By: Clay Ryder, President, Sageza Group, Inc. Posted: 12th March 2010 Copyright Sageza Group, Inc. © 2010

IBM has announced three new servers that are based on the fifth-generation IBM Enterprise X-Architecture chip (eX5). These are the four-processor IBM System x3850 X5, the BladeCenter HX5, and the System x3690 X5, which the company stated will be the most powerful two-processor server on the market. Each of these eX5 servers is equipped with a new independent memory-scaling technology, known as MAX 5, which allows processors on eX5 systems to access extended memory very quickly and enables these servers to offers six times more memory than comparable x86-based servers.

In addition to MAX5, IBM’s new eX5 systems offer additional features that seek to improve the performance, cost, and flexibility for x86 workloads:

• eXFlash, a next-generation flash-storage technology, replaces previous generation storage and can slash storage costs substantially as each eXFlash can replace 80 JBODs and associated hardware and cabling.
• FlexNode, a physical partitioning capability, allows organizations to change their systems configuration from one system to two distinct systems and back again as desired. This enables organizations to run infrastructure applications by day and larger batch jobs by night on the same system.

The eX5 systems take advantage of integration with IBM middleware to create a virtualized environment providing a flexible, highly scalable system that can reduce the number of physical servers needed to support a given workload. IBM's Systems Director management suite has been upgraded to support eX5 technology and will allow users to pre-configure servers, remotely re-purpose systems, and set up automatic updates and recoveries. The company stated that its new eX5 servers are the result of a three-year engineering effort to improve the economics of operating enterprise-sized, x86-based systems.

Pricing/Availability:
The IBM System x3850 X5, BladeCenter HX5, and System x3690 X5 are being previewed this week at the CeBIT trade show in Germany and will be officially available later this month and throughout the year. No pricing details were released.

Net/Net:
At times it is difficult to get excited about Industry Standard x86-based servers. The market is saturated with solutions that seem to universally benefit from ever-increasing CPU performance combined with a price/performance ratio that continues to rise towards the stratosphere. All told, more applications are finding their way onto this platform every year as legacy UNIX and other systems are retired in favor of this widely deployed low acquisition cost option. The platform offers choice of operating system and components from thousands of suppliers, and now with virtualization, utilization is going up, and acquisition price points are going down. Overall, it sounds like a commodity market. So why get all worked up about a vendor’s latest entry in this well populated market segment? The reasons are simple: this is NOT a commodity market, virtualization is here to stay, and disk drives are too darn slow.

While x86 processors as a component could easily be considered a commodity, a processor alone does not make a server. All of the components on the motherboard and rack/chassis along with various interconnections have a substantial impact on the performance and capability of the server. While one industry-standard server would be expected to execute the same software as another, the performance and scalability of the systems is not automatically the same. Commodity CPU yes, commodity and hence undifferentiated server, no.

The growth in x86 CPU performance is undeniable. Quad-core and higher systems with lightning-fast clock speeds have achieved an astonishing level of performance at very compelling price points. However, to effectively harness this performance, the system performance as a whole must be balanced across all of its component parts in order to cost-effectively support the application workload. As computational performance has risen, there has been a corresponding gap in overall system utilization as newer and faster systems are limited by the mundanity of relatively slow I/O access, memory swaps, disk reading and writing, network access, etc. To address this utilization gap, many have embraced virtualization to get more virtual servers out of the physical server. But this success in modestly raising CPU utilization has caused a new scaling constraint, one of limited memory.

Virtualization allows many more logical servers and workloads to be discretely serviced by a physical server. However, each of these workloads requires RAM, and the total amount of RAM is limited by the number of DIMMs and memory interconnects to the CPU that can be installed on a motherboard. Historically this has limited most x86 servers to 256GB or less, a shortcoming that MAX5 seeks to address. By increasing the amount of RAM available to the CPU up to a maximum of 1536GB, the server can support a larger virtual machine footprint and hence more workloads. This can help make use of computational resources that are otherwise idle or saturated with workloads that are more memory- than computation-intensive. Increasing the yield of virtual servers supported per physical server can reduce software licensing fees for organizations with per-socket licensing regimes. The number of users supported on a server can increase, but without an increase in socket count and hence corresponding license expense. To our way of thinking, this gives eX5-based systems a compelling advantage over traditional solutions, one that not only is technically crafty, but yields financial dividends as well.

Lastly, with increased computational prowess and sufficient memory in place, the last leg of the balancing trifecta becomes evident: access speed to out-of-memory storage. In the grand scheme of things, disk drives are just much slower than memory or CPU cache. Although many steps have been taken to improve spindle-based storage access speed, it still remains the turtle to the computational hare. Advances in flash technology have sought to address this reality, and this is where eXFlash plays its hand. Besides its higher IOP rating, each eXFlash can replace 80 JBODs, which translates into a substantial reduction in energy, floor space, and wiring requirements. Again, the performance improvement is notable, but the underlying acquisition and operational economics are the most compelling aspects of this technology.

So all told, we believe that eX5 illustrates once again that just because a server is based upon x86 processors it is not automatically a commodity solution. The unique scaling and performance technologies in these offerings serve notice that a holistic and balanced systems approach can yield very different results than a solution based simply upon assembling industry-standard technologies. We believe organizations that are turning to workload optimization and systems efficiency as part of their strategic IT course will likely find much to rejoice in with the latest eX5 servers. Likewise, for those who are merely seeking to achieve a higher degree of vertical scaling from x86 solutions, eX5 redefines the current limitations on single system scaling in a notable fashion, one which we believe will be well received.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Clay Ryder (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 12th March 2010 Copyright Bloor Research © 2010

This article explores the role of database activity monitoring in an overall compliance solution.

Database Activity Monitoring and Compliance
Organisations deploy DAM solutions for a number of reasons, ranging from compliance through to beefing up their overall security posture.

Increasingly, compliance laws, rules and regulations are forcing organisations to have tighter control over their data and, more importantly, have a provable audit trail that can be signed off, if necessary, by appropriate organisational officers or executives.

Sarbanes-Oxley, which has implications for organisations based in the United States or with a trading presence there, has a requirement that financial information is accurate, and a company executive will be expected to sign a statement to that effect. Although not specifically mandated, it makes sense to record database activity, especially if that data relates to financial information. Database activity monitoring will often be a useful addition to any compliance suite as it can provide a level of assurance that data usage is being monitored. For example, it could help enforce a separation of duties, preventing a DBA from viewing data they should not have access to during a database backup.

PCI-DSS, the payment card industry standards for data security, place a set of requirements on credit card merchants to protect customer credit card details. PCI-DSS is reasonably proscriptive in its requirements, and merchants that fail to comply with the regulations face fines and possible exclusion from credit card networks. Database activity monitoring would be a useful adjunct to a merchant's information security setup, as out of course access to credit card data can be detected and prevented. For example, if a user normally accesses 10 credit card numbers at a time then the database activity monitoring system could raise an alert if they should access more than this number of card details in a database query.       

Database Activity MonitoringTechnical Architecture
Database Activity Monitoring vendors each have their own preferred way of tracking database activity and will therefore implement slightly different architectures.

A single appliance/single server architecture will provide a one-to-one mapping of a database server with a monitoring appliance, which, in turn, acts as both a sensor and collector of relevant data. This configuration would be suited to a small departmental database but may not be effective enough for larger database systems.

A two tier architecture will consist of a centralised management server that aggregates information from a set of remote sensors or collection points. This provides a better degree of system scalability.

A hierarchical architecture builds onto the two tier architecture and supports a larger number of sensors and collectors distributed across a large organisation or enterprise. 

Advanced Database Activity Monitoring Techniques
Network monitoring is the process of monitoring all SQL traffic to a database. The advantage is that it can monitor multiple databases at any one time and keep track of all commands being sent across the network to its databases under scrutiny. It will not be able to detect database activity carried out by a user logged directly onto a database server via a local console but it is able to monitor encrypted connections if placed between the VPN and the database, at which point the SQL commands would be in plain text. Network monitoring places no overhead on the database so performance will not be adversely affected.

Remote monitoring places a SQL collector on the database with administrative privileges and native database auditing is enabled. The collector will then aggregate all activity collected by the native database auditing tools or indeed any other database feature that may provide relevant or useful user activity based data. This type of monitoring will impose an overhead on the database as logging has been fully enabled on the database server, causing it to do more work. The benefits of this approach are that all database activity is collected, included that of any user logged directly into the server via a local console.

Local agents can be installed on each database being monitored. These may or may not be successful in detecting all database activity dependent on how they have been configured and how close to the heart of the database they are allowed to sit. As the use of agents requires software to be loaded directly on a database server, and have an associated performance impact, they are not always widely regarded by normally very conservative database administrators. The upside is that a well coded and developed agent could detect all database activity with no need to turn on the local native auditing tools and may only adversely affect database performance by 27%. Of course the business will need to decide if any performance hit is acceptable against the data security risk.

In reality, each organisation will need to determine which database activity monitoring solution architecture fits their purposes and whether a compromise will need to be achieved between security and performance. Indeed, many organisations will probably implement a mix of architectures across their databases being monitored. 

More advanced database activity monitoring solutions are increasingly moving into the realms of application monitoring as well as database monitoring. This requires a deeper understanding of application architectures and is only generally available for common enterprise solutions such as widely used HR, process management and enterprise resource planning systems. With appropriate hooks into client applications the monitoring software is even better positioned to see each and every action against a database.

The next article will cover database activity monitoring for the business decision maker

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 11th March 2010 Copyright Interarbor Solutions © 2010

In a move to mainstream predictive analytics, TIBCO Software this week rolled out the latest version of its Spotfire platform.

Dubbed Spotfire 3.1, the latest iteration promises a natural language statistical experience. Spotfire 3.1 aims to help anyone in an organization get fact-based answers to questions that help drive revenue.

The company says its software is not just for analytics gurus but also marketing professionals, business development managers and others who need forward-looking business intelligence in a hurry. [TIBCO Software is a sponsor of BriefingsDirect podcasts.]

"Unlike traditional business intelligence tools, which for the most part aggregate historical trends only, Spotfire 3.1 projects them forward with what-if scenarios," says Mark Lorion, vice president of marketing for TIBCO Spotfire. "Anyone in the company can ask questions on demand and our analytics will provide future predictions based on behind-the-scenes data-driven methods. Users don't have to understand the methods. They just have to ask the questions—and they get answers instantly rather than waiting days like you would with today's business intelligence (BI) tools."

Spotfire 3.1 in action
Let’s say you’re trying to promote a new product in the consumer goods market. Spotfire 3.1 lets you choose input variables based on what you suspect might be driving the advertisement response, such as price, discounts, packaged offers, age of the respondent or length of time as a customer. You would then press a button that asks, "Are these related?"

After you push that button, Spotfire 3.1 works behind the scenes to run predictive models, using analytics and statistics to compile sensitivity analysis and correlations, then return a colorful graph that shows the response rate and which factors are most closely correlated to people clicking on your advertisement.

While BI gives you historical data, the predictive analytics aspect of Spotfire 3.1 offers insights into what could happen next time you run a similar promotion. It can also help you fine-tune your promotions by targeting the customers that clicked on your ad, or offering different promotions to different audiences—and it does it almost instantly.

Unlike traditional BI or static spreadsheets, Lorion says Spotfire 3.1 also includes conditional coloring and lasso and axis marking that allow for better data analysis of patterns, clusters and correlations among sets of variables. The software's multiple scale bar charts and combination bar and line plots offer analysis of unstructured, "free-dimensional" data to identify key outliers and trends amongst the data.

“IT organization and statistician groups aren’t able to respond quickly enough to the many questions that arise from business users, so they go to their gut,” Lorion says. “Spotfire lets you make fact-based decisions rather than gut-based decisions.”

Predictive analytics challenges
Of course, predictive analytics software is not a new concept, and Lorion admits that the predictions are only as good as the quality and breadth of the available data. But predictive analytics is gaining momentum in the enterprise marketplace.

IBM bought predictive analytics firm SPSS last July for $1.2 billion. And IDC predicts the $1.4 billion market for advanced analytics, of which predictive analytics is a subset, will grow 10 percent annually through 2011. Despite tight IT budgets, Lorion is optimistic about the space and the company’s offering.

“The economic downturn has been good for the analytics space because customers need to make reductions and predictions—but they need to be smart about it,” Lorion says. “Companies don’t want to hire PhDs to make sense of their statistics. But we need to drive awareness of our product and educate the market that the power of predictive analytics isn’t in the hands of only a couple of statisticians.”

Spotfire 3.1 works in tandem with Spotfire Application Data Services to let companies analyze data from various sources, including SAP NetWeaver BI, SAP ERP, Salesforce.com, Siebel eBusiness Applications, and the Oracle E-Business Suite.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 10th March 2010 Copyright Interarbor Solutions © 2010

In a move to tackle a persistent cloud computing challenge, Cast Iron Systems just rolled out a new platform that aims to help companies large and small securely integrate public clouds, private clouds and on-premise applications.

Dubbed OmniConnect, the cloud integration solution offers a single platform rather than multiple products or on-premise tools to accomplish cloud integrations.

Five pillars undergird OmniConnect: complete integrations, a complete cloud experience, reusability of connectivity and processes, and portable, embeddable, and brandable environments, and centralized cloud management.

"Cloud application use is exploding, but just because you like Salesforce.com doesn't mean you are going to throw out SAP, Oracle or other applications you have on-premise. It's a hybrid world where companies have a combination of cloud and on-premise locations," says Chandar Pattabhiram, vice president of Channel and Product Marketing for Cast Iron Systems. "You don't maximize the value of your cloud applications unless you get all the data into it—so you need integration."

Complete integrations
Integration can get complex in a hurry with a growing number of applications in the enterprise, such as Salesforce, Google Apps, WebEx and ADP. Companies could take a do-it-yourself approach but it won't scale over time. Companies could also use an on-demand vendor for cloud-to-cloud scenarios, or hire an on-premise integration firm. Cast Iron Systems, though, is pushing OmniConnect as a better solution.

"Fifty-six percent of CIOs in a Gartner survey said they are transitioning away from the cloud because too many choices make it too difficult," Pattabhiram says. "Our new platform is meant to solve this problem by bridging the on-premise and cloud worlds. We offer complete integrations that include data migration, process integration, and UI mashup capabilities."

OmniConnect, for example, lets SaaS applications access, cleanse, and synchronize data stored in legacy systems in real-time and completes processes such as quote-to-order, purchase-to-pay, and order-to-cash without leaving the Cast Iron OmniConnect environment. The platform can also mash up the data from disparate sources and display them in a single view without taking the data out of one application and putting it into another.

Users can configure their integration processes in the cloud, run them in a multi-tenant cloud-based environment, and monitor all integrations from a single cloud-based console. And the Cast Iron Secure Connector aims to overcome data security issues by offering a secure channel that exchanges encrypted or firewalled data between enterprise applications and Cast Iron’s multi-tenant cloud service.

Reusability, portability and management
Cast Iron also announced a new Connector Development Kit that works to streamline building connections to new applications and data sources. The kit allows IT gurus to re-use connectivity created in OmniConnect to snap in connections to public clouds, private clouds, and on-premise applications. OmniConnect also offers reusable templates of the most common processes.

Portability is another feature that Cast Iron is boasting about. The software lets users make integrations or the entire OmniConnect portable into any public cloud, private cloud or on-premise data center environment. Infrastructure providers can also embed and brand the platform as their own integration-as-a-service offering. ADP, Dell and Cisco are already reselling the service.

There is significant value in having one platform rather than multiple solutions to bridge private cloud, public cloud and on-premise applications.

Finally, a cloud-based management console makes it possible for users to monitor multiple integrations across customer deployments in a single location. Management APIs are available for IT and SaaS providers to view the monitoring data within their private or public clouds. Cast Iron also announced support for Amazon Web Services customers through integration-as-a-service.

"Security and integration are the two biggest concerns cited in Gartner's study," says Pattabhiram. "That's why you see mega-brands partnering with us. They want to have an enterprise grade solution to help their customers adopt their cloud applications. There is significant value in having one platform rather than multiple solutions to bridge private cloud, public cloud and on-premise applications."

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Neil Ward-Dutton, Research Director, MWD Advisors Posted: 9th March 2010 This work is licensed under a Creative Commons License

Just a quick note to say that I'm honoured to have been asked to provide a keynote presentation at the upcoming CloudSlam 10 virtual conference being held from March 23-25.

My presentation is scheduled for 11am ET / 8am PT on March 23rd and is titled Cloud forecasting: models, predictions, pitfalls and planning. More details are available here. I'm also moderating a panel with some IBM folks at 4pm ET / 1pm PT on March 23rd, which should be fun (though it'll be 9pm for me, so if I jabber it's because I've had too much coffee ;-)

Last year's event was a pretty big success by all accounts, so I'm really excited to be taking part. I hope to see you there!

In the meantime—if you'd like to see a preview of some of what Ill be talking about (obviously I'll be mixing it up a bit for CloudSlam) then you should check out our own virtual Cloud event, available on-demand here. It's free—you only need Guest Pass access to our research library to access the content. I'd love to hear what you think about the research we're doing in this area.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Neil Ward-Dutton (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Laurie McCabe, Partner, Hurwitz & Associates Posted: 9th March 2010 Copyright Hurwitz & Associates © 2010

What is Social Media Management?
As described in the column What is Social Networking, and Why Should You Care?, Internet-based social media make it easier for people to listen, interact, engage and collaborate with each other. But, as the volume of social media venues and conversations rises, it quickly becomes a time and labor intensive process to effectively track, converse, monitor and manage them.

Social media management solutions can help you manage outbound and incoming online interactions—along with other marketing activities—in a more efficient manner. They streamline and consolidate how you listen to and participate in relevant conversations in the different places theyre taking place—blogs, social networks like Twitter or Facebook, and other public and private web communities and sites. They help you to more easily monitor what people are saying about your business, and by automating the process of delivering your outgoing messages through multiple social media outlets simultaneously, help you to amplify your social media presence across several social media sites.

Social media management tools can also help you to integrate social media activities with other marketing programs. These can include both other online activities, such as web site, search engine marketing campaigns, contact management systems, and email marketing, as well as offline marketing, such as events or white papers.

Why Should You Care?
We all know how important word of mouth is, and social media is like word of mouth on steroids. As a business, it's vital to tap into and join online conversations, not only about your brand, but also those about your competitors, your industry and your areas of expertise.

Even if you havent launched an outbound social media strategy, you to keep a pulse on what people are saying—good or bad—about your company, competitors and major trends. And, by representing your company in a positive, authentic way, you can build credibility for your expertise and business, and link to customers and prospects quickly. You can also help mitigate damage should negative conversations about your company emerge by proactively responding to complaints. Social media can also steer people to your other marketing programs, where its easier to individually track and manage individual customer and prospect interactions.

Done right, social media can help you better understand prospect and customer needs, and increase visibility and generate leads. But it takes a lot of time and energy to stay on top of all of this in a manual, piecemeal fashion. Think about the time it takes to just to cover some of the basics, such as:

• Creating content in multiple places, such as a blog, Twitter, a Facebook page, etc., and monitor and scan the views, decide what comments to approve, and respond to replies on these sites.
• Scanning Twitter followers for conversations you may want to join, or checking your RSS reader subscriptions for relevant articles and new ideas.
• Checking Google Alerts to see when and where your business is mentioned on the Web.
• Creating and monitoring a community and topics on a site such as Facebook or LinkedIn.

Now think about the fact that the social media to do list is only going to grow. And while you are building goodwill, relationships and awareness, it's difficult to measure short-term payback on social media efforts. And you can't abandon other marketing activities—web site, search engine marketing, email marketing, etc. and contact and sales management. Social media management tools give you a way to get your arms around the many-headed social media Hydra by streamlining and integrating customer interactions across multiple marketing venues.

What to Consider
There are dozens, if not hundreds of solutions out there that let you manage/integrate different slices of the social media pie, but we are still searching for the Holy Grail in this relatively new area. However, I've spotted a few vendors that have put together some more comprehensive solutions designed and priced specifically for small business budgets, including:

• BatchBlue's BatchBook, a "social CRM" offering that integrates contact, sales and social media feeds, with mobile versions for iPhone and BlackBerry. The social media integration is cool—after you enter social media feeds from Twitter, blogs, LinkedIn, etc. on a contact record, you automatically see a contact's social networking profile, and the last three posts, tweets and/or other entries when you open the record so that you can keep a pulse on customers and prospects. With lists and reports, you can build lists, or create customized reports. BatchBook integrates with Mailchimp so you can send email newsletters to your lists. BatchBlue gives all new users a minimum of 2 hours of 1–1 consulting time to help them get productive as quickly as possible. Pricing ranges from $9.95 to $99.95 a month, based on the number of users, storage, and 1–1 consultation time you need. My take is that BatchBlue is a great solution for tech-savvy small businesses, especially services businesses where every relationship counts.
• CloudProfile gives SMBs a unified content publishing and social media hub and web presence, which businesses can use standalone in place of web site, or with their existing web site. You create an online profile, which enables your business to get found in search engines like Google, business directories, and on social networks. It helps you find and connect with customers on Twitter and Facebook, and offers tools such as click-to-call, text messaging and e-mail marketing to help you stay connected with customers. CloudProfile provides built-In reports and connect to Google Analytics. The company plans to add PayPal and Amazon checkout and appointment scheduling soon. Pricing starts at $14.95 a month. A very good choice for the approximately 40% of small businesses that don't yet have a web site—gives you an online presence plus social capabilities.
• HubSpot helps companies create, optimize and promote their content. HubSpot features a blogging platform and a content management system, and tools to help analyze your marketing reach via blogs, leads, Facebook and Twitter accounts. It provides links to conversations across the Internet related to your business keywords in one tidy dashboard. The Web Voter feature enables you to create a social news page on your site, where users can submit links and vote on them—creating an activity hub for discussion of hot issues. HubSpot also provides Keyword, Page and Link Graders, to help optimize search result rankings. Optional integration with Salesforce.com CRM is available. HubSpot charges an initial $500 start up fee, and ongoing pricing starts at $250 per month. It also offers a number of free tools, including Graders for web sites, press releases, blogs, etc. HubSpot, who we interviewed for a video a couple of weeks ago, provides a very comprehensive solution for both small and medium businesses.
• ZooLoo provides a one-stop shop to get an online presence and manage social media interactions—including domain name registration, web site creation, a blogging platform, SEO tools, privacy controls, storage, and tools to connect across social networking sites–along with a personal dashboard to manage all of it. Some tools, such as the Graffiti blogging platform that lets you share posts across your social networks, are free. ZooLoo charges for other things, such as domain registration, web sites and privacy controls. ZooLoo’s fee-based services range in price from $1.99 to $9.99 per month. Although most of it’s current users are consumers, ZooLoo is a great fit for entrepreneurs—and the Facebook-like interface makes it easy for anyone to get the hang of.

As you can see, these companies come at the social media management conundrum from different angles. So as you evaluate these and other offerings, think about what is most critical to your business. What are your key objectives for your social media investments? Where do you spend the most time manually scanning, managing, updating and integrating across social media streams and more structured marketing activities? Where are the gaps? There is no one-size fits all, so start with your own requirements and objectives to help start taming the social media Hydra.

(Originally published on March 4, 2010, in Small Business Computing)

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Laurie McCabe (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 8th March 2010 Copyright Bloor Research © 2010

On Wednesday 3 March 2010 I attended the inspiring launch of Apps for Good in Tulse Hill, Lambeth, South London.

Apps for Good is a project that will provide an environment for young people in the community to analyse issues that effect their lives and then design and develop digital applications to improve their reality.

The program is being run by CDI Europe based on techniques developed over the last 15 years. CDI started in deprived communities in Rio de Janeiro and now has hundreds of centres across South America, the Middle East, North Africa and now Europe, and is planning to expand into southern Africa and India.

The project is expected to have multiple beneficial effects:

• The availability of useful applications relevant to the needs of the local community.
• Increased understanding of the issues that effect young people and the wider community.
• Encourage the use of information technology within the community by demonstrating the benefits and thereby increase digital inclusion.
• The participants will gain transferable skills related to working in groups, working in projects, analysis, design, development and promotion of solutions.
• Improve the self awareness and motivation of the participants.
• Proof that the process works in the UK environment with the intent that it will be replicated in other centres across the UK and Europe.

I am excited by this project because I recognise the importance of digital technology to the UK and the need to ensure that young people are enthused and involved. On a personal level I realise that, as I move into retirement, the quality of my life will become dependent on both younger people around me and the innovative and effective use of technology.

As my regular readers will know my main interest is in accessibility: computing for people with disabilities. I see Apps for Good having the potential to address issues in this area in two ways. Either the young people will recognise the issue of digital exclusion of people with disabilities (along with the elderly, or people whose first language is not English) and create applications to help them. Or centres will be set up specifically for people with disabilities to create their own solutions. This has already happened in South America.

Congratulations and good luck to everyone involved in the instigation and running of this project:

• High Trees Development Trust in Tulse Hill, South London where the first UK centre is housed.
• CDI Europe who provide the knowledge and skills in running similar projects.
• Dell YouthConnect that supplied the computers and some professional support.

If this first pilot in High Trees goes welland I am convinced that it willthen there will be a demand and a desire to replicate it rapidly around the UK and other European countries. I urge everyone in the British ICT community to think how they could support this initiative: by providing equipment or volunteers to help with the project, but also thinking how they can provide support to the young people to build on the skills and solutions they have developed.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Peter Abrahams (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Bob Tarzey, Service Director, Quocirca Posted: 8th March 2010 Copyright Quocirca © 2010

Any business likes to claim to be number one at something; the biggest pet-shop in town, the largest office productivity application provider globally, the only telco that provides both mobile and broadband in your area.

To this end categories are often invented to suit the business "This is the only shop in town where you can buy sweets, records, magazines, kitchen accessories and have a cup of coffee". This is an attempt to characterise the now defunct Woolworths in the UK— trying to be all things to all people was not distinctive enough to save it in the face of the recession.

One IT vendor that faces such a problem is Novell. It once had a clear market-leading position—in the 1980s and early 1990s Novell's NetWare network operating system was the network operating system of choice for sharing files among workgroups. The ascendancy of Windows, Linux, the IP protocol, among other things, led to a fall in demand for NetWare and left Novell seeking a new identity.

Unlike Woolworths (in the UK at least) Novell is still with us and doing OK; it has $1bn in cash and, although sales shrunk a little in Q1 2010, profits and earnings per share doubled. A sign of a business managed well in tight times?

Novell's main problem is getting the message out there about what it is and what it stands for. This is hard because the reality is that Novell is not number one in any of its core markets. Since the decline of its NetWare business Novell has survived by building up four new product lines.

1. It has a commercial distribution of Linux through its acquisition of SUSE back in 2003. A strong and growing business to be in, Novell has achieved particular success in the public sector, where open source is becoming more and more attractive as budgets are squeezed. Novell is helped by partnerships with Microsoft and IBM, but it remains number two to Red Hat (and, in the datacentre, Linux is still number two to Microsoft Windows Server).
2. It has maintained a long-term presence in the identity and access management (IAM) market, but this remains fragmented; directory management is dominated by Microsoft Active Directory, the Oracle/Sun merger has bought together two strong players in access security and there are many others including IBM, CA and EMC/RSA.
3. Through its acquisition of Plate Spin in 2008, Novell entered the configuration management database (CMDB) market; but again there are a number of major players in the mid-market including HP, IBM and VMware.
4. Finally it is in the business of measuring and monitoring IT systems and performance with tools from a number of areas including its acquisitions of e-Securities/Sentinel in 2006 and Managed Objects in 2008. Again a fragmented market with lots of players.

Novell has made it clear that it is a software products company by divesting itself of its services arm in 2008 (the results of a 2001 acquisition of Cambridge Technology Partners). So, it may be that Novell can claim to be the worlds number one supplier of Linux/IAM/CMDB/measurement and monitoring products, but such a Woolworths-style proposition is confusing and will not gain traction.

A better approach is to take a recognised market requirement and build a value proposition to address it drawing on relevant components from a broad product portfolio. This is what Novell is doing with its Intelligent Workload Management initiative. IWM aims to address the problem of securely managing workloads across dynamic IT infrastructure (think virtualisation and cloud computing). It requires elements of IAM, CMDB, measurement and monitoring. Identify with an emerging category well enough and perhaps Novell can be the thought leader, as it is attempting with the web site http://www.intelligentworkloadmanagement.com and, if that works, even market leader in the long term.

However, Novell should not lose sight of where its revenue is coming from right now. At the end of the day, there is nothing wrong in being number two or three in a market if you serve it well and address niche requirements. A siloed approach focused on a variety of core businesses, doing a good job in each, providing the products and expertise that buyers want and keeping the leaders on their toes, remains a viable approach for any vendor with a mixed bag of products—even if they are not the market leader in any one area.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Bob Tarzey (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: David Tebbutt Posted: 6th March 2010 Copyright © 2010

In the days of black screens and green type, the arrival of colour was somewhat puzzling. If computers had got us so far without colour, who'd want it? Everyone, it seems.

Then came windows, icons, mice and pointers. Again, we were all happy with what we had. Why rewrite everything for some gimmicky whizzbang interface? As soon as you used an Apple Mac, you knew the answer. Ordinary people were suddenly able to do extraordinary things. But it wasn't until 11 years later when Microsoft finally got its act together with Windows 95, that this interface started to become more or less ubiquitous.

And there we've stalled for 26 or 15 years, depending whether you're a Mac or a PC fan. It works. Who wants more? Well, since the time the Macintosh came out, inventors have toiled in labs to bring us a more natural, direct, interface based on fingers, hands and, in the case of horizontal displays, objects placed on the screen. In recent years pioneering companies like Perceptive Pixel, Apple and Microsoft have been selling multi-touch surface devices.

In the abstract, it all sounds jolly fine (apart from the potential for the unselfish sharing of germs). You can access, open, expand, move, rotate and contract information artefacts right there on the screen. They could be images or documents inside the computer. Some of the systems can even interact with other things lying on the screen's surface. The external artefacts might be coded underneath so the system knows what to do with them or they could be simple things like business cards or other documents, which can be scanned. In one case, a library in Delft would whizz up pictorial information about your post code as it read your library card (video here). The Microsoft Surface can recognise and communicate with a suitably enabled mobile phone. It can show the contents of your mobile phone in a notebook. Just slide items to and from the on-screen notebook, in order to update the phone contents.

You could throw a keyboard up or, indeed, a facsimile of any kind of device but the main potential at the moment seems to be exploration, manipulation and mark-up. Fingers are better at some things but certainly not everything. However, if your organisation needs to surface information to any audience, regardless of their computer skills or application knowledge, then this might be a better way to do it than the usual single touch, keyboard or mouse controls.

The Hard Rock Café in Las Vegas has a number of Microsoft Surface tables through which visitors can browse a growing part of the company's collection of rock memorabilia. The National Library of Ireland uses the same product to show rare books and manuscripts which would otherwise be kept from public view due to their fragility or value. The US military uses Perceptive Pixel's huge displays for God-knows-what but you can bet that some of it involves 3-D terrain, flying things and weapons. Then Apple, of course, has made the iPhone exceedingly sexy with its own gestural controls.

While the technolgy and the functions are intriguing and seductive, the question is whether they give sufficient advantage over what's being used today. They cannot replace the present range of control devices except in special application-specific situations. Just as mice and pointers didn't replace keyboards, nor will multi-touch replace current devices. They may complement them though, especially as they become part of the repertoire of the everyday laptop or PC.

Whenever new technologies come along, it's quite often the user department that takes them on board, side-stepping IT if possible. We saw it with PCs and spreadsheets. We saw it again with desktop publishing. And again with mobile phones and PDAs. But, eventually, either the users or the organisation realise that the greater benefit comes from integration. IT represents the great archive in the sky to which and from which intellectual artefacts can be stored and retrieved. And, once IT is involved, more things become possible; using the mobile phone as a terminal, access to and re-use of materials produced elsewhere in the company and, in the case of multi-touch, delivering the contents of information stores to the devices. Museums and libraries are, perhaps, obvious examples but some users would value a natural way to get at and drill into, say, statistical information by geography or find and explore whatever today's equivalent of a blueprint is.

Right now, you might see these multi-touch surface devices as a bit of a curiosity but, just as the mouse (first publicly demonstrated in 1968) moved into the mainstream eventually, so these things may become important to you and your organisation.

If you're interested, a great place to mug up on the background is Bill Buxton's Multi-Touch overview.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact David Tebbutt (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dr Fern Halper, Partner, Hurwitz & Associates Posted: 5th March 2010 Copyright Hurwitz & Associates © 2010

I just got back from the SAS analyst event that was held in Steamboat Springs, Colorado. It was a great meeting. Here are some of the themes I heard over the few days I was there:

SAS is a unique place to work.
Consider the following: SAS revenue per employee is somewhat lower than the software industry average because everyone is on the payroll. That's right. Everyone from the grounds keepers to the health clinic professionals to those involved in advertising are on the SAS payroll. The company treats its employees very well, providing fitness facilities and on-site day care (also on the payroll). You don't even have to buy your own coffee or soda! The company has found that these kinds of perks have a positive impact. SAS announced no layoffs in 2009 and this further increased morale and productivity. The company actually saw increased profits in 2009. Executives from SAS also made the point that even thought they might have their own advertising, etc. they do not want to be insular. The company knows it needs new blood and new ideas. On that note, check out the next two themes:

Innovation is very important to SAS.
Here are some examples:

• Dr. Goodnight gave his presentation using the latest version of the SAS BI dashboard, which looked pretty slick.
• SAS has recently introduced some very innovative products and the trend will continue. One example is its social network analysis product that has been doing very well in the market. The product analyzes social networks and can, for example, uncover groups of people working together to commit fraud. This product was able to find $32M in welfare fraud in several weeks.
• SAS continues to enhance its UI, which it has been beat up about in the past. We also got pre-briefed on some new product announcements that I can't talk about yet, but other analysts did tweet about them at the conference. There were a lot of tweets at this conference and they were analyzed in real time.

The partnership with Accenture is a meaningful one.
SAS execs stated that, although they may not have that many partnerships, they try to make the ones they have very real. While, on the surface, the recent announcement regarding the Accenture SAS Analytics Group might seem like a 'me too' after IBM BAO, it is actually different. Accenture's goal is transform the front office, like ERP/CRM was transformed. It wants to, "Take the what and turn it into so what and now what?" It views analytics not simply as a technology, but a new competitive management science that enables agility. It obviously won't market it that way as the company takes a business focus. Look for the Accenture SAS Analytics Group to put out services such as Churn management as a service, Risk and fraud detection as a service. They will operationalize this as part of a business process.

The Cloud!
SAS has a number of SaaS offerings in the market and will, no doubt, introduce more. What I found refreshing was that SAS takes issues around SaaS very seriously. You'd expect a data company to be concerned about their customers' data and they are.

Best line of the conference
SAS is putting a lot of effort into making its products easier to use and that is a good thing. There are ways to get analysis to those people who aren't that analytical. In a discussion about the skill level required for people to use advanced analytics, however, one customer commented, "Just because you can turn on a stove doesnt mean you know how to cook". More on this in another post.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dr Fern Halper (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 4th March 2010 Copyright Interarbor Solutions © 2010

If you want a realistic view of cloud computing adoption—along with an understanding of what motivates IT executives to invest the cloud, what concerns remain, and what initiatives are planned—you can’t limit your frame to a single industry. The full picture only becomes clear through a cross section of research, manufacturing, government and education fields.

That’s the approach Platform Computing took at a recent supercomputing conference. The company late last year surveyed 95 IT executives across a number of fields to offer insight into how organizations are experimenting with cloud computing and how they view the value of private clouds. [Disclosure: Platform Computing is a sponsor of BriefingsDirect podcasts.]

The results: Nearly 85 percent intend to keep their cloud initiatives within their own firewall.

“When deploying a private cloud, organizations will need a management framework that can leverage existing hardware and software investments and support key business applications,” says Peter Nichol, general manager of the HPC Business Unit at Platform Computing. “This survey reaffirms the benefits that private clouds offer—a more flexible and dynamic infrastructure with greater levels of self-service and enterprise application support.”

Most organizations surveyed are experimenting with cloud computing—and experimenting is the key word. Eighty-two percent don’t foresee cloud bursting initiatives any time soon. This suggests an appreciation for private cloud management platforms that are independent of location and ownership, and can provide the needed security in a world of strict regulations around transparency and privacy.

Security is chief concern
Forty-nine percent cite security as a chief concern with cloud computing. Another 31 percent pointed to the complexity of managing clouds, while only 15 percent said cost was an issue. Indeed, security concerns are a force driving many IT execs toward private rather than public clouds. Forty-five percent of organizations considering establishing private clouds as they experiment with ways to improve efficiency, increase their resource pool and build a more flexible infrastructure.

. . . The adoption of cloud computing should follow a sequence of evolutionary steps rather than an overnight revolution.

There seems to be some naïveté over the cloud. Nearly three-quarters of those surveyed don’t expect their IT organization infrastructure to change in the face of cloud computing. But that is not a realistic expectation. The move to cloud computing is an evolutionary one and IT organizations must themselves evolve to meet the demands of the organizations and their users. Ultimately, a willingness to evolve begins with an appreciation of the cloud’s value.

“Cloud computing has provided the impetus for IT to make a much needed shift, but many in the industry are still struggling to understand the value of the cloud,” says Randy Clark, chief marketing officer at Platform Computing. “As organizations continue to experiment with cloud to move toward better efficiency and cost-savings, it is best to bear in mind that to ensure success, the adoption of cloud computing should follow a sequence of evolutionary steps rather than an overnight revolution.”

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 4th March 2010 Copyright Bloor Research © 2010

This article will explore how database activity monitoring deals with other types of data attacks.

Temporary Accounts
Temporary accounts have a perfectly legitimate part to play in any database system as they can provide flexibility for the DBA wanting to create short term access for contract workers or for managing some database activities. Unfortunately they are also a vector for hackers, especially if the administration account can be compromised and the temporary account assigned roles and privileges that could result in data being stolen.

By setting up a temporary account a hacker can start to create a better level of anonymity and bury their true identity at the end of a long chain of other accounts designed to throw investigators off their path. A database activity monitoring solution will raise an alert if an unusual temporary account or set of accounts has been create that do not fit into the normal pattern of behaviour for an application.

Sensitive Data
Not all data in a database is sensitive. For example you may have a table that contains a list of the products you sell on your website, all of which is public. On the other hand you may have a table that contains customer discount rates, which is highly confidential and could seriously compromise your business relationships if it was made public. Then of course we have payroll and salary data, often deemed to be the most sensitive information and organisation keeps.

During the setup phase for the database monitoring system the DBA would normally work alongside the security team and the business to categorise the data being held and determine what data is the most sensitive. It will then need to be decided what database actions are permitted on this data. For example it may be perfectly acceptable for a payroll clerk to SELECT data from the salary table for the monthly cheque run but it is completely unacceptable for them to be able to UPDATE the same data and give themselves a pay rise. Once finalised, the database activity monitoring tool will see what activities are being attempted against the various sensitive data sets and raise warnings if necessary.

Out of Course Data Access
Out of course data access is when a user attempts to access data by bypassing their usual client application. For example if an organisation has created a client server application that uses a front end Visual Basic screen to retrieve data they may decide to try and connect to the backend database using Microsoft Access or Excel. If the user was able to connect using a tool such as MS Access, the simplicity of the tool will enable most users to download huge amounts of data by pointing and clicking. The database activity monitoring tool can be configured to audit connections from clients other than the approved Visual Basic tool and raise an alert for any out of course connection attempts.

Unusual Activity
This is often a catchall for activities that fall outside the norm for a particular database. Typical unusual activities include users accessing more data than normalfor example selecting all the data from the customer table rather than just those for their sales region. It could be someone accessing the data out of hours, maybe at the weekend and maybe from home. What is unusual for one database may be usual for another, so this will need a higher degree of customisation and learning for the activity monitoring solution to prevent legitimate users getting annoyed, but it can be a powerful data protection tool.

More obscure activities should also be tracked; for example users trying to start or stop services, trying to run extended stored procedures or meddling with database backups. Any of these could be legitimate but at least you will be alerted and will have the ability to investigate what is happening.

Connection Pooling
Connection pooling has been implemented by a number of vendors of enterprise software as a way of optimising the performance of a database. For example a system may only have one shared connection under a single database account that is used for updating customer data by all users. Of course the users don't know they are using this single accountthis is a process that happens underneath the covers of the application. From an information security perspective this presents us with a problem as it is more complicated to work out who the actual user was for a specific transaction if the connection was pooled. Some database activity monitoring products are able to see if connection pooling has been implemented and then track transactions back to the client application and discover who the actual user was for each discrete transaction, a feature which is very useful with such pooled connection implementations.

The next article will cover compliance issues and the way in which a database activity monitoring solution can be architectured for best effect.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Laurie McCabe, Partner, Hurwitz & Associates Posted: 3rd March 2010 Copyright Hurwitz & Associates © 2010

In a bold move to get traditional value-added resellers (VARs) off the SaaS fence, NetSuite announced its new Solution Provider (SP) 100 Program, which gives business application VARs 100% margin on the first year of license subscriptions they sell. The program requires a 2-year minimum license commitment from the customer and, after the first year, NetSuite pays VARs 10% margin on recurring annual license fees. Prior to this program, NetSuite had offered VARs 30% of annual license sales.

NetSuite's SP 100 Program targets established mid-market and enterprise ERP and CRM VARs and consultants, including VARs selling Microsoft Dynamics, SAP, Sage, Epicor, Deltek, and others. The program is not exclusive—VARs can continue to sell their packaged business software offerings as well. NetSuite is also extending the program to its current solution provider partners, and it includes all other SP program perks, including sales and technical training, sales cycle assistance, and marketing support.

Background
Since the model got off the ground over 10 years ago, SaaS vendors have argued that SaaS can open the door for VARs to create a recurring revenue stream, and free them up from low margin IT service chores to focus on generating higher value business.

But the case has evidently not been strong enough to entice the masses, for a few key reasons. First, the recurring revenue model is radically different to the conventional business applications model, where VARs earn a large upfront commission for selling a business solution, hardware and infrastructure software. Second, VARs have baulked at not being able to generate income from services necessary to deploy and maintain business applications on customer premises. Third, whether real or perceived, many VARs don't trust SaaS vendors. Deep down, they think that after they make the sale, SaaS vendors will take control of the account and soon disintermediate them entirely.

Quick Take
NetSuite's SP 100 Program supplies VARs with the big upfront payment that they are accustomed to. NetSuite's own side-by-side VAR revenue comparison to Microsoft Dynamics favors NetSuite of course, but VARs can try it and do their own math to see how it proves out without having to give up selling competitive packaged software. It's an opportunity to get up to speed on SaaS, the cloud and recurring revenue models and develop their business consulting skills.

As important, it comes at a time when the SaaS model has proved its maturity and staying power. Many VARs have lost deals to a SaaS vendor, and many customers are trying to avoid big upfront capital outlays. While some VARs will remain skittish, distrustful, or even just lethargic about adding a SaaS solution to their business management portfolio, I think NetSuite's SP 100 will be big wake-up call for many VARs.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Laurie McCabe (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 3rd March 2010 Copyright Interarbor Solutions © 2010

Security. It's one of the major issues that keeps cloud computing from working its way deeper and more quickly into the enterprise IT mainstream.

But what are the potential threats around using cloud services? How can companies make sure business processes and data remain secured in the cloud? And how can CIOs accurately assess the risks and benefits of cloud adoption strategies?

Hewlett-Packard (HP) and the Cloud Security Alliance (CSA) answer these and other questions in a new research report entitled, "Top Threats to Cloud Computing Report."

The report, which was highlighted during the Cloud Security Summit at the RSA conference this week, taps the knowledge of information security experts at 29 enterprises, solutions providers and consulting firms that deal with demanding and complex cloud environments. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Mastering next-gen IT
As Cloud Security Alliance Founder Jim Reavis sees it, cloud services are the next generation of IT that enterprises must master—and it's imperative that companies understand and mitigate security threats that accompany the cloud.

"The objective of this report was to not only identify those threats which are most germane to IT organizations but also help organizations understand how to proactively protect themselves," Reavis said. "This is the first deliverable in our cloud threat research initiative, which will feature regular updates to reflect participation from a greater number of experts and to keep pace with the dynamic nature of new threats."

Cloud computing abuse
The Top Threats to Cloud Computing Report shines a light on vulnerabilities that threaten to hinder cloud service offerings from reaching their full potential. HP and the Cloud Security Alliance warn companies to be aware of the abuse and nefarious use of cloud computing. The report specifically points to the Zeus botnet and InfoStealing Trojan horses as a prime examples of malicious software that has compromised sensitive private resources in cloud environments.

Cloud services are the next generation of IT that enterprises must master—and it's imperative that companies understand and mitigate security threats that accompany the cloud.

Beyond malicious software, the report pegs sites that rely on multiple application programming interfaces (APIs) as typically representing the weakest security link. That's because one insecure API can impact a larger set of members using the evolving social Web, which presents data from disparate sources.

Rounding out the list of common cloud threats covered in the report are malicious insiders, shared technology vulnerabilities, data loss and leakage and account/service and traffic hijacking.

The RSA-debuted full report is available on the CSA Web site.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Clive Longbottom, Head of Research, Quocirca Posted: 2nd March 2010 Copyright Quocirca © 2010

Quocirca has completed the second cycle of research and analysis for Oracle around enterprise performance management (EPM), and the headline results show a massive improvement across the six sub-indices and the overall EPM index. Surely, then, this is good news?

Underneath the headline figures lay various findings that show that while awareness of how EPM can help an organisation has grown, existing technical systems are often ill-suited to meeting the business process requirements of an organisation, while the wish to invest in new systems has shrunk as recessionary budgets remain in force.

Also, the findings show that while respondents understand the need for better processes in each area, there is still a lack of overall belief that these processes need to be linked to gain the maximum benefit from an EPM approach.

The research looked at six different areas; stakeholder environment, market model, business model, business plan, business operations and business results. The stakeholder environment sub-index, which looks at how inputs from and the needs of customers, suppliers, shareholders and legal bodies were dealt with by those involved in the overall EPM financial processes of an organisation. As with the first cycle of the research (carried out in February 2009), this sub-index resulted in the lowest showing overall. Although the majority of respondents felt that they had consistent and repeatable processes in place to engage with stakeholders, far fewer felt that key stakeholders had a true and transparent view of the corporate strategy. Either the process of engagement is flawed, or the messages being passed through the process are poor - either way, this points to a lot of work needed to make the overall process workable.

However, at the other end of the process, the business results sub-index resulted in the highest performance overall. It is therefore tempting to look at the results and think, Hang on - if all the processes leading up to the business results are sub-optimal, why is the business result itself so strong? Good point, but one that is best looked at against a real world vertical example.

In the world of finance, we see that the business results up until 2007 were excellent: it seemed that the house of cards could continue to be built up and up without any issues. Then, sub-prime hit and the cards came tumbling down. Those institutions that were hardest hit suddenly realised that the processes that led up to the final results were flawed: stakeholders were not involved in key decision making, and strategies had not been well communicated. Chasms between various areas within the institutions themselves led to processes being broken as information was not treated transparently or consistently as it traversed from one part of the organisation to another. Internal risks were not evaluated properly, and employees were compensated more on immediate than on long-term results, leading to higher risk taking that was uncontrolled.

In effect, Quocirca believes that the EPM research is still reflecting this. Many organisations are still profitable despite poor internal processes. If they were to look at how best to apply fully cohesive and coherent EPM processes, not only could savings be made across the board, but new opportunities could be opened up through greater flexibility, as could the capacity to play the key what ifs? around new product or service offerings. The good times of the early to mid 2000s allowed many process issues to remain hidden, whereas the past two years have rapidly uncovered major process failings.

It is, as yet, not apparent as to whether the recession is over and that the world will now move back to mid-term growth. Many commentators believe that a second wave of recession will hit many countries. With effective EPM in place, an organisation will be far better placed to survive a second recession - and to do well once out the other side. Although full EPM will involve investment in new technology to underpin the processes, it will be money well spent.

After all, what is the point in saving money and going out of business?

The Quocirca report on the Oracle EPM index, Enterprise Performance Management: Cycle II, is available for free download here.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Clive Longbottom (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 2nd March 2010 Copyright Interarbor Solutions © 2010

The latest BriefingsDirect podcast discussion comes in conjunction with The Open Group’s Enterprise Architecture Practitioners Conference held earlier this month in Seattle.

We assembled a panel to examine service oriented architecture (SOA) and cloud computing—the relationships, the inter-reliance and the realities. Three years ago, the IT transformation poster child was SOA, and now we're well into the hype curve around cloud computing, but has one actually given way to the other? Are they linear in their relationship, or perhaps mutually dependent in some ways, and to what degree?

We’ll explore now whether SOA has found new value and relevance as a foundation and perhaps catalyst for cloud computing, especially for so-called private clouds. And, we'll see how the emergence of SOA and cloud may be happening in different places inside of enterprises. Shouldn’t one hand get to quickly know what the other is up to and perhaps even work together?

Here with us now, however, to plumb the depths of how SOA and cloud computing do or don’t come together, are Dr. Chris Harding, director of the SOA Work Group at The Open Group; Stephen G. Bennett, Senior Enterprise Architect at Oracle, and Peter Coffee, Director of Platform Search for Salesforce.com. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Harding: Five years ago, when we started getting into SOA, there was a huge amount of excitement and a great deal of buzz about it. Now, we can see that the hype cycle has run its course, but we're still seeing a great deal of technical interest in SOA and we're also seeing that companies are using it and are increasing their use of it. So, there is a steady uptake in the use of SOA, although the excitement about it has died down.

It’s very interesting that service orientation is very much a business concept, and SOA has been about the application of that business concept to the technology. Cloud computing, on the other hand, is very much a technical concept. It’s about what you can do with technology over the Internet.

It is a technical concept, but it has had a really big impact on the business structure. So you can see them as complementary. SOA has been the application of business principles into the technology. Cloud is a technical concept, which has had a huge impact on the business. So, yes, there probably are different parts of the organizations looking at cloud and looking at SOA, but there is a big dynamic that says they should be working together on both of them.

Coffee: I've been covering SOA for a long time. I'd say the people who adopted SOA in the previous decade got considerable upside, but those who did not didn’t really suffer any penalty for not doing so.

In the situation we're in now, where the economics of cloud computing are becoming quite compelling, the downside of not having a SOA is becoming quite apparent. If you don’t have a service environment, then your ability to extend your current assets and integrate them with cloud services is going to be somewhat hampered.

So, people are realizing now that the wait-and-see option is more perilous than it used to be. This is accelerating the actual adoption of what we would call SOA, except that’s no longer the label du jour.

It seems to me that SOA very quickly became a label of products that vendors wanted to sell. So, you saw a lot of things like enterprise service bus (ESB) products and so on.

It became dangerously easy to think that you were doing SOA, if you were buying the tools and failing to appreciate how much of a cultural and management achievement it was to get people to think of themselves not as owners of and the gatekeepers to an IT asset, but instead being publishers of and supporters of a service to other parts of the business.

It’s absolutely critical to understand that you can view SOA as simply a way of integrating the stuff you have, or you can move to the next level and start to think of it as the way you do your business. The way your business units interact with and support each other with the technology is just the enabler for that.

The same is true of the cloud. It's possible to take the existing IT model of isolated applications, each with their own data stores, and replicate that model in the cloud with elastic scalability of capacity. That would be the level of the cloud industry that’s typically called infrastructure as a service (IaaS).

Or, it's possible to use the cloud as a much more interesting and fluid medium for interaction among much more granular and business-oriented services at the level that’s traditionally been called in the industry either platform as a service (PaaS) or software as a service (SaaS). It depends on the level at which you choose to consume other people’s application work, instead of doing new application development yourself.

It’s possible to do SOA without the cloud. It’s possible to do better SOA with it. It is also possible to do an isolated silo-oriented architecture locally and also to do that in a cloud environment. Neither one necessarily implies or impels the other.

Bennett: The majority of large enterprises today are doing SOA in one fashion or another at different levels of maturity, whether that’s from the quite immature approach of seeing it as a pure integration play all the way up to seeing it more as a business agility kind of play.

So, it's becoming a norm and, therefore, we don’t need to keep hyping it or pushing it. We need to use the characteristics it offers with other supporting technology strategies such as cloud.

I actually see recession as an opportunity within IT, because it gives you opportunity to reset thinking and reset IT's approach to actually delivering IT to the business.

It's a combination of technologies that are finally ready for prime time, and an ecosystem that’s ready to support those technologies well.

Coffee: The economics of being able to have elastically scalable capacity to be able to handle peak loads without needing to own the peak capacity and wind up with very low utilization rates on your capacity are becoming so compelling that people are asking how they're going to take advantage of this opportunity of this cloud environment.

It's a combination of technologies that are finally ready for prime time, and an ecosystem that’s ready to support those technologies well—providers of services and providers of expert assistance in using those services.

That’s a very important enabling ware, when your major system integration firms begin fully to understand how they can incorporate cloud services into the portfolio of technologies that they make available to their customers. When you put that all together, the downside of not moving to an SOA becomes an embarrassing lack of ability to take advantages of these incredible economies.

... The combination of SOA, which makes your various business units able to cooperate more effectively, with cloud environments, which allow you to handle very "bursty" workloads and conduct very cost-effective pilot projects and scale the ones that work very rapidly, increase the ROI of IT spending.

The IT budget, as a line item, is not conspicuously bigger. In fact, it may actually shrink, because the IT department now is a composer and integrator of stuff that may now be getting done with the operating budget by personnel, who are on the payroll as members of a business unit, instead of members of an IT organization.

Bennett: What people are talking about is the opportunity to redirect costs to area such as business architecture, and business architecture is part of enterprise architecture (EA). That's not purely IT focused, but the wider concern—investing stuff like business capability maps to understand exactly where I should utilize SOA and cloud with my organization—is going to be key.

This will, in turn, enable the consuming enterprises to concentrate on the things that they are particularly good at.

Harding: That certainly must be one of the factors that will enable cloud computing to make enterprises more efficient—the elasticity and the take-up effect. It also has a major effect on the risk that an enterprise needs to take on. But, there is a bigger factor, which is meant to drive down cost, and that is competition.

If you take service orientation and cloud in combination, you’re seeing the ability of people to buy services from different suppliers, for those suppliers to compete, and for those suppliers to concentrate on the services that they are particularly good at. This will, in turn, enable the consuming enterprises to concentrate on the things that they are particularly good at.

So, you don’t need to dissipate your efforts on running an inefficient IT department, which is not your core business. You can outsource that, get a specialist to do it much better, and concentrate on what you're good at. That is the real dynamic that will improve things economically.

Now, from an Open Group perspective, there is a danger that you may become locked into a particular supplier. Part of our role in promoting open systems is to push for the standards to be in place so that that doesn’t happen. Provided we can prevent that locking, it’s altogether a very healthy situation.

Coffee: The granularity of this marketplace is quite surprising to many people who haven’t looked at it closely. We see already people building applications, in which they have shopped the marketplace and found a cloud storage proposition from one provider, a cloud application development platform from another, social networking algorithms and facilities from yet a third provider and have built some really interesting strategic business solutions. It’s quite startling to many people to realize what a supermarket of services has already come into being.

Bennett: The combination of cloud and SOA obviously brings together kind of speed and modularity. Those basic principles are going to allow us to take evolutionary technologies and approaches and probably revolutionize the way that IT actually interacts with the business.

So, in terms of IT being siloed—"please develop and look after this application"—it’s going to be more a move toward collaboration of how we can actually deliver business solutions to the ever-changing business dynamics.

Coffee: Finally, we have an environment in which connectivity and real-time linkage and integration of data and function instead of being costly, brittle, and time-consuming are now nearly free, very resilient, and can be done almost more quickly than they can be described.

This means that people are going to be doing more challenging work and working more closely with business units instead of having their time consumed by arduous, necessary, but relatively low-value tests of infrastructure maintenance.

So the ROI will rise. The relevance to the business of IT will increase. The sophistication of the skills of the person who does IT for a living will be greater 10 years from now than it was 10 years ago or even today, but we’ll all be pretty happy with the results.

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: David Tebbutt Posted: 1st March 2010 Copyright © 2010

As if IT directors don't have enough on their plates, they're being sucked in to all sorts of new areas. Every enterprise is, or soon will be, an online publisher. Many will transition from a hierarchical mentality to a more collaborative one. And, linked to these changes, they'll find themselves taking a renewed interest in a previously mocked concept: knowledge management.

If you take these changes, together with another big one—pursuing a sustainability agenda—you can see that one bit of the business is slap bang in the middle of it all. Yes, the IT department. It will be expected to provide the underpinnings for all these initiatives, and more.

If IT directors and the like are not already welded at the hip to the rest of the board, then they soon will be. Depending, of course, on their willingness to support several disruptions to traditional working practices all at once.

It won't be easy, but plenty of people have gone before and have learnt many tough lessons. Many of them are on the speaker circuit, have written books or produced webinars. And, of course, if you're so minded, a wealth of signal is tucked away in the noise of the public social networks. Once you've found an expert or two that you resonate with, you will easily find your way into their communities.

One such expert is Raj Datta, the Bangalore-based CKO of IT services company MindTree, a multinational company with $269M turnover at the last count. He is a man who has lived and breathed the knowledge management dream and, in his company's eyes, this has led to much innovation (30 projects significantly impacted) and a provable 5 percent positive impact on profitability.

He was in the UK last week for the Henley KM Forum 10th anniversary conference. The key themes this year were: 'The impact of social networking on knowledge sharing'; 'The journey to more knowledgeable decision making' and 'Knowledge enabled project management'.

We met for lunch after the event and he shared a few insights. (If you want a deeper look at his story, see this article in Information World Review. If you do read it, please substitute 'spirituality' for 'religion'. Mea culpa.)

He enjoyed his visit to the summit, especially when hearing what the academics have to say. They are largely free of commercial constraints, so boundaries can be pushed. Datta sees part of his job as picking out promising ideas and figuring out how to implement them inside his own strictly commercial organisation.

He likes the idea of harmonising the 'real world' with the 'work world'. He tries to create a natural working habitat in which employees can connect freely, just as they do outside. This is done through both on-line and physical workspaces. But, for the moment at least, all the social networking is done within the organisation's own boundaries. In his eyes, this means that, "All the cross-connections are building capacity for the future." It may be old hat to you, but the thought is new to me.

Rather than have all like-minded people working together, MindTree deliberately seeks diversity in its recruitment and in its creation of 'wildstorming' groups. In general the balance of sex, nationality and rural/urban backgrounds will be considered. In the wildstorming sessions, business, technical, product and functional specialisations might be mixed to consider the problem at hand. This approach to diversity is totally pragmatic, unlike the 'politically correct' version that we have over here.

The company has resisted financial pressures to lay people off, because of the harm this would do to the secure family atmosphere. The staff are treasured as 'sensors' to the outside world as well as being valuable 'minds' in their own right.

Soon, after two years of debate, the board will be ready to invite customers and suppliers to participate—even more sensors, even more intelligence in the network. If this move adds just one percent to profitability, then its cost will be paid for in one year.

Datta points to Google and 3M as companies he admires. Someone at Henley suggested he add Finext to his list. They, like MindTree, are focused on satisfying employees and customers alike. And they give staff the elbow room they need to connect, experiment and innovate.

This approach is much more achievable in 'consensus' cultures as opposed to the 'factory model' or 'command and control' business cultures. But, we are seeing companies shifting their attitudes. A blend of the two is the most likely outcome.

For anyone thinking of making the sort of changes we've been talking about, Datta advises, "The best way to create change is for people not to know it's happening."

An interesting challenge for you.

Anyone out there care to share their experiences?

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact David Tebbutt (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 1st March 2010 Copyright Interarbor Solutions © 2010

In a move to tap into the small- to mid-sized business (SMB) data center market, Hewlett-Packard (HP) just rolled out a set of services aimed at helping smaller outfits drive the same IT efficiencies as larger enterprises.

The portfolio is designed to improve efficiency and increase IT budget flexibility, while mitigating risks and maximizing return on investment (ROI) from existing IT skills and assets. The services also target dealing with rapid change and the simplifying of management of multi-vendor environments. HP also launched procurement options for custom integration operations and improvement services. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

“Our new services are based on drivers that impact owners of small- to mid-sized data centers,” said Ian Jagger, worldwide marketing manager of Infrastructure and Operations for HP’s Technology Services Group. “These services help our customers deal with the challenge of managing IT complexity and sprawl, space and infrastructure limitations, and limited IT budgets and staff.”

Improving operational efficiency
Recognizing the SMB organizations' requirements around speed, efficiency and 24/7 resource accessibility with shared virtual IT services, HP is delivering four new services designed to help clients gain tighter environment-wide control and broader, deeper visibility into support-related functions.

HP Multivendor Support Services works to help clients increase service levels and reduce the complexity and costs of managing heterogeneous IT environments. By exercising global buying power among vendors and suppliers, HP said it can effectively lower the cost of support contracts.

These services are entirely differentiated because only licensed engineers can deliver these services and HP’s competitors don’t have licensed engineers.

“We have been offering multi-vendor support solutions to our customers,” says Dionne Morgan, worldwide solutions marketing manager for HP’s Technology Services group. “In addition to IBM and Dell servers, we also now support Sun servers and Sun Solaris 10 for HP ProLiant servers. And for HP Integrity servers we’re now supporting Novell, SUSE Linux and Microsoft Windows Server 2008.”

On the operational efficiency front, HP also announced HP Insight Remote Support to monitor a customer’s environment around the clock and provide remote diagnostics, troubleshooting and a support solution. HP added support for VMware virtual environments. Meanwhile, HP Active Chat offers real-time Web chat support for problem and the HP Data Center Training Symposium will move to help companies develop a custom training plan to increase the effectiveness of IT staff.

Increasing computing capacity
HP also announced value assessment services structured for data centers up to 5,000 square feet in size. The services work to help SMBs find ways to increase computing capacity and cut energy costs.

The new services include Basic Capacity Analysis for Smaller Footprints Assessment, Infrastructure Condition and Capacity Analysis for Smaller Footprints Assessment, and Energy Efficiency Analysis for Smaller Footprints Assessment.

“These services are entirely differentiated because only licensed engineers can deliver these services and HP’s competitors don’t have licensed engineers,” Jagger says. “Our competitors have to partner with specialist companies to deliver these services. We’re also restructuring these services to be sold by our channel partners.”

Offering flexible purchase options
Finally, HP promises to make it easier for SMBs to procure value services that will help them better manage limited resources and drive business value from their technology infrastructure through HP Units of Service and HP Proactive Select Services.

“We’ve taken the customized services available from our technical services portfolio and converted them into what we call Units of Service,” Jagger says. “A Unit of Service is a deliverable at a highly granular level. Any given custom service could be made up of multiple Units of Service.”

HP Proactive Select Services let clients move to a variable budget model, acquiring expert resources on-demand to address changing data center needs.

HP Units of Service gives SMBs access to value services from HP through channel partners that aim to maximize ROI and set the stage for business growth. For example, SMBs can tap into HP custom data center consulting services such as relocation, integration, operations and improvement.

HP Proactive Select Services let clients move to a variable budget model, acquiring expert resources on-demand to address changing data center needs. HP has included Server Firmware Update Installation Service, Technical Online Seminars, Virtual Tape Library Health Check and LeftHand SAN/iQ Update Service to its portfolio.

“With these services, companies can focus their IT staff on strategic IT investments that differentiate them in the marketplace,” Jagger says. “What you’re seeing here is more and more services brought to customers at a value level through the channel that allows them to focus where they can drive the greatest ROI from staff.”

The SMB IT services and support market is ripe for efficiency and lower total costs. And the SMB arena is also a prime user for upcoming cloud and hybrid-sourced services. So now everything as a service can go anywhere.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 26th February 2010 Copyright Interarbor Solutions © 2010

In a move to enter the burgeoning SaaS-based IT management market, Citrix Online announced its acquisition of Menlo Park, Calif.-based Paglo Labs on Wednesday. The first fruits of the acquisition is an integrated web-based platform for monitoring, controlling and supporting IT infrastructure.

Dubbed GoToManage, the new service lets Citrix Online tap into the growing demand for software-as-a-service (Saas)-based IT management, a market Forrester Research predicts will reach $4 billion in 2013. Citrix Online is positioning the latest addition to its online services portfolio as an affordable alternative to premise-based software. [Disclosure: Paglo is a sponsor of BriefingsDirect podcasts. Learn more about Paglo's offerings and value.]

I expect that as more enterprises experiment and adopt more mixed-hosted services—including cloud, SaaS, IaaS, and outsourced ecosystems solutions—that web-based management capabilities will become a requirement. In order to manage across boundaries, you need management reach that has mastered those boundaries. On-premises and traditional IT management is clearly not there yet.

Elizabeth Cholawsky, vice president of Products and Services at Citrix Online, explains the reasoning behind the acquisition: “Our customers increasingly tell us they are interested in adding IT management services to our remote support capabilities. With the growing acceptance of SaaS and the increasing use of IT services in small- and medium-sized businesses, we decided IT management reinforced our remote support strategy.”

The Paglo puzzle piece
According to IDC, Citrix Online was the remote support market leader in 2008 with a 34.7 percent global share via its GoToAssist services. IDC also pegs Citrix Online as the third largest SaaS vendor in the world based on 2007 revenue, but Citrix Online needed Paglo-like log analysis technology in order to offer its customers the next puzzle piece in its full SaaS picture.

Paglo has made a name for itself providing SaaS-based IT search and management services. In short, Paglo helps companies harness and analyze the information explosion coming from all their computer, server, network and log data. Paglo helps companies improve operating efficiencies, gain a clearer understanding of true IT costs and meet compliance requirements.

Now, Paglo serves as the foundation for GoToManage. GoToManage creates an IT "system of record" to give businesses with the ability to discover and identify all network devices, monitor critical servers and applications in real-time, manage network usage, and track configuration changes. Like other Citrix Online products, GoToManage can be accessed from anywhere, and doesn’t require costly server infrastructure.

A seamless transition?
With GoToManage, Citrix Online is once again disrupting the traditional IT model. Brian de Haff, CEO of Paglo, expects a seamless integration for Paglo customers and GoToAssist customers that tap into the new service. With behind-the-scenes integration completed, customers can click on a link and instantly access GoToManage. De Haff also expects Paglo customers to adopt GoToAssist and use the two services in tandem.

Bringing these technologies together is a terrific win for the customers of both companies.

“When we look across the Paglo customer base, the integration of monitoring with remote support is by far the number one requested feature that customers are asking for,” de Haff says. “So bringing these technologies together is a terrific win for the customers of both companies.”

Cholawsky declined to comment whether Citrix Online will make additional acquisitions to add to its portfolio, which also includes GoToMyPC, GoToMeeting, GoToAssist, GoToWebinar, GoToTraining and GoView. What she did say is that Citrix Online is witnessing a large growth spurt, which she expects to continue.

“We’re constantly looking at partners and acquisitions,” Cholawsky says. “With the venture capital investments in smaller companies with great technologies over the past couple of years, acquisitions are a terrific way to grow our company. But whether we develop more organically or go out and partner closely or do more acquisitions, we’ll be investing heavily in the SaaS market.”

Financial terms of the Paglo acquisition were not disclosed.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 26th February 2010 Copyright Bloor Research © 2010

If you think through the web sites you visit on a daily basis the chances are that you will need to login to verify who you are. In most cases your username would be stored in a relational database along with all the other registered users on that web site. Hopefully your password will be encrypted and not stored in plain text.

Unfortunately there are gaping holes in the security of some web sites that are being aggressively exploited by a form of hacker attack called SQL Injection.

Even more worrying is that this attack can be carried out against fully patched databases. It is not a problem with patches, more an issue with the way databases work and how a system has been designed.

This attack can be made against any website page that contains data from a database including search pages, feedback forms and customer comment forms. The types of database being used to run web sites include products such as MySQL, SQL Server and Oracle and all of these can be vulnerable to attack. SQL injection is not only specific to SQL Server!

In a typical database used to manage website logins a table will be used to store user's details. This would probably have at least two columnsone for the username and one for the password. The table would probably be called users or something very similar.

When a user submits their details on the website the database will parse the username and password and convert it into a string of SQL to send to the database, so the database engine receives a line of SQL similar to this:

SELECT * FROM users WHERE username = 'fredsmith' AND password = 'userspassword'

This is a pretty standard SQL statement and would look more or less the same whichever database you were using to store the user's data.

Hackers are interested in SQL injection attacks as they can manipulate the database by sending it some duff data. Instead of giving a valid username they could type something like this:

SELECT * FROM users WHERE username = ' ' ' AND password = ' '

The hacker has supplied a single quote character as the username and a blank as the password. The database, being well behaved, would see this query and decide to create an error message. On seeing this error message the hacker will then start to dig around a bit more, as the error messages returned from the database will start to become increasingly more helpful, and start to point out the structure of the tables in the database. With some careful digging an experienced hacker could quite quickly compromise a vulnerable database.

In the next case we can start to fool the database further by adding in other strings to the username. For example if we type in or email='345 as our username it will be resolved by the query parser as:

SELECT * FROM users
WHERE username = ' ' or email='345  ' AND password = ' '

At this point the database may give an error if there is no such column in the users database as email. On the other hand it may not give an error message suggesting that there is a column called email after all. All we need to do then is type in an email address for a user. As most organisations have a standard email address structure it is very easy to get an employee name and then use that as your user name in the SQL injection attack.

As you can see it is scarily easy to build up a picture of a database structure based on some simple fooling of the user login screen and some intelligent guesses as to the likely structure of a database.

The good news is that it is possible to protect a database from SQL injection attacks.

Common measures include filtering out single quotes, double quotes, slash, backslash, semi colon and extended characters from user input strings and cookie values and parameters from a URL. In addition numeric values can be converted into integers before passing to the database and extended stored procedures can be deleted.

On the other hand a database activity monitoring solution will normally provide you with protection against web applications being manipulated. Once installed in a learning mode the database activity monitoring solution will start to understand what is "normal" activity for a specific application. This process of normalisation is where the intelligence of the system comes into play, especially as it needs to determine what is a normal parameterised query as opposed to one that has been submitted by a hacker - a process more involved than simply listing routine queries. Once up to speed the database activity monitoring application will then create an alert if unusual activity starts on the website, such as an attempted SQL Injection attack, and take appropriate action.

Good system design is vital to prevent SQL Injection attacks, but combining this with a database activity monitoring solution you will be even more assured that the solution will be secure.

The next article will cover other attacks that can be prevented using database activity monitoring.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 26th February 2010 Copyright Bloor Research © 2010

Along with new releases from lots of data warehousing vendors, TDWI has also seen in the formal announcement of the DataFlux Data Management Platform which was previously known as the Unity project. As the codename suggests this sees the introduction of a unified data integration, data quality, master data management and data governance suite from DataFlux.

A bit of history might be in order. Traditionally, DataFlux has been a data quality (cleanse, profile and so on) vendor. It then introduced MDM. However, data integration was a part of the SAS (DataFlux's parent company) platform and, while SAS did have a development project for data federation, it never really got to grips with this. So the task involved in creating the Platform was to bring ETL and data integration into the DataFlux environment, resurrect the previous data federation development and integrate all of this together with data quality and MDM, all as a part of a single platform. Needless to say this has been a long job.

Indeed, DataFlux is to be commended on keeping to its development schedule. I first got a detailed briefing on Platform back last September and even then the announcement data was planned for this February. In fact the product has been in beta sites since November and it should be generally available during the second quarter.

At the same time, the Platform makes a clearer distinction between SAS and DataFlux as to who sells what. Previously, infrastructure such as data integration software was marketed by SAS but this position was confusing since the sales force is primarily concerned with sales of analytic applications such as Customer Intelligence or, more broadly, the SAS platform as a BI/analytic suite. SAS sales people will still be selling data integration either when the data integration software is embedded within a solution such as Customer Intelligence or in conjunction with the SAS 9 platform as an enabling technology.

This move towards being a data quality/integration/master data stack provider is an increasingly common story in this space. However, integration between the different elements of this stack is a big issue. Some major vendors are so far away from a coherent story about integration that they do not really merit the description of a stack supplier, even if they have all of the relevant components. So the fact that DataFlux now has a genuinely integrated suite should give it a significant advantage over its competitors.

In so far as features are concerned some interesting capabilities include identity resolution, a business glossary, business process and event-driven integration, and a focus on business/IT collaboration. However, more detail will have to wait until nearer the general availability date.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Philip Howard (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Marcia Kaufman, Partner, Hurwitz & Associates Posted: 25th February 2010 Copyright Hurwitz & Associates © 2010

I will be presenting a session titled "Five Steps to Effective SOA Governance" in BrightTALK's online SOA Governance Summit on Thursday, February 25. The summit includes five webcasts on different aspects of industry best practices for SOA Governance. This summit is sponsored in association with the ITGRC Forum. Please join me for the live session by clicking on this link or check out the webcast online at BrightTALK at a later date.

While I was at the IBM Pulse2010 Conference for Integrated Service Management this week, I spoke with several IBM executives about governance issues. I've had SOA Governance on my mind because I was preparing for this webcast and found many opportunities at Pulse2010 to discuss governance as it relates to SOA, cloud, security, and business outcomes.

While there are many layers of complexity around governance, here is one basic truth that we discussed. There are two types of governance that can impact your business. One is the governance you need to do to keep out of jail or at least out of trouble with government and industry regulators and the second is the governance you want to do to ensure that your company has the flexibility to grow and innovate. This is an important distinction. You can establish tightly regulated governance policies with a goal of passing your required audits, but without the right level of governance around business process issues you can't anticipate change and find opportunities in unexpected challenges.

If you are hoping to obtain better business outcomes (and who isn't?) you will need to work hard at improving business and IT collaboration. Implementing a Service Oriented Architecture helps an organization to align IT with business goals and to succeed in rapidly changing business environments. In order for you to achieve these benefits of SOA, you will need to implement a governance model. SOA governance is critical for achieving business value from your SOA initiative by ensuring the reusability of business services.

What is SOA Governance? It helps define a methodology for creating, managing, and safeguarding your movement to SOA. It also supports the management of business rules in a standardized way across the business.

How do you create effective SOA Governance for your organization? It is important to fit your governance model to your SOA. You need to start small and grow.

Here are five key steps to effective SOA Governance.

1. Approach executive management with a justification for SOA governance.
2. Create a comprehensive plan to create the right business services with executive support.
3. Establish process for organizational change since managing change is as important as creating SOA services.
4. Balance risk with oversight to find a proper balance for SOA governance.
5. Plan for the lifecycle of business services.

SOA Governance is all about finding the right balance for your organization. You need to create the right set of business services at the right level of granularity to support the business. If your services are too narrow and technically defined, then they may not have the right meaning for the business. In order to achieve business success with SOA, you need to implement a SOA governance model that ensures business service reuse and business value.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Marcia Kaufman (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 25th February 2010 Copyright Interarbor Solutions © 2010

Today’s enterprises are creating web-based content at breakneck speed. Much of this digital content becomes bona fide business records that demand document management with regulatory compliance and legal discovery demands in mind.

That’s why Hewlett-Packard (HP) recently rolled out a web-based records management solution specifically designed to help Microsoft SharePoint customers lower business risks. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.)

Dubbed HP Total Records Information Management (TRIM) 7, the latest version of HP’s advanced records management solution aims to help organizations transparently manage Microsoft SharePoint Server records—including documents and information stored on SharePoint Server blogs, wikis, discussions, forms, calendars and workflows—in a single environment.

A Content 2.0 explosion
As HP explains it, TRIM 7 opens the door for consolidation and simplified management of stored content in multiple formats. Using HP TRIM 7, organizations can capture, search and manage physical and electronic files with complete transparency.

“The explosion in Content 2.0 blogs, wikis and discussions creates new information management challenges for organizations trying to meet an escalating set of regulation,” says Jonathan Martin, vice president and general manager of Information Management Solutions at HP. “HP TRIM allows customers to marry records management best practices and governance with dynamic collaboration platforms such as SharePoint.”

An end-to-end solution
HP TRIM 7 offers two modules to address the records management needs of SharePoint products and technologies: HP TRIM Records Management and HP TRIM Archiving.

HP TRIM Records Management aims to improve business records management via transparent access to SharePoint Server content held in HP TRIM directly from the SharePoint Server workspace.

The explosion in Content 2.0 blogs, wikis and discussions creates new information management challenges for organizations trying to meet an escalating set of regulations.

Since the U.S. Department of Defense has awarded HP TRIM its 5015.2 v3 certification, HP notes, organizations are assured the highest levels of records management control for enterprise content. HP has also made improvements that promise faster indexing and search capabilities, along with shorter response times for legal discovery, compliance requests and audits.

Closing the records management loop, HP TRIM Archiving works to help customers lower the risk of data loss while reclaiming storage and system resources from SharePoint Server. This module can either archive specific list objects in SharePoint Server or complete SharePoint Server sites. All this means organizations can take entire SharePoint Server sites offline without losing access to information.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 25th February 2010 Copyright Bloor Research © 2010

As usual at TDWI there are a series of announcements from major vendors. Not least of this year's releases has been the introduction of the Netezza TwinFin iClass, which follows on from last month's announcement of the Netezza Skimmer (a Skimboard is another sort of surfboard) as a low-end entry point to the Netezza range. However, the iClass (where i stands for insight) is a beast of a completely different stripe.

The iClass is an appliance for what Netezza refers to as advanced analytics, which is a part of the general drive across the sector towards in-database analytics. The big advantage of in-database analytics is, of course, that you get much, much better performance. Instead of having to extract the data to an external application server for processing, the analytics can actually be performed in situ. It also means that the analytics are more accurate because you don't need to sample the data, which is necessary in conventional environments in order to maintain performance. It's what Netezza refers to as big data meets big math.

So, what does the iClass actually provide? To begin with, it isn't just SAS scoring in the warehouse: it's much more comprehensive than that. So, there are two new APIs. One is an open language API that currently supports C/C++, Java, Python, Fortran and, most interestingly, R. It should be easy to add support for others should there be sufficient demand and there is an SDK so you can implement your own. The second API is an Open Framework API that supports MapReduce and Hadoop.

And then there are massively parallel analytics engines that parallelise analytic operations including embarrassingly parallel algorithms for processes that lend themselves to parallelism, task parallelism (for model execution) and algorithms for not embarrassingly parallel processes that parallelise these as much as possible. Specifically, these engines support user defined extensions (functions, aggregates and table functions) where these are to be run within a process; analytic executables, which perform the same role but outside of a process, and nzMatrix. This last is a part of the out of the box analytics functions provided by Netezza, in this case specifically focused on linear algebra with support for the resolution of simultaneous linear equations, least squares, eigenvalues and singular value problems. If youre not a mathematician or statistician I won't bother to explain what these are but suffice it to say that they are important in certain complex analytic computations.

You might think I've finished but I haven't. On top of all that the iClass also supports an R GUI and Eclipse as well, of course, as partner-based development environments.

Which brings me on to my final point, which is that Netezza is neither getting into the analytic application business nor into the data mining business. Instead it is providing a foundation platform for its partners (like bis2 and Fuzzy Logix) to build analytic applications on. I think this makes a lot of sense: after all, there are far more potential partners with feet on the ground, providing greater coverage than Netezza could manage on its own.

The bottom line is that this is a major step forward for Netezza, differentiating itself still further from the mass of competitors that have yet to implement any sort of in-database analytics. And even those that are doing so are in many cases only providing much more elementary out of the box capabilities.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Philip Howard (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Louella Fernandes, Principal Analyst, Quocirca Posted: 24th February 2010 Copyright Quocirca © 2010

Signs of a rebound in printer sales were evident from HP's latest Q1 2010 results which saw its imaging and printing business revenue grow by 4% year-on-year to $6.2 billion. Total printer unit shipments grew 16%, the largest increase in three years, with consumer and commercial printer unit shipments growing 18% and 11%, respectively. What is most notable is the momentum HP has built in its managed print services (MPS) business, which enjoyed a continued growth in Europe.

Quocirca estimates that 15% of enterprises in Europe have adopted some form of MPS to drive both financial cost savings and decrease environmental impact. In an increasingly commoditised market characterised by thin margins and falling prices, capitalising on long term, high value annuity business (through supplies and service) is key to the strategies of printer and copier companies.

HP's continued momentum in enterprise MPS
HP has streamlined its approach in the MPS market with the launch of its Managed Enterprise Solutions global business unit in September 2009, aimed at boosting new growth in its MPS business. It also announced a strategic alliance with Canon to deliver a wider portfolio of products to MPS customers, filling a gap in HP's existing portfolio. Across the globe, HP's MPS reach is wide—it now has more than 2500 customers worldwide across 170 countries.

In Europe, HP's direct MPS sales force targets 1800 enterprise accounts. HP estimates that 80% of these accounts are multi-country businesses. Its European MPS business performed well in Q1 2010: for example, SCHOTT AG that renewed its MPS contract with HP to include 1200 devices and the supply of service and supplies for 3 years. New signings include a $100m printing deal with the Danish Ministry of Finance, and a deal to manage the Norwegian telco Telenor's distributed print environment over 30 sites.

HP's competitive position in the MPS market has undoubtedly been enhanced by the EDS (now HP Enterprise Services) integration. A significant proportion of HP MPS deals are led by HP Enterprise Services account managers who provide HP with valuable depth of engagement with key customers.

Additionally, HP's Printing PayBack guarantee has further helped it demonstrate its cost-savings commitments to potential customers. Under this scheme, any qualified enterprise that does not make the cost savings that HP projects for them, within 12 months, can receive a cheque refunding the shortfall. Provence Health and Services in the US is one company which has adopted an HP MPS with the Printing PayBack Guarantee, with cost savings expectations between 30% and 35%.

HP's MPS initiatives are clearly bearing fruit. Its modular service offerings, multi-region delivery capabilities and its strategic alliance with Canon position it well to offer a comprehensive MPS portfolio for enterprises.

Capturing the midmarket opportunity with QuickPage
Up to now, MPS has largely been the domain of larger enterprises, due to established direct MPS offerings from vendors such as HP, Lexmark, Ricoh and Xerox. However midsized businesses are also waking up to the MPS opportunity with the emergence of more channel driven MPS packages. These range from device-centric offerings, which are typically inclusive service contracts encompassing service and supplies to some packages including the leasing of devices and may also include support, depending on the capability of individual resellers.

More often than not, the most successful resellers in this space have experience in selling copier or cost per page contracts. For resellers who do roll out an MPS, the opportunities are significant—providing ongoing annuity revenue streams and longer term customer relationships. One of HP's key strategies for 2010 is to build momentum in the midmarket through enhancing its contractual offerings. HP relies on its channel partners to develop their midmarket business, and is actively supporting resellers to move from a transcational to contractual sales process.

Its current portfolio of contractual offerings, which includes Channel-led Pay-per-Usage program (CLPPU), Smart Printing Service (SPS) program and Pay-for-Print (PfP) program, will be completed by the launch of QuickPage. With its introduction, HP is providing resellers with a simple packaged service that includes hardware, supplies and support. QuickPage emulates packages from copier-centric vendors such as Xerox PagePack. However QuickPage's key difference is that it includes a lease rental agreement, giving customers the ability to combine hardware, consumables and maintenance costs into one monthly payment (based on expected print volumes).

Quocirca believes that QuickPage fills a gap in HP's existing channel services porfolio by providing a simple packaged service backed by a portal infrastucture that manges reporting, service and support. Given HP's high pentration amongst IT resellers, who have little experience in selling printing contracts, the simplicty of selling and adminstering QuickPage will be fundamental to its success. For those customers who are uncertain about moving to a QuickPage contractual approach to purchasing printing, the benefits lie in predictable monthly expenses, reduced operational expenditure and less time on dealing with printer support issues.

The market for MPS in the mid-market remains wide open with varied offerings from different manufacturers. For resellers who are embarking on the MPS journey, this often means investing in a disparate set of tools and infrastucture to manage different devices. Xerox has already addressed this through its hosted multivendor MPS for channel partners—Xerox Printing Services. While there will always be benefits from a device-centric service in a standardised environment, adding multvendor capababilties to future versions of QuickPage will enable HP to enhance the value proposition for resellers and customers alike.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Louella Fernandes (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 24th February 2010 Copyright Interarbor Solutions © 2010

Electric Cloud has accelerated the software production management field with improvements to two key products: ElectricAccelerator and ElectricCommander 3.5.

ElectricAccelerator boasts a new feature that provides parallel processing and subbuild technology. Dubbed "Electrify," the patented technology promises to speed development on private or public compute clouds by applying the benefits of parallelization to new development tools and tasks.

With Electrify, developers can conduct parallel testing or data modeling on their desktop, in a private cloud or on a dedicated server. Meanwhile, the subbuild technology works to help developers avoid unnecessary or broken builds by identifying only the components required for the current project. [Disclosure: Electric Cloud is a sponsor of BriefingsDirect podcasts.]

Removing production bottlenecks
“Our goal is to remove the bottlenecks in software production wherever they exist,” explains Electric Cloud CEO Mike Maciag. “ElectricAccelerator speeds Make, NMAKE, Visual Studio, and Ant builds by 10–20x. With Electrify we are broadening the technology to enable these benefits for virtually any compute-intensive development task.”

Maciag offers the example of teams standardizing on tools like SCons. With Electrify, he says, those teams can leverage the benefits of centralization to speed builds, reduce hardware costs and curb server sprawl. The technology also makes way for developers to support multiple configurations through ElectricAccelerator’s virtualization capabilities. All this means more control for developers and fewer headaches for IT.

Commanding the cloud
Electric Cloud's ElectricCommander 3.5 offers a customizable and extensible version of its tool for automating and managing the build-test-deploy process in software development. Developers can customize ElectricCommander 3.5 to extract and display data from the defect tracker along with relevant build and test results. This lets build managers track the status of each fix and receive notification when QA has resolved the issue.

ElectricCommander 3.5 also offers user interface (UI) customization that lets development teams or managers create a custom screen to create and execute a build or test request with the appropriate parameters.

In other words, the UI is purpose-built for the developer’s role or environment. The new version also automates and manages what Electric Cloud calls “error-prone, manual pieces of the build-test-deploy process” to make software production faster and more efficient.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Andy Hayler, CEO, The Information Difference Posted: 24th February 2010 Copyright The Information Difference © 2010

At TDWI in Las Vegas this week, Vertica announced version 4.0 of its Analytic Database columnar MPP technology. There are several main areas of improved functionality. First is a major revamp of the optimiser. As well as an improved cost model, this closes certain gaps, such as proper support for full outer joins. Next is significantly improved resource and workload management. In particular it is now possible to assign priorities to certain users or processes, and to assign run-time resources to processes (for example, to stop a large batch job hogging the system). There is also improved partition management, for example the ability to drop a partition while conducting a load.

Another area of improvement is in support for analytic functions. Version 4.0 brings time-series analysis, moving average and cumulative functions, which are relevant to certain types of use cases, such as securities analysis. Vertica supports MapReduce, but not as an in-database function. There is also Unicode (UTF-8) support, which opens up the possibility for Vertica of selling into more international markets (at present its sales are around 80% US and the rest in Europe, principally in the UK), for example Asian countries which require double-byte character support.

Additionally this release brings dramatically improved performance on large deletes and updates, which have traditionally been the Achilles Heel of columnar approaches. It may seem as if this should hardly be an issue for data warehousing applications, which are essentially read-only, but in fact many real-life applications do require data to be updated regularly, even if they are not OLTP applications. Finally there are improvements to the user interface of both the automated database designer and the administration tool, bringing in better graphical representations of memory and CPU usage.

Vertica continues to show strong commercial progress, with a doubling of its customer base in 2009, and over 120 commercial customers now using its technology. Customers include Verizon, JP Morgan, Experian and Sprint. This release demonstrates its continued investment in the core product, and its responsiveness to its customer feedback e.g. the incorporation of time series and moving averages, which are heavily used in the capital markets. Given the well-documented struggles of some data warehouse appliance vendors, it is encouraging to see Vertica continuing to grow rapidly. This also validates the columnar MPP approach to analytic applications as an alternative to traditional row-oriented MPP approaches.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Andy Hayler (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 24th February 2010 Copyright Bloor Research © 2010

IBM Lotus recently announced the availability of the latest beta for Lotus Symphony and I have been trying it out for the last week. I have been very impressed by the new functions available.

For those of you who are not aware, Lotus Symphony is a full function office product for creating documents, spreadsheets and presentations. It is available as a free download from the Lotus website.

There are many new features and functions in the release and I would like to pick out just a few that caught my attention:

• There is a new property sidebar which is always visible and enables you to change text and paragraph properties; but, more importantly to me, it also allows you to see a list of styles so as you are creating a document it is just one click to add the correct style to a paragraph.
• There is also a navigator sidebar which gives you an immediate navigation to any heading, references, graphics, etc. Making it very easy to edit various parts of a large document.
• The PDF export has been significantly improved so that you can now specify if the document should be tagged (essential for accessible electronic documents), which initial view to show, how bookmarks are displayed, etc. An initial test of the PDF Export function shows that it creates a reasonable tagged PDF.

There are several functions that are not available in this beta that will be available at GA. Support of Assisitive Technologies is the big one that I will report on when it is available.

This is definitely worth a try if you have not been exposed to Symphony before.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Peter Abrahams (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 24th February 2010 Copyright Bloor Research © 2010

Releases come thick and fast during TDWI. One of the more interesting announcements this week is Aster Data nCluster version 4.5.

Aster Data's mission is to support what it calls big data analytics. It initially addressed this need through support for MapReduce combined with SQL (SQL-MR) and by enabling analytics be fully embedded with the MPP database. In this release the company has introduced an Eclipse-based visual development environment to make development of relevant functions and applications easier, and the IDE makes application push-down a single click function..

Analytics are actually embedded in-database by means of a hybrid environment (introduced in version 4.0) in which, in effect, the company embedded an application server within the data warehouse. In other words all MapReduce functions are executed in this space, which is co-located with the database within the Aster platform and which makes use of shared memory. So you dont get the performance and accuracy overheads associated with traditional environments.

Now, with this release, the company is focusing even further on in-database analytics. In particular, 4.5 includes the Aster Data Analytics Foundation, which provides common functions out of the box. These include time series and pattern analysis functions, (web) sessionisation, core statistics such as standard deviations and moving averages, and market basket analysis.

Finally, the third major element in this release is the introduction of a new (expanded), very granular, management console for administrators. You really need to see this to appreciate it but there is a new query and processing management view, a query timeline graph, a physical and virtual node and partition map, a node overview diagram with detailed drill-down, amongst other new features.

There is no doubt that Aster Data has done well since it entered the market, exhibiting substantial growth in 2009. However, its main claim to fame is its advanced support for MapReduce. As more and more companies add MapReduce capability to their offerings, how will this advantage stand up? There are two main aspects to this: cohabitation with SQL and the in-warehouse MapReduce application server (or equivalent). As far as we know there is no other company that offers both of these capabilities. And, while other companies support both SQL and MapReduce most of them don't have these integrated, and then there is the visual development environment introduced with this release, not to mention the pre-built analytics.

Put all these things together and I think Aster Data remains ahead of its competition in its core market. Of course, there is the question of what that core market is. In other words, where is it that you really need MapReduce? This is more than a short article can answer but two examples would be calculations of moving averages for stock price analysis in capital markets and deep graph analysis in retail or telecommunications where you want to identify influencers. Both of these are difficult to program in SQL and while some vendors are taking the route of extending SQL with specific functions these will always be one-off solutions rather than generic ones. Thus the bottom line is that Aster Data is ahead of the market, in its chosen market, and looks likely to remain in that position for some time to come.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Philip Howard (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 24th February 2010 Copyright Bloor Research © 2010

Vertica, along with various other companies, has made a major announcement at this week's TDWI, namely with respect to Vertica 4.0. This is a major release by any measure with the product being in beta today and general availability scheduled for the second quarter.

There are a number of major themes in this release, of which perhaps the most important is the workload management capability that is being introduced. This works in a similar manner to Teradata, in the sense that it is based on resource pools that are assigned to either users or types of tasks. The aim is to support any workload with any mix of query types and it will enable Vertica to go after enterprise data warehouse requirements where it could not previously compete.

A second major feature is support for Unicode. Historically, the product was limited to English only and this, again, was a limiting factor, which has now been removed.

Thirdly, Vertica has tackled one of the issues that the product formerly had, namely memory overflows. In order to make writing to disk more efficient, Vertica has what might be thought of as in-memory cache (actually a Write Optimised Store) into which data is loaded prior to it being committed to disk (the Read Optimised Store). However, a problem was that the memory could become full and cause queries to queue (or get rejected) before the software had got around to writing to disk. In this release this process is automated. You can still set your own parameters but if a potential overflow is detected then the software will override those settings to initiate writing to disk. In an associated development the company has also introduced a more efficient mechanism for processing deletes and updates in the storage layer.

Fourth, Vertica has extended its SQL support to add new capabilities. For example, there is now a facility for calculating moving averages, something which is important in capital markets but is difficult to do in standard SQL (though it is relatively easy in MapReduce). There are also facilities to support time series, including gap filling (when no trade occurs within a time interval) and web sessionisation. There are also more general improvements to query capabilities. For instance, Vertica could not previously perform a full outer joinyou had to perform a left join and then a right join and combine the resultsbut now it can. Associated with all of this are improvements to the optimiser, not only to recognise all of these additional capabilities but also for its own sake. Thus the optimiser can perform re-segmentation on the fly, for example.

As I said at the outset this is a big release. It adds significant new capabilities for both vertical markets and international markets, while also extending its breadth of capabilities. Given that the company's acquisition rate is currently around 15 to 20 new customers per quarter we would expect this to further ramp up.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Philip Howard (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon