By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 23rd August 2011 Copyright Bloor Research © 2011

Why would a blind person go into a library? Maybe to borrow a book in Braille, or more likely to borrow a talking book, CD or DVD. In Lambeth the new answer is to learn to use a computer.

Computers have the potential to improve the quality of life and job prospects of anyone who is blind or has a vision impairment (a Vision Impaired Person or VIP for short). A very large percentage of the world's knowledge has only been available in printed form on paper. This meant that it was inaccessible to anyone with a limited or no vision. Over the years various solutions have been used to close this gap a bit.

Braille was one very clever and successful solution but it is limited by: the cost of setting and printing any document; the size of a Braille document, which is a disadvantage; but probably the biggest issue is that it is difficult to learn, especially for anyone whose lost their vision later in life.

Audio books is a wonderful medium for fiction, where a book is read, and listened to, from the beginning to the end. It is not such a useful solution for reference or text books where navigation becomes a major issue. The cost of production also limits the titles available.

DAISY talking books provide the benefits of audio books and adds navigation capabilities.

All of these solutions have major limitations, as the number of titles is limited and great swathes of printed material - newspapers, magazines, journals - are generally not available and certainly not in a timely fashion.

More recently the rise of the computer, the Internet and various forms of electronic publishing have enabled a whole new set of sources of textual information; emails, blogs, wikis, online news channels etc. All of this is displayed on a screen and is again not accessible.

However, the fact that this information is electronic and therefore can be manipulated means that it is possible to turn the electronic words into spoken words that are accessible to people with vision impairments. All of human knowledge is being rapidly turned into electronic format and thus the knowledge available to a VIP is growing exponentially.

Unfortunately there are two barriers that need to be removed before all this information is available. Firstly the user needs access to suitable hardware and software that will read the information on the screen and enable them to navigate easily. Secondly they need to learn how to use the hardware and software. A VIP who has not learnt to use the system will not be able to assess the benefit to them and therefore will not be able to justify the initial outlay. The cost of a suitably configured machine is a considerable barrier to adoption.

The libraries in Lambeth have recently been the venue for an experiment to fix both these problems. The initiative is being driven forward by a local resident, Christina Burnett of Wide Eye Pictures, who is passionate about the benefits of computing to VIPs.

Like every modern library Lambeth has several computers in each library. The only extra hardware required was headphones; these are obviously essential if there are going to be several screen reader users in the library at one time. It is probable that headphones would have become necessary anyway for the general public as more and more audio information is available on the Internet. The other addition was to install screen reader software on all the library machines; it was decided to install it on all machines so that a VIP could use the system whichever library they wanted to visit. Some screen reader solutions are expensive and it would have been prohibitive to equip all machines; this was resolved by installing a free screen reader called Thunder which is available from www.screenreader.net. So for a minimal expenditure the libraries removed the first of the barriers.

To assist the VIP to learn to use the system a series of seven weekly training sessions was run, called DTvip (Digital Tuesday for Vision Impaired People). The initial set of sessions trained some VIPs and some volunteers so the scheme can be repeated and extended in the future. Screenreader.net, which developed Thunder, has obtained funding from Awards for All to work with DTVIP on this pilot training scheme at the Tate South Lambeth Library.

The first set of sessions was a great success and proved that the model works. Naturally, lessons have been learnt, in particular to have a structure that can support different users, ranging from a VIP who has never used a keyboard, through to a VIP who is an expert PC user but, through failing sight, needs to learn how to use a screen reader.

The second set of sessions is under way. The question now is how to quickly extend this model throughout Lambeth and the rest of the UK.

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 21st June 2011 Copyright Bloor Research © 2011

Apple has announced the next version of OS X, the operating system for Macs, called Lion. It has 250+ new features, including 11 specific accessibility features and several more that could have accessibility benefits.

OS X ships with a built-in screen-reader, VoiceOver, which has been extended to:

In previous versions you have been able to increase the size of the cursor arrow but when you did this the arrow became pixelated and the edges were rough; a small improvement in Lion is that the larger cursors remain crisp and sharp. I have my cursor at a medium size, it makes it easier to find on a large iMac screen and I look forward to this small improvement.

Another feature I use quite frequently is screen zoom. If there is something on the screen that is small, some text or often an image, I zoom the whole of the screen so I can see the relevant section blown up. The problem is that I lose the rest of the screen. Lion will offer a function to have a section of the screen in a separate window and to zoom on that. This is the best of both worlds with magnification of the bit of the screen of interest whilst still being able to see the context of the rest of the screen.

Lion improves Braille support with support for more languages and more control of the verbosity.

A significant usability feature is that for existing OS X users Lion will be downloadable from the Mac App Store. The advantage being that there will be no distribution of CD and installation from CDs. For people with disabilities this should be a welcome improvement, just a couple of clicks to download (see my article Usability and Accessibility of Apple Mac App Store) then a few more to install.

FaceTime, the video calling facility built-in to Lion, provides high-definition video which should make it possible for deaf people to use sign-language when communicating remotely. Lion improves and extends the support for full-screen apps. Full screen applications are beneficial to people with vision impairments as the content can be bigger and also there are no distractions. Full-screen should also help people with dyslexia, and some cognitive limitations. With Lion you can have multiple applications open in full-screen mode and you can navigate from one to another using a gesture.

Preview is the tool for looking at images and PDF documents. Lion provides a magnify feature to enlarge specific text or images.

Safari, the built-in browser, has some new features that will benefit people with disabilities.

The Screen Sharing feature enables one Mac to observe or takeover control of another Mac. This provides an excellent remote user support facility. Many users with disabilities will find this useful as it means that small issues can be diagnosed and resolved quickly and effectively by a remote friend.

And finally you can resize a window from any side or corner.

Lion will ship in July and is great value at £20.99 in the UK ($29.99 in the US). I plan to upgrade as soon as it ships as the accessibility benefits are significant as well as many other of the 250 new features which will improve my usability and general user experience.

By: Natalie Newman, Senior Analyst, Bloor Research Posted: 24th March 2011 Copyright Bloor Research © 2011

What will the 2011 Census tell us? Not much without geographic information technology! Demographic information guides the planning for all sectors. Whether for the provision of public services, the supply of power and water, or the marketing and selling of products and services, the where factor will be critical!

On March 27th everyone in England and Wales will be expected to complete the 2011 Census form. We lose an hour during the night before and hopefully that will not cause late submissions. This is the first census that can be completed on line. One hopes that this will not adversely affect an accurate information collection—the last census had an alleged 25% undercounting.

Reading an article in the local Compass Wessex magazine started a train of thoughts of what this new information can mean to public and private sector organisations.

The focus on socio and economic trends opens the usefulness of this information to countless opportunities. Is there anything that is not affected in some way? It is vital to understand where—the location—to which the statistics relate.  

Comparison with the first census in 1801 reveals great change and we all know that the speed of change is increasing. In 1801, the 2 million households averaged 5.6 people compared with 2001 where an average of 2.4 people were recorded in 26 million households. The escalation curve would be very interesting to understand how the rate of change has increased. The geographic illustration of where these changes take place will provide invaluable guidance to so many facets of planning and provision.

New questions about residents include passports held, nationality, year of entry to UK and intended length of stay for recent arrivals, main language and second residence. These statistics would reveal interesting trends, showing where employment is impacted, where transitional populations reside, where different languages should be accommodated, and where homes are not permanently occupied.

Frighteningly, apparently, 1 in 6 homes in the UK fall within a flood plain and the Environment Agency's flood testing centre at HR Wallingford in Oxfordshire is investing in experiments to withstand these wet onslaughts. The 2011 Census will reveal how many people are impacted. That could be a very pessimistic picture? Insurance risk cannot be managed without evaluating where and to what extent the risk exists. This is impossible without geographic technology.

The increasing population densities are essential for network planning organisations—water, gas & electricity, telecommunications. Without geographic visualisation, they will not know where the change in demand is taking place.

The first summary results are expected in September 2012 with more details emerging in 2013 and 2014.  That does seem like a while to wait, but maybe we should already be putting on our thinking hats and start planning how to use this information.

If geographic technology is not part of your solution, think again. Without knowing where change is taking place, the statistics are meaningless.

By: Simon Holloway, Practice Leader - Process Management & RFID, Bloor Research Posted: 10th February 2011 Copyright Bloor Research © 2011

As the realisation comes to the software market that the new generation of workers need user interfaces that fit with the lifestyle of Facebook, Twitter and mobile phones with apps, we are starting to see how various software companies are meeting these changes. For the BPMS market, Appian have always been one of the companies leading the way and with the release of Appian 6.5, which includes a new interface called Appian Tempo, they have produced a release that is geared towards the end user of BPMS-driven solutions in terms of a mobile and social interface with cloud capabilities.

Malcolm Ross, Appian’s Director of Product Management, told me “The release delivers a revolutionary way to extend process visibility and participation through native mobile device access, real-time collaboration, filtered and personalised views of key business events, integration to external systems, and the ability to take direct action in a familiar and intuitive social media interface.” So what does the new Appian interface deliver?

Mobility

Appian Tempo provides native client applications for the Apple iPad, iPod Touch and iPhone as well as RIM BlackBerry devices. Ross explained that mobile BPM allows employees to stay connected, allowing them to monitor, collaborate and take action on important business decisions regardless of where they are. It also extends BPM participation beyond pre-defined process participants to include all levels of the organisation. The iPhone and iPad applications are available for immediate download from the Apple App Store. The BlackBerry application is available now from the Appian Forum community site, and will be available shortly on the BlackBerry App World site. A native application for Google Android devices will be available shortly.

Figure 1: Appian Tempo user interface on BlackBerry, iPad and iPhone. (Source: Appian)

Social

There always seems to be a contradiction about incorporating social media into a business world. Social technologies are powerful communication and collaboration platforms, but they must be harnessed in a business context to have business value. Ross explained, “Appian utilises familiar social tools and interfaces to drive business collaboration across the enterprise through personalised, filtered views that allow easy collaboration with the ability to take action when needed.” Users can filter views by relevant application or process areas and subscribe to customised feeds to monitor the key events and information that is meaningful to them. As well, users can comment, pose questions and collaborate on business events through real-time message posts and ad hoc updates to targeted groups within and outside of pre-planned business processes. The last user capability is to “Take Action”; here a user can generate actions and complete tasks from inside the event feed or from a mobile device, using optimised web and mobile forms to capture data and route tasks.

Customer-Driven

Samir Gulati, Appian’s Vice President of Marketing, described how Appian 6.5, and in particular Appian Tempo, had been driven by their customers’ business needs. One example is Archstone, a leading apartment management company, headquartered in the USA. Archstone have a highly mobile and dispersed workforce which is supported by a system built on Appian. David Carpenter, Director of BPM, Archstone, stated that “Appian Tempo delivers a new level of value to our customer service associates through instant mobile access to our key enterprise processes and forms.”

Comment

I was very impressed with the demonstration of Appian 6.5 and the Appian Tempo interface. From an end user viewpoint it opens up the ability to make real-time decisions where and when they are needed by using collaborative technology. The product is definitely easy-to-use and intuitive. While all events and collaborations can be secured at a granular level, organisations that make use of the new Appian release will need to think about the security implications of the information that can be shared.

In addition to on-premise deployment, Appian has emerged as the BPM-in-the-cloud market leader. When you add the capabilities of Appian Tempo to those already in the Appian BPMS and Appian Anywhere, as well as Appian’s specific knowledge about industries such as government and financial services, you have a very compelling proposition.

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 27th January 2011 Copyright Bloor Research © 2011

Data virtualisation is the latest technology to enjoy its moment in the hypelight and there has been some considerable debate within the blogosphere about what it actually is and what its relationship is to data federation, data integration and EII (enterprise information integration).

Rather than start from scratch I thought I would go back through my files and see what I had written about this in the past (if anything). I found the following definition of an EII platform (that is, what you need to support EII, which is, after all, about information rather than mere data). What I wrote, some three years ago, was that an EII platform needs to do four things:

1. “It virtualises your data – it makes all relevant data sources, including databases, application environments and other places where data may be sourced, appear as if they were in one place so that you can access that data as such.
2. “It abstracts your data – that is to say, it conforms your data so that it is in a consistent format regardless of any native structure and syntax that may be in use in the underlying data sources.
3. “It federates the data – it provides the connectivity that allows you to pull data together, from diverse, heterogeneous sources (which may contain either operational or historical data or both) so that it can be virtualised. It should also enable things like push-down optimisation so that query joins can be mastered in the optimal place.
4. “It presents the data in a consistent format to the front-end application (typically, but not always, a BI tool) either through relational views (via SQL) or by means of web/data services, or both.”

Actually, I didn’t quite write that: I have updated it somewhat but the gist is the same.

Clearly, data federation is not the same as data virtualisation. Moreover, federation is not necessary for virtualisation, depending on why you are doing the virtualisation. If you want to link a number of data marts together so that you can query across them then clearly the query optimisation capabilities of a federation engine will be necessary. On the other hand, if you want to create Mashups or other applications that have relatively lightweight access requirements, or you want to use virtualisation to support MDM-like capabilities, then such functions may not be necessary. Instead you can use data services. Data services may also be more appropriate in environments where less of the data is relational and more of it comes from a variety of unstructured sources or from the web. Indeed, there is a whole new discussion to be had about the distinctions between data virtualisation for unstructured data and structured data (or a combination of the two) but that’s a subject for another day.

The other question that arises is whether parts 1, 2 and 4 are all actually parts of the same thing. I think 2 and 4 probably are or, at least, the differences are so slight that there is no point in making a distinction.

Parts 1 and 2 are another issue. If data virtualisation is about having a virtual data source that does not necessarily mean that it is easy to work with. It is certainly easy to imagine a huge hybrid database that contains relational and non-relational data, pdf documents and a whole bunch of other things, but that would not necessarily mean that the data was all in a common format and, therefore, easy to work with. So, I think both 1 and 2 are required and are different. It is certainly true that it does not make much sense to implement data virtualisation without an abstraction layer but that doesn’t mean they are the same thing.

Finally, I haven’t talked about data integration at all. Well, the fact is that leading data integration products support data services so you should certainly be able to virtualise data sources even if you can’t federate them (they won’t typically have the sort of distributed query optimiser you would want from a data federation product). The question will be how easy it is to build the abstraction layer with a data integration tool. Of course, you can create all the transformations and mappings necessary for this purpose but what you would really like is something that automates a lot of this abstraction rather than requiring you to build it for yourself. It is in these two areas—federation and automated abstraction—that the pure players in the market, especially Composite Software and Denodo, have a significant advantage over the data integration vendors.

By: Natalie Newman, Senior Analyst, Bloor Research Posted: 25th January 2011 Copyright Bloor Research © 2011

I am not referring to Cloud Computing but rather the cloud of confusion prevailing over geographic information amongst the general public. The confusion over this type of information; the confusion over the many terms used for information that can be linked to the earth's surface; and the confusion over maps.

Watching a TV program the other evening called, ‘The Beauty of Maps' highlighted the subjectivity of maps. The map maker has cartographic licence to create a map display which projects his interpretation of the subject; whether it is to visualise the topography correctly and read the labels easily, or to project an image that might not be true. This program described William Morgan's 1682 Map of London. He created a map of a city after it was destroyed by The Great Fire. His map illustrated the city he envisaged London would become. St Paul's Cathedral was well illustrated on the map even though it was totally destroyed and had yet to be rebuilt. Maps project what the creator intends.

There is a book written by Allan and Barbara Pease called ‘Why men don't listen and women can't read maps'.The theory goes that "due to their different roles in evolution, men had to hunt and stalk their prey, so became skilled at navigation, while women foraged for food and so became good at spotting fruits and nuts close by" [The Telegraph website]. I am not sure that explains it and, if one can generalise quite so simply, women should then be the bigger enthusiast about SatNavs. Maybe the ‘don't listen' bit prevents men from asking for or listening to directions :)

Returning to the subject—there is a great lack of understanding amongst laymen about location and geographic information systems (GIS)—as my previous article described the need to increase aWhereness. Location information—or whatever we want to call it—is simply the position on the earth's surface to the accuracy that is possible, and/or the accuracy that is required.

Initially Google Maps and Google Earth provided much needed publicity for geographic information. Google Maps, or similar, is used by most people I know to find their destination and obtain directions to reach it. Google Earth stirred an interest in places we might not visit but can view. So much good has emanated from those two applications to raise the profile of location.

The downside is that there is still not enough understanding or appreciation of the implications of geographic information and the systems. The associated costs are now even harder to sell as ‘Google is free'.

The Google application, Latitude, enables a mobile phone user to allow certain people to view their current location. I assume that these locations include both the longitude and latitude measurement; just the distance from the equator would not really help anyone.

Another term to increase the confusion, or is Google taking latitude with Latitude?

In addition, according to the latest Apollo survey table measuring the media coverage per technology company, Google came 1st in Europe and in USA, and 3rd in UK!  With that much media exposure, we should not underestimate the influence of Google!

We will have to tell a convincing story about the necessary investment to add location to your business systems. We will have to ensure that the longitude accompanies the latitude and makes good sense.

That means we, geographic professionals will have to work that much harder to tell—and sell—our story.

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 11th January 2011 Copyright Bloor Research © 2011

In December 2010 the British standards Institute (BSi) published "Web accessibility - Code of practice (BS 8878:2010)" http://shop.bsigroup.com/en/ProductDetail/?pid=000000000030180388; this document is based on, and replaces, "PAS 78: Guide to good practices in commissioning accessible websites". It extends, updates and improves on its predecessor and is therefore essential reading for anyone intending to create or update a web product.

This new document, like its predecessor, concentrates on the processes, procedures and practices required to create an accessible web product; it does not discuss coding or technical issues but does provide references to relevant standards, guidelines and practices; so there is no conflict between this standard and the guidelines produced by the W3C Web Accessibility Initiative (WAI).

Jonathan Hassell, from the BBC, who lead the development of the standard says "Most web product managers know accessibility is important, but need a guide to the decisions they make during product development which can impact disabled and elderly users of the types of multi-platform, interaction-rich products they are creating. BS8878 is that guide, and encompasses the best advice and experience from many experts from all round the world on how to make products that include these people.".

Firstly it describes the policies and structures that an organisation needs to have in place to support accessibility.

Secondly it describes a series of steps required to create an accessible web product. The steps are summarised in the document as follows:

• Research and understand the requirements for the web product;
• Make strategic choices based on that research;
• Decide whether to create or procure the web product in-house or contract out externally;
• Produce the web product;
• Evaluate the web product;
• Launch the new product;
• Post-launch maintenance.

The document describes the specific accessibility issues that should be considered at each step. At first sight this may look like a lot of new work but in reality nearly all of the steps are considered good practice for any web product development.

This is followed by an introduction to the existing guidelines for developing accessible web products as well as discussion of accessibility of non-browser interfaces and special consideration when developing for older users.

Finally there is a detailed section on "Assuring Accessibility throughout the web product's lifecycle", which identifies and discusses the various methods of accessibility validation.

Graeme Whippy, of Lloyds Banking Group, one of the authors of the standard, said "Lloyds Banking Group is committed to best practice in accessibility and sees significant business benefits in making our websites as accessible as possible".

The standard is about 90 pages long and the second half is made up of fifteen extremely useful annexes. These cover areas such as definitions, laws, standards, responsibilities, challenges, examples of web accessibility policies and statements, guides to testing and a comprehensive bibliography.

I have read the standard and found the information in it clear, concise, insightful and pragmatic. It is laid out in such a way that it can be read in small chunks as required by different audiences and steps of a project. It provides all the parties involved in the creation of web products the information they need to understand the issues, decide how to proceed towards an accessible product and, importantly, how to deal with real world conflicts between ultimate accessibility and other market forces.

It provides a single source for accessibility best practice and information on the law and standards regarding accessibility.

The only criticism I have is that it does not discuss in sufficient detail the importance of ensuring that new content added to the web product after launch is accessible. It hints and implies that this is essential but does not highlight the issue.

Having seen the document, Gail Bradbrook of Fix the Web, an organisation set up to help people with disabilities report web accessibility issues and get them fixed, said "if every web product used the standard then we would not be needed and could close down; unfortunately that is not the case yet and we are very busy and need more volunteers (see http://www.fixtheweb.net )."

To ensure the maximum benefit is obtained from the standard there is a need for a community to be built up around the standard that can add to and refine the standard based on new experiences, technologies and opportunities and I expect some organisation will step up provide the platform for this community.

The standard is an essential purchase for anyone creating web products, as it provides:

• Pre-digested research into accessibility and best practice;
• A roadmap showing how to ensure accessibility is built into web products;
• A template for recording the decisions made about accessibility which will help to show good intentions if complaints are made.

Its cost should be recouped within a few days of starting any significant web product development and it will continue paying dividends throughout the whole life-cycle. It should be used by all commissioners and developers of web products.

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 31st December 2010 Copyright Bloor Research © 2010

For a variety of reasons geographic and geospatial considerations have been in my mind recently. To begin with, Natalie Newman will, provided all things go smoothly, shortly be joining the Information Management group here at Bloor Research, specialising in exactly these areas. She has 25 years of experience of working in this space, especially in government (local and national), defence and in the telecommunications sector, both here and in her native South Africa. Most recently she was working with BT Global Services. So Natalie is welcome addition to our team.

Then, earlier this week, I received an email from Capscan, announcing its support for CACI’s ACORN. ACORN (a classification of residential neighbourhoods) enriches UK address data with a whole load of demographic data. If you go to the CACI site you can try it for yourself. Put simply, you put in a postcode and then the software classifies that post code as being in one of a number of categories, groups and types. For example, my post code comes into category 1: “wealthy achievers”, group A: “wealthy executives” and type 3: “villages with wealthy commuters”. Not that I’m a commuter. Or very wealthy for that matter. You can then analyse this type by a variety of lifestyle and demographic attributes to see how type 3 communities compare. For example, the average household in a type 3 community is 1.76 times more likely to have 2 or more cars compared to the country as a whole. It’s really quite cool. Capscan is suggesting using ACORN in conjunction with name and address cleansing and you can see how this would make sense or even, for that matter, using it independently of data quality.

Now, this demographic data is based on locations and we’ve all heard a lot about location-based services and the like, which brings me to something I’ve been thinking about for a while, which is why GIS (geographic information systems), in particular, is not as popular as it might be?

What I have been wondering is whether it’s because of the name. It seems to me that GIS systems are not really about geography at all: they are really about locations. And, for that matter, spatial analytics is not really about spaces but about topography. Perhaps if they actually said on the tin what they are about then people might use them more.

Here are some examples:

• GIS systems are often used to help decide where to put new store or depot locations. Yes, locations.
• GIS systems can be used to identify hotspots for benefit fraud. That is, where (locations) this is happening.
• I remember a particularly neat example from Information Builders: one of its clients had done a location-based analysis of its suppliers and found that 90% of them were on the other side of a major river, meaning that if the bridge was out for some reason, then their whole JIT (just in time) manufacturing would go out the window.
• The most common application of spatial analytics is in the insurance sector, for determining things like flood risk. This is essentially worked by how close you are to a flood plain or coast and how high your property is relative to the water source. Which sounds to me like topography.

Long-time readers know that I like to call a spade a spade and this is no exception. Normally, I would say that we are stuck with these terms but that may not be the case with GIS. With the huge growth in location-based services and location analytics there is the possibility that GIS could re-brand itself and finally prove as successful and as widespread as it ought to be. Hopefully, Natalie will help to make that happen.

By: Gerry Brown, Analyst - Digital Marketing & CRM, Bloor Research Posted: 22nd December 2010 Copyright Bloor Research © 2010

1. Technology Designed for Everyone
The technology world enlarged in 2010. Consumers fell in love with the intuitive user interfaces and versatile technologies of the likes of Apple, Facebook and Google. “I love it” is how most users describe their iPad or iPhone. Now consumers want their enterprise applications to offer a similar user-oriented experience.

Consumers want to use technology to connect and collaborate with others. No wonder social networking and mobility is such a compelling combination for businesses and end users alike. Facebook’s mobile users spend twice the amount of time on Facebook than do non-mobile users. This trend is set to accelerate. Hence SAP acquired Sybase for its mobile apps platform, rather than its database technology.

Traditional consumer brands such as Sony (Vaio) and Samsung (Galaxy) and Amazon (Kindle and EC2) sense there is more money to be made in Tech. As do a vibrant new group of entrepreneurs who have developed well over a million consumer apps on various platforms. There are no barriers or caveats to entering the software market anymore.

2. Making Technology Easy to Consume
How do you turn 5 keystrokes into 3? How do you make software that is immediately intuitive and makes obvious sense to users? Can you eradicate training courses and user manuals? Some enterprise software user interfaces look like a flight pilot’s cockpit instrument panel.

Steve Jobs, the Tech industry’s top CEO, loves a clean design and simplicity for Apple’s users. The iPod has 5 keys; the more modern iPad has 3. Jobs launched the iPhone 3G using only 11 presentation slides, only one of which contained any words. BBC Radio 4 recently praised Apple’s use of clear, plain English in its product descriptions, in contrast to Microsoft’s “techno-babble” that can alienate potential customers.

Facebook starts product development from the premise ‘how does this product enable users to communicate and collaborate?’ Features and functions become outputs rather than inputs when viewed in this manner.

3. Getting the Price Point Down
High price is the last great bastion of the technology industry. But now many vendors offer similar ranges of products to address similar markets; the key decision-making criteria has become availability, brand, and most importantly, price—especially as vendor pricing is increasingly transparent and available on the Internet. There are now many options open to vendors who want to offer more customer value and encourage product trial.

BI vendors such as QlikTech, Tableau, TIBCO Spotfire, and MicroStrategy offer generous free trial product downloads. Open Source vendors such as Jaspersoft, Pentaho and SugarCRM offer free entry-level products. Spiceworks’ network management software is free if you are prepared to accept the advertisements that come with it. Many excellent applications, such as Google Analytics for example, are totally free of charge. Virtually every kind of software platform, application and service is available for rent as a SaaS service in the Cloud.

4. Be different
Competition from now on will be intense and hostile. Recent aggressive moves from industry titans such as HP, IBM, Oracle, and Microsoft set the tone. Product innovations are easy to copy and vendors are now stepping on each others’ toes. To insulate themselves against this trend the top Tech companies have transformed themselves into brands. They hope to encourage a sense of community and belonging, customer loyalty and advocacy, and a feeling that customers cannot do without them.

Brand Finance now rates Apple, Microsoft and IBM as 3 of the most valuable ($) 5 brands on earth—ahead of Coke, Mars, Persil and all the other household names. Six of the Top 20 valued brands are from the Tech industry. The thought-leadership, business model innovations and brand distinctiveness that characterise these vendors are now becoming essential pre-requisites for success in Tech.

Those that are truly market-oriented and customer-centric will thrive. Those that remain product-led will find it increasingly hard to attract new customers. Business agility will be key to vendor survival. ‘Be fast and be bold’ as Facebook says. Vendors, customers and users should endeavour to embrace this dictum.

If there are vendors or others who want advice in any of the above, drop me a line and I will be glad to help. It is Xmas after all ;-) And a happy New Year to all our readers!

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 21st December 2010 Copyright Bloor Research © 2010

I recently presented at a webinar alongside LogLogic on the issues of compliance for IT professionals. Here is an edited transcript of my talk.

Until fairly recently, information security people were buried away in server rooms configuring firewalls and patching servers. With the sudden surge of compliance and regulatory requirements being placed onto a business, IT security people are now required to understand and help implement compliance solutions.

But how can security teams help join the dots between their security work and compliance issues? How can compliance requirements be met without placing undue strain on the organisation causing paralysis by analysis? How can information security people add value to a business following a compliance agenda?

The pressure to deliver a secure IT infrastructure against a background of constantly changing compliance and regulatory demands is tough, and not helped by a reduction in budgets to achieve this ever-changing goal. The first part of this process is to get an understanding of exactly what compliance requirements you need to be worried about and, more importantly, those that can be put to the background. Not only do we need to consider state laws, federal laws and international laws, there are industry-specific regulations that further complicate the picture. Those organisations trading across international boundaries face even more challenges as they get to grips with different legal structures and cultural demands. During this webinar you will have a chance to learn about the realities of achieving an acceptable level of compliance for your organisation, and hopefully get some help for your work down in the trenches.

I would imagine that everyone knows only too well the demands on us as information security professionals. I think it could be argued that we have one of the most difficult jobs in the IT business as we need to be seen to add value whilst at the same time often saying no—often a contradictory position.

As the current financial situation rolls on we are faced with doing more with less, and organisations are increasingly worried about reputational risk more than ever before as any damage to the business will have an affect on often slim profits. This work needs to be balanced with the relentless slog of dealing with malware and other unexpected gotchas waiting in the wings to pounce.

Some of us are lucky enough to enjoy a lot of support from the executive team downwards. Unfortunately other boards may see the information security role as nothing but a pain and something they wish they could make go away. If this is your position you have my sympathies!

Data security is now getting a lot of attention as it is subject to legal and regulatory compliance requirements. Failing to adhere to appropriate laws and regulations can result in legal actions, fines, reputational risk and maybe, in extreme circumstances, imprisonment.

The benfits of compliance
Achieving  compliance, in the broadest sense of the word, can be a good thing as it often instils good practices and procedures.

On the other hand over-compliance can be detrimental as the business can be bogged down in achieving a goal that delivers little direct business benefit. Many medium-sized businesses are struggling with compliance requirements as they are big enough to be caught by various requirements but too small to have resources to cope. Of course failing a compliance audit can result in lots of difficult questions from the board of directors, shareholders and partners.

The only thing we can promise is that there will be more compliance and regulatory requirements coming down the line to affect data handling and security. The demands of a business culture that is becoming more and more compliance oriented can be major. The problem is that this change in culture leads to some strange ideas.

One objection to additional security spend I hear from businesses is that they are fully compliant, as proved by external auditors, and therefore don’t need much or any more investment in their IT security systems. Some business managers are then astonished when they realise that security has been breached, especially after they had spent considerable sums on establishing this compliant business environment. Indeed, the fact that the business is compliant, whatever that means, has induced a level of complacency in some as regards information security.

IT security managers have a need to help educate business managers in the differences between compliance and security. That way a business can make investment decisions based on accurate information rather than assumptions.

I feel for medium-sized businesses that are captured by the compliance net but have little or no resources to meet what can be seen as an onerous requirement. Fortunately some compliance and regulatory demands have planned for this and offer suitable break points so that small and medium sized business don’t fall foul of regulations whilst being able to run their day to day business.

The cost of poor compliance
So what about the real cost of poor compliance and bad information security? In March 2010 Zurich Insurance announced that it was going to improve its information security after losing personal financial information on 46,000 British clients through careless handling of unencrypted back-up tapes.

The back-up tape, which also contained personal details of 1,800 third party insurance claimants from the UK, was lost by Zurich's South African sister company during what was described as a routine transfer to a data storage facility in South Africa in August 2008.

In total, 51,000 British records were on the tape, along with a much larger number of details about Zurich customers in South Africa (550,000) and Botswana (40,000). Zurich's UK arm wasn't informed about the problem until a year later.

They were fined the equivalent of $5m by the Financial Services Authority, the highest fine levied in the UK on a single firm for data security failings. This is the cost of non-compliance.

US compliance
In many respects, the United States has led when it comes to data security laws that mandate stricter requirements and harsher penalties if data is compromised.

The implementation of state-level data breach notification laws in California in 2002 was seen as a prime example of addressing individuals' concerns about their data privacy. In this case, if personally identifiable data has been lost then those individuals possibly affected must be notified and steps taken to help them manage any ongoing consequences. 44 of the US states now have similar laws in place but, of course, if data has been demonstrably encrypted, then there would be no obligation to disclose its loss.

Since 2002, many US states have introduced even more draconian laws. The state of Massachusetts has introduced regulation 201 that is designed to protect personal data, for which encryption plays a big part. The compliance date was set for January 2010 and violators face penalties of $5,000 per infringement.

Other US laws encompass data security and imply that data encryption is required, even if it is not explicatively stated in the legislation.

The Health Insurance Portability and Accountability Act of 1996 gives powers to the Department of Health and Human Services to watch over and enforce rules applicable to the safe and secure handling of patient data, including that which contains personally-identifiable health information. It is applicable to all entities that use such data, including healthcare providers, insurance companies and public health authorities. There are three safeguards that need to be implemented covering administration, physical and technical areas of data management. The technical safeguards require that patient health information is not improperly modified and any deliberate misuse could result in a prison term.

The Sarbanes-Oxley Act of 2002 was intended to improve the regulation and accountability of publicly owned companies following the spectacular corporate failures that occurred in the early part of that decade. Under Section 404: Management Assessment of Internal Controls of the Sarbanes-Oxley Act, there is a need to prove the integrity and confidentiality of financial information.

The U.S. Congress passed the Gramm-Leach-Bliley Act (GLBA), also known as the Financial Services Modernization Act, in 1999 to assist in the growth of the US financial services industry. One part of the Act (Sec. 501b) addresses the safeguarding of customer information including the integrity and confidentiality of non-public personal information and customer records.

EU compliance
The EU has a very different make up to the United States. The European Union currently comprises 27 member states. It was established following the Maastricht treaty in 1993, which renewed the union originally called the European Economic Community, or EEC. The EU generates approximately 30% of worldwide GDP and has around 500 million citizens.

The EU has developed a system of laws that apply to the movement of goods and people and the creation of a single trading entity. Each member state is subject to both EU and their own locally created national laws. There are countries that form part of Europe geographically but do not have membership of the EU, for example Switzerland. These countries are therefore not subject to EU-based laws.

As part of its remit, the EU has created business-related compliance and regulatory requirements, including laws that cover the safe keeping and management of data in computer systems. Failure to comply with these laws can result in criminal proceedings and prosecutions, so any organisation operating in the EU needs to take such laws as seriously as those developed by individual nation states.

When considering EU law it is important to understand the structure of the EU and how laws are enacted.

The EU Council represents national governments and is a council of ministers run by a 6-month rotating presidency. National ministers attend meetings as appropriate to their portfolio. The European Parliament is elected every five years by citizens of the member states. Members of the European Parliament have geographically-based constituencies that are generally larger than those for members of a national parliament.

The European Commission acts as a civil service and drafts new laws, which are passed to the European Parliament for discussion and enactment. The EU is based on a rule of law, which is laid down in a series of treaties and directives. These then become a collective legislative act of the EU, which is then enacted in member state laws. If a member state fails to enact a suitable law then action can be taken against that state in the European Courts of Justice, which is the judicial institution of the Community.

The compliance and regulatory framework in EMEA is never far from the spotlight, more so as the current worldwide financial situation is forcing regulators to review their oversight and regulatory activities in an attempt to prevent a similar crisis happening again. This is against a backdrop of relentless data loss incidents across both the private and public sector.

So let’s look at some key requirements in detail. The UK Data Protection Act is a useful example of a data privacy law and the PCI DSS is an interesting example of an international requirement put in place by a non-state organisation.

Data Protection Act
The UK Data Protection Act imposes legal obligations on anyone processing personal data to ensure there is good practice and management of that data. In part 1 of the Act there are 8 enforceable principles of good personal information handling. Data must be:

• Accurate and up to date.
• Fairly and lawfully processed.
• Secured.
• Not allowed to leave the UK unless the destination countries have similar legislation.
• Processed in line with a person’s rights.
• Only kept for as long as necessary.
• Processed for limited purposes.
• Adequate, relevant and not excessive.

Part 2 of the act gives individuals rights to find out what personal information is held about them on computers and most paper records. The UK Information Commissioner’s Office (ICO) has legal powers to ensure that organisations comply with the requirements of the Data Protection Act. A data controller who persistently breaches the Act and has been served with an enforcement notice can be prosecuted for failing to comply with a notice. From April 2010 the ICO can impose penalties not exceeding £500,000 for serious breaches of this act. We are still waiting for the “big one” to hit, but I understand there are some ongoing investigations that may result in the maximum fine. Certainly if the loss of 25 million records, as happened a couple of years ago by the UK’s HM Revenue and Customs happened today then the ICO has publicly stated that it would have levied the maximum fine. Then, of course, we have discussions about public money travelling from one place to another but that is beyond the scope of this presentation.

In Germany the Bundesdatenschutzgesetz (BDSG), adheres to the seven basic principles of EU Directive 95/46/EC in the protection of data relating to individuals or data that allows an individual to be identified. The 16 Länder have their own data protection regulations that cover local public bodies. These local regulations are similar in spirit to the Federal Data Protection Act. In July 2009, German legislature passed a number of amendments to the act to strengthen its powers. Most notably there was a new requirement introduced to provide notification of data breaches in a similar way to the United States. These were effective as from 1st September 2009.

PCI DSS
This is probably one of these regulations that appears to have achieved a good compliance vs. effort balance as organisations that I work with are generally satisfied that they can achieve their required level of PCI DSS compliance without it breaking their businesses. If you take a look at the 12 requirements of PCI DSS no one could argue against the sanity of putting in place these measures:

• Build and maintain a secure network including installing and maintaining a firewall configuration to protect cardholder data and not using default passwords.
• Protect cardholder data and encrypt transmission of cardholder data across open, public networks.
• Maintain a vulnerability management program and use regularly updated anti-virus software. Develop and maintain secure systems and applications.
• Implement strong access control measures and restrict access to cardholder data on a need-to-know basis. Assign a unique ID to each person with computer access and restrict physical access to cardholder data.
• Regularly monitor and test networks and track and monitor all access to network resources and cardholder data.
• Maintain a policy that addresses information security.

I don’t see how any information security professional could argue against implementing these requirements as they all go to make up a commonsense set of security structures. Having recently had my credit card details stolen I am as keen as anyone to see merchants achieve a better level of security and compliance.

Contrast the relative clarity of PCI DSS with the Sarbanes-Oxley requirements in the US. This imposes rather mystical requirements on information security. For example section 404 of Sarbanes-Oxley requires organisations to, “provide internal controls and report on their effectiveness” and section 802 says that organisations must, “ensure the integrity and availability of records”. This is a charter for auditors to make a lot of money!

As we have seen, compliance is now a big requirement for many businesses and I think most people would agree that the depth and breadth of compliance requirements is only going to deepen. As organisations switch on to the world of compliance they realise that it is far more cost-effective to run compliant systems 24/7 rather than hastily scrabble to clean up prior to an audit. Those days should be long gone and organisations should ideally be “audit ready” at all times, or at least strive to be. Any investments in systems that assist in gathering data and then produce compliance documentation will inevitably be proven to be a wise one, if even in the short term there is some practical and fiscal pain in purchasing and implementing the system.

This is where knowing the unknowns can pay dividends. I worked with a very large organisation recently that was feeling under pressure to come up to scratch from a compliance viewpoint. The IT infrastructure was (and indeed is) huge, and quite frankly systems, servers, networks and deployments ran away with themselves for a number of years. The IT management was feeling overwhelmed and needed to try and get a grip. To that end they installed and configured some automatic discovery tools to try and scan the network to see how it matched with their “official” documentation. The scale of additional network segments, hidden wireless access points, secret departmental databases and a wealth of other unauthorised IT was frightening.

This shook up the management and lead to a far more structured planning and network management process. Luckily they managed to get most of these issues addressed prior to a looming audit.

Compliance adding value
We, as information security professionals, need to be adding value to the business. Instead of being seen as the people that say no, we should be a conduit to ease the implementation of compliance systems. By understanding not only the technical challenges of compliance requirements but also the business context we can be seen to add value from the off. The good news is that, as we have seen, investing in compliance can also help us deliver a secure working environment. That said, it is beholden on us to ensure the business really understands the difference between compliance and security but at the same time sees the improved business case of delivering appropriate security projects on the back of a compliance requirement. Information technology can be notoriously complex and we often see business managers chased away from involvement in decisions related to technology. Whilst this may be appropriate in very narrow technical decisions it is important that business understands IT and how it is benefiting the business.

From a compliance perspective it is very easy for the business to be frightened by talk of liabilities, whilst technicians appear to spend budgets with limited care for the overall business benefit. When considering IT compliance, it is imperative that a strategic approach is taken based on clear, rational thinking. Many businesses have rushed into a technical solution that was sold as solving compliance issues only for them to quickly realise the limitations of the product.

IT security professionals have a responsibility not only to define an effective technical solution but to ensure that the solution is developed and deployed to mitigate fully the exposure and risks facing the business. Businesses must recognise that IT security is not only an important aspect of today’s business requirements but a permanent feature, the importance of which will only grow as the rights of the individual are ever more politicised and enshrined in EU and national law.

Data is either static or on the move. In both cases businesses must be able to secure it and to demonstrate to all parties that it is doing so. In our industry nothing stays still for long.

A word of caution now needs to be sounded about cloud-based systems and compliance. The race to the cloud has seen a number of organisations fall foul of data protection regulations and issues such as data privacy. Of course the cloud delivers some interesting business benefits but these must be balanced against the associated security and regulatory issues—joining the dots between security and compliance initiatives when talking about cloud computing can be very tricky.

The good news is that aligning information security and compliance, although a challenge, is probably getting easier now than it was up until a couple of years ago. The availability of tools to help in this process should reduce the compliance headache and help us get some value out of the compliance process.

New compliance requirements
We have seen new compliance and legislative requirements continually emerge in response to political initiatives, market dynamics and the need to manage new technologies.

Although many of these were not directly aimed at IT systems it is inevitable that such systems will be used to transport, store and manage data that will be subject to audit and control. There will therefore be a need for data to be held and moved demonstrably in a safe and secure way such that integrity is retained.

Examples include the UK’s smart metering initiative, where household energy meters will be upgraded to devices connected to a network and data transferred automatically to central billing facilities. Requests for data privacy comments have been made by OFGEM, the energy regulator. Although a lot of existing regulations and laws such as the Data Protection Act will be applicable it would not be surprising if tailored requirements emerge.

Effective governance that protects all constituents and demonstrates compliance and clear corporate responsibility will become an increasingly key component of data-related business solutions. Increasing awareness of the consequences of non-compliance will drive requirements for transparency and complete end-to-end visibility of data movements within the enterprise and, ultimately, throughout the value and supply chain.

Does compliance = MOT?
I will leave you with one last thought. Here in the UK, after the second world war, lots of people were driving cars that were in pretty bad repair—brakes were poor, lights were damaged and steering was often ropey. This lead to accidents and injuries that could have been prevented. In 1960 the Ministry of Transport introduced a compulsory test, now commonly called the MOT,  on all vehicles over 10 years old in an effort to ban the most dangerous cars from the road. Over time the age of annual tests reduced to its current of 3 years and the breadth and depth of the MOT has now expanded to incorporate new technologies such as catalytic converters.

Is the growth in IT related regulations and compliance requirements following a similar trajectory to the evolution of the MOT test?

All in all we now see far fewer old bangers or clunkers on the road than at anytime in the past and I wonder whether we will benefit in seeing fewer data breaches and security lapses as computer systems are put through regular audits or MOTs.

Of course the mistake many people make when buying a car is to assume that a current MOT certificate is proof that a vehicle is roadworthy. Of course it isn’t—all it means is that at the time of testing the car was able to pass the MOT test.

In a similar way a computer system may pass an audit but very rapidly collapse into a state of non-compliance due to mismanagement. Constant attention to audit and compliance is the only sensible way to manage these needs.

Who knows, with the development of decent compliance and regulations we may see less dangerous IT systems and fewer data loss accidents and mishaps!

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 20th December 2010 Copyright Bloor Research © 2010

It is time of year when we are expected to make predictions about the following year. My predictions for next year are, in no particular order:

1. We won’t see any less hype next year. Probably more.
2. Confusion will continue to spread, mostly because of 1.
3. Cloud computing won’t take over the world.
4. The advocates of cloud computing will say that it is taking over the world (see 1).
5. Most people won’t be much clearer about what cloud computing is and what it isn’t and what the different types of cloud computing are (see 2). For example, it needs to be understood that XaaS (something as a service) is not the same thing as cloud computing and that there are (maybe) 3 types of cloud computing: public, private and hosted, where the last of these is effectively a private cloud that it is run for you by someone else. But what is the difference between a flexible on-premise infrastructure and a private cloud? And what is the difference between an outsourced infrastructure and a hosted cloud? Beats me.
6. We will run out of letters to put before aaS (see 2). Just kidding. I wonder how many have actually been used up?
7. Virtualisation will continue to be the next greatest buzz word; at the latest count applying to at least four different technologies (see 1 and 2). Currently we have desktop virtualisation, server virtualisation, data virtualisation (which refers to having a virtual data model and is therefore completely different) and we are about to see the emergence of the polar opposite of server virtualisation (making one big system look like a lot of small ones) whereby you make a cluster of small systems look like one big one, which will also use the v word.
8. We will hear lots more about big data (see 1). From the amount of noise about it (see 1) you would think big data was the number one issue in data management. It isn’t. It is certainly important for some companies but those companies are a relatively small fraction of the total. Most companies are more concerned with mundane issues like performance and meeting user demands for new reports than they are with big data. But big data means big bucks, particularly if you are a disk manufacturer, so expect more 1.
9. In order to meet the demands of big data there will be more sets of initials: SQL, NoSQL and NOSQL aren’t nearly enough: someone will certainly invent some more (see 1 and 2).
10. The number of proprietary data warehousing vendors will fall though not enough to compensate for the growth in NoSQL, NOSQL and other initial-based open source database vendors claiming to address the big data problem.
11. It won’t get any better in 2012 so you might as well enjoy 2011 while you can.

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 17th December 2010 Copyright Quocirca © 2010

‘Tis the season to be jolly.....careful online. Not only is there a huge amount of digital commerce traffic in the run up to the Christmas holiday season, but there are various nefarious ‘cyber’ activities affecting major websites and the cracking of passwords on some social networking sites.

From phone hacking (phreaking) to social engineering, hacking and malware, there have always been those wishing to exploit network and individual vulnerabilities. Passwords, the first line of personal protection for any computer user, have been in use for several decades, but the internet opened up new risks, especially now that so many destinations require user registration. Not only do people do more online, they are signing up to a multitude of services from retail and social media to dealing with government bodies and utility providers, each service requiring a user name of some sort and a password.

Managing this is becoming a nightmare and as news stories such as the recent breach in social networking service Gawker revealed, too many people have too simplistic a view of passwords. So the slowdown and holiday season presents an ideal opportunity for reviewing and changing a few.

So what can a user do to make a password more secure? Well, there are many widely recommended good practices:

• Make sure the password is sufficiently long—8 characters is a good minimum
• Use a mix of upper and lower case letter, numbers and other symbols.
• Have different passwords for different websites or services
• Change passwords regularly, (or better still, at random times)
• Avoid names, date of births or other memorable numbers like car registrations, national insurance etc
• Make substitutions eg ‘3’ for ‘e’ or ‘$’ for ‘s’
• Add related suffixes or prefixes—eg ‘shop’ to the front of an e-commerce password

Of course this is not infallible; passwords can still be cracked with brute force algorithms or can be intercepted if transmitted in ‘clear text’ and are vulnerable to the visible eavesdropping of ‘shoulder surfers’. It should also be remembered that a ‘Colt 45 beats four aces’ and real security requires more than just a clever password or two.

There is also the problem of user forgetfulness, and laziness. Many systems that force regular password changes find that the users either shuttle between two favourites or simply increment a counter at the end of the password. Passwords that are too difficult to remember might need continual resetting and this process is vulnerable to interception.

Writing passwords down used to be frowned upon, and certainly the case of a user at a major telecoms company writing a password on a sticky note then attaching it to the side of his PC did not go un-noticed. However, if the written passwords are physically protected and kept safely out of sight, this may not be as bad an idea as first thought. It certainly is better than storing them all in a word processing document, and is probably at least on a par with other forms of electronic password key safes since it is at least a separate mode of storage to digital.

If memorable without crack-able is the goal, then a decent starting point is a one-liner with substitution. For example, take a memorable film, book or music title or quote (“Do they know it’s Christmas time at all”), use only the first character in each word (“DtkiCtaa”), add a prefix for use on a mobile carrier’s website (tel:DtkiCtaa), then substitute in your preferred way (“t3£:Dtk1Ctaa”). It might look a bit long, but after typing a few times it will sink it and it might be rather difficult for someone to snoop and remember over your shoulder on a train.

Stick with the same idea, but with different prefixes and perhaps one-liners along the way and that should be more secure and less forgettable. Merry Christmas and a Happy and secure New Year.

By: Simon Holloway, Practice Leader - Process Management & RFID, Bloor Research Posted: 17th December 2010 Copyright Bloor Research © 2010

Last week I posted a short blog post about a collaboration between NXP Semiconductors and Google to provide an open source software stack for NFC. This article looks at this announcement in a little more detail.

In a nutshell what is this announcement about? Well, firstly, the NFC stack will be fully integrated and validated on Gingerbread, the latest version of the Android platform. The other piece of the announcement relates to Google integrating NXP’s NFC controller (PN544) into its newly launched Nexus S phone, co-developed by Google and Samsung, offering users access to NFC based services and applications. Using natural touch gestures, NFC devices can easily pair with accessories, interact on a peer-to-peer level to exchange data, and connect to a huge installed base of reader and tag infrastructures. Nexus S will offer consumers immediate access to read NFC tags.

What does this mean? For developers of applications for Android it means that they are now able to access an open source NFC implementation, giving them a faster time to market and lower implementation and development costs. NXP have agreed to help drive the development of new applications that extend the touch interface of mobile applications beyond the devices screen.

Launched in 2009, the PN544 is, according to NXP, the world’s first truly industry standard NFC controller. It provides a fully compliant platform for handset manufacturers and operators to introduce NFC devices and services. The NXP PN544 chip is fully compliant with all released NFC specifications on the Single Wire Protocol (SWP) connection with the SIM and the Host Controller Interface (HCI). Features include:

• Small footprint for size optimisation
• Optimised for low power consumption
• Optionally working in Battery Off and Battery Low modes
• MIFARE 1K/4K Reader/writer functionality enabled in host baseband
• Optionally available with an modular, generic and platform independent software stack
• Optimised antenna designs for best-in-class RF performance

Eric Chu, Mobile Platforms Program Manager, Google, stated: “With NXP's contribution, the introduction of NFC in Android provides developers, service providers, and device manufacturers a game-changing opportunity to deliver new services while enabling users to interact with each other and the physical world in ways previously not possible.”

NFC is a market proven technology co-invented by NXP in 2002. In 2004 NXP co-founded the NFC Forum to lead the collaboration with all industry stakeholders and help standardise the technology. NFC technology evolved from a combination of contactless identification (RFID) and interconnection technologies. NXP have been ranked as the number one contactless IC vendor by ABI Research for three years in a row.

By: Gerry Brown, Analyst - Digital Marketing & CRM, Bloor Research Posted: 9th December 2010 Copyright Bloor Research © 2010

Facebook is a phenomenon. Founded in 2004, it now has 600m+ active users (as of September 2010) c. 10% of the WORLD’s population. It will add around 300m users during 2010. That’s about how many people live in the whole of the US. Not that Facebook is a US phenomenon; 70% of Facebook users live outside of the US.

Number of users is one thing, actual usage is another. This is where Facebook gets really scary. Fifty per cent of Facebook users log onto Facebook everyday for 30+ minutes. People spend over 700 billion minutes per month on Facebook. So it’s sticky, which advertisers love.

The mobile revolution is fuelling Facebook’s growth. Facebook has 200m+ mobile device users. Having more ubiquitous access, they are twice as active as non-mobile users. All this for a relatively tiny software company of 1,700 employees that is dwarfed by the size and resources of the likes of Microsoft or Oracle.

So what makes Facebook so successful? Well firstly, Facebook believes that human interaction and sociability is a natural and normal human condition. This means they start their software development from the premise of ‘how does this product help people to communicate and collaborate?’

For example, Facebook’s first products to market offered relatively low functionality. Pictures weren’t shown in high definition and you couldn’t even move them around. It didn’t matter though because the product was easy to use and the pictures were easy to share with others. ‘Social’ is the startpoint for software development rather than functions, and is deeply embedded in all Facebook’s products.

CEO Mark Zuckerberg parallels this consumer-oriented mindset with that of enterprise software vendors. He believes that enterprise software vendors are more concerned with “a features checklist rather than what is really good to use”. Few analysts would disagree. It is rare indeed to find users raving about a piece of enterprise software like Facebook users do. However, that being said, Tableau, QlikTech and others have been making moves in this direction.

Zuckerberg goes further: “if you build a product that people love you can make lots of mistakes”. He means that users will forgive you if you build a product around the needs of people, and which is engaging, enjoyable and fun to use.

Facebook spends a lot of time trying to keep the user interface simple and intuitive, as Apple does. Unlike Apple, Facebook (which develops on Open Source platforms such as MySQL) also tries to be ‘open’ so that users can access and connect to a wide variety of services (including Facebook’s catalogue of 550,000 applications). This is true from a technical perspective, but also for user adoption. There are no user sign-up qualifications—apart from having to use your own real name rather than hiding behind an alias.

Facebook understands that it is at the forefront of a massive shift in tech marketplace dynamics—and wants to keep it that way. Every day their executives have intellectual debates about such issues as privacy, searching to better understand and shape trends, rather than to react to them. Facebook’s two most important corporate values are “move fast and be bold”.

Facebook may be run by a group of people who look like they just got out of High School (Zuckerberg is still aged only 26), but it should not be underestimated. Facebook has tapped into (and to some degree created) a rich vein of IT-enabled social interaction that few legacy software vendors have been able to exploit. The combination of intellectual zeal, ambition and teamwork; backed by top industry veterans (such as Netscape’s founder Marc Andreessen) has created a corporate culture that will be difficult for rivals to replicate.

Most importantly, Facebook has demonstrated a fanatical desire to understand and make sense of the fast-changing market environment around us—and convert that understanding into new products that are truly customer-centric, easy, social and fun to use. No wonder its dazzling speed to market and excellent execution is striking fear into rivals. With good reason.

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 8th December 2010 Copyright Bloor Research © 2010

In October, Martha Lane Fox, UK Digital Champion, wrote to Francis Maude, Minister for the Cabinet Office and Paymaster General, with the results of a strategic review of DirectGov he had commissioned.

I enclose some short excerpts from her letter below.

The letter and Francis Maude's positive response are well worth reading and can be found at the Cabinet Office Newroom http://www.cabinetoffice.gov.uk/newsroom/news_releases/2010/101122-defaultdigital.aspx.

The major thrust of the recommendations is "to improve citizens' experience of key transactions". I understand this to mean that usability and accessibility need to be improved. The need for improvements in accessibility were inadvertently highlighted when the report was first published on the web as an inaccessible PDF file. When I reported this error to the webmaster the response was a rapid 'mea culpa' and an agreement to resolve it as soon as possible.

In general I agree with the suggestions in the report as it suggests ways of:

• Making it easier for citizens to navigate around and through the government websites.
• Reducing the cost of providing the various services.
• Improving the quality of the services, including usability and accessibility.

The simple answer to all of this is to take the hundreds of existing government websites and centralise them under the DirectGov banner. In the process provision, control and technology could all be centralised and simplified.

I suspect that reducing the number of websites is certain to improve the services. However, I have seen many reorganisations in my business life, and I have always been struck by the fact that the proponent of the reorganisation always explains the benefits that will accrue but never seems to consider what may, or will, get broken in the process. I believe what is likely to get broken is the ability of individual parts of the government to react quickly to changes in circumstance or opportunities. The new structure will be big, inevitably bureaucratic, and liable to stifle innovation.

The intention of the new structure is to enable a citizen to go to one place whatever the issue. It is not clear exactly how wide the net would be, for example would it include the NHS, Local Government, the Citizens Advice Bureau or the remaining Quangos, etc. If it does then the structure is gargantuan, if it does not then it cannot meet all the requirements of the citizen.

Getting the balance right between centralised organisation and control, and flexibility for the departments, is going to be the major challenge for the new CEO for Digital (see recommendation 4 below).

I will watch the progress with interest and report back on a regular basis.

Extract from Martha's Letter:

"You asked me to oversee a strategic review of Directgov and to report to you by the end of September. I have undertaken this review in the context of my wider remit as UK Digital Champion which includes offering advice on "how efficiencies can best be realised through the online delivery of public services." This means that I have not reviewed Directgov in isolation but as part of how the government can use the Internet both to communicate and interact better with citizens and to deliver significant efficiency savings from channel shift. This letter sets out my findings and key recommendations.

Summary of Key Recommendations

1. Make Directgov the government front end for all departments' transactional online services to citizens and businesses, with the teeth to mandate cross government solutions, set standards and force departments to improve citizens' experience of key transactions.
2. Make Directgov a wholesaler as well as the retail shop front for government services & content by mandating the development and opening up of Application Programme Interfaces (APIs) to third parties.
3. Change the model of government online publishing, by putting a new central team in Cabinet Office in absolute control of the overall user experience across all digital channels, commissioning all government online information from other departments.
   • Departmental experts will still produce much content, on a commissioned basis.
   • Over time, departments will stop publishing content to their existing sites.
   • Any savings from the reduction in duplication should remain in departments, once transition costs and ongoing funding for the new central team have been taken into account.
   • Ultimately, government should use just one Internet domain, which could be direct.gov.uk or hmg.gov.uk .
   • A shared, agile, cost-effective suite of web services should replace existing departmental web publishing infrastructure.
   • Put more effort into syndicating government content across the third party websites
4. Appoint a new CEO for Digital in the Cabinet Office with absolute authority over the user experience across all government online services (websites and APIs) and the power to direct all government online spending."

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 3rd December 2010 Copyright Bloor Research © 2010

For anyone with a disability, navigating a website is likely to take longer than it would for a fully able person. If you have very good eyesight, good hand-eye coordination, the ability to scan text and images quickly, and an understanding of how the Webmaster's mind ticks, then with a few quick moves of a mouse and a few deft clicks you will get to the information you require simply and quickly. If, on the other hand, you have to use a screen magnifier and can only use the keyboard you can spend a frustratingly long time finding the link you are interested in, and this will be repeated for each page you have to traverse to get to the information, or process, that you need.

There are several ways in which a website can be made more navigation friendly, including:

• A well structured, understandable menu hierarchy.
• Jump to, skip to, links to the most important parts of a page.
• A simple heading structure within a page.
• Potentially an A to Z of all the website.
• A search function.

But none of these are as easy to use as asking a real person questions like "How do I pay my parking fine?" Or "What time are the trains from London to Cambridge next Sunday morning?" The real person may be able to answer the question immediately or may need to ask you some additional clarification questions, but you will get to the correct answer or procedure very quickly.

The Virtual Zone (http://www.thevirtualzone.co.uk) now provides consultancy and software to create virtual assistants that can provide the ease-of-use of a real telephone operator within a website.

The software provides the ability to analyse natural language and extract the salient information from the question and then initiate:

• A direct connection to the relevant webpage.
• A structured question-and-answer session similar to those used by real telephone operators.

The consultancy is needed for the initial analysis of the type of questions that may be asked by visitors to the site and how the relevant answers can be retrieved from the site.

When the virtual assistant is initially put into production it is expected that it will be able to answer about 80% of the questions put to it. The software records all the questions and answers in a database, which can then be analysed to see how the process can be improved. This learning process should quickly bring the hit rate to above 95%.

Because this technology greatly reduces the number of links traversed to get to the answer and is also a human friendly interface it will appeal to all users; but particularly those who find using the Internet difficult, either because they have a disability or because they are not that familiar with the technology.

I have played with several sites that include this solution and have been pleasantly surprised at how easy it is and how quickly I found the information I was looking for.

To make the technology as user-friendly as possible it is important that the function is well signposted so that a new user to a site will be immediately aware of its existence. This probably requires that it is near the top left-hand corner of the homepage, and also that it is signposted by a ‘jump to' link at the very top of the page (those of my readers not familiar with this concept it is a link that is read out by a screen-reader that says something like "jump to virtual assistant", the user can then hit enter and go straight to the requisite part of the page).

The technology is already being used in a variety of different types of site including:

• Transport, for example Lisa at National Rail Enquiries (http://www.nationalrail.co.uk/).
• Shopping, for example Anna at IKEA (http://www.ikea.com/gb/en/), which also has an audio output which really improves the experience.

I would recommend trying out a few examples to see how you could adapt the technology to your industry and website.

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 23rd November 2010 Copyright Interarbor Solutions © 2010

Three megatrends are shaping the next generation of successful businesses and governments. We're talking about pervasive mobile applications, highly responsive cloud-computing models, and knowledge-adept social collaboration.

Indeed, by the year 2020, The Economist newspaper predicts there will be two trillion devices connected to the Internet. And taking a look at where we are right now, McKinsey Quarterly reported in August that in 2010 some four billion people have cell phones, and 450 million have access to a full web experience.

Moreover, Jupiter Research reports that by 2014 there will be 130 million enterprise users involved with mobile cloud activities. Not only is access pervasive, but the amount of information available is also exploding. The Economist again reports that in 2005 mankind created 150 exabytes of digital data … and in 2010 we will create fully eight times more data.

These changes are at a pace they’ve never seen before as they address them and try to drive these into their business or government environments.

As these trends literally rearrange business ecosystems, a gap will surely emerge between the companies that master change -- and exploit enabling technologies -- and those that fall ever further behind.

For those that do step up to the challenge -- expect a relentless emphasis on rapidly recurring innovation to meet dynamic customer and citizen demands.

Our latest BriefingsDirect podcast therefore focuses on how these trends -- and rapidly evolving customer, citizen, and user expectations -- are newly impacting the enterprise. We also examine how technology advancements are making it possible to drive innovation to meet these new demands for instant gratification.

Please join HP executive Dave Shirk, Senior Vice President of Worldwide Marketing at HP Enterprise Business, as we explore how HP is working to make headway, so that the next few years bring about a generational opportunity -- and not a downward complexity spiral. The discussion is moderated by BriefingsDirect's Dana Gardner, Principal Analyst at Interarbor Solutions.

Here are some excerpts:

Shirk: We're seeing a lot of shift going on in the marketplace right now. When we look at where consumers are driving business or where citizens are driving government, it's fundamentally changing the way they operate. We've seen three core things come out.

The business models are all starting to change the way in which people approach markets across the globe. That's having to really rethink the ways in which they've approached them versus traditional methods.

The second thing we see is this whole shift in mobile computing meeting cloud computing and the enterprise trying to figure out exactly how to take best advantage of that to create this competitive advantage. Then, the overall demographic piece weighs into that.

We've seen the rise of the millennials, as they're being referred to. All of these things are forcing business and government to stop and say, "You know what, if we're going to grow or we're going to create a service differentiation, we're really going to need to do things differently and we're going to have to do it way faster than we've ever done it before."

According to the Society for Engineers, you now have over 800,000 graduates in China, over 300,000 graduates in India, 100,000 some in Japan, etc. It's over the last 10 to 12 years that each of those graduation rates has occurred. They are part of the workforce now.

When they went through that process, they were always connected and they always were involved in a social network-based environment. They have a level of their lifestyle that is all tied to this always-connected environment. When you think about the ubiquitous computing that that has brought to them, as they enter the workforce, they are looking at things a lot differently than ever before.

They bring new ideas. They bring new ways to that. They're looking for businesses that will support that kind of methodology and structure. ... So, when we think about that Gen X group that's out there, we see them driving an enormous part of this change.

The last statistic I saw was that they are now over 50 percent of the workforce. The analogy that's always used is that, to them, being connected and always involved in some type of networking-based collaboration or information sharing of some sort is about the same as it is for you and me to pick up our remote controls and turn on our television sets. That's already having a very profound effect on how business and government are changing and the expectations that are out there in the marketplace.

It's this [demand for] immediate or instant gratification: "If I can't get what I want in the following way, I’ll find the business or government environment where I can." While the government piece maybe a bit harder to change, the business piece isn't, and so the competitive pressure to serve this audience, both as the consumer and also as employees, is a big part of that shift.

We see technology as the cornerstone to being able to solve some of these trends and some of these challenges.

We call that the "Now Problem." They want this, they want it done now, and they want it to work a certain way. We see technology as the cornerstone to being able to solve some of these trends and some of these challenges.

These changes are at a pace they’ve never seen before as they address them and try to drive these into their business or government environments.

This is probably best represented in the words of Professor Gary Hamel, who is the foremost business visionary person out there in the marketplace. In his book, Future of Management, he described it as "whiplash change."

That's very much the case when I speak with our clients both on the business side and the government side. That's exactly what they're sitting there and thinking and working through right now.

Role of technology

We look at the technology piece of [the change] and say that you really can't [react] any other way -- the pace of it, the speed of it, and some of the complexity associated with it. For a long time, business has tried to use labor as an arbitrage to try to work their way through this and just throw bodies at it. That's quickly dissipating. The speed and the connectedness that we see, and the confidence level that all of these types of services require make it no longer possible to go through that.

What we see is IT completely embedded in the business. Over the next couple of years, that's going to continue to be the trend and the strategy that will play out in the way in which business and government work this. Ultimately, that's going to be the differentiator that drives an ability not only to serve these constituencies but to out-serve them, and that's going to be the name of the game.

[The solution] starts with a desire to change and to drive innovation in a different way. We sit and we think about the fundamental change in this. We talked for years that the business was focused on business processes and business process reengineering. While that’s still very important, it isn't going to go away any time soon.

It's becoming obvious that the bigger driver and the more significant trend is the information process, understanding the segments of business or government that need to be addressed. What their needs are, what they want, what they want to talk about, the ways in which they want to interact is all part of this change that’s taking place.

Closing the gap

So, as we start to pull back and step back from this, we look at that and we look at this vision that we have for the Instant-On Enterprise and how we’re enabling end-users to become a part of that, how we’re enabling businesses and governments to provide that type of capability. It really is about closing the gap between what IT can provide and what the business needs to be able to serve each of those audiences.

What we’ve launched with this vision is to put the foundations in place to make that possible and take a journey with our clients both from the business side and government side and help them move down that particular path, find ways to navigate these challenges and these trends, and to out-serve and to over-serve all the audiences that they need to meet the needs of.

[This change] is inevitable. Different businesses and governments will have, at different times, one of these four elements be more important or more significant to them at different points. All of them share the innovation requirement. We see that in all things.

Our view is that the innovation has to take place throughout that information process. It doesn’t matter whether it happens back at the data center or at every touch point. Innovation has to take place throughout for the business to meet the needs of those segments I’ve referred to earlier -- how it services it, how it conducts itself, and ultimately how it meets our needs or exceeds the needs of the audiences.

Agility really is about instant expectations, and can we turn things on and off, instead of just setting them up for a rainy day and hoping that they will be used.

Agility, optimization, and risk all vary in and out with innovation in terms of their need and their level of importance.

Agility really is about instant expectations, and can we turn things on and off, instead of just setting them up for a rainy day and hoping that they will be used. A big part of technology’s trouble in the past was that we created all of these things and we never had a plan for ending their lifecycle or turning them down slightly, so that we could turn up other activities or other possibilities in an instant-on environment and an instant-on enterprise. A core part of the vision that we see is being able to drive that agility to meet those changing business needs.

When HP looks at the Instant-On Enterprise, the enablement of that is really a journey, and we’ve got to figure out what pieces make the most sense. There are some things that are much easier to focus on first and then, over time, to gain more and more of an Instant-On nature.

Critical success factors

Flexibility, security, speed, automation, and insight, those absolutely are attributes that we look for. We see them as the critical success factors in the way in which every part of the environment that IT leverages, drives, and embeds in the business has to come forward.

And yet, everybody is stuck in this mode of an enormous legacy that they have to deal with, and that gets in the way of being able to provide some of these new capabilities.

We’ve spent a lot of time and gotten a lot of expertise over the years trying to figure out the best ways to address these albatrosses that are keeping IT from being able to deal with the needs of the business. In the Instant-On Enterprise journey, that's a big part of the set of steps that we have to work through and work with our clients to make sure that they understand where to prioritize.

In the first few months that I have been here, one of the things that I've learned is that HP, as a company, has this incredible breath and depth of portfolio.

Our view is that we work with our clients and figure out ways that they can, as we say, shift that equation. How do you shift from 70 percent of that equation being focused on operational management, and 30 percent, if you are lucky, being spent on new and innovation-based capabilities to help or assist the business and its growth versus shifting it the other way? How do you get to 30 percent operational mode, and move forward with 70 percent focused on the business?

Changing business models

When I spend time with clients and listen to them, a big part of what they're asking for is, "We’ve got these pressures. We're seeing the business models change and we're experimenting with some things. We're seeing the mobile and the cloud computing pieces coming at us like a freight train. At the same time, we're seeing the demographic shift both on the end-user consumer side and on our employee side. We need strategic partners to help us with this. How do we navigate this? What is the way in which we should do that? HP, do you have a point of view?"

We're in a unique position, because we're the only company in the marketplace that has a full suite of consumer products, and yet we stretch all the way back through to the data center. All the capability, all the offerings, that are in between, all the services that are necessary to address each of those pieces, are contained inside the portfolio capability that HP has of hardware, software, and services.

We looked at this and said, "How do we take the best combination of that breadth of portfolio and bring those together in a set of solutions to best address what we are hearing over-and-over from some of the research that we’ve done and listening that we’ve done with our clients?"

They need to figure out how to modernize their applications. We want to make sure that we are there and we’ve got a set of solutions for that. They’ve got huge data-center issues in terms of how they're going to transform their data centers and deal with more virtualization-based techniques and capabilities and bring networking and storage and compute power together in some fashion.

They’ve got this issue of enterprise security. They need to figure out how to secure the enterprise. I don’t mean desktops, but all points, all touch points of the enterprise -- how they build applications, how this information is accessed inside and outside of the organization, and then fundamentally optimizing that information, the ways in which you store it, the way in which you deliver it, the way in which you print it for that matter, all those pieces.

Hybrid delivery for us is our answer to the multiple ways in which a customer or client has to go through the process of building or delivering on these various technology services to their enterprise or their government.

Then, they need to underpin that by the best way to figure out how to deliver it. Do we do it for them? Do they build it themselves with our architecture, and our capability set, and our consulting expertise? What combination of ways makes the most sense to set that up?

... We help our clients work their way through that with a series of workshops that we do to get in and investigate. We ask a series of questions, do a series of exploratory-based activities that help prioritize where we think the quickest return on investment is, because all these require some level of return to feed the next one and then the next one.

Hybrid delivery for us is our answer to the multiple ways in which a customer or client has to go through the process of building or delivering on these various technology services to their enterprise or their government.

There’s an enormous amount of talk about cloud in the marketplace today. HP has been at the forefront of that, but we have a little different position. We think it’s unique and we think we're the only ones out there that are really positioned to do this, which is the concept of hybrid IT, where you’ve got a mix. You’ve got a mix of traditional on-premises-based capabilities, but then you figure out what private cloud or public cloud-based capabilities best serve your business on a global basis.

HP comes in and, unlike other companies that try to force you into a one-size-fits-all structure, we sit down with the client. Our unique IP in this area is that we have an incredible depth of intellectual capital in this particular area, which is helping the clients figure out the best balance or mix of the delivery methods.

We can help them build it. They can host it or we can host it for them. We can provide those services from our public cloud-based capabilities or from our private cloud based capabilities. We really don’t care, if that blend changes over time. That’s the beauty to the journey to this Instant-On Enterprise.

Starting small

Our data says that most customers still start with a small private cloud implementation to really understand the value of the cloud and demystify it. We’ve said that there is going to be something after cloud. We don’t know what that level or that style of computing is going to be, but our architecture is built such that we’ll be ready for that. For our clients, we’ll help navigate them through each of these pieces, and that’s the important thing for us.

We have our new HP Hybrid Delivery Strategy Service, which is a place for a client to start, get a basic orientation, sit down and understand kind of where we think they might consider beginning that journey. So that, along with a number of other capabilities that we have to help them through these various workshops, I think is really the best place for them to start.

There are a whole series of workshops globally that our teams are set up to do, everything from a small couple-of-hour based interaction to a full suite of in-depth analysis and consulting engagements to work with a client. ... We ask a series of questions, do a series of exploratory-based activities that help prioritize where we think the quickest return on investment is, because all these require some level of return to feed the next one and then the next one.

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Learn more. Sponsor: HP.

You may also be interested in:

• Shoemaker on how HP CSA Aids Total Visibility in Services Management Lifecycle for Cloud Computing
• HP Business Service Automation portfolio gives IT the tools it needs to compete with clouds
• HP eyes automated apps deployment, 'standardized' private cloud creation with integrated CloudStart package
• HP adds new consulting services to smooth the enterprise path to cloud adoption

By: Rob Bamforth, Principal Analyst, Quocirca Posted: 19th November 2010 Copyright Quocirca © 2010

Despite the claims of many marketing brochures filled with words ending in ‘-ability’, there are only three real tangible benefits to consider when evaluating a product or service; value, cost and risk. When it comes to turning the bottom line from red to black – as is often the case during recession and government cuts – companies generally look to just one of these – cost cutting.  Its counterpart – value growth – whilst popular during boom years is far harder to find in a downturn. It requires companies, and more often individuals, to go out on a limb; something they are much more wary of as they look to protect their own position.

This leaves the third benefit – risk mitigation. On the face of it this seems a negative subject only to be addressed when something goes horribly wrong.  A catastrophic disk crash introduces many to the concept of regular backups. A security breach highlights the vulnerability of data assets. A volcanic eruption highlights the value of alternatives to air travel and buying comprehensive travel insurance.  Adaptability and flexibility help reduce risk; these ‘-abilities’ in particular can deliver real benefits, allowing agile organisations to pounce on unexpected opportunities as well as stave off unforeseen problems.

Hence, when problems create opportunities, a lack of flexibility can often get in the way of capitalising on them.  An example of this was apparent during the travel crisis as a result of the ash from the Icelandic volcano eruption.  It was thought that some travel operators were profiteering by ramping up the cost of one-way ‘cheap’ tickets by hundreds of pounds.  However, those travelling would have been surprised to see quite a few empty seats on the plane.  Presumably, those with tickets booked as returns but unable to travel on the outward leg didn’t show up, leaving a raft of available seats only identified at the departure gate.  Many companies with tight booking processes appear to have no way of reselling those seats as ‘standby’ on a first come, first served basis at the airport – or over the web.  Filling even 5 extra seats on a plane would have been massively profitable for the airline concerned.  It might be tricky to introduce with current systems, but a more adaptable model of reselling empty seats might have done wonders not only for the bottom line but perhaps also avoiding the negative media perception of air travel that was created by the crisis.

When problems occur, it also leads to a positive view of those who can cope in these sorts of crises – for example, when large numbers of workers were disrupted by apparently unexpected heavy snowfalls in the UK in early 2010 (well, it was in winter).  Mobile phones, laptops and remote access to enterprise systems are all now in widespread use.  Those organisations that had implemented more flexible solutions or worked with more flexible suppliers, were able to manage the sudden increase in user load as everyone equipped to occasionally work remotely did so all at once.

It is not only limitations or constraints in the technology that amplify problems when a glitch occurs, but also lack of flexibility in service offerings, levels and tariffs.  Businesses should no longer simply look for the cheapest options, even during a recession, but those that deliver the best overall value.  This means putting a value on flexibility.

Flexibility can be supported by appropriate use of suitable technology, but it really comes into its own when there is the right commercial framework backing it. No wonder then that ‘as a service’ models are springing up to offer a pay as you go model, where incremental changes in either direction are simpler to make.  Whether we call this cloud, hosted, managed or on demand doesn’t really matter, the value is about pushing the complexity and upfront costs onto someone outside who’s a specialist, and then renting the service back from them.

Need more software licenses to cope with a sudden surge or more bandwidth at the end of the month, or perhaps fewer desks and phones as you’ve moved office workers to a ‘hot-desking’ model? No problem – the service provider will “flex”

This flexibility goes further, as the rented service can be delivered ‘anywhere’, no longer tying its use to specific locations or office premises. Mobile working, not as in working on the move, but moving the place of work, becomes a doddle right?

To a point, but with all of the benefits of flexibility, there has to be some consideration and evaluation of what has been given up to get it.  The main challenge is dealing with a loss of top down control. When something critical is outsourced, hosted on an external server, or available anytime from a cloud at the end of a network cable, can you really trust that the network or service provider can deliver the quality of service you need, or that your data is really secure? These are assurances that must be sought, rather than seeing such services as a money saving exercise, and there are now many companies able to deliver safe, secure and reliable services.

More mobile and flexible working looks on the face of it to benefit both employer and employee, but there are caveats, and again it boils down to quality of service and assurance. Management tools and processes need to evolve to convince some managers that employees are not simply engaging in social network conversations, playing games or surfing the web while ‘working from home’. Similarly employees need to be assured that “off” means “off” and expectations of 24/7 availability, simply because the network is there, are not fair.

Applying suitable metrics for measurement and controls to ensure goals are met will become an increasing challenge in dealing with both employee and service provider flexibility.  The old metrics of hours in the office and narrow objectives will no longer work for many individuals, just as network outages will no longer be sufficient for measuring service provision. Part of the problem in working out new business goal oriented metrics is that companies have been based and built up on a rigid top down hierarchical command and control system.

This is where flexibility still needs to be applied by many organisations. When it is perhaps some of the apparently chaotic concepts that have emerged in IT and communications – the internet, open source, ad hoc collaboration, social networking – will ultimately lead to a new flexibility in management systems.

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 17th November 2010 Copyright Interarbor Solutions © 2010

The rapidly changing and fast-growing opportunity for more businesses to reach their customers and deliver their services via mobile applications is at a crossroads.

Over just the past two years, the demand for mobile applications on more capable classes of devices, such as smartphones and tablets, has skyrocketed. Now businesses need to figure out how they can get into the action.

Small and medium-size businesses (SMBs) especially need to reevaluate their application development and end-user access strategies to be able to deliver low-cost yet impactful applications to these newer devices. This goes for reaching employees, as well as partners, users, and customers.

Hopefully, there's a shift in the skills required to put these applications on these devices and distribute them. The emphasis on capabilities is moving from hardcore coders -- with mastery of embedded platforms and tools -- to more mainstream graphical and scripting-skilled workers, more power-users than developers.

This sponsored podcast explores how mobile application development and the market opportunity are shifting, and how more businesses can quickly get into the mobile applications game and build out new revenue, share more data, and provide better direct customer access in the process.

Our panel consists of Roger Entner, Senior Vice President and Head of Research and Insights in the Telecom Practice at the Nielsen Co., and Wayne Parrott, Vice President for Product Development at Genuitec. The discussion is moderated by BriefingsDirect's Dana Gardner, Principal Analyst at Interarbor Solutions.

Here are some excerpts:

Entner: About 50 percent of all devices being sold in the US right now are smartphones. We expect smartphone penetration to be at about 50 percent by the end of next year. Almost 60 percent of smartphone owners are actually using applications. That’s a huge percentage.

We're now at that sweet spot where it makes a lot of sense for businesses to have applications both for their consumers and their employees alike, because there is enough of an addressable base there.

We just launched our second edition of our Mobile Apps Playbook. But to quote numbers from there, year-over-year second quarter '09 to second quarter '10, smartphone penetration in the US went from 16 percent to 25 percent.

Now, we have 3- and 4-inch screens that are actually readable. We're not just merely replicating a desktop experience, but actually tailoring it to the device and working with the strengths of the device rather than with the weaknesses.

The devices that we call now smartphones are little computers that today are as powerful as laptops a few years ago. I always say that this little thing you have in your hands, a smartphone, has far more computing power than was used by NASA to put men safely on the moon and bring them back alive.

Applications becoming easier

And now Apple, Google, Microsoft, and the others, have software development kits (SDKs) out there that make app development a lot easier than it has ever been.

If you have a talented developer or a talented person in your department, he might be able to build that internally. Or, there are now myriad development shops out there that have the capabilities to build applications and charge only a few thousand dollars -- and that's single digit thousand dollars -- to have a capable, usable application.

There are a lot more people who know how to program these things, and have good ideas of applications. There is a really good market out there to put the two together.

Parrott: We’re seeing a big move toward interest in mobile at the development side. What are the factors that’s really led to the explosion of mobile apps? It's not only the smartphones and their capabilities, but we also look at the social changes in terms of behavior.

People more and more have a higher reliance on their smartphone and how they run their lives, whether they are at work or on the move. The idea is that they are always connected. They can always get to the data that they need.

Basically, we're taking their lifestyle away from their desktop and putting it in their pocket as they move around. More and more, we see companies wanting to reach out and provide a mobile presence for their own workforce and for their customers.

The question they ask is, "How do we do that? We already have a web presence. People have learned about our brand, but they can't access this through their smartphones, or the experience is inferior to what they’ve come to expect on the smartphone."

We're seeing a big growth of interest in terms of just getting on to the mobile -- having a mobile presence for the SMBs.

Still a great deal of complexity

If you take a look at the current state of native mobile app development, it's really not much better than it was five years ago. You still see a strong fragmented programming model base, different operating systems, and different hardware capability. It's still a mess. You pretty much have to pick a subset of devices that you want to focus on.

Entner: If we take one little step back, one of the genius things that Apple has done is turn the bookmarks into an application. About 60-70 percent of all applications on the iPhone or an Android are actually glorified HTML ports. So, it's not that difficult or that demanding on the application side.

One new trend is HTML5, which is slowly but surely approaching. There has been no finalized HTML5 standard [from the W3C], but a lot of web browsers, and even mobile web browsers, have now some HTML5 capabilities. And, it will really help in the development cycle for basic applications.

Where HTML5 will not to be able to help us, at least right now, is when we try to take advantage of location-based services because there is no standard yet. They're still arguing about this one, and especially high performance graphics. But, on the standard application, HTML5 will take us miles forward and diminish the difference between the desktop and the mobile environment.

... At the same time, all of the SDKs are getting more powerful and more user-friendly. So, it's moving toward a more harmonized and more rapid development environment.

Parrott: Prior to HTML5 talking about mobile web was pretty much a joke. Mobile web was an afterthought in the phone market. You had these small, dinky displays. Most of them couldn't even render most standard HTML. What's new?

You still see a strong fragmented programming model base, different operating systems, and different hardware capability. It's still a mess. With the advent of the smartphone what you really saw was pretty much the Internet, as you experience it on your desktop, now on to your smartphone, but with even more capability.

Part of it is because HTML5 has stepped back and looked at what the future needed to be for a web programming model. To become more of a common run-time, they had to address some of the key gaps between native hardware, APIs, and web. Much of those have really centered on one of the biggest digs that mobile web had in the old days, when you were doing something, were connected, and then you lost your connectivity.

Out of the box

HTML5, right out of the box, has a specification for how to operate in an online, offline, or disconnected type mode. Another thing was a rendering model, beyond just what you see on your desktop, that actually provides a high-end graphics type capability -- 2D, 3D types of programming. These are things that more advanced programs can take advantage of, but you can build very rich desktop type of experiences on the laptop.

Then, they went beyond what you're used to seeing on your desktop and took advantage of some of the sensors that these phones have now -- accelerometers, location capability, or geolocation. APIs are now emerging as a companion to HTML5, which is a spec that will span across your desktop to the mobile phone. It's a very capable specification.

In addition, there is the movement in terms of the standards body, especially the W3C, to address mobile device API. You will eventually program in a standard way and talk to your contacts list, your cameras, video, recording devices, and things like that. That will soon be available to us in a web programming model.

What used to be exclusively the demand of the hardware API guys to do really low level, high performance bit twiddling is now going to be available to the general web programming masses. That opens up the future for a lot more innovation than what we’ve seen in past.

There is enough HTML5 core already emerging that we could start to program to a subset of that spec and treat it as kind of a common run-time that you would program across pretty much all of the new emerging smartphones as we look forward.

Entner: It's only a matter of when ... HTML5 will come. Apple and Google are at the forefront and are already launching websites and services in it. You can get HTML5 YouTube, HTML5 Google, and even Yahoo mail access. You can have the Apple website in HTML5. It just depends on what is fully supported right now.

Some browsers support it, and some don't yet. On the mobile side, it also fully depends on what is supported. If you have the WebKit engine at the core of the browser that your device is using, HTML5 is pretty widely supported.

Parrott: As we've talked to more-and-more of our SMBs, one thing that stands out is that they don't have a lot of resources. They don't have a huge web department. Their personnel wear a number of hats. Web development is just one of n things that one of the individuals may do in one of these organizations.

At Genuitec, we developed a product called MobiOne Studio. The target user is anyone who has an idea or an vision for a mobile web application or website. MobiOne is geared to provide a whole new intuitive type of experience, in which you just draw what you want. If you can develop PowerPoint presentations, you can create a mobile web application using MobiOne.

You lay out your screens, you pane them all up, and then you wire them together with different types of transitions. From there, you can then immediately generate mobile web code and begin to test it either in the MobiOne test environment, that's an emulated type of HTML5 environment, or you can immediately deploy it through MobiOne to your phone and test it directly on a real device.

If you can develop PowerPoint presentations, you can create a mobile web application using MobiOne.

With MobiOne Studio we recognized that the first thing that most companies want to do is just mobilize, just get a mobile presence, mobilize their websites, and have that capability. As Roger said a while ago, a lot of the apps you see out there are really glorified mobile websites and are packaged up in a binary format.

Second Studio phase

In MobiOne Studio's second phase, once you design and you like what you have, you have a progressive step that you can go from a very portable form to compile it down -- or cross-compile -- from HTML5 to whatever the native requirements are of that particular target app store. So, Google will have their app store, and Apple and RIM each has their own model. They are all fairly different models.

But with HTML5, you can go directly to your customers now. You can market to them directly. It depends on your way of interacting with your customers, but we have seen a number of novel approaches already from some of our customers. When any customer is in your store, you make it very easy for them to access your site, to make them aware of your mobile capabilities, lure them in, and get them connected that way.

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: Genuitec. Learn more.

You may also be interested in:

• Rise of WebKit Advances Mobile Web's Role, Opens Huge Opportunity for Enterprise Developers on Devices
• Genuitec Marks Progress with Two Milestone Releases of MyEclipse 6.5 Products
• Genuitec Expands Pulse Provisioning System Beyond Tools to Eclipse Distros, Eyes Larger Software Management Role

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 16th November 2010 Copyright Interarbor Solutions © 2010

The lives of IT admins in Windows environments should get a little easier with the launch of rPath's rBuilder 5.8 for "push-button" deployment of Windows Server instances.

The Raleigh, N.C. company's rBuilder 5.8 introduces release automation to the world of Windows Server applications. With the new software, rBuilder 5.8 earns bragging rights as a first commercial solution to address deployment automation for Windows instances and apps. [Disclosure: rPath is a sponsor of BriefingsDirect podcasts.]

The deployment challenge

For most IT organizations, deploying Windows apps into production is complex, cumbersome, and time-consuming. That complexity can lead to long delays in full deployments that leave a dark cloud hanging over service levels and business agility.

The rise of public cloud services such as Amazon EC2 has further motivated IT to become more responsive to business lines.

With its automation approach, rBuilder 5.8 is wrestling that challenge to the ground with what it calls “push-button deployment” of Windows apps. This software helps to automatically resolve dependencies to virtually eliminate deployment-time failures, automatically generate standard MSI packages that are ready to deploy, apply version control to all packaged elements, and eliminate drift between dev, test, and production release stages, says rPath.

rBuilder 5.8 also generates image output on demand for rapid deployment or retargeting between physical, virtual, and cloud environments, makes way for targeted changes for low-overhead, conflict-free maintenance, and provides a single enterprise solution for automated deployment of any application, running any platform, deployed to any execution environment -- physical, virtual, or cloud, said rPath.

There are some more resources available on the capabilities and new release: Attend a free, live webinar Nov. 16; watch a short video; read a whitepaper, and learn more.

The need for deployment speed

Deployment dysfunction is a primary source of delay in delivering IT services in response to business demand. The rPath solution also works to complement Microsoft development and operating environments, including Team Foundation Server and System Center Configuration Manager.

With some 70 to 80 percent of IT spending due to operating expenses, nearly half is attributable to deployment-related tasks. This is particularly true for Microsoft Windows environments, which constitute 74 percent of the data-center server market. If rBuilder 5.8 lives up to its promises, it could find a home in many Windows-based IT departments. And it lends a hand in migration and hybrid deployments, too.

rPath has also joined the Microsoft System Center Alliance, a partner community in support of the System Center ecosystem. The System Center Alliance provides an online community that aims to help partners collaborate on the creation of solutions for the System Center and deliver an information resource about these new solutions for customers and sales channel partners.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

You may also be interested in:

• rPath brings data center automation to Windows environments
  
• Trio of cloud companies collaborate on new private cloud platform offerings
  
• rPath offers free management tool for applications aspiring to the cloud

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 12th November 2010 Copyright Interarbor Solutions © 2010

Businesses are increasingly using cloud and e-commerce to improve how they do sales, marketing, and online transactions.

One smaller company, Tampa-based MarkMaster, has quickly moved to nearly all-paperless sales transactions, found new customers via online networks, and increased the amount of product it sells to its existing clients. This was accomplished without a lot of additional IT or business-process spending by using cloud-based collaborative business commerce solutions.

To learn more about how MarkMaster is conducting its business better, BriefingsDirect's Dana Gardner, Principal Analyst at Interarbor Solutions, recently interviewed Kevin Govin, the CEO at MarkMaster.

Here are some excerpts:

Govin: E-commerce has definitely changed our reach, which is national and international. We have a plant in Birmingham, England, that we fulfill from as well for our American-based companies. We service nine of the top 10 banks in United States. We do eight of the top 10 insurance companies. Without cloud computing, there's just no way we would have even considered doing that. ... This all has been just a godsend for us.

It's totally changed our business. I laughed a little bit at your intro, when you talked about going "paperless." One of our main product lines is rubber stamps, and it seems counter-productive to go paperless with what we do.

Yet we have changed a lot. Now, 95 percent of our orders come electronically. We have one location in the United States that services all of the US and Europe. How could we do that without some kind of cloud transacting? It just makes the most sense. Over the last 10 years, I think 99 percent of our new customers have been coming through those kinds of systems.

Most of our products are considered office supplies. So, I have to look like the big Office Maxes, Office Depots, and that kind of thing. That’s how we present ourselves. Even though we're the biggest in our industry, we're still a small company.

We deal mostly with Fortune 500 companies. We sell rubber stamps, name badges, name plates, and interior/exterior signage. It's a unique field, kind of a niche market, as rubber stamps are a mature market. But, we seem to be gaining market share, so that’s been great for us.

Top-line, our sales are growing at least 10 to 15 percent a year for the last 10 years, and that’s the same time-frame that we’ve been on e-commerce and now cloud computing. So we have to believe that that’s a lot of it. Our industry is shrinking as well. There were 1,200 rubber stamp makers, now there are 400.

Quick turnaround from cloud
We definitely use the cloud-computing models to go out and sell. There is nothing jazzy about a rubber stamp. Name badges are pretty much specified by the customers. So, we are not out there selling anything new or exciting as far as that’s concerned.

But we have changed our model, and our salespeople don’t travel with the product. They travel with the computer and they show what we can do online and what kinds of services we can provide.

The investment in hardware has actually come down over time, but we do like to keep up today with the current technologies.

We can turn around on a customer in two days, because it's just all uploading something. There are no ports to connect or anything highly technical at all.

Because both on the buyer and the supplier supply side we are having hosted solutions or in the cloud it makes it a lot easier. There used to be a real reluctance from the customers to want to put us on board, because I might only be $100,000 year in spend, and they were going to outlay a lot of IT to connect me.

Now, with cloud solutions, there is very little IT on either end. I'd imagine that it's even easier now than it was with the paper system before, because we can communicate to their end-users that we’re out here, and we’re ready to be bought from.

We work heavily within the Ariba network, and because of that, now we are an Ariba Silver supplier. So, there's a lot of pluses that go with that, and we use a lot of banner ads and things like that.

We’re posted out on Ariba’s Discovery area, so they can find us very easily, and when they look at that, they see number of connections, and we get instant credibility on top of that. Then, of course, we even use the Ariba LIVE event. That’s huge for us, because it puts us in front of all those users that are looking for somebody like us.

One of the larger banks that we deal with, when we originally started with them, weren’t even considering us as a supplier, but they found us on the Ariba Discovery network. They called us and said, "Can you really do all of this. You're a small supplier?"

We showed them our list of what we have, where we’d already made Silver. So they knew we were vetted already by the supplier and we ended up with the business. It wasn't necessarily in a RFQ kind of environment either. It was "Wow. You can do this, and you’re the supplier we want and, in our case, you’re a minority supplier." So, it was just having that all together.

Can't always be there
But, they found us on Ariba. We didn’t solicit them. I mean, we had been soliciting them, and they knew of us, but we can't always be there when the customers need these products now. It's just too hard, because our products are needed everyday. So, that came out very well for us.

Bottom-line, we have had year-over-year growth, and our customer service department has not grown, or added anybody to that staff. How does that work, because we've grown exponentially? The reality is online systems.

We proactively give them the information as to the status of their order, and they can actually see it go through our plan step-by-step. Does everybody need that information? No, but it does keep them from calling customer service. So it’s definitely changed.

Now, 10 years ago, we were 95 percent paper, and it's just totally flipped. So, you can count on your hand the overhead that this gets rid of.

We’re always talking about transacting in the cloud and getting orders and billing. The billing part is where we want our customers to go next, because it seems like the front-end integration is great, but on the back end there are 100,000 different ways that people want us to bill them and get paid—EDIs or ACH or whatever.

We see it coming. People are migrating to the pay element, so that everything is integrated, and that’s great for us. It turns money faster. I don’t deal with credit cards as much, all of which cost me a lot of overhead.

Remember, my products are $5 or $6. People buy one at a time. So, handling invoices is just a nightmare. I get 20,000 invoices every day. We need to upload them, link them, and know the bill is okay.

My clients are not the kind of clients that aren’t paying me because they don’t have the money. They're the kind of clients that aren’t paying because I didn’t do the paperwork correctly. So having that end-to-end order-to-pay integration is where we see it's coming next for us in integrating the whole cycle. Some of my larger banks have definitely gotten on-board with that and it's great, and for a small company, it changed my cash-flow as well.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 11th November 2010 Copyright Interarbor Solutions © 2010

How do IT architectures at software-as-a-service (SaaS) providers provide significant advantages over traditional enterprise IT architectures?

We answer that "Architecture is Destiny" question by looking at how one human resources management (HRM), financial management and payroll SaaS provider, Workday, has from the very beginning moved beyond relational databases and distributed architectures that date to the mid-1990s.

Instead, Workday has designed its architecture to provide secure transactions, wider integrations, and deep analysis off of the same optimized data source—all to better serve business needs. The advantages of these modern services-based architecture can be passed on to the end users—and across the ecosystem of business process partners—at significantly lower cost than conventional IT.

Joining us here is a technology executive from Workday, Petros Dermetzis, Vice President of Development there, to explore how architecting properly provides the means to adapt and extend how businesses need to operate, and not be limited by how IT has to operate. The discussion is moderated by BriefingsDirect's Dana Gardner, Principal Analyst at Interarbor Solutions.

Here are some excerpts:

Dermetzis: We have a unique opportunity to stand back and see what history and evolution provided over the past 20 years and say, "Okay, how can we provide one technology stack that starts addressing all those individual problems that started appearing over time?"

If you think of the majority of the systems out there, the way we describe them is that they were built from the ground up as islands. It was really very data-centric. The whole idea was that the enterprise resource planning (ERP) system gave all the solutions, which in reality isn't true.

What we tried to do at Workday was start from a completely white sheet of paper. The reality around ERP systems is actually making all this work together. You want your transactions, you want your validations, you want to secure your data, and at the same time you want access to that data and to be able to analyze it. So, that’s the problem we set out to do.

What drove our technology architecture was first, we have a very simple mentality. You have a central system that stores transactions, and you make sure that it's safe, secure, encrypted, and all these great words. At the same time, we appreciate that systems, as well as humans, interact with this central transactional system. So we treat them not as an afterthought, but as equal citizens.

If you go back in time to when mainframes started appearing, it was about transactions, capturing transactions, and safeguarding those transactions. IT was the center of the universe and they called the shots. As it evolved over time, IT began to realize that departments wanted their own solutions. They try to extract the data and take them into areas, such as spreadsheets and what have you, for further analysis.

ERP solutions evolved over time and started adding technology solutions as problems occurred. They started with a need to report data and very quickly realized it was like climbing a ladder of hierarchic needs. When you get your basic reporting right, you need to start analyzing data.

The technologies at the time, around the relational models, don’t actually address that very well. Then, you find other industries, like business intelligence (BI) vendors, appeared who tried to solve those problems.

The way things evolved, you started with an application, and integrations were an afterthought; they got bolted on. ... They kept on adding more and more and more layers of vendors, and the more the poor enterprise IT customers are trying to peel it, the more they start crying—crying in terms of maintenance and maintenance dollars.

Old approach won't scale
Right now, the state of the art is hard-wiring most of these central solutions to these third-party solutions, and that basically doesn't scale. That’s where technology kicks in and you have to adopt new open standard and web services standards.

What we try to do at Workday is understand holistically what the current problems are today, and say, "This is a golden opportunity." This is opposed to finding all existing technologies, cobbling them all together, and trying to solve the problems exactly the same way.

If you're managing any system with HRM systems, you need to communicate with other systems, be it for background checks, for providing information to benefit providers, connecting to third-party payrolls, or what have you.

Obviously, [traditional ERP vendors] were solving the problem incrementally, as they were going along. What we tried to do was address it all in the same place. Where we are right now is what I would describe as very business transaction-centric in what I define as legacy applications. Then, we want to take it more to an area which is business interactions, and interactions can happen from humans or machines.

We're creating a revolution in the ERP industry. As always, you have early adopters. At the other end of the bell-shaped curve, you've got the laggards. When you're talking to forward thinking, modern thinking, profit-oriented, innovative companies, they very quickly appreciate that the way to go is SaaS.

Now, they've got a bunch of questions, and most of the questions are around security—"Is my data safe?" We have a huge variety of ways of assuring our customers that these are actually probably safer in our environment than on-premise.

Some customers wait, and some will just jump in the pool with everyone else. We are in our fifth year of existence, and it’s very interesting to see how our customers are scaling from the small, lower end, to huge companies and corporations that are running on Workday.

A blast from the past
Applications are built on top of relational databases today, and then they are being designed thinking about the end-user, sitting in front of a browser, interacting with the system. But, really they were designed around capturing the transaction and being able to report straight-off that transaction.

The idea of integrating with third parties was an afterthought. Being an afterthought, what happened was that you find this new industry emerging, which is around extract, transform and load (ETL) tools and integration tools. It was a realization that we have to coexist within the many systems.

What happened was that they bolted on these integration third-party systems straight onto the database. That sounds very good. However, all the business logic, all the security, and the whole data structure that hangs together is known by the application—and not by the database. When you bolt-on an integration technology on the side, you lose all that. You have to recreate it in the third-party technology.

Similarly, when it comes to reporting, relational technology does a phenomenal job with the use of SQL and producing reports, which I will define as two-dimensional reports, for producing lists, matrix reports, and summary reports. But, eventually, as business evolves, you need to analyze data and you have to create this idea of dimensionality. Well, yet another industry was created—and it was bolted back onto the database level, which is the [BI] analytics, and this created cubes.

In fact, what they used were object-oriented technologies and in-memory solutions for reasons of performance to be able to analyze data. This is currently the state of the art.

The same treatment
Conversely, any request that comes into our system, be it from a UI or from a third-party system by integrations, we treat exactly the same way. They go through exactly the same functional application security. It knows exactly what the structure of your object model is. It gets evaluated exactly the same way and then it serves back the answer. So that fundamental principle solves most of our integration problems.

On the integration side, we just work off open standards. The only way that you can talk with a third-party system with Workday is through web services, and those services are contracts that we spec to the outside world. We may change things internally, but that’s our problem.

That’s the point where we have a technology around our enterprise service plus our integration server that actually talks the language that we do, standards web service based. At the same time, it's able to transform any bit of that information to whatever the receiving component wants, whether it’s banking, the various formats, or whatever is out there.

We put the technology into the hands of our customers to be able to ratchet down the latest technology to whatever other file structures that they currently have. We provide that to our customers, so they can connect them to the card-scanning systems, security systems, badging systems, or even their own financial systems that they may have in house.

We're a SaaS vendor, and we do modify things and we add things, but those external contracts, which are the Web services talking to third-party systems, we respect and we don’t change. So, in effect, we do not break the integrations.

Best way to access data
The next architectural benefit is about analyzing data. As I said, there are a lot of technologies out there that do a very good job at lists and matrix reporting. Eventually, most of these things end up in spreadsheets, where people do further analysis.

But the dream that we are aiming for continuously is: When you are looking at a screen, you see a number. That number could be an accumulation of counts that you'd be really interested in clicking on and finding out what those counts are—name of applicants, name of positions, number of assets that you have. Or, it's an accumulation. You look at the balance sheet. You look at the big number. You want to click and figure out what comprises that number.

To do that, you have to have that analytical component and your transactional component all in the same place. You can't afford what I call I/Os. It's a huge penalty to go back and forth through a relational database on a disk. So, that forces you to bring everything into memory, because people expect to click something and within earth time get a response.

The technology solutions that we opted for was this totally in-memory object model that allows us to do the basic embedded analytics, taking action on everything you see on the screen.When you are traversing, you come to a number in a balance sheet, and as you're drilling around, what you are really doing in effect is traversing an object model underneath, and you should be able to get that for nothing.

So the persistence layer is really forced by the analytical components. When you're analyzing information, it has to perform extremely fast. You only have one option, and that is memory. So, you have to bring everything up in-memory.

We do use a relational component, but not as a relational database. We use a relational database, which is really good at securing your data, encrypting your data, backing up your data, restoring it, replicating it, and all these great utilities the database gives you, but we don’t use a relational model. We use an object model, which is all in-memory.

But, you need to store things somewhere. In fact, we have a belief at Workday that the disk, which is more the relational component, is the future tape. What you used to use in legacy systems was putting things on tape for safety and archiving reasons. We use disk, and we actually believe, if you look at the future, that nearly everything will be done exclusively in-memory.

Make way for metadata
And, there is another bit of technology that you add to that. We're a totally metadata-driven technology stack. Right now, we put out what we describe as updates three times a year. You put new applications, new features, and new innovations into the hands of your customers, and being in only one central place, we get immediate feedback on the usage, which we can enhance. And, we just keep on going on and keep on adding and adding more and more and more.

This is something that was an absolute luxury in your legacy stack, to take a complete release. You have to live through all the breakages that we mentioned before around integrations and the analytical component.

As soon as you can have the luxury of maintaining one system, let's call it one code line, and you're hanging our customers, our tenants, off that one single code line, it allows you to do very, very frequent upgrades or updates or new releases, if you wish, to that central code line, because you only have to maintain one thing.

Multi-tenancy is also one of the core ingredients, if you want to become a SaaS vendor. Now, I'm not an advocate of saying multi-tenancy A is better than multi-tenancy B. There are different ways you can solve the multi-tenancy problems. You can do it at the database level, the application level, or the hardware level. There’s no right or wrong one. The main difference is, what does it cost?

All we're looking at is one single code line that we have to maintain and secure continuously. We believe in one single code line, and multiple tenants are sharing that single code line. That reduces all our efforts around revving it and updating it. That does result in cost savings for the vendor, in other words, ourselves.

And as far back as I can remember, when humans realized that you take time and material, package that for a profit, and send it to your end-market, as soon as you can reduce your cost of the time or the material, you can either pocket the difference, or move that cost saving onto your customers.

We believe that multi-tenancy is one of the key ingredients of reducing the cost of maintenance that we have internally. At the same time, it allows us to rev new innovative applications out to the market very quickly, get feedback for it, and pass that cost savings on to our customers, which then they can take that and invest in whatever they do—making carpets, yogurt, or electric motors.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 10th November 2010 Copyright Interarbor Solutions © 2010

WSO2 recently announced the debut of WSO2 Carbon Studio, an Eclipse-based integrated developer environment (IDE) for WSO2 Carbon.

The new offering allows users to build service-oriented architecture (SOA) and composite applications based on WSO2 Carbon. [Disclaimer: WSO2 is a sponsor of BriefingsDirect podcasts.]

Highlights of WSO2 Carbon Studio include the ability to:

• Organize artifacts that span the multiple runtimes common to composite applications into a single project—a Carbon Application (CApp).
• Develop applications using tools designed for WSO2 Carbon-based products including the WSO2 ESB, WSO2 Web Services Application Server (WSO2 WSAS), WSO2 Business Process Server (BPS), WSO2 Governance Registry, and more.
• Test and debug WSO2 Carbon-based applications directly within the IDE.
• Export Carbon Applications in the new Carbon Archive format.

“We have found that many of our customers are developing sophisticated applications that span the WSO2 Carbon product family, and they are taking advantage of the unique strengths of our platform when used as a whole,” said Dr. Sanjiva Weerawarana, founder and CEO of WSO2. “We’re now revving up our tooling support with WSO2 Carbon Studio—helping developers to organize, develop, test, and deploy these composite applications with greater ease than ever before.”

Middleware platform
The WSO2 Carbon Studio IDE is designed to take advantage of the open source WSO2 Carbon middleware platform. The Eclipse-based offering includes graphical editors for XML configuration files, an enhanced Eclipse BPEL editor, and easy integration of Carbon-based applications with the WSO2 Governance Registry. Additionally, Carbon Studio offers a rich set of third-party Eclipse plug-ins, including Maven and the OpenSocial Gadget Editor.

Carbon Studio supports SOA projects that often combine multiple application types into a single composite application or service. Developers also have single-click function for testing Java-based applications and services—without leaving the IDE. Debugging tools support Axis2-based services, Apache Synapse mediators, registry handlers, and data validators.

Tools to support SOA development include Apache Axis2 and JAX-WS, Data Service, BPEL, ESB, and ESB Tooling, as well as a gadget editor.

WSO2 Carbon Studio, available now as a set of Eclipse plug-ins, is a fully open-source solution released under Eclipse and Apache Licenses and does not carry any licensing fees. WSO2 offers a range of service and support options for Carbon Studio, including development support and production support.

By: Gerry Brown, Analyst - Digital Marketing & CRM, Bloor Research Posted: 9th November 2010 Copyright Bloor Research © 2010

I met with Brian Gentile, CEO of open source BI vendor Jaspersoft. Brian is a self-proclaimed “fan of new generation software”. Here is what he believes constitutes new generation software—and how it differs from traditional enterprise software. This article explores further the tenets of the recent article ‘Is the traditional BI market in decline?’.

First, Jaspersoft has built a club of volunteers who give time and effort to the cause. It’s a bit like the parents’ committee at a well-run primary school where parents want a stake in creating the best learning environment for their kids. Jaspersoft has 175,000 registered programmers in its ‘community’ of fans who have a similar ownership stake in Jaspersoft.

These unpaid end users fix bugs and develop enhancements to Jaspersoft’s open source product, iReport. They champion the product, and provide ‘free’ programming and powerful word-of-mouth recommendations to other potential users. In addition they vote on the new features for the next release—so product development is largely driven by user priorities.

Second, the software architecture is lightweight, web-based, has open APIs, and is easy to install and upgrade. Everything is built on the Java platform and the whole software suite is only 500MB. It requires little installation and professional services consulting support, and is available both for web download and through Jaspersoft’s OEM partners as a SaaS deployment.

Third, it’s low-cost and affordable. The entry level price for the commercial version is $10,000.

Compare this with how the enterprise software vendors tackle these areas:

First, enterprise software vendors have a network of resellers, complementary software vendors, and systems integrators and consultants. These mercenaries add value to the core product only where and when it is in their best commercial interest. Vendor loyalty is typically low—software and services partners often jump ship to where the profit potential is highest. Acts of charity are not high on their agenda.

Product development rests on the needs of a small number of key customers—who may or may not be representative of the market. The vendors control which features are included or excluded from the commercial release.

Second, the traditional enterprise software architecture is heavyweight and leans towards proprietary lock-ins. For example, SAP Business Objects’ BI suite is said to contain c. 30GB of code (ie 60x the size of Jaspersoft’s BI suite). Installation and upgrades are typically long and rely on on-site consulting and services provision over many months.

Third, enterprise software is expensive. Brian reckons Jaspersoft software costs around 1/10 of the cost of comparable commercial enterprise software. The enterprise vendors’ business models demand a premium price in excess of $100K for the most part. Implementation services expenses could double that cost.

So, Jaspersoft has built quite a compelling value proposition. Participative, collaborative, lightweight, fast to implement, transparent and open, and lower cost than its legacy competitors. Granted, it is mainly adopted and used by techie programmers, and it doesn’t offer the sexy front end user experience of SAP Business Object’s Crystal reports, for example. Neither does Jaspersoft offer the comfort of the size and support resources of an SAP or similar. However Jaspersoft is clearly doing something right as iReport downloads are now at the staggering rate of a 250,000 per month.

So what can customers learn from Jaspersoft’s software development techniques?

1) Engage with the hearts and minds of your community (ie ‘The Business’)—not on the basis of “it’s your job to help IT” but rather that “it’s fun to be involved and your contribution will be recognised”. Co-creation and collaboration are the watchwords.

2) Create and choose software that is light, flexible, and easy, and incorporates ‘the wisdom of crowds’. Don’t get dragged down by miles of inflexible code that cannot be re-purposed to reflect the business challenges of tomorrow. SOA is very important here.

3) Experiment with low cost web-based solutions. If they don’t work, junk them, and try something else. Don't put all your eggs in one big enterprise software investment basket with an uncertain outcome.

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 5th November 2010 Copyright Bloor Research © 2010

I recently contributed to a virtual conference run by InfoSecurity Magazine US  

The topic was data breaches and here is a summary of my presentation.

Data loss is a real issue for many organisations, but what is the real cost and how can we try and prevent these incidents from happening?

Unfortunately, even the best intentioned and well motivated member of staff can make mistakes resulting in the loss of organisational data. In fact, the majority of data loss incidents are the result of this incompetent and non-malicious act rather than a pre-meditated competent and malicious theft of data. The fact that we can all make such mistakes often acts to motivate company security to put protections in place to prevent these events and changes the organisational reaction from one of a wish to punish to one of empathy.

As data proliferates and, more importantly, becomes fragmented across organisations on a variety of media, the control of data has rapidly become one of the most important challenges facing information security professionals and businesses alike.

I recently completed some research on behalf of McAfee, the security company, available here. We interviewed 1100 mid-sized organisations (these are companies that that employ between 50 and 1000 employees) across the world and the results were interesting:

• 40% have had data breaches in the past year, an increase of 13% from last year. So, for these companies, data breaches and data losses are a real problem. As these are generally smaller businesses they don't have the resources of bigger companies to survive a data breach. In fact 75% said that there is a chance that a serious data breach could force them out of business, up from 70% in last year's survey. 5% reported that they had suffered a data loss that had cost them more than $25,000. Of these 25% were from China, 14% from France and 11% from India.
• 47% of all reported intellectual property losses were from mid-sized organisations based in Europe. This is a real problem as for many smaller businesses, intellectual property makes up a significant part of their company valuation. Often, smaller businesses may only have one or two pieces of intellectual property, such as the designs of a key product, so any loss of this data could be significant.

The bottom line is that the real cost of a data breach to these companies can be the loss of their business.

So what about real data loss incidents?

In March 2010, Zurich Insurance announced that it was going to improve its information security after losing personal financial information on 46,000 British clients through careless handling of unencrypted backup tapes. The back-up tape, which also contained personal details of 1,800 third party insurance claimants from the UK, was lost by Zurich's South African sister company during what was described as a routine transfer to a data storage facility in South Africa in August 2008.

In total, 51,000 British records were on the tape, along with a much larger number of details about Zurich customers in South Africa (550,000) and Botswana (40,000). Zurich's UK arm wasn't informed about the problem until a year later. They were fined the equivalent of $5m by the Financial Services Authority, the highest fine levied in the UK on a single firm for data security failings.

There are also a number of scare stories relating to data loss.

In this very recent example, headlines screamed that nuclear data had been lost from a plant in the UK. In fact the memory stick that was found in a hotel room by a coach driver contained less exciting data relating to the transfer of staff from one plant to another, but few people will bother with the detail, instead it is the headline that most will remember. 

For the company that owns the data it is too late, their reputation has been tarnished and the damage done. This has further political implications, as losses associated with politically sensitive industries or projects may run and run, being blown out of all proportion and used to fulfil other objectives. All because data was left, unencrypted, on a memory stick.

Another example from my archives comes from 2008.

A UK company called PA Consulting lost a memory stick containing the details of 84,000 prisoners. As a direct result of this it had its 3 year contract, worth $3m, terminated and further contracts worth $15m placed under review. It is believed that the unprotected memory stick was placed into an insecure desk drawer over a weekend.

If you lose a laptop, USB stick or CD it can be fairly obvious that the data has gone missing. Voice data is very different, as a successful interception can leave no physical trace so there is little chance of realising your data has actually been intercepted until it is too late. For many, this realisation may be when they have been undercut by a competitor or see their products copied in another country. This makes the promotion of voice security more of a challenge, as a direct link to an incident is often difficult to make.

Of course this lack of detection and traceability is a real bonus for the eavesdropper. When a victim realises the loss of data the attacker is long gone, hiding their trail as they go.

In order to understand the cost of lost voice data the Ponemon Institute, in collaboration with Cellcrypt, recently undertook a study called The Security of Voice Data. 

The study reveals that 67% of those 75 organisations surveyed were not confident that the information passed during a cell phone conversation was adequately secured and only 14% use technologies to secure mobile phone calls when travelling to sensitive areas. The cost to the organisation each time a corporate secret is revealed to competitors or their agents has been averaged at $1.3 million.

There are a number of ways in which mobile phone voice data can be intercepted:

Spyware can be loaded onto a phone.
This, in turn, can activate the phone as a bugging device with full remote control available to an eavesdropper. Advanced spyware has a number of features, including voice-activated microphones to save on battery life and the ability to auto forward SMS messages and the contact list on a phone.

GSM encryption can be hacked
A number of attacks have been demonstrated and, in theory, given suitable resources, mobile phone encryption could be compromised. This is a passive attack and is undetectable as the signals are received using a specialised radio, which is both portable and easy to hide.

Inside threat
Threats to information security systems often emanate from inside an organisation. These can take the form of knowledgeable insiders being bribed or bullied into supplying relevant cell phone data and can even be an employee planted by a security agency. In June 2010, a technician who worked in a Lebanese mobile phone operator was arrested for being an Israeli spy and giving access to phone calls for 14 years. Because of the man's role on the technical side of the cell phone network's operations, it was assumed that the entire national network had been compromised.

It could be argued that data protection is a key role for information security people. As organisational data is dispersed throughout a business keeping a secure track on it is very difficult, but necessary. This is a tough call, as the needs of the business to have access to this data lie contrary to the desire for information security people to lock it up and prevent anyone getting to it. Clearly a compromise is important.

New and emerging threats will only lead to new ways in which data can be obtained, and keeping on top of this ball is now vital, especially when we are dealing with systems that may transfer huge amounts of data around the world in fractions of a second. The increasing use of "i" devices, online social networks and other sharing tools brings about a culture of sharing what many in older generations would consider private or personal data.

It's only by bringing together decent security policies, user education and supporting tools that we can hope to keep on top of the cost of data loss incidents.  

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 4th November 2010 Copyright Interarbor Solutions © 2010

The rapidly evolving landscape for global business—and the consequent need for IT to relate differently to businesses so they together serve their customers in innovative ways—has to mean more than business as usual from technology suppliers.

While a majority of vendors seem to be hunkering down around an entrenched set of core products and aging IT approaches, HP this week shared a different vision, what it calls the “Instant-On Enterprise." [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

The Instant-On Enterprise, as HP defines it, is a data-driven organization that leverages technology for everything—but specifically to better address the ever-evolving needs of end-users. As users' expectations and experience change, so too must the ways enterprises relate to them, are perceived by them.

The next several years will form a culmination of now-clear mega trends that have only just begun to roil conventional business practices. We're talking about pervasive mobile applications use, highly responsive cloud computing models, and knowledge-adept social collaboration. More than just these shifts, there also needs to be an increasingly automated, secure, and harmonizing management capability that combines and reinforces them.

As these trends literally re-arrange business ecosystems and re-established the service delivery order, a gap will surely grow between the companies that master change and exploit enabling technologies—and those that fall ever further behind.

With that in mind, HP has rolled out new solutions that aim to help both business and government create their own Instant-On Enterprise. Not surprisingly, the driver of the Instant-On Enterprise is everything becoming connected and immediate, people expect responses regardless of sourcing and/or partner ecosystems—and within seconds instead of days.

“It takes a special kind of enterprise to close the expectation gap between what customers and citizens expect and what the enterprise can deliver,” says Tom Hogan, executive vice president of Enterprise Sales, Marketing and Strategy at HP. “The Instant-On Enterprise delivers differentiated competitive advantage, serving customers, employees, partners and citizens with whatever they want and need, instantly…"

Embedding Tech
New HP research reveals that the role of IT is shifting from chiefly being the administrator of the enterprise to becoming one and the same with the enterprise. This means enabling rapid, recurring business process improvements to meet dynamic customer demands, as well as gaining near-instant insights into shifting markets.

Coleman Parkes research conducted for HP in October reveals that 86 percent of senior business and government executives believe they must rapidly adapt the enterprise to meet changes in consumer expectations. The research also indicates that 78 percent believe technology is the key to business and government innovation, and 85 percent indicated that in order to be successful, technology needs to be embedded in the business or government service

HP’s new solutions work to help enterprises and government leverage technology in ways that will meet those goals. HP sees it as a reinvention of how technology is used to deliver innovation at every point in the value chain. That covers the services that are delivered, the mobile devices that provide the access, and the global data centers required to power the Instant-On Enterprise.

Instant-On Puzzle Pieces
There are several components to HP’s Instant-On Enterprise: HP Application Transformation, HP Converged Infrastructure, HP Enterprise Security, and HP Information Optimization:

• HP Application Transformation solutions work to help enterprises gain control over aging applications and inflexible processes that challenge innovation and agility by governing their responsiveness and pace of change.
• HP Converged Infrastructure solutions are engineered to drive out costs and provide the foundation for agile service delivery. HP promises this solution delivers the data center of the future.
• HP Enterprise Security solutions secures the IT infrastructure by people, processes, technology and content. These solutions aim to aligns security to meet business and government demands without losing flexibility.
• HP Information Optimization solutions deal with how information is gathered, stored and used. The idea is to harness the power of information and ensure its integrity and protection while delivering it in the context of the enterprise.

Realizing that there is no one single delivery model that meets every end-user need, HP also introduced two new Hybrid Delivery services. HP Hybrid Delivery Strategy Service offers a patent-pending, model-driven framework to introduce hybrid delivery concepts into their existing environments.

HP Hybrid Delivery Workload Analysis Service offers experts that gather service usage and demand profile data, and then develop a set of recommendations on how to best characterize and combine workloads in hybrid environments.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 2nd November 2010 Copyright Interarbor Solutions © 2010

What if you could buy and sell cloud-computing capacity the same way people book hotel rooms on Priceline or Hotwire? Startup SpotCloud, the brainchild of Toronto-based Enomaly, aims to find out.

Acting as an online clearing house, SpotCloud will allow cloud providers to offer unused capacity to keep servers busy and will allow cloud users to buy spot cloud capacity at bargain prices.

SpotCloud uses the concept of Random Access Compute Capacity, similar to cloud bursting or the dynamic deployment of a software application that runs on internal organizational compute resources to a public cloud to address a spike in demand.

However, unlike cloud bursting, which refers strictly to expanding the application to an external cloud to handle spikes in demand, SpotCloud's cloud spanning includes scenarios in which applications components are continuously distributed across multiple localized cloud providers.

The capacity itself is provided via a global pool of regional cloud providers. SpotCloud treats providers as a nameless, faceless, and possibly unsecured group of providers of raw, localized computing capability. While buyers can purchase capacity based on performance and price and the location of the provider, the name of the provider remains hidden until after the purchase is made. This is to prevent undercutting the provider's retail sales of capacity.

Wasted capacity
According to Reuven Cohen, founder and chief technologist of Enomaly, the idea came about because of numerous cloud providers whose companies—often the first such enterprise in their respective countries—weren't well known and had excess capacity. With no way to make themselves known to potential buyers on a broad scale, they were watching that capacity go to waste.

At the same time, cost-conscious buyers would benefit from being able to make quick purchases of capacity, as well as location, at favorable prices. Selecting a provider becomes easier with the clearing house, because potential buyers don't need to scour the Internet looking for potential providers. Also, buyers can continually monitor the site and determine the best price at which to buy computing resources.

The process becomes easier for both sides because SpotCloud will provide the invoicing and billing. Providers avoid the hassle of trying to bill customers for small spot jobs, and buyers, who may spread their cloud use among several providers, will have to deal with only one payment. SpotCloud will make its money by charging a fee to the seller.

By: Gerry Brown, Analyst - Digital Marketing & CRM, Bloor Research Posted: 1st November 2010 Copyright Bloor Research © 2010

A long time ago a whale lived in the IT sea called Big Blue. But Big Blue was no ordinary whale, it was the biggest killer whale ever. As the biggest creature in the IT sea (with 80%+ market share), all the other creatures relied on Big Blue to set the rules, which were its proprietary interfaces. If Big Blue changed its interfaces so a little fish (vendor) couldn’t interface with its mainframes, the little fish died, and Big Blue ate up its customers, thus becoming even bigger.

Eventually the sea god Neptune (the US government) lost its patience with Big Blue and threatened to break up its monopoly so the rules of normal competition could be observed. Then the IT sea began to grow healthily again, like other seas (markets). A long and expensive court case ensued and Big Blue was never quite the same again. Until now.

Today, IBM is no longer an aggressive tin-shifter nor the services company envisaged by Lou Gerstner, but a dynamic software vendor. In the last decade IBM has acquired 100+ software companies and has software revenues of c. $23Bn and 70,000 employees in its Software Group (it is almost exactly the same size as Oracle).

Just a few years ago Oracle boasted of being the biggest venture capitalist in Silicon Valley. Not anymore. In a thinly disguised reference to Oracle, IBM’s annual report says: “Today, many of our competitors are emulating our moves. For instance, several have gone on an acquisition binge to get into new spaces . . . largely to compensate for rapidly commoditizing business models”.

So why software? The 86% margin IBM gets on software is double what they achieve elsewhere. In addition, as McKinsey points out: “By pushing their products through a global sales force, IBM estimates it increased their revenues by almost 50% in the first two years after each acquisition and an average of more than 10% in the next three years”.

Analytics is the main thrust. In four years IBM has invested $12Bn in 23 analytics-related acquisitions including Cognos, Netezza, SPSS, and OpenPages. IBM’s resulting Business Analytics and Optimization (BAO) practice has 6,000 consultants and “enables clients to get far more value from their information . . . advanced analytics allow clients to see patterns in data they could not see before, understand their exposure to risk and pre­dict the outcomes of business decisions with greater certainty”. IBM plans to grow its BAO business by $7Bn to $16Bn by 2015. These are big numbers.

Customers should consider IBM for their acquired analytics competencies, depth and breadth of product set, and services capabilities. However, customers should be mindful that IBM (as is Microsoft) is a product-centric organisation. IBM sees its differentials and value as being its size and power, and a $6Bn annual investment in R&D. Customer-centricity and market orientation do not appear central. Hence ‘customer delight’, ‘customer intimacy’, and ‘customer satisfaction and loyalty’ are likely to result from paid-for consulting rather than a deliberate strategy.

Oracle describes itself as: “the world’s biggest business software company ... and seeks to be an industry leader in each of the specific product categories in which it competes and to expand into new and emerging markets”. This is a virtually identical strategy to IBM’s. And IBM also has a database (DB2) to counter Oracle’s strong position in the enterprise RDBMS market.

So an almighty clash of the titans is developing. IBM is saying to Oracle: “I’ll huff and I’ll puff and I’ll blow your house down!” Is Oracle made of straw, of wood, or of stone? Larry Ellison might have something to say about that. Let battle commence.

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 28th October 2010 Copyright Interarbor Solutions © 2010

Businesses are looking to cloud-computing models to foster agility and improve time-to-market for new services. Yet attaining cloud benefits can founder without higher levels of unified server, data, network, storage, and applications management.

These typically disparate forms of management must now come together in new ways to mutually support a variety of different cloud approaches -- public, private, and hybrid. Without adoption of such Business Service Automation (BSA) capabilities, those deploying applications on private and hybrid clouds will almost certainly encounter increased complexity, higher risk, and stubborn cost structures.

This latest BriefingsDirect discussion therefore focuses on finding low-risk, high-reward paths to cloud computing by using increased automation and proven reference models for cloud management—and by breaking down traditional IT management silos. In doing so, the progression toward cloud benefits will come more quickly, at lower total cost, and with an ability to rapidly scale to even more applications and data.

We're here with two executives from HP Software & Solutions to learn more about what BSA is and why it's proving essential to managed and productive cloud computing adoption: Mark Shoemaker, Executive Program Manager for Cloud Computing in the Software & Solutions Group at HP, and Venkat Devraj, Chief Technology Officer for Application Automation, also in HP’s Software & Solutions Group. The discussion is moderated by BriefingsDirect's Dana Gardner, Principal Analyst at Interarbor Solutions.

Here are some excerpts:

Shoemaker: There is hardly a place we go that we don’t end up talking to our customers about cloud. Most of the enterprise customers we talk to are looking at private cloud, the internal cloud solution that they own, that they then provide to their business partners, whether that’s the development teams or other elements in their business. Most of them are looking to build on the virtualization work that they've already done.

They want to improve their productivity, definitely get better utilization out of what they have already got. They want IT to be your better partner in the business. What that means is to shorten the time that the business has to wait for the services.

Devraj: There is also an interesting micro trend that’s occurring. A lot of the application teams, end-user business teams, are getting increasingly sophisticated. They're learning about private cloud implementations. Consequently, they're demanding levels of service from IT that are difficult to provide without a private cloud.

For example, because of things like agile development methodologies, application teams are doing a lot more application deployments and code releases than ever before. It's not uncommon to see dozens of application releases for different applications happening during the same day.

IT operations are just bombarded with these requirements and requests, and they are just unable to keep up based on yesterday’s processes, which are relatively static. These application teams and business unit teams are quite influential.

They're even willing to fund specific initiatives to allow their teams to work in self-service mode, and IT ops are finding themselves in reactive mode. They have to support them, make their internal processes more fluid and dynamic, and leveraging technology that allows that kind of dynamism.

... The third-party companies, the cloud providers, the pure-play server enablers, have an unfair advantage. Because they were started relatively recently, in the last few years, they have the advantage of standardized platforms and delivery units.

They can say, "Okay, I'm going to deliver only Linux-based platforms, Windows-based platforms, or certain applications." When you look at the typical enterprise today, however, IT has a lot more to deliver.

There is a lot of prevailing heterogeneity in terms of multiple software platforms and versions. There is a lack of standardization. It's very difficult to talk about cloud and delivery within the enterprise in the same breath, when you look at these kinds of technical challenges.

As a result, IT is undergoing a lot of pressure—but they have to deliver given the kind of challenges that they face. That’s going to require a lot of education and access to the right kind of technology, training, and guidance.

Shoemaker: Just to add to Venkat’s comment, we're seeing the business driving IT and demanding that agility and that flexibility. We talk to a lot of our customers, where their own coworkers have taken corporate credit cards and gone out into the public cloud, procured space, and have begun developing outside of them. IT really has to get in front of this. They have to manage all this.

... The one thing that’s different about cloud is that it really is a supply chain. It’s the supply chain of IT technology that the business consumes. If you think about what a supply chain is, it’s something that’s got to be repeatable. It has to be governed, and it provides a baseline or foundation and building blocks to build those services that you can then customize on top of the business.

So, the farther up that you can go with your standard building blocks, the less difficult it is to manage and focus on the custom business-facing functions on the front-end.

To do this, cloud has helped us out in a lot of ways. One of the challenges IT has always had is to get the business to consume standards. Because of a lot of hype in the market, the business absolutely is convinced that they get it, and they want the business benefits that cloud offers.

Even if the business decides to go to a public cloud, they still have to consume those elements in a standard fashion. There's no way out of that.

Devraj: And yet, the software used by these enterprises tends to be disparate, heterogeneous, and requires a lot of domain knowledge to be able to manage, resulting in significant delays and bottlenecks associated with service delivery. Those processes just don’t scale in the cloud.

At Stratavia we had built a patented technology to manage and control varied software stacks, such as databases, web servers, application servers, and even well-known packaged applications, including Microsoft Exchange, Oracle E-Business Suite, and SAP.

The content that I talk about becomes an abstraction layer, where the customer, the end user, the people who consume the services, see a very easy to understand service catalog. They can click on it. They can choose some menu options, some values from a drop-down box, and then specify exactly what they need, and have the response come back in minutes and in hours, rather than days and weeks, as is traditionally the case.

For example, just at the database layer, within the enterprise, it's very common to see four or five different platforms in use, such as DB2, SQL Server, Oracle, and so on. By automating the operations management lifecycle around these layers, Stratavia has made it possible for the enterprise to deliver and manage these assets as a service within the context of the cloud.

As more and more of HP’s and Stratavia’s joint customers started seeing value in that capability, HP brought Stratavia into its BSA/Business Technology Optimization umbrella.

There's a big gap in IT today, which is IT/Ops Engineering or IT/Ops Architecture. That’s a big missing silo within IT/Ops. And a lot of the operators today that rely on scripts, command-line stuff, and point-and-click tools need to evolve themselves to more of an architect approach. They need more of taking stock of the big picture, and taking the tribal knowledge that they have in their heads and looking at the out-of-the-box content that HP provides and selecting the right content that corresponds to their tribal knowledge.

When they go into the cloud, the underlying management, things like compliance and governance, are not out of whack. They're able to successfully take that knowledge, put it in there, and then, in their new role as architects or engineering folks, they're able to watch, measure, and make modifications as appropriate.

So, the role that people play, that key subject matter experts play, is very crucial as part of walking before running with automation.

Gardner: Now that you have mentioned Stratavia, and for the benefit of our listeners and readers, HP has acquired Stratavia, and there was also quite a bit of related product and service news on Sept. 15 around BSA as the acquisition was unveiled.

Shoemaker: Obviously, the Stratavia acquisition was a huge, huge win for us, and puts us in a great position to help our customers transform their infrastructure. ... And several other things have happened in the last 60 days. We had VMworld, and we presented a cohesive strategy for infrastructure and even PaaS built on the BladeSystem Matrix hardware platform that we have, Converged Infrastructure. We've combined that with two other pieces and a piece of Cloud Service Automation (CSA) software.

CloudStart is a consulting and a professional services-led engagement capability where we come in and work with the customer to get that transformation process nailed, so we can quickly get them moving into the cloud benefits.

On the back end of that, there is another piece that we announced called Cloud Maps, which is really more knowledge, but in a different capacity, in that it offers downloadable templates, preconfigured applications, and best practices for sizing.

We see the Stratavia acquisition fueling this fire, because in the end, cloud is a solution, and a solution needs content, and content wins. Content is what the customer is able to consume and use day one, when the solution is in. So it's important. And we've done a lot there.

We now have a best-in-class content provider in Stratavia that’s come on board to help round out the capabilities and add more into what the customer can get out of our solutions in very quick order.

All that sits on a recently refreshed BSA portfolio, with significant enhancements and new capabilities across network, automations, servers, and storage, that really makes all this happen.

... Let's face it, a lot of the CIOs are looking at a data center that’s packed full of applications that they probably don’t feel as if they have got a good handle on. Now, cloud is coming into the picture, and they've got two things to do here.

Number one, they need to start applying those new business methodologies to IT around providing cloud and the things that go with that, but also they have got a transformation piece to go along. And that can be very daunting.

What we've done is looked at the experience of helping previous customers do that work and we have applied that into the CloudStart and Cloud Maps, CloudStart being the planning and the upfront work that you need to get done.

So, we're right there with you. You don’t have to read chapter one of the book.

Then, as we put the infrastructure in with CSA for Matrix in the frame, we're embedding some of the CSA software inside of the Blade Matrix frame. So you have a way to build infrastructure as a service (IaaS) and manage it through the platform throughout the lifecycle.

Then, on the back end of that, we have the preconfigured application templates. If I need a SQL Server image to put into the system, I can pull that from Cloud Maps, build it into a framework and offer that very quickly. I don’t have to go and figure out how to size for this piece or what golden template looks like for this application.

It's really about obtaining a running start into the cloud, and one that’s not going to leave you wanting in a year or two. You have to be careful. Cloud is a great enablement technology and a lot of people are looking at IaaS, but that’s the starting point for it, and then you have to manage everything that you put inside of that as well.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 26th October 2010 Copyright Interarbor Solutions © 2010

The FUSE family of software is now under the FuseSource name and has today gained new autonomy from Progress Software with its own corporate identity.

Part of the IONA Technologies acquisition by Progress Software in 2008, FuseSource has now become its own company, owned by Progress, but now more independent, to aggressively pursue its open source business model and to leverage the community development process strengths.

In anticipation of today's news, our discussion here targets the rapid growth, increased relevance, and new market direction for major open source middleware and integration software under the Apache license.

We'll also look at where FuseSource projects are headed in the near future. [NOTE: Larry Alston also recently joined FuseSource as president.]

Even as the IT mega vendors are consolidating more elements of IT infrastructure, and in some cases, buying up open-source projects and companies, the role and power of open source for enterprise and service providers alike has never been more popular or successful. Virtualization, cloud computing, mobile computing, and services orientation are all supporting more interest and increased mainstream use of open-source infrastructure.

Here now to discuss how FuseSource is therefore evolving we're joined by Debbie Moynihan, Director of Marketing for FuseSource, and Rob Davies, Director of Engineering for FuseSource. The discussion is moderated by BriefingsDirect's Dana Gardner, Principal Analyst at Interarbor Solutions.

Here are some excerpts:

Moynihan: Over the past couple of years, there has been a lot of focus on cost reduction, and that resulted in a lot of people looking at open source who maybe wouldn’t have looked at it in the past.

The other thing that’s really happened with open source is that some of the early adopters who started out with a single project have now standardized on FuseSource products across the entire organization. So there are many more proof-points of large global organizations rolling out open source in mission-critical production environments. Those two factors have driven a lot of people to think about open source, and to start adopting open source.

Then, the whole cloud trend came along. When you think about scaling in the cloud, open source is perfect for that. You don’t have to think about the licensing cost as you scale up. So, there are a lot of trends that have been happening and that have really been really helpful. We're very happy about them helping push open source into the mainstream.

From a FuseSource perspective, we've been seeing over 100 percent growth each year in our business, and that’s part of the reason for some of the things we're going to talk about today.

Davies: We've been around in this space for a while, but the earlier adopters who were just trying out in distinct groups are now rolling this out into broader production. Because of that, there is this snowball effect. People see that larger organizations are actually using open source for their infrastructure and their integration. That gives them more confidence to do the same.

I recently spoke to a large customer of ours in the telco space. They had this remit. Any open source that came in, they wouldn’t put into mission-critical situations, until they kicked the tires for a good while — at least a couple of years.

But because there has been this push for more open source projects following open standards, people are now more willing to have a go using open source software.

In fact, if you look at the numbers of some of our larger customers, they are using Apache ServiceMix and Apache ActiveMQ to support many thousands of business transactions, and this is business-critical stuff. That alone is enough to give people more confidence that open source is the right way to go.

When you look at cloud, there are different issues you have to overcome. There is the issue about deploying into the cloud. How do you do that? If you're using a public cloud, there are different mechanisms for deploying stuff. And there are open source projects already in existence to make that easier to do.

This is something we have found internally as well. We deploy a lot of internal software when we are doing our big scale testing. We make choices about which particular vendors we're going to use. So, we have to abstract the way we are doing things. We did that as an open source project, which we have been using internally.

When you get to the point of deploying, it’s how do you actually interface with these things? There is always going to be this continuing trend towards standards for integration. How are you going to integrate? Are you going to use SOAP? Are you going to use RESTful services? Would you like to use messaging, for example, to actually interface into an integration structure?

You have to have choice. You can’t really dictate to use it this way or the other way. You've got to have a whole menu of different options for connecting. This is what we try to provide in our software.

We always try to be agnostic to the technology, as much as how you connect to the infrastructure that we provide. But, we also tend to be as open as we can about the different ways of hooking these disparate systems together. That’s the only way you can really be successful in providing something like integration as a service and a cloud-like environment. You have to be completely open.

Moynihan: Progress is launching a new company called FuseSource that will be completely focused on the open source business model. We're really excited as a team. The FuseSource team has been an independent business unit since IONA was acquired by Progress Software. We have been fairly independent within the company, but separated as our own company we'll be able to be completely independent in terms of how we do our marketing, sales, support, services, and engineering.

When you're part of a large organization, there are certain processes that everyone is supposed to follow. Within Progress, we are doing things slightly differently (or very differently depending on the area) because the needs of the open source market are different. So being our own company we'll have that independence to do everything that makes sense for the open-source users, and I'm pretty excited about that.

From a practical perspective, the business model is very different. In traditional enterprise software sales, there is a license fee which is typically a large upfront license cost relative to the entire cost over the lifetime of that software. Then, you have your annual maintenance charges and your services, training, and things like that.

From an open source perspective, typically upfront, there is no license cost. Our model is that there is no license cost. It’s a subscription support model, where there is a monthly fee, but the way that it is accounted for and the way that it works with the customer is very different. That's one of the reasons we split out our business. The way that we work with the customers and the way they consume the software are very different. It’s a month-to-month subscription support charge, but no license charge.

That’s also the reason people like cloud. You pay as you go. You scale as you go. And you don’t have that upfront capital expenditure cost. For new projects, it can be really hard to get money right now. All these benefits are why we're seeing so much growth in FuseSource.

While we do have some level of product management for open source, a lot of it is based around packaging, delivery, licensing, and these types of things, because our engineers are hearing directly from customers on a moment-by-moment basis. They're seeing the feedback in the community, getting out there, and partnering with our customers. So, from an economic perspective, the model is different.

Now, being backed by Progress Software provides us the benefit that customers can have that assurance that we're backed by a large organization. But, having FuseSource as standalone company, as you said, gives us that independence around decision making and really being like a startup.

We'll be able to have our own processes in any functional area that we need to best meet the needs of the open source users.

Davies: From a technical perspective, it’s really good for us. The shackles are off. There’s a lot of sudden reinvigorating that seems to move forward. We've got a lot of really good ideas that we want to push out and roll out over the coming year, particularly enhancing of the products we already have, but also moving onto new areas.

There's a big excitement, like you would expect when you have got a startup. It just feels like a startup mentality. People are very passionate about what they're doing inside FuseSource.

It's even more so, now that we have become autonomous of Progress. Not that working inside Progress was a bad thing, but we were constrained by some of the rigors and procedures that you have to go through when you are part of a larger organization. Because those shackles have been taken away, it means that we can actually start innovating more in the direction we really want to drive our software too. It’s really good.

Moynihan: From a customer perspective, this change will have a small but significant impact. We are continuing to do everything that we have been doing, but we will be able to have even more independence in the way that we do things. So it will all be beneficial to customers.

We have also launched a new community site at FuseSource.com, which we're pretty excited about. We were planning to do that and we've been working on that for several months. That just provides some additional usability and ability to find things on the site.

Overall, it will be really good for our customers. We've talked with them, and they're pretty excited about it.

Listen to the podcast. Find it on iTunes/iPod. Read a full transcript or download a copy.