether it's internal or external from a cloud provider, just because the economies of scale are there, and the ability to deploy the stuff is so simple once you get it set up that the efficiencies are also there besides the economies of purchase.

For example, a customer, the Dallas Cowboys, built a new football stadium in the Dallas area. It's a $1.4 billion investment. In the bottom of the thing is their data center. They run 30 different businesses out of the data center in the Dallas Cowboys stadium.

They have built it on a virtual environment. They have BladeSystems. They have the FlexFabric built into the environment. They went from over 500 servers down to 16 blades, with virtual machines running on them for the point of sale environment within the stadium. It drove a smaller footprint, but also the dynamics in the server and storage environment, so they can bring on new applications for the 30 businesses very quickly.

They changed their infrastructure to support their environment. ... They bring applications online and very reactive to the lines of businesses they are supporting. That's what a converged infrastructure really delivers, besides the lower economic cost that John and I have talked about. It's that efficiency to bring new opportunities to the lines of businesses, accelerate business growth, or increase customer satisfaction.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 22nd February 2010 Copyright Quocirca © 2010

Mobile application development is full of hard choices. Although there is a seemingly insatiable appetite for ever-smarter handheld mobile devices and the applications these enable, developers have to decide which subset of the available mobile market they want to write applications for, in order to get a worthwhile and profitable return for their effort.

At one time it seemed like there might have been some uniformity and a common platform might emerge, but most attempts have faltered, and ultimately fallen short of the ideal they set out to achieve—SIM toolkit (too simple), WAP (too telco), Java (too fragmented), Symbian (too European?). None of these approaches were directly at fault. They simply satisfied a set of needs at a moment in time in the evolution of mobile devices that made the best of prevailing hardware and network limitations. The problem for each of them has been the speed of evolution of mobile capability.

True, handheld mobile devices are still limited by screen size and the lack of a ‘real' keyboard, and despite continual improvements in wireless data transmission technology, there will not be as much bandwidth radiated over air waves as that channelled down copper wires or glass pipes.

There are already plenty of handheld devices with bright readable screens capable of fast and watchable video, 3D graphics and the potential for 3DTV/video in the near future. Touch screens, haptics (buzz) feedback, accelerometers, compasses, GPS now augment the input options and user interfaces of increasing numbers of devices. Most have decent audio capability, many for music and ringtones, and of course they should all have decent enough audio for phone use (although this is not always the case as early BlackBerry and Apple users opined). The functionality is in place for some fantastic 'killer' applications and for smart developers to exploit.

However there is little uniformity as hardware manufacturers strive to get the best out of their devices and network operators do likewise with their networks and the tweaks they often demand from the handset providers. There is still, too, an industry propensity towards overly proprietary tendencies, something that was mostly beaten out of the IT industry in the 1990s as the internet and associated open protocols and standards took hold.

What many in the mobile industry fail to recognise is that real momentum stems from a wide swell of common interest, rather than the generally chaotic shoves of narrow vested interests. In spite of this, the mobile operator community are (again) having an attempt to pull things together through the Wholesale Applications Community initiative. A creditable concept, although it could appear a bit like a nervous reaction to Apple's success with its App Store, and the other efforts of hardware companies, from Nokia to BlackBerry and Samsung, rather than some groundbreaking idea.

The initiative has, on the face of it, a very significant group of operators lined up in support and, between them, they account for over 3 billion subscribers worldwide. These operators and their industry body, the GSMA, can help push towards common standards, closer links between fixed and mobile and perhaps common platforms for mobile applications. All good stuff, especially if the hardware manufacturers line up to standardise too, although some will see this as a loss of differentiation.

The real issue is, what do developers do in the meantime? Harmonisation towards a 'precious few' rather than an unwieldy handful of mobile platforms might help their long term cross platform and portability challenges, but, right now, developers needs to be able to create applications that will sell in large enough numbers to pay the bills. It is not simply a matter of being able to develop for a platform, or even an easy way to download and sell—there has to be user appeal, and in large enough numbers of them for developers to cost effectively reach.

That means technically taking advantage of the 'cool stuff' that users want—in whatever 'fruit'-named box it appears—across as many subscribers' handsets that are out there now, not just those that will be ready to ship 'in time for Christmas'. Also, from a commercial perspective, developers will need to be able to charge enough to recoup their effort—which is always greater if more platforms and differences have to be traversed—and not pay too great a 'tax' to online stores, whether these are operator led or not.

In short, the mobile industry, and the operator community in particular, needs to recognise that its success is dependent on the success of the broader ecosystem, and the big fish need to stop trying to eat up the food of the little ones. For more thoughts on stimulating the mobile applications market, download Quocirca's free paper regarding Mobile Application Momentum.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 19th February 2010 Copyright Interarbor Solutions © 2010

The next BriefingsDirect Analyst Insights Edition, Volume 49, hones in on the predictions for IT industry growth and impact, now that the recession appears to have bottomed out. We're going to ask our distinguished panel of analysts and experts for their top five predictions for IT growth through 2010 and beyond.

To help us gaze into the IT trends crystal ball we are joined by our panel: Jim Kobielus, senior analyst at Forrester Research; Joe McKendrick, independent analyst and prolific blogger; Tony Baer, senior analyst at Ovum; Brad Shimmin, principal analyst at Current Analysis; Dave Linthicum, CEO of Blue Mountain Labs; Dave Lounsbury, vice-president of collaboration services at The Open Group; Jason Bloomberg, managing partner at ZapThink, and JP Morgenthal, independent analyst and IT consultant. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions. [Disclosure: The Open Group is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:

Shimmin: Mine are geared toward collaboration and conferencing. The first and most obvious is that clouds are going to become less cloudy. Vendors, particularly those in the collaboration space, are going to start to deliver solutions that are actually a blend of both cloud and on-premise.

We've seen Cisco take this approach already with front-ending some web conferencing to off-load bandwidth requirements at the edge and to speed internal communications. IBM, at least technically, is poised do the same with Foundations, their appliances line, and LotusLive, their cloud-based solution.

With vendors like these that are going to be pulling hybrid, premise/cloud, and appliance/service offerings, it's going to really let companies, particularly those in the small and medium business (SMB) space, work around IT constraints without sacrificing the control and ownership of key processes and data, which in my mind is the key, and has been one of the limiting factors of cloud this year.

Number two: I have "software licensing looks like you." As with the housing market, it's really a buyer's market right now for software. It's being reflected in how vendors are approaching selling their software. Customers have the power to demand software pricing that better reflects their needs, whether it's servers or users.

So, taking cues from both the cloud and the open-source licensing vendors out there, we will see some traditional software manufacturers really set up a "pick your poison" buffet. You can have purchase options that are like monthly or yearly subscriptions or flat perpetual licenses that are based on per seat, per server, per CPU, per request, per processor, or per value unit—with a shout out at IBM there—or any of the above.

You put those together in a way that is most beneficial to you as a customer to meet your use case. We saw last year with web conferencing software that you could pick between unlimited usage with a few seats or unlimited seats with limited usage. You can tailor what you pay to what you need.

Third for me is the mobile OS wars are going to heat up. I'm all done with the desktop. I'm really thinking that it's all about the Google Chrome/Android. I know there's a little bit of contention there, but Google Chrome/Android, Symbian, RIM, Apple iPhone, Windows Mobile, all those devices will be the new battle ground for enterprise users.

I think the weapons will be user facing enterprise apps that work in concert with line-of-business solutions on the back-end. We'll see the emergence of native applications, particularly within the collaboration space, that are capable of fully maximizing the underlying hardware of these devices, and that's really key. Capabilities like geo-positioning, simultaneous web invoice and, eventually, video, are really going to take off across all these platforms this year.

But, the true battle for this isn't going to be in these cool nifty apps. It's really going to be in how these vendors can hopefully turn these devices into desktops, in terms of provisioning, security, visibility, governance, etc. That, to me, is going to be where they're going to either win or lose this year.

Four is "The Grand Unification Theory"—the grand unification of collaboration. That's going to start this year. We're no longer going to talk about video conferencing, web conferencing, telepresence, and general collaboration software solutions as separate concerns. You're still going to have PBXs, video codecs, monitors, cameras, desk phones, and all that stuff being sold as point solutions to fill specific requirements, like desktop voice or room-based video conferencing and the like.

But, these solutions are really not going to operate in complete ignorance of one another as they have in the past. Vendors with capabilities or partnerships spanning these areas, in particular—I'm pointing out Cisco and Microsoft here—can bring, and will be bringing, facets of these together technically to enable users to really participate in collaboration efforts, using their available equipment.

And last but not least ... Google Wave is really going to kick in in 2010. I may be stating the obvious, or I maybe stating something that's going to be completely wrong, but I really feel that this is going to be the year that traditional enterprise collaboration players jump head long into this Google Wave pool in an effort to really cash in on what's already a super-strong mind share within the consumer ranks.

Even though they have a limited access to the beta right now, there are over a million users of it, that are chunking away at this writing code and using Wave.

Of course, Google hosted rendition will excel in supporting consumer tasks like collaborative apps and role playing games. That's going to be big.

Linthicum: My top five are going to be, number one, cloud computing goes mainstream. That's a top prediction, I'm just seeing the inflection point on that.

I know I'm going out on the edge on this one. Go to indeed.com and do a search on the cloud-computing jobs postings. As I posted on my InfoWorld blog few weeks ago, it's going up at an angle that I have never seen at any time in the history of IT. The amount of growth around cloud computing is just amazing. Of course, it's different aspects of cloud computing, not just architecture, with people who are cloud computing developers and things like that.

The Global 2000 and the government, the Global 1, really haven't yet accepted cloud computing, even though it's been politically correct for some time to do so. The reason is the lack of control, security concerns, and privacy issues, and, of course, all the times the cloud providers went down. The Google outages and the loss of stuff with T-Mobile, hasn't really helped, but ultimately people are gearing up, hiring up, and training up for cloud computing.

We are going to see a huge inflection point in cloud computing. This can be more mainstream in Global 2000 than it has been in the past. It's largely been the domain of SMBs, pilot projects, things like that. It's going to be a huge deal in 2010 and people are going to move into cloud computing in some way, shape, or form, if they are in an organization.

The next is privacy becomes important. Facebook late last year pulled a little trick, where they changed the privacy settings, and you had to go back and reset your privacy settings. So, in essence, if you weren’t diligent about looking at the privacy settings within your Facebook account and your friends list, your information was out on the Internet and people could see it.

The reason is that they're trying to monetize people who are using Facebook. They're trying to get at the information and put the information out there so it's searchable by the search engines. They get the ad revenue and all the things that are associated with having a big mega social media site.

People are going to move away from these social media sites that post their private information, and the social media sites are going to react to that. They're going to change their policies by the end of 2010, and there's going to be a big uproar at first.

Next, the cloud crashes make major new stories. We've got two things occurring right now. We've got a massive move into the cloud. That was my first prediction. We have the cloud providers trying to scale up, and perhaps they’ve never scaled up to the levels that they are going to be expected to scale to in 2010. That's ripe for disaster.

A lot of these cloud providers are going to over extend and over sell, and they're going to crash. Performance is going to go down—very analogous to AOL’s outage issues, when the Internet first took off.

We're going to see people moving to the cloud, and cloud providers not able to provide them with the service levels that they need. We're going to get a lot of stories in the press about cloud providers going away for hours at a time, data getting lost, all these sorts of things. It's just a matter of growth in a particular space. They're growing very quickly, they are not putting as much R&D into what these cloud systems should do, and ultimately that's going to result in some disasters.

Next, Microsoft becomes cloud relevant. Microsoft, up to now, has been the punch line of all cloud computing. It had the Azure platform out there. They've had a lot of web applications and things like that. They really have a bigger impact in the cloud than most people think, even though when we think of cloud, we think of Amazon, Google, and larger players out there.

With Azure coming into its own in the first quarter of next year in the rise of their office automation applications for the cloud, you are going to see a massive amount of people moving to the Microsoft platform for development, deployment, infrastructure, and the office automation application. The Global 2000 that are already Microsoft players and the government that has a big investment in Microsoft are going to move in that direction.

Suddenly, you're going to see Microsoft with a larger share of the cloud, and they're going to be relevant very quickly. In the small- and medium-sized business, it's still going to be the domain of Google, and state and local governments are still be going to be the domain of Google, but Microsoft is going to end up ruling the roost by the end of 2010.

Finally, the technology feeding frenzy, which is occurring right now. People see the market recovering. There is money being put back into the business. That was on the sidelines for a while. People are going to use that money to buy companies. I think there is going to be a big feeding frenzy in the service-oriented architecture (SOA) world, in the business intelligence (BI) world, and definitely in the cloud-computing world.

Lots of these little companies that you may not have heard about, which may have some initial venture funding, are suddenly going to disappear. Google has been taking these guys out left and right. You just don’t hear about it. You could do a podcast just on the Google acquisitions that have occurred this week. That's going to continue and accelerate in 2010 to a point where it's almost going to be ridiculous.

Lounsbury: I'm going to jump on the cloud bandwagon initially. We’ve seen huge amounts of interest across the board in cloud and, particularly, increasing discussions about how people make sense of cloud at the line-of-business level.

Another bold prediction here is that the cloud market is going to continue to grow, and we'll see that inflection point that Dave Linthicum mentioned. But, I believe that we're going to see the segmentation of that into two overarching markets, an infrastructure-as-a-service (IaaS) or platform-as-a-service market (PaaS) and software-as-a-service (SaaS) market. So that's my number one prediction.

We'll see the continued growth in the acceptance by SMBs of the IaaS and PaaS for the cost and speed reasons. But, the public IaaS and PaaS are going to start to become the gateway drug for medium- to large-size enterprises. You're going to see them piloting in public or shared environments, but they are going to continue to move back toward that locus of controlling their own resources in order to manage risk and security, so that they can deliver their service levels that their customers expect.

My third prediction, again in cloud, is that SaaS will continue to gain mainstream acceptance at all levels in the enterprise, from small to large. What you’ll see there is a lot of work on interfaces and APIs and how people are going to mash up cloud services and bring them into their enterprise architectures.

Of course all of this is set against the context that all distributed computing activities are set against, which is security and privacy issues.

This is actually going to be another trend that Dave Linthicum has mentioned as a blurring of a line between SaaS and SOA at the enterprise level. You’ll see these well on the way to emerging as disciplines in 2010.

The fourth general area is that all of this interest in cloud and concern about uptake at the enterprise level is going to drive the development of cloud deployment and development skills as a recognized job function in the IT world, whether it's internal to the IT department or as a consultancy. Obviously, as a consultancy, we look to the cloud to provide elasticity of deployment and demand and that's going to demand an elastic workforce.

So the question will be how do you know you are getting a skilled person in that area. I think you'll see the rise of a lot of enterprise-level artifacts such as business use cases, enterprise architecture tools, and analytic tools. Potentially, what we'll see in 2010 is the beginning of the development of a body of knowledge: practitioners in cloud. We'll start to recognize that as a specialty the way we currently recognize SOA as a specialty.

Of course all of this is set against the context that all distributed computing activities are set against, which is security and privacy issues. I don’t know if this is a prediction or not, but I wonder whether we're going to see our cloud harbor in 2010 its first big crash and the first big breach.

We've already mentioned privacy here. That's going to become increasingly a public topic, both in terms of the attention in the mainstream press and increasing levels of government attention.

There have been some fits and starts at the White House level about the cyber czar and things like that, but every time you turn around in Washington now, you see people discussing cyber security. How we're going to grow our capability in cyber security and increasing recognition of cyber security risk in mainstream business are going to be emerging hot topics of 2010.

Kobielus: Number one: IT is increasingly going to in-source much of BI development of reports, queries, dashboards, and the like to the user through mash up self-service approaches, SaaS, flexible visualization, and so forth, simply because they have to.

IT is short staffed. We're still in a recession essentially. IT budgets are severely constrained. Manpower is severely constrained. Users are demanding mashups and self-service capabilities. It's coming along big time, not only in terms of enterprise deployment, but all the BI vendors are increasingly focused on self-service solution portfolios.

Number two: The users who do more of the analytics development are going to become developers in their own right. That may sound crazy based on the fact that traditionally data mining is done by a cadre of PhD statisticians and others who are highly specialized.

Question analysis, classification and segmentation, and predictive analytics is coming into the core BI stack in a major way. IBM’s acquisition of SPSS clearly shows that not only is IBM focusing there, but other vendors in this space, especially a lot of smaller players, already have some basic predictive analytics capabilities in their portfolios or plan to release them in 2010.

Basically, we're taking data mining out of the hands of the rocket scientists and giving it to the masses through very user-friendly tools. That's coming in 2010.

Number three: There will be an increasing convergence of analytics and transactional computing, and the data warehouse is the hub of all that. More-and-more transactional application logic will be pushed down to be executed inside of the data warehouse.

The data warehouse is a greater cloud, because that's where the data lives and that's where the CPU power is, the horse power. We see Exadata, Version 2 from Oracle. We see Aster Data, nCluster Version 4.0. And, other vendors are doing similar things, pointing ahead to the coming decade, when the data warehouse becomes a complete analytic application server in its own right—analytics plus transaction.

Number four: We're seeing, as I said, that predictive analytics is becoming ever more important and central to where enterprises are going with BI and the big pool of juicy data that will be brought into predictive model. Much of it is coming from the whole Web 2.0 sphere and from social networks—Twitters, Facebooks and the like, and blogs. That's all highly monetizable content, as Dave Linthicum indicated.

We're seeing that social network analysis has a core set of algorithms and approaches for advanced analytics that are coming in a big way to data mining tools, text analytics tools, and to BI. Companies are doing serious marketing campaign planning, optimization, and so forth, based on a lot of that information streaming in real-time. It's customer sentiment in many ways. You know pretty much immediately whether your new marketing campaign is a hit or a flop, because customers are tweeting all about it.

That's going to be a big theme in 2010 and beyond. Social network analysis really is a core business intelligence for marketing and maintaining and sustaining business in this new wave.

And, finally, number five: Analytics gets dirt cheap. Right now, we're in the middle of a price war for the enterprise data warehousing stack hardware and software. Servers and storage, plus the database licenses, query tools, loading tools, and BI are being packaged pretty much everywhere into appliances that are one-stop shopping, one throat to choke, quick-deploy solutions that are pre-built.

Increasingly, they'll be for specific vertical and horizontal applications and will be available to enterprises for a fraction of what it would traditionally cost them to acquire all those components separately and figure it out all themselves. The vendors in the analytics market are all going appliance. They're fighting with each other to provide the cheapest complete application on the market.

McKendrick: My number one trend is the impact of the economy. By all indications, 2010 is going to be a growth year in the economy. We're probably in this V shape.

See, I'm actually an optimist, not a pessimist. The world may end in 2012, but for 2010, we're going to have a great economy. It's going to move forward.

For this decade, we're looking forward to the rise of something called "social commerce," where the markets are user-driven and are conversations.

Number two: Cloud computing. We’ve all been talking about that. That's the big development, the big paradigm shift. Clouds will be the new "normal." From the SOA perspective, we're going to be seeing a convergence. When we talk about cloud, we're going to talk about SOA, and the two are going to be mapped very closely together.

Dave Linthicum talks a lot about this in his new book and in his blog work. Services are services. They need to be transparent. They need to be reusable and sharable. They need to cross enterprise boundaries. We're going to see a convergence of SOA and cloud. It’s a service-oriented culture.

Number three: Google is becoming what I call the Microsoft of the clouds. Google offers a browser and email. It has a backend app engine. It offers storage. They're talking about bringing out an OS. Google is essentially providing an entire stack from which you can build your IT infrastructure. You can actually build a company’s IT infrastructure on the back of this. So, Google is definitely the Microsoft of the cloud for the current time.

Microsoft is also getting into the act as well with cloud computing, and they are doing a great job there. It’s going to be interesting to see what happens. By the way, Google also offers search as a capability.

Number four: We're going to see less of a distinction between service providers and service consumers over clouds, SOA, what have you. That's going to be blurring. Everybody will be providing and publishing services, and everybody will be consuming services.

You're going to see less of a distinction between providers and consumers. For example, I was talking to a reinsurance company a few months back. They offer a portal to their customers, the customers being insurance companies. They say that they offer a lot of analytics capabilities that their customers don’t have, and the customers are using their portal to do their own analytic work.

They don’t call it cloud. Cloud never entered the conversation, but this is a cloud. This is a company that’s offering cloud services to its consumers. We're going to see a lot of that, and it’s not necessarily going to be called cloud. You're not going to see companies saying, "We're offering clouds to our partners." It’s just going to be as the way it is.

Number five: In the enterprise application area, we've seen it already, but we're going to see more-and-more pushback against where money is being spent. As I said, the economy is growing, but there is going to be a lot of attention paid to where IT dollars are going.

I base this on a Harvard Medical School study that just came out last month. They studied 4,000 hospitals over a three-year period and found that, despite hundreds of millions of dollars being invested at IT, IT had no impact on hospital operations, patient care quality, or anything else.

Morgenthal: Number one: Cyber security. I am beginning to understand how little people actually understand about the differences between what security is and information assurance is, and how little people realize that their systems are compromised and how long it takes to eliminate threat within an organization.

Because of all of this connectedness, social networking, and cloud, a lot of stuff is going to start to bubble up. People who thought things were taken care of are going to learn that it wasn’t taken care of, and there will be a sense of urgency about responding to that. We're going to see that happen a lot in the first half of 2010.

Number two: Mobile. The mobile platforms are now the PC of yesterday, right? The real battle is for how we use these platforms effectively to integrate into people’s lives and allow them to leverage the platform for communications, for collaboration, and to stay in touch.

It seems everywhere I go, people are willing to spend a lot of money on their data plan. So, that’s a good sign for telecoms.

My personal belief is that it overkills information overlook, but that’s me. I know that everywhere I go, I see people using their iPhones and flicking through their apps. So, they hit upon a market segment, a very large market segment, that actually enjoys that. Whether small people like me end up in a cave somewhere, the majority of people are definitely going to be focused on the mobile platform. That also relates to the carriers. I think there still a carrier war here. We've yet to see AT&T and iPhone in the US break apart and open up its doors to other carriers.

Number three: Business intelligence and analytics, especially around complex event processing (CEP). CEP is still in an immature state. It does some really interesting things. It can aggregate and correlate. It really needs to go to that next step and help people understand how to build models for correlation. That’s going to be a difficult step.

As somebody was saying earlier, you had these little Poindexters sitting in the back room doing the stuff. There's a reason why the Poindexters were back there doing that. They understand math and the formulas that are under building these analytical models.

CEP and analytics—and the two tied together. You’ll see that the BI, and data aspects of the BI, side will integrate with the CEP modeling to not only report after the fact on a bunch of raw data, but almost be proactive, and try to, as I said in my blog entry, know when the spit hits the fan.

Number four is collaboration. We’ve crossed the threshold here. People want it. They're leveraging it.

The labor market has not caught up to take advantage of these tools, design them, architect the solutions properly, and deploy and manage them.

I've been seeing some uptake on Google Wave. I think people are still a little confused by the environment, and the interaction model is not quite there yet to really turn it on its ear, but it clearly is an indication that people like large-scale interactions with large groups of people and to be able to control that information and make it usable. Google is somewhat there, and we'll see some more interesting models emerge out of that as well.

Number four is labor. We're at a point where the market is based on all these other things based on the cloud. We had a lot of disruptive technologies hit in the past five years—enterprise mashups, SOA, and cloud computing. The labor market has not caught up to take advantage of these tools, design them, architect the solutions properly, and deploy and manage them.

I think that 2010 has to be a year for training, rebuilding, and getting some of those skills up. Today, you hear a lot of stories, but there is a large gap for any company to be able to jump into this. Skills are not there. The resources are not there and they are not trained. That's going to be a huge issue for us in 2010.

Bloomberg: I'm going to be a bit of the naysayer of the bunch. I just don't see cloud computing striking it big in 2010. When we talk to enterprise architects, we see a lot of curiosity and some dabbling. But, at the enterprise scale, we see too much resistance in terms of security and other issues to put a lot of investment into it. It's going to be gradually growing, but I don't see such a point coming as soon as you might like.

Small organizations are a different story. We see small organizations basing their whole business models on the cloud, but at the enterprise level, it's sort of a toe in the water, and we see that happening in the 2010.

Another thing we don't see really taking off in any big way is Enterprise 2.0. That is Web 2.0 collaborative technologies for the enterprise. You know, "Twitter On Steroids," and that kind of thing. Again, it's going to be more of a toe in the water thing. Collaborative technologies are maturing, but we don't see a huge paradigm shift in how collaboration is done in the enterprise. It's going to be more of a gradual process.

Another thing that we are not seeing happening in 2010 is CIOs and other executives really getting the connection between business process management (BPM) and SOA. We see those as two sides of the same coin. Architects are increasingly seeing that in order to do effective BPM you have to have the proper architecture in place. But, we don't see the executives getting that and putting money where it belongs in order to effect more flexible business process. So, this is another work in progress, and it's going to be a struggle for architects to make progress over the course of the year.

As far as the end of the recession, yeah, we're all hoping that the economy picks up, and I do see that there is going to be a lot of additional activity as a result of an improving economy, but I don't see a huge uptake in spending on software per se.

Spending in IT is going to go up, but in terms of what the executives going to invest in, they're going to be very careful about purchasing software. That's going to drive some money to cloud-based solutions, but that's still just a toe in the water as well.

Software vendors were hoping for a huge year, but they're going to be disappointed. It's going to be a growth year, but it's going to be moderate growth for the vendors.

Those are my first four. Those are the negatives. Not to be too negative, in terms of the positive, what we see happening in 2010 is increased focus on "MSW." You know what MSW is, right? Politely speaking it's "Make Stuff Work." Of course, you could put a different word in there for the S, but Make Stuff Work, that's what we see the architects really focusing on.

They have a good idea now of what SOA is all about. They have a good idea about how the technology fits in the story and the various technologies that have been mentioned on this call, whether it's analytics, data management, SaaS, and the cloud-based approaches. Now, it's time to get the stuff to work together, and that's the real challenge that we see.

The SOA story is no longer an isolated story. We're going to do SOA, let's go do SOA. But, it's SOA plus other things. So, we're going to do SOA, BPM, and the architecture driving that, despite the fact that the CIO may not quite connect the dots there.

SOA plus master data management (MDM)—it's not one or the other now. It's how we get those things to work together. SOA plus virtualization. That's another challenge. Previously, those conversations were separate parts of the organization. We see more and more conversations bringing those together.

SOA and SaaS—somebody already mentioned that SaaS is one segment of the cloud category. It's little more mature than the rest. We see more organizations understanding the connection between those two and trying to put them together. We'll do middleware and we'll do SOA, but we don't really see the connection where we confuse one for the other, and that was a big issue.

We're happy to call this services-oriented, even though the organization, as a whole, may call it variety of different things, depending on the perspective of the individual.

Baer: On cloud and virtualization, basically I agree with Jason, and I don't agree with David or with Joe. It’s not going to be the "new normal." We're going to see this year an uptake of all the management overhead of dealing with cloud and virtualization, the same way we saw with outsourcing years back, where we thought we'd just throw labor costs over the wall.

Secondly, JP, I very much believe that there is going to be convergence between BI and CEP this year. I agree with him that there's not going to be a surge of Albert Einsteins out there. On the other hand, I see this as a golden opportunity for vendors to package these analytics as applications or as services. That's where I really see the inflection curve happening.

Number three: Microsoft and Google. Microsoft will be struggling to stay relevant. Yes, people will buy Windows 7, because it's not Vista. That’s kind of a backhanded compliment to say, "We're buying this, because you didn't screw up as badly as last time." It doesn't speak well for the future.

Google meets a struggle for focus. I agree with Joe that they are aspiring to be the Microsoft of the cloud, but it may or may not be such a good thing for Google to follow that Microsoft model.

Finally, I agree with Jim that you are going to see a lot more business-oriented, whether it's BI, BPM, or IBM buying Lombardi. I hope they don't mess up Lombardi and especially I hope they don't mess up Blueprint. I've already blogged about that.

One other point—and I don't know if this fits into a top five or not—but I found what Joe was talking about very interesting in terms of the let-down on health-care investment in IT. There's going to be lot a of pushing in electronic medical records (EMR) this year. I very much believe in EMRs, but, on the other hand, they are no panacea. We're going to see a trough of disillusionment happen on that as well.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 18th February 2010 Copyright Bloor Research © 2010

We are inundated with new technologies and products designed to help make our organisations safe from hackers and other malcontents. One technology that has gained ground over the past few years is database activity monitoring. It makes sense to protect valuable databases, and by adding an intelligent monitor capable of sniffing out threats an additional level of protection can be gained.

But what is database activity monitoring and why should you care?

Database security - some background
The majority of sizeable organisations will use a database of some description to store their vital data, be it contact data, customer lists, product data or any other valuable intellectual property. With the widespread use of relational databases, the chances are that a product such as Microsoft SQL Server or Oracle will be the database of choice.

Although existing for many years these products have had a chequered history when it comes to their security. It wasn't that long ago when the default Microsoft SQL Server administration password was simply blank, something that reveals a lot about cavalier attitudes towards data security in the 1990's. Of course this has changed. Microsoft launched the Trustworthy Computer Initiative in 2002 and retrained its developers to ensure that secure coding became the norm. In an effort to beef up its product security, Oracle introduced the Software Security Assurance Process (SSAP). The objective of this process was to ensure that products developed by Oracle engineers were secured from the start, rather than having to re-secure production code and deploy large numbers of patches to their customers.

To sell some new software for the DBA to install on their database server is a very difficult process, and, probably in many circumstances, nearly impossible as the servers are so locked down nothing other than the database and operating system is allowed on the computer.

When it comes to IT security a lot of vendors have been successfully following the appliance modelthat is supplying a hardware box of tricks that carries out a single task which can be plugged into a network without having to install server-based software. This non-invasive approach has great appeal to network administrators who often like to touch and feel kit, safe in the knowledge they can remove it if they wish. This tangible aspect is something that software can't deliver.

The nature of IT security is also changing as we move away from solely securing the perimeter to ensuring we have defence in depth. IT security practitioners and DBAs are realising that the threat to their data, be it loss or damage, is increasingly coming from within. Disgruntled employees can quickly download a database result set to their memory stick and be out the door before anyone realises there has been a problem.

Database Activity Monitoring vs. Database auditing
We have seen how database vendors have improved their product security over the past few years. This also includes the inclusion of tools to monitor database activities. If we take Microsoft SQL Server 2008 as an example, there are a couple of native database auditing tools that could be useful, but fall short of a comprehensive database activity monitoring tool.

SQL Server connection auditing is a subsystem that monitors failed or successful login attempts to the database server. The audit trail provides a guide as to who is attempting to connect to a server, when the attempt took place and if they managed to secure a connection. This level of auditing has relatively little impact on database performance as it is one of the native characteristics of the database product.

In addition, SQL Server provides an auditing tool that meets the need of the C2 Security Evaluation Criteria. It is not enabled by default but when working will track each and every auditable event and write them to a file on the server. Therein lies the drawback with this auditing mode. It is possible to create huge volumes of audit data that is simply overwhelming. If the audit file should grow to the stage that it is bigger than the disk space allowed for it then SQL Server will stop working, as it is prohibited from processing any data that is not supported in an audit trail. In addition, the presence of an audit file will soon be detected by an attacker and will quickly be edited to remove traces of any attack, unless the attacker is very poorly skilled.

SQL Server Trace is another auditing tool but has other uses as a way of tracing and debugging slow queries. Although it is possible to configure SQL Server Trace to work quite efficiently, out of the box it does consume considerable resources and as such is not a viable tool if you need to audit the database from a security perspective.

Database Activity Monitoring Brings it Together
Database activity monitoring is designed to provide specific tools and techniques above those found in database products off the shelf and brings together the world of database and conventional information security.

Database activity monitoring products are normally appliances that sit between client applications and the relational database they use. The appliance analyses all Structured Query Language (or SQL) statements that are sent by the clients to the database and will flag potentially dangerous activity.

This is the pivotal difference between database activity monitoring and log management. With database activity monitoring it is the actual SQL commands that are monitored. With log management tools it is the database and system logs that are monitored for suspicious activity.

So how are the thousands of SQL statements that could be submitted to a database analysed? Well, this is where the appliance's "smarts" come into play.

Using specially designed algorithms the database activity monitor analyses SQL statements until it comes across SQL that is out of the ordinary. It will then flag the potential problem to the DBA for them to take action.

So what do we mean by SQL that is out of the ordinary? Well, it could be anything out of the ordinary for that particular SQL query, user, table being accessed, time of day or any one of many measurements being tracked day in and day out.

For example in business, a finance user may normally select data covering a three month period for analysis each week. If, suddenly, they request 5 years worth of data this might be an innocent request to do some more historical analysis or it could be an attempt to steal 5 years worth of data from the business.

In the next article in this series we will explore how database activity monitoring works for real.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 18th February 2010 Copyright Interarbor Solutions © 2010

Hewlett-Packard (HP) is pushing deeper into the cloud opportunity with new consulting services that aim to help businesses and government agencies speed cloud-based infrastructure adoption and respond more quickly to market demands for efficiency.

Dubbed HP Cloud Design Service, the new offering advises organizations how to quickly design and deploy scalable, cloud-based infrastructures. HP's consulting services come with risk mitigation in mind and support a hybrid sourcing model that encompass private and public cloud options. HP promises its approach will allow organizations to consume and deliver services that support varied workloads. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

"There's a lot of hype out there, and organizations just can't deal with cool, exciting cloud concepts in a vacuum," says Flynn Maloy, vice president of marketing for HP's Technology Services group. "If you even make a tiny pull of cloud services into your IT environment, it touches everything else in the environment. Our HP Cloud Design Service looks at the big picture."

Anatomy of HP Cloud Design
HP is basing the new consulting services on its own experience with demanding cloud environments, including work with the Defense Information Systems Agency to design a cloud infrastructure solution that accelerates the process of provisioning computing services for U.S. military applications.

A year ago companies were skeptical. Last year they were running pilots. Now, companies are trying to figure out how to leverage cloud innovations internally.

Here's how HP's Cloud Design Service works: First, HP explores a client's business and technical requirements, as well as existing IT investments. HP then creates a customized cloud infrastructure design blueprint and implementation plan, complete with cost estimates and deployment, testing, operational management, service lifecycle management, government and support guidelines.

HP outlines four key benefits of its cloud consulting service: access to a common, flexible framework for cloud engagements, faster time to delivery with mitigated implementation risks, reduced technology redundancies, and the ability to leverage existing HP and non-HP technology investments. The result, according to HP, is a cloud-specific infrastructure that's safe and effective – and meets business objectives.

Mapping the cloud
HP's Cloud Design Service builds on existing HP efforts in the cloud, including the Cloud Discovery Workshop and the Roadmap Service. The Cloud Design Service acts as the next step in an organization's move into the cloud. The updates this week follow earlier moves last summer on cloud consulting services.

As Maloy describes it, the new service sends HP's cloud consultants into an organization's IT environment with sleeves rolled up, ready to help design and build an architecture that leverages the benefits of a shared internal cloud while offering access to external public clouds.

The big question is, are organizations ready to move beyond private clouds to public clouds? Maloy says organizations are kicking the tires, trying to figure out how to bring public cloud innovations into the enterprise. HP, he says, has established best practices to do this safely.

"A year ago companies were skeptical. Last year they were running pilots. Now, companies are trying to figure out how to leverage cloud innovations internally," Maloy says. "Our HP Reference Architecture for Cloud is part of the Cloud Design Service. It has all of the elements we think a robust, well-designed environment takes into account."

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 17th February 2010 Copyright Interarbor Solutions © 2010

Security may be the hottest topic in IT. But it's also one of the least understood. So BriefingsDirect assembled a panel to examine the need for IT security to run more like a data-driven science, rather than a mysterious art form.

Rigorously applying data and metrics to security can dramatically improve IT results and reduce overall risk to the business. By employing and applying more metrics and standards to security, the protection of IT becomes better, and the known threats can become evaluated uniformly.

Standards like Information Security Management Maturity Model (SM3) are helping to not only gain greater visibility, but also allowing IT leaders to scale security best practices repeatably and reliably.

With standards and greater reliance on data, security practitioners can understand better what they are up against, perhaps gaining close to real-time responses. They can know what's working—or is not working—both inside and outside of their organization.

The security metrics panel and podcast discussion are coming to you from The Open Group’s Enterprise Architecture Practitioners Conference in Seattle on Feb. 2, 2010. The goal is to determine the strategic imperatives for security metrics, and to discuss how to use them to change the outcomes in terms of IT’s value to the business.

Our panel consists of a security executive from The Open Group, as well as two experts on security who are presenting at the consortium's Security Practitioners Conference: Jim Hietala, Vice President for Security at The Open Group; Adam Shostack, co-author of The New School of Information Security, and Vicente Aceituno, director of the ISM3 Consortium. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions

Here are some excerpts:

Hietala: We think there's a contribution to make from The Open Group, in terms of developing the ISM3 standard and getting it out there more widely. [Being a data-driven security organization means] using information to make decisions, as opposed to what vendors are pitching at you, or your gut reaction. It's getting a little more scientific about gathering data on the kinds of attacks you're seeing and the kinds of threats that you face, and using that data to inform the decisions around the right set of controls to put in place to effectively secure the organization.

A presentation we had today from an analyst firm talked about people being all over the map [on security practices]. I wouldn’t say there's a lot of rigor and standardization around the kinds of data that’s being collected to inform decisions, but there is some of that work going on in very large organizations. There, you typically see a little more mature metrics program. In smaller organizations, not so much. It's a little all over the map.

... The important outputs of a good metrics program can be that it gives you a different way to talk to your senior management about the progress that you're making against the business objectives and security objectives.

That’s been an area of enormous disconnect. Security professionals have tended to talk about viruses, worms, relatively technical things, but haven't been able to show a trend to senior management that justifies the kind of spending they have been doing and the kind of spending they need to do in the future. Business language around some of that is needed in this area.

Shostack: We have an opportunity to be a heck of a lot more effective than we have been. We can say, "This control that we all thought was a really good idea—well, everyone is doing it, and it's not having the impact that we would like." So, we can reassess how we're getting real, where we're putting our dollars.

The big change we've seen is that people have started to talk about the problems that they are having, as a result of laws passed in California and elsewhere that require them to say, "We made a mistake with data that we hold about you," and to tell their customers.

We've seen that a lot of the things we feared would happen haven't come to pass. We used to say that your company would go out of business and your customers would all flee. It's not happening that way. So, we're getting an opportunity today to share data in a way that’s never been possible before.

Aceituno: The top priority should be to make sure that the things you measure are things that are contributing positivity to the value that you're bringing to business as a information security management (ISM) practitioner. That’s the focus. Are you measuring things that are actually bringing value or are you measuring things that are fancy or look good?

Because metrics are all about controlling what you do and being able to manage the outputs that you produce and that contribute value to the business ... you can use metrics to manage internal factors.

I don’t think it brings a bigger return on investment (ROI) to collect metrics on external things that you can't control. It’s like hearing the news. What can you do about it? You're not the government or you're not directly involved. It's only the internal metrics that really make sense.

Basically, we link business goals, business objectives, and security objectives in a way that’s never been done before, because we are painfully detailed when we express the outcomes that you are supposed to get from your ISM system. That will make it far easier for practitioners to actually measure the things that matter.

Shostack: Vicente’s point about measuring the things you can control is critical. Oftentimes in security, we don’t like to admit that we've made mistakes and we conceal some of the issues that are happening. A metrics initiative gives you the opportunity to get out there and talk about what's going on, not in a finger pointing way, which has happened so often in the past, but in an objective and numerically centered way. That gives us opportunity to improve.

Hietala: There's some taxonomy work to be done. One of the real issues in security is that when I say "threat," do other people have the same understanding? Risk management is rife with different terms that mean different things to different people. So getting a common taxonomy is something that makes sense.

The kinds of metrics we're collecting can be all over the map, but generally they're the things that would guide the right kind of decision making within an IT security organization around the question, "Are we doing the right things?"

Today, Vicente used an example of looking at vulnerabilities that are found in web applications. A critical metric was how long those vulnerabilities are out there before they get fixed by different lines of business, by different parts of the business, looking at how the organization is responding to that. We're trying to drive that metric toward the vulnerabilities being open for less time and getting fixed quicker.

Shostack: We've seen over the last few years that those security programs that succeed are the ones that talk to the business needs and talk to the executive suite in language that the executives understand.

We've seen over the last few years that those security programs that succeed are the ones that talk to the business needs and talk to the executive suite in language that the executives understand.

The real success here and the real step with ISM3 is that it gives people a prescriptive way to get started on building those metrics.

You can pick it up and look at it and say, "Okay, I'm going to measure these things. I'm going to trend on them." And, I'm going to report on them."

As we get toward a place, where more people are talking about those things, we'll start to see an expectation that security is a little bit different. There is a risk environment that's very outside of people's control, but this gives people a way to get a handle on it.

Aceituno: The main task of the ISM3 Consortium so far was to manage the ISM3 standard. I'm very happy to say that The Open Group and ISM3 Consortium reached an agreement and, with this agreement, The Open Group will be managing ISM3 from here on in. We'll be devoting our time to other things, like teaching and consulting services in Spain, which is our main market. I can't think of anything better than for ISM3 to be managed from The Open Group.

Hietala: You have metrics and control approaches in various areas and you can pick a starting point. You can come at this top-down, if you're trying to implement a big program. Or, you come at it bottoms-up and pick a niche, where you know you are not doing well and want to establish some rigor around what you are doing. You can do a smaller implementation and get some benefit out of it. It's approachable either way.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Clay Ryder, President, Sageza Group, Inc. Posted: 17th February 2010 Copyright Sageza Group, Inc. © 2010

IBM has announced a new hardware and software offering, known as IBM Scale Out Network Attached Storage (SONAS), that assembles server and storage components into a virtual storage environment to overcome many of the scalability limitations of current NAS technology. SONAS is massively scalable with support for up to 14.4PB in a single system while offering the ability to seamlessly add storage capacity. It features automated tiering, is capable of scanning 1+ billion files in a matter of minutes, and uses policy-driven file-level tiering to enable organizations to specify where data is placed and/or how it is migrated over time. IBM states that the target market for SONAS is midsize to larger enterprises in industries that need to store, access, and manage dramatic growth in file-based data, including verticals such as financial services, insurance, banking, medical and life sciences, digital media and government.

Key business benefits outlined in the announcement include:

• Better control of data through consolidation of islands of data into a single network-based store that is accessible from anywhere in the world and can non-disruptively add storage capacity.
• Smarter use of resources achieved through policy-driven automation and tiered storage management.
• Reduced Operational Costs through hardware consolidation, reduced CAPEX, and maximizing of overall storage ROI as well as minimizing of administration headcount through streamlined and simplified administration, backup, and application access to data.

Net/Net: One simple IT axiom is that the number of files being created on a daily basis continues to grow, seemingly unabated. At the same time, the value of these files increases geometrically as they are made available in a policy-based fashion to an ever growing number of LoB professionals, business partners, customers, and even the world at large. Files represent information, the key component of the information-driven economy, and organizations that are cost-effectively able to capture this growing pool of data and transform it into actionable information are those which will have the competitive advantage in the marketplace.

Files almost seem to create themselves and expand to overfill the available storage space. Just ask any IT professional tasked with managing capacity just how long that “new” free storage capacity lasts after installation. Although for many organizations managing the utilization of servers has become paramount in the quest for organizational efficiency, not as many have fully embraced this reality with respect to storage. This is in part due to some additional challenges that storage management presents compared with servers. Although there are a few exceptions, notably horizontal applications such as email, or desktop productivity applications, most applications deployed in an organization are used by specific groups, departments, or other functional organizations. Thus it is possible to consolidate like applications within a subset of the corporate server resources and manage their level of service with some degree of predictability.

For the most part storage solutions have retained more of the traditional siloed approach than their server brethren, which would seem counter-intuitive given the focus on improved utilization through virtualization in most organizations. Yet part of the challenge lies in the fundamental difference between how storage is consumed and how applications are. As we noted earlier, access to applications can grouped by function with some degree of the physical manifestation mimicking this principle. However, file-based storage (as opposed to block-based storage) has essentially universal appeal to applications so a bevy of applications can end up making substantial demands for file space. In addition, there is the unprecedented growth in unstructured files of most any type finding their way on to network-based storage. The historic approaches that sought to deliver enterprise-wide storage, typically NAS in nature, are ultimately limited in the number of files that could be delivered within a given namespace. As space ran out, extensions to NAS required either that a potentially enormous number of files had to be moved to the new storage to keep associated files together, or users had to deal with their files being stored across multiple file namespaces and the inevitable management headache that entailed.

This is where we believe SONAS has the potential to greatly ease the management and accessibility of universal file systems and help move organizations towards a single universally accessible file store of considerable size. With SONAS, organizations can move towards Cloud-based infrastructures with the knowledge that the sheer demand for file space will not outstrip the ability of the storage infrastructure to keep up with rising demand while keeping the management expense under control. With the scale that Cloud portends, automated policy control and tiering will be absolutely essential in order for organizations to achieve the scale required while being able to match the business value of information being stored with the cost of its storage. Decisions on where data is placed upon creation, where and when it moves within the tiers of the storage hierarchy, where it is copied for disaster recovery, and when it will be deleted would be automated based upon the organization’s defined policy guidelines.

While SONAS has the potential to deliver a single large file system in the Cloud, by no means would it become the sole storage approach for an organization or service provider. By virtue of its file system-based approach to storage, NAS (or now SONAS), is not the most efficient means by which to deliver block-oriented storage for applications such as large database instances or other applications requiring large quantities of raw storage that are under the application’s direct management and control. Hence, even in a cloud environment, a one-style-fits-all approach will not best meet the needs of the organization.

Overall, we are heartened by this announcement as it illustrates a big-picture vision of how the vast number of files that could be found in a Cloud or very large enterprise environment could be managed in much more efficient, streamlined, and cost-effective fashion over past solutions. In line with the notion of efficiency, we are also pleased to read the very business-focused positioning of this technology, a discussion about operational efficiency and improved utilization as opposed to a singular fixation on the zillions of files that could be stored. In any large-scale deployment such as that implied by a Cloud Computing approach, the efficient management of resources, both human and capital, will be paramount for IT success. In the case of storage, this implies a high degree of automation, tiering, and policy definition and enforcement. To our way of thinking, SONAS is a logical extension to the well-understood NAS approach, but one that has the potential to allow NAS to grow far beyond its original design considerations and into its next wave of potential.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Clay Ryder (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 16th February 2010 Copyright Interarbor Solutions © 2010

This podcast discussion looks at ArchiMate, a way of conceptualizing, modeling, and controlling enterprise architecture (EA) and business architecture.

ArchiMate provides ways to develop visualizations and control of IT architecture to more swiftly obtain business benefits. To learn more, we interview an expert on this, Dr. Harmen van den Berg, partner and co-founder at BiZZdesign.

This podcast was recorded Feb. 2 at The Open Group’s Enterprise Architecture Practitioners Conference in Seattle the week of Feb. 1, 2010. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Gardner: I really enjoyed your presentation on ArchiMate. How did the standard come about?

Dr. Harmen van den Berg: ArchiMate was developed in the Netherlands by a number of companies and research institutes. They developed it because there was a lack of a language for describing EA. After it was completed, they offered it to The Open Group as a standard.

Gardner: What problems does it solve?

Van den Berg: The problem that it solves is that you need a language to express yourself, just like normal communication. If you want to talk about the enterprise and the important assets in the enterprise, the language supports that conversation.

Gardner: We are talking about more and more angles on this conversation, now that we talk about cloud computing and hybrid computing. It seems as if the complexity of EA and the ability to bring in the business side, provide them with a sense of trust in the IT department, and allow the IT department to better understand the requirements of the business, all need a new language. Do you think it can live up to that?

Van den Berg: Yes, because if you look at other languages, like UML, which is for system development and is a very detailed language, it only covers a very limited part of the complete enterprise. ArchiMate is focused on giving you a language for describing the complete enterprise, from all different angles, not on a detailed level, but on a more global level, which is understandable to the business as well.

Gardner: So more stakeholders can become involved with something like ArchiMate. I guess that's an important benefit here.

Van den Berg: Yes, because the language is not focused only on IT, but on the business as well and on all kinds of stakeholders in your organization.

Gardner: How would someone get started, if they were interested in using ArchiMate to solve some of these problems? What is the typical way in which this becomes actually pragmatic and useful?

Van den Berg: The easiest way is just to start describing your enterprise in terms of ArchiMate. The language forces you to describe it on a certain global level, which gives you direct insight in the coherence within your enterprise.

Gardner: So, this allows you to get a meta-view of processes and assets that are fundamentally in IT, but have implication for and reverberate around the business.

Van den Berg: You don't have to start in IT. You can just start at the business side. What are products? What are services? And, how are they supported by IT? That's a very useful way to start, not from the IT side, but from the business side.

Gardner: Are there certain benefits or capabilities in ArchiMate that would, in fact, allow it to do a good job at defining and capturing what goes on across an extended enterprise, perhaps hybrid sourcing or multiple sourcing of business processes and services?

Van den Berg: It's often used, for example, when you have an outsourcing project to describe not only your internal affairs, but also your relation with other companies and other organizations.

Gardner: What are some next steps with ArchiMate within The Open Group as a standard? Tell us what it might be maturing into or what some of the future steps are.

Van den Berg: The future steps are to align it more with TOGAF, which is the process for EA, and also extending it to cover more elements that are useful to describe an EA.

It's often used, for example, when you have an outsourcing project to describe not only your internal affairs, but also your relation with other companies and other organizations.

Gardner: And for those folks who would like to learn more about ArchiMate and how to get this very interesting view of their processes, business activities, and IT architecture variables where would you go?

Van den Berg: The best place to go is The Open Group website. There is a section on ArchiMate and it gives you all the information.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: David Tang, Global VP, VoSKY Technologies Posted: 16th February 2010 Copyright VoSKY Technologies © 2010

It's funny that some of the most revolutionary technologies are first brought into businesses by individual users, rather than IT departments. Then, when others see the benefits those pioneering users are getting, the technology is quickly adopted company-wide. It happened this way with PC-based fax, then email, and with instant messaging. And it's happening with Skype.

And that's really no surprise. Individuals first embraced Skype because it offered free voice and video calls over the Internet. The adoption rate skyrocketed due to Skype's ease of use and superior voice quality over the public Internet. But now that it operates the world's largest and most reliable Internet communications community, with over 405M registered users, it's also a very attractive infrastructure for business telephony applications. According to Skype, 30% of its users are using Skype for business.

What's more, it complements the communications infrastructure that you already have in place, enabling you to do more with the resources you already have, which is particularly compelling in the current business climate.

So here are five key reasons why corporate IT managers have embraced Skype in their organizations—and how they can deploy and centrally manage it effectively.

It saves—and keeps on saving
Skype isn't just about cost savings—but it's a great benefit nonetheless. It saves your business money on all call costs: national, international, mobile, inter-office, to any user, and it keeps on delivering savings.

With Skype centrally managed in your organisation via PBX-to-Skype gateways you can create global numbering plans, enabling employees to use extension dialling between offices. Site-to-site calls are free, and long-distance calls are handled using SkypeOut to reduce costs. The gateways also centralise Skype provisioning and management, giving IT managers full control and eliminating the need to install Skype on each PC. All Skype voice functions are delivered to users' handsets.

The benefits can also extend to mobile users. With Skype installed on any smart mobile phone that can run the lite version of Skype, the user's call preferences can be set up centrally by the IT team, via the PBX gateway, for alternate routing to the mobile user's Skype account. This is done via mobile broadband under the user's mobile data plan, giving huge savings compared with even the cheapest international mobile tariffs.

It leverages your existing technology
These PBX-to-Skype application gateways can link any office phone system (whether traditional digital switch, or IP / SIP PBX) to Skype, for a low one-time upgrade cost without having to swap out or replace existing equipment. The gateways add anything from 4 to 30 Skype lines to the company PBX, so that Skype calls can be made and transferred between extensions as normal. Employees simply dial 8 for Skype, or 9 for an ordinary line.

None of your investments are made obsolete. You just make your existing assets work harder for your business—and start saving money.

It's easy to manage
The gateways can be installed, and Skype provisioned, in less than half a day, with zero changes to existing PBX equipment, phones, or PCs. The gateway ties the Skype Online number to the business to enable Skype DID. It also simplifies configuration, management and support, putting Skype under the IT manager's full control.

There's no need to install Skype on each PC—Skype usage can be monitored by the business just like ordinary calls, and number schemes easily managed. You set it up and it's under centralised control right away.

Skype is completely free of malware, adware and spyware
So it does not add another potential security threat, or attack vector to your network. How many other corporate networks can say the same?

Skype is encrypted
When Skype users connect, it's over an AES-encrypted session, whether it's via instant message, voice, video, or the sending of files. So Skype communications are secure—giving an advantage over conventional VoIP or voice VPNs.

And of course, with a gateway at each office, you get secure voice VPN working over Skype without paying for expensive leased lines, or having to deploy IP PBXs from the same vendor at every office. That's in addition to the benefits outlined earlier.

So with the cost savings and functionality benefits available to you through Skype usage, what's not to love about it?

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact David Tang (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 15th February 2010 Copyright Interarbor Solutions © 2010

What's the difference between enterprise architecture (EA) and business architecture (BA)? We pose the question to Tim Westbrock, Managing Director of EAdirections, as part of a podcast discussion coming to you from The Open Group’s Enterprise Architecture Practitioners Conference in Seattle, the week of Feb. 1, 2010.

The discussion is moderated by me, Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Gardner: I really enjoyed your presentation today. Can you tell us a little bit about some of the high-level takeaways. Principally, how do you define BA?

Westbrock: Well, the premise of my discussion today is that, in order for EA to maintain and continue to evolve, we have to go outside the domain of IT. Hence, the conversation about BA. To me, BA is an intrinsic component of EA, but what most people really perform in most organizations that I see is IT architecture.

A real business-owned enterprise business architecture and enterprise information architecture are really the differentiating factors for me. I'm not one of these guys that is straight about definitions. You’ve got to get a sense from the words that you use.

To me enterprise business architecture is a set of artifacts and methods that helps business leaders make decisions about direction and communicate the changes that are required in order to achieve that vision.

Gardner: How do we get here? What's been the progression? And, why has there been such a gulf between what the IT people eat, sleep, and drink, and what the business people expect?

Westbrock: There are a lot of factors in that. Back in the late '80s and early '90s, we got really good at providing solutions really quickly in isolated spots. What happened in most organizations is that you had really good isolated solutions all over the place. Integrated? No. Was there a need to integrate? Eventually. And, that's when we began really piling up the complexity.

We went from an environment, where we had one main vendor or two main vendors, to every specific solution having multiple vendors contributing to the software and the hardware environment.

That complexity is something that the business doesn’t really understand, and we haven’t done a real good job of getting the business to understand the implications of that complexity. But, it's not something they should really be worried about. It's our excuse sometimes that it's too complex to change quickly.

Focus on capabilities
We really need to focus the conversation on capabilities. Part of my presentation talked about deriving capabilities as the next layer of abstraction down from business strategy, business outcomes, and business objectives. It's a more finite discussion of the real changes that have to happen in an organization, to the channel, to the marketing approach, to the skill mix, and to the compensation. They're real things that have to change for an organization to achieve its strategies.

In IT architecture, we talk about the changes in the systems. What are the changes in the data? What are the changes in the infrastructure? Those are capabilities that need to change as well. But, we don't need to talk about the details of that. We need to understand the capabilities that the business requires. So, we talk to folks a lot about understanding capabilities and deriving them from business direction.

Gardner: It seems to me that, over the past 20 or 30 years, the pace of IT technological change was very rapid -- business change, not so much. But now, it seems as if the technology change is not quite as fast, but the business change is. Is that a fair characterization?

Westbrock: It's unbelievably fast now. It amazes me when I come across an organization now that's surviving and they can't get a new product out the door in less than a year -- 18 months, 24 months. How in a world are they responding to what their customers are looking for, if it takes that long to get system changes products out the door?

BA is a means by which we can engage as IT professionals with the business leadership, the business decision-makers who are really deciding how the business is going to change.

We're looking at organizations trying monthly, every six weeks, every two months, quarterly to get significant product system changes out the door in production. You've got to be able to respond that quickly.

Gardner: So, in the past, the IT people had to really adapt and change to the technology that was so rapidly shifting around them, but now the IT people need to think about the rapidly shifting business environment around them.

Westbrock: "Think about," yes, but not "figure out." That's the whole point. BA is a means by which we can engage as IT professionals with the business leadership, the business decision-makers who are really deciding how the business is going to change.

Some of that change is a natural response to government regulations, competitive pressures, political pressures, and demographics, but some of it is strategic, conscious decisions, and there are implications and dependencies that come along with that.

Sometimes, the businesses are aware of them and sometimes they're not. Sometimes, we understand as IT professionals -- some not all -- about those dependencies and those implications. By having that meaningful dialogue on an ongoing basis, not just as a result of the big implementation, we can start to shorten that time to market.

Gardner: So, the folks who are practitioners of BA, rather than more narrowly EA, have to fill this role of Rosetta Stone in the organization. They have to translate cultural frames of mind and ideas about the priorities between that IT side and the business side.

Understanding your audience
Westbrock: This isn't a technical skill, but understanding your audience is a big part of doing this. We like to joke about executives being ADD and not really being into the details, but you know what, some are. We've got to figure out the right way to communicate with this set of leadership that's really steering the course for our enterprise.

That's why there's no, "This is the artifact to create." There's no, "This is the type of information that they require." There is no, "This is the specific set of requirements to discuss."

That's why we like to start broad. Can you build the picture of the enterprise on one page and have conversations maybe that zero in on a particular part of that? Then, you go down to other levels of detail. But, you don't know that until you start having the conversation.

Gardner: Okay, as we close out, you mentioned something called "strategic capability changes." Explain that for us?

. . . There's a missing linkage between that vision, that strategy, that direction, and the actual activities that are going on in an organization.

Westbrock: To me, so many organizations have great vision and strategy. It comes from their leadership. They understand it. They think about it. But, there's a missing linkage between that vision, that strategy, that direction, and the actual activities that are going on in an organization. Decisions are being made about who to hire, the kinds of projects we decide to invest in, and where we're going to build our next manufacturing facility. All those are real decisions and real activities that are going on on a daily basis.

This jump from high-level strategy down to tactical daily decision-making and activities is too broad of a gap. So, we talk about strategic capability changes as being the vehicle that folks can use to have that conversation and to bring that discussion down to another level.

When we talk about strategic capability changes, it's the answer to the question, "What capabilities do we need to change about our enterprise in order to achieve our strategy?" But, that's a little bit too high level still. So, we help people carve out the specific questions that you would ask about business capability changes, about information capability changes, system, and technology.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: V Bharathwaj, CMO, 24/7 Customer Posted: 15th February 2010 Copyright 24/7 Customer © 2010

Are opinions on social media a lead indicator for CSAT? Absolutely yes.

With millions of opinions expressed on social media sites, such as Twitter and Facebook, it has become a reality today. For example, we analyse tweets about several companies through 247tweetview and when we compare the sentiments expressed by consumers with the end customer CSAT for our clients there is a clear pattern. Companies do not need to wait for a survey to be done/analysed and then figure out whether their CSAT scores are good or bad. The moment of truth is happening every minute/every day.

Take the following as an indicator. On an average, CSAT survey responses are between 1%–1.5%. For a company that has a million contacts every month, this would be around 10,000 responses in a month. On the other hand a company with a similar contact base would receive anywhere between 50,000 to 60,000 tweets every month.

Even if one discounts 50% of this, it is still a threefold volume in terms of direct voice of customer inputs. And this is only from one source in social media. Compound this with other social media sites and the level of insights one can get from social media cannot be ignored. This does not mean that CSAT surveys are redundant. It only means that CSAT surveys should be seen in conjunction with the opinions expressed in social media. And it will not be long before social media starts driving a redesign of CSAT surveys.

Companies need to start thinking about this as part of their customer service and social media strategy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact V Bharathwaj (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 15th February 2010 Copyright Bloor Research © 2010

For hundreds of years we have been recording, collecting, distributing and storing information using pen and paper; this extends to thousands of years if we include making marks on paper/papyrus or clay tablets. It is only in my lifetime that we have been able to use digital technology for these purposes. The advantages of digital over the pen are numerous and obvious, I leave it to my reader to make their own list. However, in our rush towards the benefits of digital we may have ignored and overlooked the continuing benefits of pen and paper.

This was brought home to me when I saw a presentation by Anoto of their digital pen. The pen looks like a normal ball point and writes on normal paper so has the advantages of paper; however, some very clever technology captures all the marks the pen makes and these can be uploaded later.

Let me list a few of the benefits of this hybrid solution:

• Paper is a physical medium that can be read by most people without any technology. My apologies to anyone with a severe visual impairment when this is not the case. There are various situations where this can be important:
  • Legal documents often require the physical paper and signature.
  • A physical receipt is convenient at the end of a transaction.
  • More interestingly is the example of a care worker who goes into a person's home, a paper record of all the visits can be left so the patient or anyone else who is interested can see the record. Whilst a digital version is stored in the pen for later processing.
• Paper and pen are inexpensive in comparison to a PDA or laptop.
  • This is important where loss or theft is a major problem, such as drug rehabilitation centres.
  • It also allows the distribution of the technology to larger groups of users such as people collecting for charity.
• Paper is light and robust and can be used in challenging surroundings:
  • Inspectors of both buildings and lifeboats use them in situations where electronic technology would get in the way of the job.
• Filling out a paper form is a common experience and therefore it is socially acceptable to do it during an interview. A laptop or PDA can put up a barrier either because the interviewee is not used to the technology or because they cannot see what is being written. The paper can easily be shared with either person filling in parts with very fast verification.
• The pen has a very low energy requirement so can be used when power is not readily or easily available.
  • Collecting information in the jungle.
  • Recording information in a disaster zone.
  • Just being away from base office for a day or two.
• Existing forms can continue to be used so requiring no training for the operative. The data collected electronically will be more accurate and available faster.
  • For example patients can be monitored on a regular basis and the information fed back to a central office for analysis and any changes can be recognised and appropriate action taken.
  • A calendar of cleaning in toilets can continue to be used with the information being available to the users who read the calendar, but also to the management on a regular basis.

Although this looks like a low-tech solution the technology behind it is clever. Basically any piece of paper that is to be used has a matrix of tiny dots printed on it (this can be done using a normal 600dpi printer) as well as the form itself. The pattern of dots is unique for each piece of paper printed and each small area on the paper. So the pen can immediately record the time and date, what piece of paper, where on the paper, as well as pressure and direction.

This information can be sent to a computer through a USB connection or Bluetooth and a mobile phone. Once at the computer the form can be recreated to look exactly like the original, and information can be digitised for further processing.

There is an alternative way of using this technology. Devices are available that will recognise what they are pointing at and replay a relevant mp3 file. This has been used for childrens' books; the child points at the book and the device reads out the relevant text or makes a suitable sound to go with the picture. It can also be used for labels on items for people with vision impairment or people who understand another language.

This technology shows that paper can continue to be the medium of choice for many applications. Providing inexpensive, low-tech, friendly, usable and robust solutions.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Peter Abrahams (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 12th February 2010 Copyright Interarbor Solutions © 2010

This event podcast discussion comes to you from The Open Group’s Enterprise Architecture Practitioners Conference in Seattle, the week of Feb. 1, 2010.

We examine the definition of enterprise architecture (EA), the role of the architect and how that might be shifting with an expert from the Open Group, Len Fehskens, Vice President of Skills and Capabilities. The interview is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Gardner: I was really intrigued by your presentation, talking, with a great deal of forethought obviously, about the whole notion of EA, the role of the architect, this notion of "fit for purpose." We want to have the fit-for-purpose discussion about EA. What are the essential characteristics of this new definition?

Fehskens: You'll remember that one of the things I hoped to do with this definition was understand the architecture of architecture, and that the definition would basically be the architecture of architecture. The meme, so to speak, for this definition is the idea that architecture is about three things: mission, solution, and environment. Both the mission and the solution exist in the environment, and the purpose of the architecture is to specify essentials that address fitness for purpose.

There are basically five words or phrases; mission, solution, environment, fitness for purpose, and essentials. Those capture all the ideas behind the definition of architecture.

Gardner: The whole notion of EA has been in works for 30 years, as you pointed out. What is it about right now in the maturity of IT and the importance of IT in modern business that makes this concept of enterprise architect so important?

Fehskens: A lot of practicing enterprise architects have realized that they can't do enterprise IT architecture in isolation anymore. The constant mantra is "business-IT alignment." In order to achieve business-IT alignment, architects need some way of understanding what the business is really about. So, coming from an architectural perspective, it becomes natural to think of specifying the business in architectural terms.

Enterprise architects are now talking more frequently about the idea of "business architecture." The question becomes, "What do we really mean by business architecture?" We keep saying that it's the stakeholders who really define what's going on. We need to talk to business people to understand what the business architecture is, but the business people don't want to talk tech-speak.

We need to be able to talk to them in their language, but addressing an architectural end. What I tried to do was come up with a definition of architecture and EA that wasn't in tech-speak. That would allow business people to relate to concepts that make sense in their domain. At the same time, it would provide the kind of information that architects are looking for in understanding what the architecture of the business is, so that they can develop an EA that supports the needs of the business.

Gardner: So, in addition to defining EA properly for this time and place, and with the hindsight of the legacy, development, and history of IT and now business, what is the special sauce for a person to be able to fill that role? It’s not just about the definition, but it's also about the pragmatic analog world, day-in and day-out skills and capabilities.

Borrowed skills
Fehskens: That's a really good question. I've had this conversation with a lot of architects, and we all pretty much agree that maybe 90 percent of what an architect does involves skills that are borrowed from other disciplines—program management, project management, governance, risk management, all the technology stuff, social skills, consulting skills, presentation skills, communication skills, and all of that stuff.

But, even if you’ve assembled all of those skills in a single individual, there is still something that an architect has to be able to do to take advantage of those capabilities and actually do architecture and deliver on the needs of their clients or their stakeholders.

I don't think we really understand yet exactly what that thing is. We’ve been okay so far, because people who entered the discipline have been largely self-selecting. I got into it because I wanted to solve problems bigger than I could solve myself by writing all code. I was interested in having a larger impact then I could just writing a single program or doing something that was something that I could do all by myself.

That way, we filter out people who try to become architects. Then, there's a second filter that applies: if you don't do it well, people don't let you do it. We're now at the point where people are saying, "That model for finding, selecting, and growing architects isn't going to work anymore, and we need to be more proactive in producing and grooming architects." So, what is it that distinguishes the people who have that skill from the people who don't?

If you go back to the definition of architecture that I articulated in this talk, one of the things that becomes clear is that an architect not only has to have good design skills. An architect also has to be almost Sherlock Holmes-like in his ability to infer from all kinds of subtle signals about what really matters, what's really important to the stakeholders, and how to balance all of these different things in a way that ends up focusing on an answer to this very squishily, ill-defined statement of the problem.

This person, this individual, needs to have that sense of the big picture—all of the moving parts—but also needs to be able to drill in both at the technical detail and the human detail.

In fact, this notion of fitness for purpose comes back in. As I said before, an architect has to be able to figure out what matters, not only in the development of an architectural solution to a problem, but in the process of discerning that architecture. There's an old saw about a sculptor. Somebody asked him, "How did you design this beautiful sculpture," and he says, "I didn't. I just released it from the stone."

What a good architect does is very similar to that. The answer is in there. All you have to is find it. In some respects, it's not so much a creative discipline, as much as it's an exploratory or searching kind of discipline. You have to know where to look. You have to know which questions to ask and how to interpret the answers to them.

Rarely done
Gardner: One of the things that came out early in your presentation was this notion that architecture is talked about and focused on, but very rarely actually done. If it's the case in the real world that there is less architecture being done than we would think is necessary, why do it at all?

Fehskens: There's a lot of stuff being done that is called architecture. A lot of that work, even if it's not purely architecture in the sense that I've defined architecture, is still a good enough approximation so that people are getting their problems solved.

What we're looking for now, as we aspire to professionalize the discipline, is to get to the point where we can do that more efficiently, more effectively, get there faster, and not waste time on stuff that doesn't really matter.

I'm reminded of the place medicine was 100 or 150 years ago. I hate to give leeches a bad name, because we’ve actually discovered that they're really useful in some medical situations. But, there was trepanning, where they cut holes in a person's skull to release vapors, and things like that. A lot of what we are doing in architecture is similar.

What we want to do is get better at that, so that we pick the right things to do in the right situations, and the odds of them actually working are much higher than better than chance.

We do stuff because it's the state of the art and other people have tried it. Sometimes, it works and sometimes, it doesn't. What we want to do is get better at that, so that we pick the right things to do in the right situations, and the odds of them actually working are much higher than better than chance.

Gardner: Okay, a last question. Is there anything about this economic environment and the interest in cloud computing and various sourcing options and alternatives that make the architecture role all the more important?

Fehskens: I hate to give you the typical architect signature which is, "Yes, but." Yes, but I don't think that's a causal a relationship. It's sort of a coincidence. In many respects, architecture is the last frontier. It's the thing that's ultimately going to determine whether or not an organization will survive in an extremely dynamic environment. New technologies like cloud are just the latest example of that environment changing radically.

It isn't so much that cloud computing makes good EA necessary, as much as cloud computing is just the latest example of changes in the external environment that require organizations to have enterprise architects to make sure that the organization is always fit for purpose in an extremely dynamically changing environment.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 11th February 2010 Copyright Interarbor Solutions © 2010

Welcome to a special BriefingsDirect podcast presentation, Real-Time Web Data Services in Action at Deutsche Börse.

As the culmination of a four-part series on web data services (WDS), we examine a fascinating use-case for data services with Deutsche Börse Group in Frankfurt, Germany. An innovative information service, recently created there, highlights how real-time content and data assembled from various online sources scattered across the Web provides a valuable analysis service.

The offering supports energy traders seeking to track global fluctuations and micro trends in oil and other related markets. But the need for real-time and precise data affects more than energy traders and financial professionals. More than ever, all sorts of businesses need to know what's going on in and what's being said about their respective markets, products, and services.

In this series with Kapow Technologies, we've examined the need for WDS and ways that WDS and related tools can be used broadly to solve these problems. Now, we are going to learn the full story of how Deutsche Börse took web data resources, and not only efficiently assembled knowledge from automated robots, cleansing tools, and analytics management, but from these capabilities they also created high value and focused WDS offerings onto itself.

Thanks for joining us, as we take an in-depth look at how the market for WDS has shaped up and then hear directly from the leader of the Deutsche Börse project, as well as from a key supplier that supported them in accomplishing their web services goal.

So, to learn more about WDS as a business, please welcome our guests, Mario Schultz, director of Energy Facts at Deutsche Börse Group, and Stefan Andreasen, CTO at Kapow Technologies. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Gardner: It's interesting to me that we've moved beyond a level of static information to dynamic information and yet we still haven’t taken full advantage of everything that’s being developed and created across the Web.

But today’s market turbulence demands that we do that. We have to move into an era where we can take quality data and provide agility into how we can consume and distribute it. We're dealing with more diverse data sources. That means we need to have completeness and we need to be comprehensive, in order to accomplish the business information challenges each business faces.

The need now is for flexible, agile, and mixed sourcing of services and data together. The content is often portable. That means it's ubiquitous across mobile devices and social networks in such a way that real-time analytics becomes extremely important.

The use of data as a business is now coming to the fore. We're beginning to see value, not from just the assimilation of data for use internally, but as more and more businesses are starting to take advantage of the data that they create and have access to. They share that with their partners, create ecosystems of value, and then even perhaps sell outright the information, as well as insights and analysis from that information.

Schultz: Deutsche Börse is the German stock exchange in Frankfurt, Germany, and we offer all kinds of products and services around on-exchange trading and the adjacent processes. For several years now, I've been responsible for developing new products and services around information for on-exchange or off-exchange trading. This is why we've invented and developed the Energy Facts service.

We developed new products and services where we could transform our know-how and this real-time connection, aggregation, and dissemination of data to other business lines. This is why we looked into the energy trading sector, mainly focused on the power trading here in Europe.

I began by working on the exchange of information that we have in our own systems. We were proceeding with our ideas of enhancing our services and designing new products and services. We were then looking into the Web and trying to get more information from the data that we gather from websites -- or somewhere else on the global Web -- and to integrate this with our own company's internal information.

Everything we do focuses on the real-time aspect. Our use of web data services is always focusing on the real-time aspects of this.

At Deutsche Börse, we have something that’s called Xetra, our electronic trading system for cash products. We have Eurex, our derivative business line, which is worldwide, well-known, where you can trade other derivatives on that platform.

We have a main system called CEF. It is our backbone IT solution for delivering data in real-time with milliseconds optimization. The data is mainly coming from our internal IT systems, like Xetra and Eurex, and we deliver this data to the outside world.

In addition, we calculate all the relevant indices, like the DAX, the flagship index for the German markets with 30 instruments, and more than 2,000—or nearly 3,000—indices that are distributed over the well-known data vendors, for example, Bloomberg or Reuters. They are our main distribution networks, where we are delivering all our information.

Germany is currently the most important market for energy and power trading in the middle of Europe.

By talking to well-known players in the market, we quickly recognized that we could build up very powerful and fundamental data models. You have to collect all the relevant information to get an overview and to get an estimate about the price, in this case, where power could develop and in which direction it could develop.

Traders are looking into the fundamental factors that affect the price of the energy or the power that you trade, whether it’s oil or whatever. That’s how we started with power trading. You have the wind and other weather factors. You have temperature. You have the availability of power plants. So, you try to categorize and summarize these sectors. It's called the supply and the demand side regarding this energy trading.

Fundamental data models
The main issue and main task in the beginning was to collect the relevant data. Quite quickly, we were able to set up a big list of all relevant data sets or sources, especially for Germany and some adjacent countries. We came up with something around 70, 80, or even 100 different sources on the Web to grab information from. So, the main issue was how to collect and grab all this data in a manageable way into one data base. That was the first step.

In the second step, Kapow came into this play. We recognized that it’s really important to have a one-stop shopping inbound channel that collects all the information from these sources, so that you don’t have to have have several IT systems, or your own program, JavaScript, or whatever to get the information.

I wanted to have a responsible product manager for this project or for this new product. From the beginning, I had to have a good technology in place that would be able to handle all these kind of sources from the Web.

We recognized that there are so many different data formats that we had to grab. There are all these different providers of information in Germany and other European countries. They have their own websites. Some give the data in HTML format. Others use XLS, CSV, or even PDFs.

Kapow tells us how to get this information from these different sources in quite different formats. This is a manageable way, with a process-driven or graphical user interface (GUI) driven tool, that would use the effort, the personal, the manpower efforts to collect and grab the data.

Not only websites
Currently, we have 70 or 80 sources that we're grabbing. It's not only websites, but we have some third-party providers that are delivering information, for example, weather, temperature, and things like that. We have providers giving data via FTP service, and we even use Kapow for grabbing data from these third-party players. As I said, it's a one-stop shopping solution to get everything via one channel.

The value-add was to grab all this data into one common data format, one database, so we would be able to deliver this data to the vendors via web tool, web terminal, or even our existing CEF data feeds. A lot of the players in the market are trying to collect this data by themselves, or even manually, to get an overview of where the power price would develop over the next day, hours, weeks, months, whatever.

Andreasen: This is an extremely impressive service that Mario just showed us here, and I'm sure, if you're dealing with buying and selling energy, this is a must for you to be sure you made the right decision.

If these data sources exist somewhere on the Web, we can actually grab them where they are. What you traditionally do with information gathering is that you call every company or every entity that has data and ask them, "Will you please provide the data in this or this format?" But, with Kapow Web Data Services, you can just grab the data, wherever it is on the Web, and assemble this valuable data source much easier and much faster.

Businesses are relying more and more on data to make the right decision, and their focus is on quality, completeness, and agility. Let's be more practical here and ask how you actually get this data.

There is a term, data integration, which is about accessing the data and providing it in a standard API, so that you can actually leverage the measure of business application.

Energy Facts is accessing this data at the 70–80 different data sources, as Mario said, and providing it as a feed that depends on the volatility of the different data sources. Some of the data delivers every minute, and some deliver every four hours, etc., based on how quickly the data source changes. WDS is all about getting access to this data where it resides.

There are really two different kinds of data sources. One set of data sources is more like a real-time source data source. Let's say you go to a patent directory, and there are probably millions of patents. In that case you would use Kapow Data Server to wrap that data source into a service layer, and then you would be able to do real-time, as soon as you get real-time results back. So, that's real-time access, where you have vast amount of information.

Actually, all styles exist, but there is a tendency for many companies to actually access the data where it is, rather than trying to consolidate it to a new place.

The other scenario, and I think that's more what we see in the Energy Facts example here, is where you have a more limited data source, and you are actually trying to do a consolidation of the data into a database, and then you use that database to serve different customers or different applications.

With Kapow, you can actually go in and access the data, if you can see them on your browser. That's one thing. The other thing you need to do to make this data available to your business application is to transform and enrich the data, so that it actually matches the format that you want.

For example, on the website, it might have the date saying, "2 hours ago" or "3 minutes ago" and so on. That's really not useful. What you really want is a time stamp with the hour, the second, the minute, the months, the day, the year, so you can actually start comparing these. So, data cleansing is an extremely important part of data extraction and access.

The last thing, of course, is serving the data in the format you need. That can be a database, if you're doing consolidation, or it can be as an API, if you are doing more of a federated access to data, and leaving the data where it is.

More examples on data as a service
Go to our website and download a white paper from one of our customers, called Fiserv. It's a large financial services company in the U.S. Fiserv has a lot of business partners, actually they have more than 300 banks in more than 10 countries as business partners. Because they're selling services, it's incredibly important for them to also monitor their customers to understand what's happening.

They had a lot of people who logged into these 300 partner banks every day and grabbed some financial information, such as interest rates, etc., into an Excel spreadsheet, put it into a database, and then got it up on a dashboard.

The thing about this is that, first, you have a lot of human labor, which can cause human errors, and so on. You can only do it once a day, and it's a tedious process. So what they did is got Kapow in and automated the extraction of this data from all their business partners—300 banks in more than 10 countries.

They can now get that data in near real-time, so they don’t have to wait for data. They don’t have to go without on the weekend, because people are not working. They get that very business critical insights to the market and their partners instantly through our product.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download the transcript.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Clay Ryder, President, Sageza Group, Inc. Posted: 11th February 2010 Copyright Sageza Group, Inc. © 2010

IBM has announced its latest generation of its Power-based servers, the new POWER7 system, which is designed to manage demanding emerging applications such as smart electrical grids and realtime analytics for financial markets, which rely on processing an enormous number of concurrent transactions and data while analyzing that information in real time. The new systems enable clients to manage applications and services at lower cost through technology breakthroughs in virtualization, energy savings, more cost-efficient use of memory, and price performance.

The new systems and management software announced include:

• IBM Power 780, a new category of scalable, high-end servers, featuring an advanced modular design with up to 64 POWER7 cores, and the new TurboCore workload optimizing mode. TurboCore can deliver up to two times the per-core performance of POWER6-based systems.
• IBM Power 770, a modular enterprise system with up to 64 POWER7 cores, featuring higher per-core performance over POWER6 processors while using up to 70% less energy for the same number of cores as in the IBM Power 570.
• IBM Power 755, a high-performance computing cluster node with 32 POWER7 cores that is Energy Star qualified.
• IBM Power 750 Express, an Energy Star qualified server targeting mid-market organizations by offering four times the processing capacity of its predecessor, the IBM Power 550 Express, in the same energy envelope.
• IBM Systems Director Express, Standard, and Enterprise Editions, which offer newly simplified packaging of management software including the advanced virtualization management capabilities of VMControl. VMControl permits the management of multiple Power servers as one entity, which can reduce management cost and complexity.

The company also indicated that it has significantly increased the parallel processing capabilities of POWER7 systems across both hardware and software in order to support managing the millions of concurrent transactions in transaction processing and database workloads as well as delivering “throughput” computing, that is optimized for running massive Internet workloads.

Availability: The Power 750 Express and 755 planned volume ship date is February 19 and the Power 770 and 780 planned volume availability is March 16. The IBM Systems Director Editions, supporting both POWER7 and POWER6 models, planned availability is March 5.

Net/Net: The sheer size of this announcement cannot be underestimated; just one glance at the press release shows a litany of technology and product detail that is not easily dismissed as “just another upgrade.” The announcement of POWER7 is much more than a bigger, better, cheaper POWER6, even though there are numerous technological achievements to challenge even the most technically adroit. But despite all this technical celebration, the overall positioning of POWER7 is that the latest and greatest POWER systems are focused on meeting the needs of business through enhanced financial, not technical, performance. What irony.

To adequately discuss all of the technical achievement of POWER7 would take far more than this forum permits; however, there are a few items which we believe illustrate why POWER7 should prove appealing to its target market. These are the number of cores and the degree of multithreading delivered by the POWER7, improvement in energy efficiency, the holistic solutions focus afforded by IBM, and an overall market message about financial/business efficiency.

The new POWER7 processor has eight cores with four threads each, which is 4x the maximum number of cores in POWER6 systems and 8x the number of threads per chip. With the TurboCore mode, four cores are deemed active and most of the resources backing all eight cores are put behind the four active cores thus increasing the cache and memory bandwidth, and allowing the clock speed to be increased, which can result in significant per-core performance gains. From a purely computational and transaction processing perspective, this achievement of POWER7 is admirable. However, this is only part of the story.

Through POWER7’s Intelligent Energy technology, organizations can power up or shut down various sections of the server as well as dynamically adjust processor clock speeds based on thermal conditions and system utilization, on a single server or across a pool of multiple servers. The integration of energy management spanning the processor, firmware, PowerVM virtualization, OS, up through IBM Active Energy Manager Software (included in Systems Director Standard and Enterprise Editions) allows organizations to tune not only their systems performance and overall energy usage but also the specific price/performance yield of each processor and, by extension, applications supported by each processor. This degree of energy management flexibility illustrates the energy efficiency on a performance per-watt basis afforded by the POWER7 over competitive platforms such as x86, SPARC, and Itanium-based solutions.

In the press release, IBM stated that the new POWER7 systems can manage millions of realtime transactions and analyze the associated volumes of data typical of emerging applications such as the smart electrical grid. This is an interesting for a couple of reasons. While there has been an increasing focus on improved energy efficiency in the datacenter, the reality is that improved energy efficiency across the board would benefit not only data centers, but any business or consumer connected to the grid, as each pays to support the considerable overhead involved in the creation, management, and delivery of electricity. Unlike the historic grid, where control and reporting points are limited and their data only accessible to the system operator, the smart grid requires realtime data from orders of magnitude more data points, all of which needs to collected, analyzed, and reported not only to the system operator, but to the entire customer base as well. A major utility moving to a smart grid pilot could go from processing less than one million meter reads per day to tens of millions meter reads per day in a smart grid.

Being able to collect, analyze, and execute on the volume of information inherent in a smart grid would allow a utility to achieve a higher utilization of its generation, distribution, and billing assets. It would also permit more flexibility in determining which assets would be pressed into service; given each has unique price/performance characteristics. However, when one stops to think about it, this quest for utilization and efficiency is shared by most any organization. Achieving the maximum utilization and hence leverage of corporate resources is all about achieving maximum ROI. The notion of the Smarter Planet intersects with the Smarter Pocketbook and for more than just those who are deploying smart grids or financial marketplaces.

In order to thrive, not just survive, in the new economic reality of the 2010s, organizations of all stripes will have to maximize their efficiency on several fronts. A Smarter Planet that drives more data collection and information generation will challenge organizations to respond to market forces more rapidly than ever before. At the same time, the potential for more closely matching supply with demand, cost with revenue, etc. has never been greater, in turn providing the opportunity for new-found business efficiency. This is where the efficiency theme of the POWER7 resonates so very well.

Through TurboCore mode, clever organizations could maximize their ROI on software licenses that are charged on a per-core basis. An organization could turbocharge the core to get more performance, yet maintain, or even possibly reduce, the number of cores licensed in order to support the application’s users. With POWER7’s ability to support ten virtual machines per core, the number of servers made available per IT management professional could rise substantially and these servers would be more energy efficient than in the past. While each of these examples is made possible due to a technical improvement, the real value is in the business and financial improvement that the technology offers.

Overall, we are impressed by the technical and business acumen demonstrated by IBM in its latest POWER systems offerings. The technology is impressive and serves notice that the venerable Power architecture is not at all in danger of becoming a stagnating dinosaur any time soon. But more impressive is how Big Blue has wrapped this technological achievement into a much larger and more sophisticated narrative about achieving more with less, and positioning financial efficiency on an even footing with energy efficiency and hardware utilization. In addition, IBM has done this on a sliding scale with solutions that are appropriate for the mid market while scaling up to enterprise class solutions and beyond. While the march of technological advancement will continue to amaze even the most jaded onlooker, the challenge for vendors is how to capture the mindset of their customers and unequivocally demonstrate how their customers’ technology investments will drive business performance and ultimately financial success. To our way of thinking, Smarter Planet, holistic systems management, and POWER7 are great examples of this in action.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Clay Ryder (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 9th February 2010 Copyright Interarbor Solutions © 2010

The latest BriefingsDirect Analyst Insights Edition, Volume 50, focuses on the fallout from the Google’s threat to pull out of China, due to a series of sophisticated hacks and attacks on Google, as well as a dozen more IT companies. Due to the attacks late last year, Google on Jan. 12 vowed to stop censoring Internet content for China’s web users and possibly to leave the country altogether.

This ongoing tiff between Google and the Internet control authorities in China’s Communist Party-dominated government have uncorked a Pandora’s Box of security, free speech and corporate espionage issues. There are human rights issues and free speech issues, questions on China’s actual role, trade and fairness issues, and the point about Google’s policy of initially enabling Internet censorship and now apparently backtracking.

But there are also larger issues around security and Internet governance in general. Those are the issues we’ll be focusing on today. So, even as the U.S. State Department and others in the U.S. federal government seek answers on China’s purported role or complicity in the attacks, the repercussions on cloud computing and enterprise security are profound and may be long-term.

We’re going to look at some of the answers to what this donnybrook means for how enterprises should best protect their intellectual property from such sophisticated hackers as government, military or, quasi-government corporate entities and whether cloud services providers like Google are better than your average enterprise, or especially medium-sized business, at thwarting such risks.

We'll look at how users of cloud computing should trust or not trust providers of such mission-critical cloud services as email, calendar, word processing, document storage, databases, and applications hosting. And we’ll look at how enterprise architecture, governance, security best practices, standards, and skills need to adapt still to meet these new requirements from insidious world-class threats.

So, join me now in welcoming our panel for today’s discussion: Jim Kobielus, senior analyst at Forrester Research; Jason Bloomberg, managing partner at ZapThink; Jim Hietala, Vice President for Security at The Open Group; Elinor Mills, senior writer at CNET, and Michael Dortch, Director of Research at Focus. The discussion is moderated by BriefingsDirect's Dana Gardner, principal analyst at Interarbor Solutions. [Disclosure: The Open Group is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:

Mills: We now have a huge first public example of a company coming out and saying, not only that they've been attacked—companies don’t want to admit that ever and it’s all under the radar—but also they’re pointing the fingers. Even though they're not specifically saying, "We think it’s the Chinese state," but they think enough of it that they're willing to threaten to pull out of the country.

It’s huge and it’s going to have every company reevaluating what their response is going to be—not just how they’re going to do business in other countries, but what is their response going to be to a major attack.

Bloomberg: It’s not as big of a wakeup call as it should be. You can ask yourself, "Is this an attack by some small cadre of renegade hackers or is this attack by the government of the People’s Republic of China? That’s an open question at this point.

Who is the victim? Is it Google, a corporation, or the United States? Is it the western world that is the victim here? Is this a harbinger of the way that international wars are going to be fought down the road?

We’ve all been worried about cyber warfare coming, but we maybe don’t recognize it when we see it as a new battlefield. It's the same as terrorism. It’s not necessarily clear who the participants are.

When you place the enterprise into this context, well, it’s not necessarily just that you have a business within the context of a government subject to particular laws of particular government, you have the supernational, where large corporations have to play in multiple jurisdictions. That’s already a governance challenge for these large enterprises.

We already have this awareness that every single system on our network has to look out for itself and, even then, has levels of vulnerability.

Now, we have the introduction of cyber warfare, where we have concerted professional attacks from unknown parties attacking unknown targets and where it’s not clear who the players are. Anybody, whether it’s a private company, a public company, or a government organization is potentially involved.

That basically raises the bar for security throughout the entire organization. We’ve seen this already, where perimeter-based security has fallen by the wayside as being insufficient. We already have this awareness that every single system on our network has to look out for itself and, even then, has levels of vulnerability. This just takes it to the national level.

Kobielus: I don’t see anything radically or fundamentally new going on here. This is just a big, powerful, and growing world power, China, and a big and growing world power on a tech front Google, colliding. ... There has always been corporate espionage and there’s always been vandalism perpetrated by companies against each other through subterfuge, and also by companies or fronts operating as the agent of unseen foreign power. ... This is international real-politic as usual, but in a different technological realm.

Hietala: In terms of the visibility it’s gotten and the kinds of companies that were attacked, it’s a little bit game-changing. From the information security community perspective, these sorts of attacks have been going on for quite a while, aimed at defense contractors, and are now aimed at commercial enterprises and providers of cloud services.

I don’t think that the attacks per se are game-changing. There’s not a lot new here. It’s an attack against a browser that was couple of revs old and had vulnerability. The way in which the company was attacked isn’t necessarily game-changing, but the political ramifications around it and the other things we’ve just been talking about are what make it a little game-changing.

Dortch: This puts Google in the very interesting position of having to decide. Is it a politically neutral corporation or is it a protector of the data that its clients around the world, not just here, and not just from governments but corporations? Is it a protector and an advocate of protection for the data that those clients have been trusted to it? Or, is it going to use the fact that it is a broker of all that data to sort of throw its muscle around and take on governments like China’s in debates like this.

The implications here are bigger than even what we’ve been discussing so far, because they get at the very nature of what a corporation is in this brave new network world of ours.

Gardner: This boils down to almost two giant systems or schools of thought that are now colliding at a new point. They've collided at different points in the past on physical sovereignty, military sovereignty, and economic sovereignty. The competition is between what we might call free enterprise based systems and state sponsorship through centralized control systems.

Free enterprise won, when it came to the cold war, but it's hard to say what's going to happen in the economic environment where China is a different beast. It's state sponsored and it's also taking advantage of free enterprise, but it's very choosy about what it allows for either one of those systems to do or to dominate.

When you look at Google, Google made itself into a figurehead of representing what a free enterprise approach could do. It's not state sponsored or nationalistic. It's corporate sponsored. So, it would be interesting to see who has the better technology, who has the better financial resources, and ultimately who has the organizational wherewithal to manifest their goals online that wins out in the marketplace.

If an organized effort is better at doing this than a corporate one, well then they might dominate. But so far, we've seen a very complex system that the marketplace—with choice, and shedding light and transparency on activities—ultimately allows for free enterprise predominance. They can do it better, faster, cheaper and that it will ultimately win.

I think, we're really on the cusp here of a new level of competition, but not between countries or even alliances, but really between systems. The free enterprise system versus the state-sponsored or the centralized or the controlled system. It should be very interesting.

Bloomberg: ... If anything, cloud environments reduce the level of security.

They don’t increase it for the very reason that we don’t have a way of making them sovereign in their own right. They’re always not only subject to the laws of the local jurisdiction, but they’re subject to any number of different attacks that could be coming from any different location, where now the customers aren’t aware of this sort of vulnerability.

So, “Trust, but verify,” is a good point, but how can you verify, if you’re relying on a third party to protect your data for you? It becomes much more difficult to do the verification. I'd say that organizations are going to be backing away from cloud, once they realize just how risky cloud environments are.

Mills: Microsoft’s general counsel Brad Smith recently gave a keynote at the Brookings Institute Forum, and he talked about modernizing and updating the laws to adapt specifically to the cloud. That included privacy rights under the Electronic Communications Privacy Act being more clearly defined, updating the Computer Fraud and Abuse Act, and setting up a framework so that differences in the regulations and practices in various countries can be worked out and reconciled.

Hietala: I don’t think there is a silver-bullet cloud provider out there that has superior security to have that position. All enterprises still are going to have to be at the top of their game, in terms of protecting their assets, and that extends to small or medium businesses.

At some point, you could see a cloud provider stake out that part of the market to say, "We’re going to put in a superior set of controls and manage security to a higher degree than a typical small-to-medium business could," but I don’t see that out there today.

Dortch: Many small businesses outsource payroll processing, customer relationship management (CRM), and a whole bunch of things. A lot of that stuff is outsourced to cloud service providers, and companies haven’t asked enough questions yet about exactly how cloud providers are protecting data and exactly how they can reassure that nothing bad is going to happen to it.

For example, if their servers come under attack, can they demonstrate credibly how data is going to be protected. These are the types of questions that incidents like this can and should raise in the minds of decision-makers at small and mid-sized businesses, just as they're starting to raise these issues, and have been raising them for a while, among decision-makers at larger enterprise.

Kobielus: I think what will happen is that some cloud providers will increasingly be seen as safe havens for your data and for your applications, because (a) they have the strong security, and (b) they are hosted within, and governed by, the laws of nation states that rigorously and faithfully try to protect this information, and assure that the information can then be removed—transferred out of that country fluidly by the owners, without loss.

How about governments in general, maybe it's the United Nations who steps in? Who is the ultimate governor of what happens in cyber space?

In other words, it's like the Cayman Islands of the cloud—that offshore banking safe haven you can turn to for all this. Clearly, it's not going to be China.

... In terms of who has responsibility and how will governance best practices be spread uniformly across the world in such areas of IT protection, it's going to be some combination of multilateral, bilateral, and unilateral action. For multilateral, the UN points to that, but there are also regional organizations. In Southeast Asia there is ASEAN, and in the Atlantic there is NATO, and so forth.

Bloomberg: Who decides what is enough? We have these opposing forces. One is that information should be free, and the Internet should be available to everybody. That basically pushes for removing barriers to information flow.

Then you have the security concerns that are driving putting up barriers to information flow, and there is always going to be conflict between those two forces. As increasingly sophisticated attacks develop, that pushes the public consensus toward increasing security.

That will impact our ability to have freedom, and that's going to be, continue to be, a battle that I don’t see anybody winning. It's’ really just going to be an ongoing battle as technology improves and as the bad guys attacks improve. It's going to be an ongoing battle between security and freedom and between the good guys and the bad guys, as it were, and that's never going to change.

Hietala: Large enterprises are going to have to be responsible for the security of their information. I think there are a lot of takeaways for enterprises from this attack. If you're talking about specific individuals, it’s almost hopeless, because your average individual consumer doesn’t have the level of knowledge to go out and find the right solutions to protect themselves today.

So, I'll focus on the large enterprises. They have to do a good job of asset inventory, know where, within their identity infrastructure, they're vulnerable to this specific attack, and then be pretty agile about implementing countermeasures to prevent it. They have to have patch management that's adequate to the task of getting patches out quickly.

They need to do things like looking at the traffic leaving their network to see if people are already in their infrastructure. These Trojans leave traces of themselves, when they ship information out of an organization. When people really understand what happened in this attack, they can take something away, go back, look at what they are doing from a security standpoint, and tighten things up.

If you're talking about individuals putting things in the cloud, that’s a different discussion that doesn’t seem real feasible to me to get them to the point where they can secure their information today.

Kobielus: I don't think Google is going to leave China. I think they are going to stay in China and somehow try to work it out with the PRC. I don't know where that's going, but fundamentally Google is a business and has a "don't do evil" philosophy. They're going to continue to qualify evil down to those things that don't actually align with their business interest.

In other words, they're going to stay. There's going to be a lot of wariness now to entrust Google's China operation with a whole lot of your IT—"you" as a corporation—and your data. There will be that wariness.

Preferred platforms
Other cloud providers will be setting up shop or hosting in other nations that are more respectful of IP, other nations that may not be launching corporate or governmental espionage at US-headquartered properties in China. Those nations will become the preferred supernational cloud hosting platforms for the world.

I can't really say who those nations might be, but you know what, Switzerland always sort of stands out. They're still neutral after all these years. You've got to hand that to them. I trust them.

Bloomberg: In the short-term, the noise is going to die down or going to go back to business as usual. The security is going to need to improve, but so are hacks from the bad guys. It's going to continue, until there is the next big attack. And the question is, "What's it going to be and how big is it going to be?"

We're still waiting for that game changer. I don't think this is a game changer. It's just a way to skirmish. But, if a hacker is able to bring down the internet, for example, targeting the DNS infrastructure to the point that the entire thing collapses, that’s something that could wake people up to say, "We really have to get a handle on this and come up with a better approach."

Hietala: From our perspective [at The Open Group], we're starting to see more awareness at higher levels in governments that the threats and issues here are real. They’re here today. They seem to be state sponsored, and they're something that needs to be paid attention to.

Secretary of State Clinton recently gave a speech where she talked specifically about this attack, but also talked about the need for nations to band together to address the problem. I don't know what that looks like at this point, but I think that the fact that people at that level are talking about the problem is good for the industry and good for the outlook for solutions that are important in the future.

Mills: I think Google is going to get out of China and try and lead some kind of U.S. corporate effort or be a role model to try to do business in a more ethical way, without having to compromise and censor.

There will be a divergence that you'll see. China and other countries may be pushed more towards limiting and creating their own sort of channel that's government filtered. I think the battle is just going to get bigger. We're going to have more fights on this front, but I think that Google may lead the way.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download the transcript.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 9th February 2010 Copyright Quocirca © 2010

The usage of business communications tools—fixed and mobile, voice and data—appears to be growing relentlessly, but there is a strong counter-current from businesses wanting to reduce complexity and, above all, control costs. The current direction, driven largely by an IT industry agenda, looks and feels like offering everything as a network service (XaaS)—either in-house or in the public cloud—unified on common and consistent network plumbing, all based on the big melting pot of IP. This means carrying telephony as if it is just another data application: but that might not be so appealing to traditional carriers and does it completely meet the needs of enterprise customers?

After all, even though businesses are looking to reduce costs and take advantage of some of the benefits offered by convergence of all communications to IP networks, they still require the availability, security and reliability of traditional telephony, whether fixed or mobile. If the flexibility of mobile can be preserved and the promise of unified communications fulfilled, while call costs are cut and security assured, most businesses would probably be pleased. However, that is a big challenge that will not be solved overnight, so how should businesses look at the process of moving traditional telephony services in an all-IP direction?

Quocirca research shows that it is at this point that companies most often look to their existing carriers and service providers for guidance. In turn, these providers, despite long term ambitions to be converged carriers of voice and data based over a IP Multimedia Subsystem (IMS), still have legacy investments in profitable lines of voice and message-based telephony that both carrier and its shareholders rely on.

Converging or consolidating onto an IP bit pipe too quickly might seem like a bad step for the carriers, who, after all, want to differentiate on more than just price per megabyte of traffic, irrespective of its content or service delivered. However there are a number of stages between the legacy of separate siloed communications systems and the flat and indistinct unified converged nirvana of an all IP connected world.

It is here that carriers can offer something of value—control and quality—while, at the same time, exploiting IP to keep their costs down (and hopefully pass at least part of these reductions on to their customers). To do this, even the most progressive carriers will have to recognise that IP traffic will need to be carried across some networks with legacy terminations or end points, and connected to other carriers that are either further ahead or behind in their adoption of IP. This means a more active operator strategy to carrying IP packets, through managed trunking and routing, and controlling their borders' with other carriers.

It also means that, even in challenging economic climates, businesses need to evaluate their carrier network suppliers—both fixed and mobile—on a broader set of criteria than simply short term cost. They should be asking the carriers questions about quality, integrity and reliability of service, not just about uptime or their network asset level, but about the impact on services, applications and, ultimately, users. This has to include how the network supplier manages its relationships with other external carrier partners, both at commercial and network levels, and the phasing of longer term migration to IP, including what steps are being taken in the meantime.

Those quality, integrity and reliability criteria will determine the impact of communications decisions on business productivity— whether potential gains are achieved or current levels lost. Overall this 'opportunity' cost might be far more significant than a few pounds/dollars or euros shaved off the bill by myopic negotiations.

The telecommunications world is moving to all-IP, but the steps are many and progress will continue to be uneven. Businesses should expect carriers to provide a helping hand and stepping stones, rather than an all-or-nothing approach and, in doing so, seek a route that provides a balance between value and cost.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Rob Bamforth (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 9th February 2010 Copyright Bloor Research © 2010

In the previous article with this title I discussed the consolidation of the MDM market. The same thing is happening in the CEP (complex event processing) market. However, here matters are somewhat different. In this sector, first IBM acquired AptSoft, then Aleri merged with Coral8, Informatica got AgentLogic and, most recently, Sybase has acquired the assets of Aleri (along with Coral8).

In the case of IBM, this means that that company has two major CEP engines: AptSoft, which is primarily used in conjunction with business process management, and InfoSphere Streams, which is the high-end, more serious CEP product. Informatica, on the other hand, primarily acquired AgentLogic to support event-driven data integration, though AgentLogic is still being targeted at government implementations where it has historically been strong.

Sybase is different, and it now has three CEP engines since it also has its own Sybase CEP product that works in conjunction with Sybase RAP (real-time analytics platform). However, before Sybase released its own CEP engine it partnered with, amongst others, Aleri and, in fact, Aleri has been a Sybase VAR for a number of years, so the acquisition is not simply tactical and to gain market share (though it undoubtedly does that) but it also has a more strategic rationale.

The point here is that these acquisitions were actually done for different reasons, at least in part. However, the Sybase purchase, in particular, raises interesting questions. For one thing, it means that Streambase is pretty much the only pure play left in the capital markets sector, which now looks like being carved up by Sybase, Streambase and Progress between them. But is Streambase big enough to continue on its own? A merger with Vertica seems likely at some point.

However, this is not the whole point. This acquisition pretty much marks the end of consolidation within the CEP capital markets sector. However, there remains the infrastructure market, exemplified by AptSoft and AgentLogic, and it is also notable that Progress recently bought Saviion and the company is likely to integrate this with Progress Apama to compete in this space.

However, perhaps most interesting is the RFID and sensor space, where there are other active CEP vendors like Starview and Event Zero. This is starting to ramp up and, interestingly, Sybase has stated that it plans to extend beyond capital markets in due course, and IBM has already done so. Progress has some customers here already and obviously this represents an opportunity for Streambase also.

So, what we have is a partial consolidation in the CEP market for one particular sector. It will be some time before that spreads into other areas, where markets are still in their infancy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Philip Howard (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon