By: Simon Holloway, Practice Leader - Process Management & RFID, Bloor Research Posted: 18th March 2010 Copyright Bloor Research © 2010

There is a noise going about that cloud computing can cut costs, speed implementations, and scale quickly. However, the noise may be slightly off-the mark—particularly in product pitches!

Just what is Cloud Computing? Search.com provides the following definition, "Cloud computing is a general term for anything that involves delivering hosted services over the Internet. These services are broadly divided into three categories: Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS)." The term cloud is used as a metaphor for the Internet, based on the cloud drawing used to depict the Internet in computer network diagrams as an abstraction of the underlying infrastructure it represents. Martin Banks, Associate Analyst at Bloor Research for Data Centres, told me, "I prefer the term Exostructure—an externally sourced (and theoretically limitless) seamless extension of an internal IT systems infrastructure that delivers information services on a fee-paying basis. This is looking at the issue from the users' point of view."

Infrastructure-as-a-Service, like Amazon Web Services, provides virtual server instances with unique IP addresses and blocks of storage on demand. Customers use the provider's application program interface to start, stop, access and configure their virtual servers and storage.

Platform-as-a-Service in the cloud is defined as a set of software and product development tools hosted on the provider's infrastructure. Developers create applications on the provider's platform over the Internet. PaaS providers may use APIs, website portals or gateway software installed on the customer's computer. Force.com, (an outgrowth of Salesforce.com) and GoogleApps are examples of PaaS. Developers need to know that currently, there are not standards for interoperability or data portability in the cloud.

In the Software-as-a-Service cloud model, the vendor supplies the hardware infrastructure, the software product and interacts with the user through a front-end portal. SaaS is a very broad market. Services can be anything from Web-based email to inventory control and database processing. Because the service provider hosts both the application and the data, the end user is free to use the service from anywhere.

A cloud service has three distinct characteristics that differentiate it from traditional hosting.

• It is sold on demand, typically by the minute or the hour;
• A user can have as much or as little of a service as they want at any given time; and
• The service is fully managed by the provider (the consumer needs nothing but a personal computer and Internet access).

So what does this really mean to a business? Well, rather than running computer applications on an in-house computer, you run them on an external machine, which could be anywhere in the world, and access the application programs via the internet. It also means that the data associated with the application is held externally to your organisation. So the application is hosted on a server with the associated data being stored in a database—all on a server run by a third party.

There is just one more piece that we need to understand and that is that a cloud service can be either public or private. What does this mean? A public cloud sells services to anyone on the Internet. Amazon Web Services is the largest public cloud provider at the time of writing. A private cloud is a proprietary network or a data centre that supplies hosted services to a limited number of people. Just one more term that you need to understand and that is virtual private cloud; this is when a service provider uses public cloud resources to create their private cloud.

What makes cloud computing so appealing at the moment? In a recent article[1], Nigel Stanley, Bloor Research's Security Practice Leader, said the following, "In an economic downturn cloud computing oozes sexiness. The thoughts of off loading your data to a third party gets financial types excited as they start to see how much money can be saved." Cloud computing means that rather than purchasing software, which would go on your CAPEX, you pay for it when you use it so it comes off your OPEX budget instead. Banks feels that, in fact, cloud computing will also reduce your OPEX spend as well as the implementation costs and associated consultancy costs will be less as well. On one point that Banks made I am not sure that I would agree with in that he felt the integration cost would also be smaller; I am not so sure and would advocate budgeting the same as an in-house implementation.

So how can cloud computing be used in manufacturing? CRM has been one of the first areas covered; this being piloted by salesforce.com with its launch in 2000. Salesforce.com's CRM solution is broken down into several modules: Sales, Service & Support, Partner Relationship Management, Marketing, Content, Ideas and Analytics. Salesforce.com's Platform-as-a-Service product (Force.com Platform) allows external developers to create add-on applications that integrate into the main Salesforce application and are hosted on Salesforce.com's infrastructure. Salesforce.com currently has 55,400 customers and over 1,500,000 subscribers. Why CRM? Well the answer, in my view, is due to the need to support a mobile sales force that needs to be able to record information easily and quickly without necessarily having contact always to the centre. Couple this with the need for the centre to have control over this distributed workforce and you create an ideal environment for cloud computing solution.

A number of the large ERP vendors, such as SAP, provide cloud capabilities. SAP launched its Business ByDesign in September 2007. Over the past couple of years Business ByDesign has been plagued by some really bad press. In September 2009, SAP gave a briefing to the industry on how it was tackling a number of the issues. These included:

• Scalability issues: all customers run on their own blade servers
• Overly "feature-rich": the suite was originally designed to meet all of the needs of its customer base instead of focusing on specific functionality
• Lack of corporate commitment: SAP is cutting R&D funding and shifting resources to other products
• Runs on NetWeaver: a full instance is too heavy for a SaaS application and finding "cloud developers" who have full Java EE stack experience may be tough

Infor entered the market in October 2008 with the launch of a SaaS version of ERP SyteLine. This is a very typical entry from an existing vendor in that it allows a user to move seamlessly between SaaS and on-premises deployment, or vice-versa.

Microsoft Dynamics entered the SaaS market in 2007 with the introduction CRM Live. This is run at Microsoft data centres around the world, along with all the other "Live" products such as Live Small Business Office. Software-plus-Services for Microsoft Dynamics ERP is the new capability being offered. This allows a user to choose to implement their Microsoft Dynamics software as a wholly-owned on-site solution, via online services, all or partly- hosted, or in any combination.

Oracle entered the market last year with the introduction of an offering comprising its Oracle Sourcing and Oracle Sourcing Optimization products. Nagaraj Srinivasan, Oracle's vice president for EBS supply chain management, in an interview with Managing Automation in March 2009, described the primary focus as being on automating the transactional aspects of material procurement. The tool can be used to aggregate demand; determine whether an RFP, RFQ, or other sourcing process is needed; compile contract terms; notify and qualify suppliers; establish prices and discounts and conduct multi-round negotiations; and aggregate and award bids. In addition, Oracle is offering CRM as a SaaS, called CRM On Demand.

Cloud Computing-based manufacturing solutions are emerging as viable competitors to products from established vendors. These cloud solutions are most commonly used for supply chain visibility, transportation management and supplier/contract negotiation. Vendors are rapidly creating cloud computing modules to address other manufacturing issues, such as: supply chain execution, shop floor planning, demand planning and production scheduling.

But where else? Christian Verstraete, HP's Chief Technologist for Manufacturing and Distribution services, believes a couple of areas will quickly become the favourites of manufacturing companies and these include:

• Cross enterprise collaboration. Verstraete sees cross-enterprise collaboration as being a current weak point in Supply Chain management. The required integrated environment would require the exchange of structured and unstructured data, of synchronous and asynchronous communication. By integrating multiple concepts of social networking and providing them in an integrated, cloud based environment, companies could use a variety of collaboration mechanisms to perform key business processes without having to manage the environment. Data can be contributed by the parties on request, limiting the sensitive data in the cloud. Mike Frichol, founder of Pragmatic Papers, stated:[2]. "Cloud computing provides a geographically dispersed network approach that is much better aligned to serve all these trading partners trying to communicate with each other through different systems. Supply chains are networks. Cloud computing comprises networks for delivering business applications anywhere, anytime—that should significantly improve supply chain capabilities, communication and coordination."
• High Performance Computing. Verstraete foresees the needs for additional computing power, as companies increase the use of digital models to virtually test their products and/or to understand their business environment better through business intelligence and decision making. The models used are typically highly parallelizable and fit well for a cloud environment as long as the amount of data they need to be provided with is not large, when the network could become a bottleneck.

But cloud computing can get a business in hot water if they have not thought through the many consequences, and this particularly means data security. Stanley states, "Without assurances that organisational data will be totally secure in a remote site the whole concept of cloud computing is dead in the water." So securing the cloud is vital for its success. With companies trusting their corporate data—their most important asset—to third party organisations, what another of my Bloor colleagues, Peter Cooke, describes as the holy trinity of confidentiality, integrity and accessibility, has to be assured. The infrastructure underpinning this is Identity Access Management (IAM). Without it, system access security is non-existent.

Another worry is about the ability of the provider of the service ability to still be around tomorrow. Raimund Genes, CTO at Trend Micro, the global security company, in a recent eBook[3]. "You need a provider that will be in business three years from now. When you give up your IT infrastructure, you need a reliable service provider." Banks stated that "With Cloud Computing you must realize that your business process in no longer in your complete control. It is wrapped into the cloud service and in the control of the provider" Therefore it is imperative that when choosing a cloud service provider, you choose one that is likely to be there for the long-haul, or a supplier that has a strategy to manage the situation if they are not there. Could we ESCROW agreement for business processes locked in cloud services?

The goal of cloud computing is to provide easy, scalable access to computing resources and IT services. Cloud computing users gain some significant economic advantages. They have no capital expenses. They have reduced service costs because of a simplified IT infrastructure. They do not have to buy systems scaled to their worst case use scenarios, and there is a reduction in large client applications. The primary disadvantages are the risks associated with Internet reliability, security and access of data, and the financial stability of the service provider.

[1] Generating Maximum Value from your IT Security Spend - An Analyst's Perspective. Nigel Stanley, Bloor Research, 29 September, 2009.

[2] The Cloud Computing Advantage for Companies that Outsource Manufacturing, Dr. Katherine Jones, Industry Week, April 24, 2009

[3] What to Expect from Cloud Computing, internet.com, Three Steps to Secure Cloud Computing, Robert McGarvey, 2009

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Simon Holloway (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Clive Longbottom, Head of Research, Quocirca Posted: 18th March 2010 Copyright Quocirca © 2010

When presenting on how to build a modern data centre, I generally point to the fact that a data centre should be built for the machines, not for the humans, and an air temperature of around 26–27 degrees C is fine for most equipment—provided that the real temperature-dependent items are cooled through forced, ducted air cooling. If this is combined with hot aisle/cold aisle or contained rack systems, the warm air can generally be ducted away to use for space heating elsewhere in the building—so saving energy and cutting costs, while also boosting green credentials.

But, this only works well where there is need for heating space where humans work: fine for the UK during the cold spell we've been having; not so good for the Middle East, where space cooling is more of a requirement. However, even these places have a need for hot water, and it is possible (if a little expensive) to use a heat pump to extract the low-grade heat from data centre exit gases and upgrade it to the temperatures required for hot water.

There is, however, an alternative. Back in the good ol' days of the mainframe, water cooled systems were used extensively, but fell out of fashion as distributed systems became the norm and air cooling was seen as being more cost effective. But, energy costs are getting more unpredictable in the short term, with the only certainty that, in the longer term, they will go up. At the same time, equipment densities are creating more hot spots and less air volume space for effective air cooling to take place. The cost of designing, implementing and maintaining effective air cooling systems for today's data centres is getting beyond the reach of many organisations (and even vendors), and the possibility of water cooling is once again on the agenda.

In its research laboratories in Zurich, IBM has been investigating the best way of implementing water cooling for distributed systems in a modern data centre. It has come up with a nickel-coated copper block that sits on top of the CPU, replacing the standard CPU heat fins/fan ensemble. The copper block is micro-drilled to maximise the cooling capacity of the water. For blade-based and rack mounted systems, the feeder tubes to the blocks are routed to the back of the board, and a clever isolation system is used to ensure that the boards can be hot swapped without the need for the water system to be shut down and without any water leakage into the electrical systems.

The cleverest part is that in order to cool a CPU down to the best working temperature using air requires a massive temperature difference between the CPU surface and the air—generally speaking, data centres use air at around 18C to ensure that CPUs dont heat above 75C. With water being a far better conductor of heat, the delta can be far less—IBM reckons that using water at 60C will still maintain a CPU at 75C. Why use water at 60C? This is the temperature of the hot water systems in the majority of buildings. By using a closed system for the distilled water needed for the cooling circuit, the exit water at 65 degrees C or higher can be used to provide input heat directly in to the general hot water supply in the building—saving a much greater amount of overall energy and therefore cost.

The problem would be if the water supply failed—there would be far less time to ensure that systems were shut down in order for the CPUs to remain unharmed. There's also the small problem of what if a leak did happen: not a problem with air based systems, but slightly more where water and electricity are concerned! However, neither of these issues should be show-stoppers. Self-contained systems can ensure that water is available in all but the worst case scenarios. Automated systems can very rapidly shut down servers and leakages can be avoided through the appropriate use of the right materials and well engineered plumbing.

Even for large remote data centres and service provider data centres where there will be little need for hot water in the building itself, water cooling can have a part to play. Most data centres will be within a commercial or industrial environment, and the hot water can be sold or just passed on to those who can make use of it, depending on whether the organisation wants to maximise its cost savings or to up its green credentials even further.

As the cost of power and the density of data centre equipment both continue to increase, it may be time to take the plunge back into water cooled systems, and pass the benefit on to the business through helping keep its hot water needs met.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Clive Longbottom (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dr Fern Halper, Partner, Hurwitz & Associates Posted: 17th March 2010 Copyright Hurwitz & Associates © 2010

I had an interesting briefing with the Basis Technology team the other week. They updated me on the latest release of their technology called Rosette 7. In case you're not familiar with Basis Technology it is the multilingual engine that is embedded in some of the biggest Internet search engines out there—including Google, Bing, and Yahoo. Enterprises and the government also utilize it. But, the company is not just about keyword search. Its technology also enables the extraction of entities (about 18 different kinds) such as organizations, names, and places. What does this mean? It means that the software can discover these kinds of entities across massive amounts of data and perform context sensitive discovery in many different languages.

An Example
Heres a simple example. Say you're in the Canadian consulate and you want to understand what is being said about Canada across the world. You type "Canada" into your search engine and get back a listing of documents. How do you make sense of this? Using Basis Technology entity extraction (an enhancement to search and a basic component of text analytics), you could actually perform faceted (i.e. guided) navigation across multiple languages. This is illustrated in the figure below. Here, the user typed "Canada" into the search engine and got back 89 documents. In the main pane in the browser, you can see that an arrow in a number of different languages highlights the word Canada, so you know that it is included in these documents. On the left hand side of the screen is the guided navigation pane. For example, you can see that there are 15 documents that contain a reference to Obama and another 6 that contain a reference to Barack Obama. This is not necessarily a co-occurrence in a sentence, just in the document. So, any of these articles would contain a reference to Obama and Canada. This would help you determine what Obama might have said about Canada. Or, what the connection is between Canada and the BBC (under organization). This idea is not necessarily new, but the strong multilingual capabilities make it compelling for global organizations.

If you have eagle eyes, you will notice that the search on Canada returned 89 documents, but the entity "Canada" only returned 61 documents. This illustrates what entity extraction is all about. When the search for Canada was run on the Rosette Name Indexer tab (see upper right hand corner of the screen shot) the query searched for Canada against all automatically extracted "Canada" entities that existed in all of the documents. This includes all persons, locations, and organizations that have similar names. This included entities like "Canada Post" and " Canada Life" which are organizations, not the country itself. Therefore the 28 other documents with a Canada variant are organizations or other entities.

Use Cases
There are obviously a number of different use cases where the ability to extract entities across languages can be important. Here are three:

• Watch lists. With the ability to extract entities, such as people, in multiple languages, this kind of technology is good for government or financial watch lists. Basis can resolve matches and translate names in 9 different languages. This includes resolving multiple spelling variations of foreign names. It also enables organizations to match names of people, places, and organizations against entries in a multilingual database.
• Legal discovery. Basis technology can identify entities in 55 different languages. This can obviously help in legal discovery by narrowing down the number of documents that companies would need to analyze, for example, in the case of a global enterprise. Additionally, it could process many documents and extract the entities associated with them to find the right set of documents needed in legal discovery.
• Brand image, competitive intelligence. The technology can be used to extract company names across multiple languages. The software can also be used against disparate data sources, such as internal document management systems as well as external sources such as the Internet. This means that it could cull the Internet to extract company name (and variations on the name) in multiple languages. I would expect this technology to be used by "listening posts" and other "Voice of the Customer" services in the near future.

While this technology is not a text analytics analysis platform, it does provide an important piece of core functionality needed in a global economy. Look for more announcements from the company in 2010 around enhanced search in additional languages.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dr Fern Halper (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 17th March 2010 Copyright Bloor Research © 2010

Bloor Research is a member of the OneVoice for Accessible ICT coalition and is delighted to announce the availability of an accessible PDF version of the coalition's report "Accessible Information and Communication TechnologiesBenefits to Business and Society"

The coalition was formed to bring like-minded organisations together to act as one voice for ICT accessibility and usability. The coalition central goal is to develop a shared agenda for change in accessible and usable ICT in order for business and society to receive the maximum benefits from ICT. To achieve this the coalition have identified three specific themes to collaborate and work on:

• Promotion: this theme will look to the benefits to the economy and society of provisioning accessible and usable information and communication technologies and update the rationale and business case to underpin this.
• Campaigns: campaigns will increase the awareness of ICT accessibility across all sectors. In addition to awareness this theme also focuses on influencing and working with the ICT industry to make the ICT products and services accessible and usable.
• Professionalism: professionalisation focuses on establishing a suite of academic and vocational courses in ICT accessibility for ICT and health professionals. These courses will provide a range of qualifications to recognise standard for ICT accessibility.

The first output from the coalition is a report entitled "Accessible Information and Communication TechnologiesBenefits to Business and Society". This unique report reflects the experiences of representatives from the ICT industry, business, government, the third sector and academia. Executives from some of the U.K.'s principal employers, procurers and producers of ICT, present their business rationale for commitment to diversity and inclusion and the commercial benefits they have reaped through investing in accessible ICT.

The report has forewords by John Varley, CEO, Barclays, and the Right Honourable Stephen Timms, Minister for digital Britain.

The report presents a series of case studies that show how enterprises have achieved their key business goals through the use of accessible ICT. It then goes on to outline how to make accessible ICT business-as-usual in an enterprise. The final section is a call to action to further the case for accessible ICT.

The printed version of the report was launched at an event in late January with speeches from both John Varley and Stephen Timms.

We are delighted to announce the availability of an accessible electronic PDF version of the report which can be freely downloaded from the One Voice for ICT Coalition website http://www.onevoiceict.org/tools/tr-tools.asp. We would like to thank NetCentric, who created the accessible version using NetCentric CommonLook® Section 508 for Adobe® Acrobat®.

We urge anyone who has an interest in promoting accessible ICT to access and read this report and then publicise it to stakeholders who can influence the uptake of accessible ICT within their organisations.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Peter Abrahams (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Laurie McCabe, Partner, Hurwitz & Associates Posted: 16th March 2010 Copyright Hurwitz & Associates © 2010

I dialed into SAP's SME (small and medium enterprises) Global Business Update Call a couple of weeks ago. Jeff Stiles, SVP, SME, Volume & Ecosystem Marketing, provided analysts a recap of recent SAP SME highlights, and shared strategic directions for 2010. Ive been following SAP in the SME market since it acquired TopManage (which later become SAP Business One) in 2002, so I'm always interested in checking their progress. Here's what I heard and what I took away from the discussion—with the most interesting stuff saved for the end.

• SME is critical to SAP's future growth: As part of recent restructuring changes, the company named Peter Lorenz, Executive vice president of Small and Midsize Enterprises (SME), as a Corporate Officer, elevating SME attention at the corporate level. Though SAP has been investing in SME solutions, marketing and sales for several years, this appointment indicates that SAP is redoubling its efforts to crack the SME code. SAP also recently hired Kevin Gilroy—who spent 24 years at HP, most recently as senior VP of HP's worldwide small and medium business segment—as vice president for channel and business development for SAP's small and midsize business organization in North America. SAP is also making substantial product, channel and marketing investments in SAP Business One and SAP Business by Design—both of which are geared to smaller companies—as well as to SAP Business All-In-One, which is designed for the mid-market. As noted in the next bullet, however, SAP's SME definition, solutions and pricing still skew towards larger SMEs, so the question remains, how low will SAP be able to go in the broader small business market?
• SAP is growing its SME market footprint: Jeff shared a number of impressive stats, such as the fact that more than 77% of SAP's 95,000 customers are SMEs, and that this percentage is growing. However, SAP defines the SME market as companies with $500 million in annual revenues or less, which gets into some pretty big businesses. For instance, the U.S. Small Business Administration (SBA), has established two widely used size standards—500 employees for most manufacturing and mining industries, and $7 million in average annual receipts for most non-manufacturing industries. Nevertheless, SAP has tripled its SME base (using its SME definition) in last 3 years (with about 30% coming from the Business Objects acquisition). The vendor indicates that it is garnering 35 new SME customers per working day, and that it is enjoying good growth among small businesses and in the lower end of the medium business market.
• SAP is investing in channels to enable SME growth: The direct, feet-on-the street sales model that has served SAP so well in the large enterprise space doesn't scale to the economies needed in SME. In addition to hiring Kevin Gilroy, SAP is recruiting and enabling more SME channel partners and developing and expanding direct inside sales to do the job. Channel partners now account for more than 50% of SAP's SME revenues, inside sales accounts for 20% of the business, and 30% derive from SAP's direct outside sales team. SAP has struggled with building effective SME channels for a long time. But it looks like it is making some good gains here. It is investing in "virtual agency" marketing services to help its 6,000 partners create their own targeted campaigns, and in SAP Marketing University to teach partners about marketing. Inside sales will be increasingly critical for SAP in SME—especially as it prepares for Business by Designs grand market re-launch later in 2010.
• Business One gets a facelift and Business All-in-One gets a refresh: Release of Business One 8.8, slated for Q2 2010, features a new UI with Web 2.0 capabilities for a better user experience, and cloud integration for partner applications. Behind the scenes, SAP has consolidated three individual lines of Business One code into one—making the economics much more attractive. SAP has also created packaged integration scenarios for subsidiaries of big companies, making it easier for them to integrate with their corporate HQ SAP systems; remote monitoring; and embedded, packaged analytics. Meanwhile, Business All-in-One gets a refresh, with SAP extending the Fast Start (fixed scope, fixed fee) program with partner hosting offerings in 20 countries—another indicator that more companies just don't want to or can't run all of this themselves. SAP also said that its online solution configurator is helping to reduce the cost of sales, and that it will introduce a new supply chain relationship management module into the Business All-in-One offering.
• Business Objects has been a boon: With 57% year-over-year growth, Business Objects has seen good traction with both SAP ERP customers (it tripled BI revenues with SAP ERP clients in Q1 through Q4 of this year) and non-SAP customers. SAP also intends to use Business Objects as a wedge opportunity, to get in the door and eventually replace older legacy systems with SAP ERP. The company recently announced a free personal use version of BI On Demand, which should boost interest among the vast majority of SMBs that dont yet use any BI solution.

And now to what I found most interesting—Business by Design, Chapter 2. What a long strange trip this has been. After launching ByDesign to much fanfare in 2007, things quickly fizzled. Going against conventional wisdom (and economics) SAP built its debut SaaS offering on a single-tenant model instead of a multi-tenant architecture. We all know what that means—lots of red ink because single tenancy doesn't afford the economies of scale and skill that multi-tenancy provides. Anyway, since then SAP has limited ByDesign to about 100 charter clients, who are getting a lot of tender loving care. Feature Pack (FP) 2.5, slated for H2 2010 will sport multi-tenancy, making it economically feasible for SAP to sell, provision, maintain and support it in a broader market. SAP will continue to offer a single tenancy option alongside the multi-tenant offering (both on the same code base).

Since this is ByDesign's first multi-tenant varietal, SAP isn't quite sure what the sweet spot will be but will stick with a 25-user minimum. From my perspective, this still seems a bit high for getting at much of the SMB market. By SAP's own calculations, about 10% of client companies workers currently use ERP. Although this percentage may grow, right now this puts ByDesign at 250 employees and up (whereas the vast majority of SMBs have fewer than 100 employees). Another challenge SAP faces is around routes to market. Few SaaS vendors have established successful channel programs with traditional IT VARs, many of whom have been skittish about the model. As I mentioned above, SAP will need to fire up the inside sales model for ByDesign, and create a lot of pull with marketing campaigns (enter the 100 ByDesign reference customers).

Another interesting note: SAP is incorporating Microsoft Silverlight to make it easier to make changes to the ByDesign UI, create mashups and integrate with Microsoft Office applications and features. SAP will also release an SDK for developers based on Microsoft Visual Studio.NET, hoping that all those developers will be enticed to build add-ons and industry-specific extensions for ByDesign. And yes, there will be a store for that—SAP intends to build an app store down the road.

I don’t know if I’m reading too much into the tea leaves, but I’m a bit intrigued by SAP’s growing relationship with Microsoft for ByDesign. Since Microsoft Dynamics has yet to offer a true SaaS ERP solution, it just makes me wonder if there’s something up with that. Related to this, Microsoft recently forfeited it’s small business accounting play to Intuit, and soon after, inked a deal with Intuit to integrate its cloud-based Partner Platform with Microsoft Windows Azure—which looks to be a mutually beneficial relationship. Could SAP and Microsoft be hatching some similar type of joint effort in this space, aimed at the mid-market?

As ByDesign FP 2.5 comes fully online, SAP will probably spend more time than it would like in positioning ByDesign against both Business One and Business All-in-One. Though the on-site vs. cloud angle is clear, there is lots of market overlap. SAP will need to proactively guide both customers and partners to the right solution in terms of total cost, ease of use, functionality, ROI timeframes, etc. so it doesn’t waste time and energy competing against itself—or having its partners compete against themselves or its inside sales team. It will also be interesting to see if ByDesign can replicate the experience of its 100 charter customers to a broader base, as it will be difficult to broadly supply the same level of attention that these early customers enjoyed.

But clearly, the vendor must make ByDesign work to capture the SME market’s increasing appetite for SaaS and cloud alternatives—yes, even in the ERP space, as evidenced by NetSuite and Intacct. SAP’s recent investments, Peter Lorenz’ new chair at SAP’s corporate table, and Kevin Gilroy’s appointment to steer North American channel and business development indicate that this time, the vendor intends to go much further to make sure that it’s cloud and SME formulas work.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Laurie McCabe (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 16th March 2010 Copyright Bloor Research © 2010

For many users, one of their only interfaces with information security is via their passwords. Once successfully logged into a system little of the security infrastructure that surrounds them is - or maybe better still should be - visible unless of course something goes wrong.

Unfortunately passwords are a nightmare to manage.

On the one hand we insist that passwords should be difficult to guess, and on the other hand we insist that users never write their passwords down. Never before have we expected so much of our users, and never before have we laid ourselves open to such ridicule.

This article will explore some issues about passwords, password management and user's attitudes to the use of passwords. It is based on a webinar presentation given on 9/3/10 which is available for downloading.

Password 101: Creating Correct Passwords
Organisations all seem to have their own take on the correct use of passwords, but the basics of password creation seem to remain the same;

• The password should be over 6 characters long, ideally around 12 or 14
• Each password should contain a mix of numbers and symbols, lowercase and uppercase letters
• The chosen password should not be in a dictionary, have number or letter sequences or contain information that can be guessed - such as the name of a partner, pet or child

And then we insist it should be easy to remember!

To complicate matters further, some organisations put in place password expiration policies, so that a given password will expire on a regular basis - maybe every 30 days. This can be implemented using system administration tools and users can normally be prevented from entering recently used passwords. This process of refreshing passwords may address issues such as brute force attacks, with the password being changed before an attacker has successfully tried every combination of letters and numbers, but the downside is that some systems allow passwords to be changed by simply adding an incremental number to the end of the password - hardly big time security.

It is better to break down the process of creating a passphrase into logical steps that allows users to form their own more robust secret code.

The first step is to think of a sentence. This can be as ridiculous as a user can think of, within reason. The most important point is that it means something to them, and hopefully only them. This phrase is then broken down into a row of letters that is then further mangled by the addition of extra characters, numbers and symbols.

The resultant pass code should be secure against most types of attack, assuming the user doesn't write it down... Of course therein lies the flaw as the world's most secure passphrase is only as secure as the post it note it is written on.

Password Implementations
Unfortunately, even with seemingly secure passwords we have been let down by the implementation of security systems.

One of the most famous is the LAN Manager hash (or LM hash), an algorithm that is very old dating back to the original days of Microsoft LAN Manager, a networking application that was sold in the early 1990's. The LM hash uses DES, or Data Encryption Standard, which is a well known block cipher. Out of interest DES is showing its age and is now considered no longer fit for purpose as it only has a 56-bit key size, small enough to be brute force attacked within a few hours, but this is not the issue at hand.

In this case, the insecurity of the system is more in the way the security has been implemented rather than the specifics of DES itself. In essence the implementation of LM hash in Lan Manager introduced weaknesses many years ago and which still haunt us today.

This is how daft the implementation of LM Hash is;

• First, passwords are restricted to the ANSI character set. As we have seen this produces a smaller number of character options for a hacker to attack.
• Second, any password longer than 7 characters is divided into two and hashed separately. This basically creates two small targets to attack.
• And finally, all lower case letters are changed to uppercase letters before the hash is computed, again further reducing the combination of letters that need to be guessed.

This has resulted in a weak password model that has been carried forward into later versions of Windows to ensure backwards compatibility, and it is only later versions of Windows such as Vista that switch off this capability by default.

In this case the implementation of the security system has let us down, not the user and their passwords.

Dictionary Words and Crackers
One of the cardinal rules of passwords given to users is Don't use dictionary words. This is often met with a degree of incredulity as they cannot fathom out how anyone could possibly work out their password as there are lots of words in the dictionary.

Password crackers have been around for a long time, and are now very sophisticated pieces of software.

Popular password crackers often have huge lists of standard words. For example the John the Ripper password cracker has a set of word lists in over 20 languages plus lists of common passwords and derivatives (or mangled words) including: Afrikaans, Croatian, Czech, Danish, Dutch, English, Finnish, French, German, Hungarian, Italian, Japanese, Latin, Norwegian, Polish, Russian, Spanish, Swahili, Swedish, Turkish, and Yiddish.

This amounts to in excess of 40 million entries that can be quickly searched. To put that into context the Oxford English Dictionary has around 170,000 entries covering contemporary English language words.

Brute force attacks can often break passwords relatively quickly which shocks users. Here are some examples for a "fast" PC;

Password: karen
Possible combinations:  >300 million
Time to brute force: 5 minutes

Password: Kraz4uw
Possible combinations:  >3.5 trillion
Time to brute force: 41 days

Password: Kr&46ugH
Possible combinations:  >7.2 quadrillion
Time to brute force: 229 years

Without dwelling on the mathematics this provides an example of an exponential rise in the time to brute force an attack on passwords, and many end users are shocked to see the huge difference a few different characters can make to thwarting  such an attack.

Of course these numbers refer to an average fast PC. The computer power available to large security agencies can significantly reduce the time to crack a password, and the final example could possibly be cracked within 3 months rather than 229 years with the right application of computer horse power.

This is why we insist that passwords are changed every 30 days or so, so that if a brute force attack is underway then it has less chance of succeeding. Users generally love it when you explain things in more simple terms and they get to see the reasons WHY we insist their passwords are structured in such a way. 

Passwords from Real Life
As we have seen, passwords are often the most irritating, badly implemented and annoying parts of an IT security system.

In December 2009, there was a major breach of security at the social networking site RockYou that resulted in 32 million user accounts being released into the wild. Amazingly it was reported that all user account data was stored in plain text, including the user's passwords. The site appears to have been compromised by a relatively simple SQL Injection Attack.

Of course the release of so much private data is a major problem and no doubt has caused some of the users considerable angst. From a security research point of view this is an opportunity to undertake an analysis of real live user data and get to understand contemporary password usage and management. It also enables us to learn from others mistakes and understand how to implement website security properly.

Bizarrely the RockYou system only supported passwords that were between 5 and 15 characters long and the site prevented, or at least actively dissuaded, the use of mixed case, numbers or punctuation in passwords.

Passwords were stored in plain text and then emailed, again in plain text, to the user. Due to their attempt to integrate with other social network sites the RockYou site also encouraged users to enter credentials for other social networking sites into the RockYou site, possibly putting in place a longer chain of insecurities.

A lot of users chose passwords whose length was equal or below six characters and almost 60% of users chose their passwords from a limited set of alpha-numeric characters. Nearly 50% of users used names, slang words, dictionary words or trivial passwords and the most common password among Rockyou.com account owners is 123456

Now I wonder if people were a bit more blasé about this website than they would have been if it was their bank account? You would hope so, but it wouldnt be a surprise if these users were just as bad when managing their online bank account security. Or is it that people are fed up being told what to do and are rebelling against computer security? We dont really know!

We have seen that users will still opt for the easy solution. It is not suggested that a site such as RockYou is a perfect example of a typical organisational IT system, as being a social networking site users are probably young and maybe not too concerned about security of their data in this instance.

The problem arises when they bring such attitudes to the work place and the finance system is protected by such flimsy and ill thought out passwords.

Password management is a nightmare, and an aspect of information security that keeps many CISOs awake at night. The cost of managing passwords only ever seems to increase with the technical support function bearing the cost of the Monday morning password reset calls. The sooner we can manage passwords with greater effect the better.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: David Tebbutt Posted: 15th March 2010 Copyright © 2010

Say "semantic web" to a lot of people and the shutters on their brains come down. They may have lived through the disappointments of the AI or expert systems eras. Or they may simply know how impossibly tedious it would be to retrofit their web pages with semantic data.

Say "linked data" to them and they might ask "what's that?" with a reasonably open mind. At some point during the explanation, it will dawn on them that the terms are identical to those used in the semantic web. By then, of course, it's too late, they're hooked.

The basic idea is that web pages, html or otherwise, contain some information that links them to other web pages in a meaningful way. Nothing particularly new in that, you might say. But the meaningful bit in this context is not what the human reads—a bit of clickable text that takes you to another web page—but what a computer application can read and make sense of.

An example might be understood as: 'The prime minister is Gordon Brown'. This might be expressed as prime minister:Gordon Brown. And these elements, in turn, might point to well-defined explanations of the two concepts elsewhere on the web. In dbpedia.org/page/ the links would be Prime_minister and Gordon_Brown, respectively. Other authentic sources include Freebase, the Guardian or the New York Times. The application might drill into these pages plucking out useful information and following other links, which would have been defined in a similar fashion.

Of course, because this page has been published, it becomes a potential resource for others to link to. It rather depends what the page was about. The Gordon Brown entry, in this case, was just one element. It might have been 'The British Cabinet in March 2010', for example. And others might have found that information useful.

(If you want to experiment a bit, go to where you can whack in terms and read their definitions in plain text.)

Many public and not-so-public bodies have been making their resource or link information openly available. Friend of a Friend (or FOAF) provides a means of defining yourself. The National Library of Congress has published its Subject Headings—a list of standard names which everyone may as well use to ensure consistency. But it's not essential, you (or someone else) can always declare equivalence using a SameAs or exactMatch type of relationship. e.g. 'Brown, Gordon' can be equated to 'Gordon Brown'.

As you rummage, you'll come across terms such as RDF, URI, graphs, triples and so on. These exist to clarify rather than confuse. The resource description framework (RDF) defines how information should be expressed. Fundamentally each item is a triple comprising: subject; predicate (or property); object, as in Gordon Brown; is a; politician. A uniform resource identifier (URI) might define each of those elements. And the collection of triples is referred to as an RDF graph. Of course, you'll get exceptions, and finer nuances, but that's the basic idea.

The point of all this is that, as with the rest of the web, it must be allowed to flourish in a decentralised and scalable way, which means without central control, although open standards are very important and make life easier for all participants.

With this general introduction, it's possible to see how data sets can be joined together without the explicit permission or participation of the providers. You could find a URI and, from that, find all the other datasets that reference it, if you wanted to. Because of the common interest, you (or your application, more like) would be able to collect further information about the subject.

Talis is a UK company that's deep into this stuff. It's been going for around 40 years and was originally a library services provider. It has spread its wings somewhat and now divides its attention between education, library and platform services. The platform element is the part that's deeply into linked data. It recently set up a demonstration for the Department of Business, Innovation and Skills (BIS) to show some of the potential of this stuff. It takes RDF information from three sources—the Technology Strategy Board (TSB), Research Councils UK (RCUK) and the Intellectual Property Office (IPO)—and produces a heat map of activity in mainland Britain. You can see how much investment is going in, how many patents are being applied for and so on. You can zoom into to ever finer-grained detail and use a slider to see how the map changes over time. You can play with the Research Funding Explorer yourself or follow the links in this piece by Richard Wallis to see a movie.

For you, the question in your mind must be, "All very well, but what's in it for me?" For a start, you can get hold of a lot of data which might be useful in your business—information about customers, sources of supply or geographic locations, for example. So, you may find value purely as a consumer. However, you may be able to give value by sharing data sets or taxonomies that your company has developed. This might sound like madness, but we've already seen in the social web that people who give stuff away become magnets for inbound links and reputational gains. In this case, you could become the authoritative source for certain definitions and types of information. It all depends what sort of organisation you are and how you want to be seen by others.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact David Tebbutt (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: John Brand, Research Director, Hydrasight Posted: 15th March 2010 Copyright Hydrasight © 2010

As cloud computing matures, Hydrasight foresees that proprietary enterprise cloud infrastructures will become increasingly attractive to vendors, as a point of competitive differentiation, before 2015. We expect proprietary software and hardware cloud infrastructure vendors will market their products as providing additional benefits in availability, scalability, performance, optimisation, manageability and cost. While Hydrasight advises that the majority of enterprise clients recognise the proprietary components of cloud computing, we also note there are some business and technical requirements that can benefit from proprietary technology adoption, regardless of vendor lock-in.

Over the last decade, so-called ‘commodity' hardware has increasingly become the preference for deploying cost effective, highly scalable applications (refer "Commodity is not (necessarily) a dirty word"). This is particularly true for web-delivered, as well as some mid-range, applications. As a result, proprietary hardware vendor revenues (and viability) have invariably suffered (e.g., Bull, Digital, Fujitsu, Hitachi, IBM, Prime, Sun Microsystems and Wang).

Despite the rhetoric around the open nature of cloud computing, Hydrasight believes cloud architectures provide both hardware and software vendors with a new opportunity to differentiate-and therefore to potentially lock-in customers. This will, in some cases, significantly reduce the benefits of using the cloud.

Hydrasight warns that cloud computing should not be assumed to be inherently more open or flexible than any other technology platform.

Moreover, enterprise cloud computing must be recognised as having similar risks to previous technology platforms (e.g., risk of vendor lock-in such as higher procurement and support costs, shortages of skills, availability of high quality support, unplanned migration/upgrade costs). Ultimately, Hydrasight believes that, in the absence of any (viable) open cloud architectures, organisations will adopt proprietary cloud architectures. This will again force organisations to adopt long-term strategic vendor partnerships and actively manage increasing costs driven by market demand.

Hydrasight believes that hybrid cloud architectures, which can seamlessly and securely move workloads independent of their location, will ultimately provide the greatest business value (refer "Cloud computing: worthy of definition(s)").

Because hybrid clouds must inherently be less restricted by physical infrastructure constraints (i.e., they can utilise both internal and external resources as required), they will also require greater levels of (automated) management and bandwidth in order to achieve the high(er) degree of availability, performance and security sought. Ironically, we note that proprietary solutions are invariably more manageable due to the tighter level of integration and control and their ability to assert control over a complex technology environment.

Hydrasight also notes that current enterprise interest in cloud technology is predominantly targeted at internal, private cloud architectures (refer "Next-generation data centres: raining on the cloud computing parade"). This provides a perfect opportunity for vendors to begin locking-in customers—early in cloud computing's evolution. Moreover, Hydrasight warns that proprietary architectures will inhibit organisations in their ability to adopt hybrid clouds longer term and therefore threatens the potential to achieve the full benefits of cloud computing.

In regard to delivery and management technology, Hydrasight believes that hybrid cloud computing will rely more heavily on advanced software capabilities rather than hardware. This is already evidenced by VMware's dominance in, and management (software) approach to, on-premise server hardware virtualisation (refer "VMware is the new Microsoft (and why virtualisation is neither free nor cheap)"). We note that VMware's vCloud initiative now aims to expand toward a proprietary version / vision of the hybrid enterprise cloud computing model.

Irrespective, hardware capabilities for optimisation of cloud resources within the firewall or data centre may still be required in some limited cases (e.g., crypto-accelerators for security, XML processing and / or high performance cores for specific analytical modelling applications). Hardware-dependent clouds will therefore continue to offer some distinct advantages, particularly for high performance / high security applications.

However, Hydrasight warns that the majority of implementations based on proprietary hardware will fail to deliver any significant additional business benefit over more open, software-oriented clouds.

Hydrasight believes ‘standardised, generalised' software-based ‘grid', ‘utility' and ‘cloud' architectures will deliver the greatest business benefit, especially in non-specialist applications. For the majority of enterprise clients, a reliance on proprietary cloud architectures-including storage clouds, compute / application clouds and / or non-internet based network clouds-is a return of the vendor-driven lock-in witnessed during the height of the mainframe era and the early days of public LAN / WAN infrastructure.

Hydrasight therefore recommends enterprises carefully review emerging proprietary cloud architectures and their potential benefit compared to the risks, costs and limitations they will ultimately impose (e.g., being less able to take advantage of hybrid clouds due to either hardware and / or software incompatibilities). While proprietary solutions will inevitably present some vendor lock-in, removing hardware dependencies will, in most cases, at least minimise the risks and reduce the overall cost. Nonetheless, proprietary cloud computing architectures will present (and / or perpetuate) organisations with similar risks, costs and complexities in achieving interoperability. Organisations must therefore be appropriately cautious about buying into proprietary cloud infrastructures that may result in cloud ultimately being viewed as ‘the new mainframe'.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact John Brand (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 15th March 2010 Copyright Interarbor Solutions © 2010

One of the biggest questions facing companies today is what to make of cloud computing. Does it signal a major shift in how we approach IT—and the business—or is it just another ride on the hype wave that will disappear if we just wait it out?

HP tackled this question this month with a series of virtual conferences, "Cloud: Practical Advice for Taking the Next Steps," whose aim was to cut through the fog and to try and point business leaders and IT executives in the value-oriented direction.

A panel of industry analysts, practitioners, and HP experts outlined the value proposition of moving to the cloud, the danger of inaction, and how companies can get started on their cloud journey. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

For those who didn't catch the virtual conference live, HP has made the replays available.

Tom Kolopolous, president and founder, of The Delphi Group, opened the series as keynote speaker by stressing the opportunities cloud model provide for innovation, especially during an economic downturn.

Cloud, Kolopoulos said, is a key enabler of innovation. For those who might question the ability to innovate during an economic crisis, Kolopolous had some sage advice: "When you tighten the belt, innovation becomes more of an issue . . . you can’t innovate if your stomach is full. You only innovate when you’re hungry."

Tom Bittman, vice president and distinguished analyst of Gartner echoed similar themes in his closing keynote, in which he stressed that the risk of inaction was the greatest risk enterprises face today: "The only choice that’s a really bad choice is to do nothing with cloud computing at this point. Having a strategy and moving forward is very important."

Other speakers included Ken Hamilton, director of Data Center Synergy and Cloud Computing for HP; Tim van Ash, HP director of Products for SaaS; Archie Reed, who is HP’s Chief Technologist for Cloud Security and the author of several publications, including The Definitive Guide to Identity Management; Jim Reavis, Executive Director of the Cloud Security Alliance and president and founder of the Reavis Consulting Group, Chris Whitener, HP Chief Security Strategist; Duncan Campbell, VP Worldwide Marketing, HP; Chris Rence, a CIO from FICO, and Alan Wain, VP Solutions Infrastructure Practice, HP.

Some highlights:

Koulopoulos: My advice is that number one, don’t look at the cloud simply by looking at what’s available today. Think of it as a long-term trend that you will have to adapt to, and you have to begin that adaptation now. You can’t wait until it’s fully evolved.

Begin moving down that road with non-core applications and services that maybe aren’t as critical to the regulatory aspects of your business, to those aspects that would involve more security concerns, and in that way, you acclimate yourself to the cloud. You begin to understand what it means to work, to live, to run a business in the cloud, and the rest of these issues will resolve themselves, and they’ll resolve themselves for the same reason that they always do—because of pure economics.

When the cloud becomes important enough that we rest enough of our economic value on it, we will invest enough to make sure that the security issues have been addressed, but it’s an evolution. So don’t look at the cloud and say, “Well, it’ll never work because today, here’s what exists.” Look at the cloud and say, “I have to evolve with it.”

Bittman: There really are three major benefits. One is cost, the idea of sharing, the idea of economies of scale definitely can reduce cost. But this one, I think, is often overstated and companies that are looking at cloud computing primarily as a cost benefit are probably missing some of the bigger benefits. Another benefit that is very important is quality of service.

In other words, it's the ability to specify explicitly what your service requirements are through a services-oriented interface to set your service levels high or low, to set your performance requirements high or low, depending on what you need, and base your price based on the service levels you need. That quality of service is something that might be very valuable to a business to adjust over time based on changing business dynamic cloud services.

Another part of that that’s important is the ability to change quickly. That gets to the third benefit which I think is the most important, and that’s agility—the ability to spin up a new business, to spin up a start-up requirement in an enterprise, the ability to change your service level requirements or to change your scale very quickly.

This not only helps the bottom line in a typical company but it helps the top line. It can help a business grow. It can provide a competitive advantage to be able to react to a business change very, very quickly at the speed of business instead of at the speed of IT.

Reed: Security, just like cloud, is hard to define. It’s a very broad term when we think about it. It can be many different things for different people. When you get to cloud security, first off, you’ve got to define which part of the cloud you’re talking about—which cloud service, which cloud computing model you’re talking about. Then we can talk about which specific security aspects apply to that part of the model.

What we do is look to standards, taxonomies; ways of talking about this that make sense both to the business people as well as the technology people Cloud computing represents phase 2 of the internet where we’re actually leveraging the internet connectivity to create this utility of computing. It changes everything.

Van Ash: HP’s approach, with Cloud Assure, is really about enabling business confidence in the cloud. It’s about mitigating risk and you talked about risk management earlier. We’re really attacking four key categories. We’re attacking security, performance, availability and service levels, and controlling the ongoing cost. Now, why do we go after those four elements? Well, they’re consistently the top four elements that we see from both analysts and customers alike and they map pretty well to the seven deadly sins that Jim talked about right upfront.

Reavis: Don’t read the research in and of itself and assume you’re g

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Clay Ryder, President, Sageza Group, Inc. Posted: 12th March 2010 Copyright Sageza Group, Inc. © 2010

IBM has announced three new servers that are based on the fifth-generation IBM Enterprise X-Architecture chip (eX5). These are the four-processor IBM System x3850 X5, the BladeCenter HX5, and the System x3690 X5, which the company stated will be the most powerful two-processor server on the market. Each of these eX5 servers is equipped with a new independent memory-scaling technology, known as MAX 5, which allows processors on eX5 systems to access extended memory very quickly and enables these servers to offers six times more memory than comparable x86-based servers.

In addition to MAX5, IBM’s new eX5 systems offer additional features that seek to improve the performance, cost, and flexibility for x86 workloads:

• eXFlash, a next-generation flash-storage technology, replaces previous generation storage and can slash storage costs substantially as each eXFlash can replace 80 JBODs and associated hardware and cabling.
• FlexNode, a physical partitioning capability, allows organizations to change their systems configuration from one system to two distinct systems and back again as desired. This enables organizations to run infrastructure applications by day and larger batch jobs by night on the same system.

The eX5 systems take advantage of integration with IBM middleware to create a virtualized environment providing a flexible, highly scalable system that can reduce the number of physical servers needed to support a given workload. IBM's Systems Director management suite has been upgraded to support eX5 technology and will allow users to pre-configure servers, remotely re-purpose systems, and set up automatic updates and recoveries. The company stated that its new eX5 servers are the result of a three-year engineering effort to improve the economics of operating enterprise-sized, x86-based systems.

Pricing/Availability:
The IBM System x3850 X5, BladeCenter HX5, and System x3690 X5 are being previewed this week at the CeBIT trade show in Germany and will be officially available later this month and throughout the year. No pricing details were released.

Net/Net:
At times it is difficult to get excited about Industry Standard x86-based servers. The market is saturated with solutions that seem to universally benefit from ever-increasing CPU performance combined with a price/performance ratio that continues to rise towards the stratosphere. All told, more applications are finding their way onto this platform every year as legacy UNIX and other systems are retired in favor of this widely deployed low acquisition cost option. The platform offers choice of operating system and components from thousands of suppliers, and now with virtualization, utilization is going up, and acquisition price points are going down. Overall, it sounds like a commodity market. So why get all worked up about a vendor’s latest entry in this well populated market segment? The reasons are simple: this is NOT a commodity market, virtualization is here to stay, and disk drives are too darn slow.

While x86 processors as a component could easily be considered a commodity, a processor alone does not make a server. All of the components on the motherboard and rack/chassis along with various interconnections have a substantial impact on the performance and capability of the server. While one industry-standard server would be expected to execute the same software as another, the performance and scalability of the systems is not automatically the same. Commodity CPU yes, commodity and hence undifferentiated server, no.

The growth in x86 CPU performance is undeniable. Quad-core and higher systems with lightning-fast clock speeds have achieved an astonishing level of performance at very compelling price points. However, to effectively harness this performance, the system performance as a whole must be balanced across all of its component parts in order to cost-effectively support the application workload. As computational performance has risen, there has been a corresponding gap in overall system utilization as newer and faster systems are limited by the mundanity of relatively slow I/O access, memory swaps, disk reading and writing, network access, etc. To address this utilization gap, many have embraced virtualization to get more virtual servers out of the physical server. But this success in modestly raising CPU utilization has caused a new scaling constraint, one of limited memory.

Virtualization allows many more logical servers and workloads to be discretely serviced by a physical server. However, each of these workloads requires RAM, and the total amount of RAM is limited by the number of DIMMs and memory interconnects to the CPU that can be installed on a motherboard. Historically this has limited most x86 servers to 256GB or less, a shortcoming that MAX5 seeks to address. By increasing the amount of RAM available to the CPU up to a maximum of 1536GB, the server can support a larger virtual machine footprint and hence more workloads. This can help make use of computational resources that are otherwise idle or saturated with workloads that are more memory- than computation-intensive. Increasing the yield of virtual servers supported per physical server can reduce software licensing fees for organizations with per-socket licensing regimes. The number of users supported on a server can increase, but without an increase in socket count and hence corresponding license expense. To our way of thinking, this gives eX5-based systems a compelling advantage over traditional solutions, one that not only is technically crafty, but yields financial dividends as well.

Lastly, with increased computational prowess and sufficient memory in place, the last leg of the balancing trifecta becomes evident: access speed to out-of-memory storage. In the grand scheme of things, disk drives are just much slower than memory or CPU cache. Although many steps have been taken to improve spindle-based storage access speed, it still remains the turtle to the computational hare. Advances in flash technology have sought to address this reality, and this is where eXFlash plays its hand. Besides its higher IOP rating, each eXFlash can replace 80 JBODs, which translates into a substantial reduction in energy, floor space, and wiring requirements. Again, the performance improvement is notable, but the underlying acquisition and operational economics are the most compelling aspects of this technology.

So all told, we believe that eX5 illustrates once again that just because a server is based upon x86 processors it is not automatically a commodity solution. The unique scaling and performance technologies in these offerings serve notice that a holistic and balanced systems approach can yield very different results than a solution based simply upon assembling industry-standard technologies. We believe organizations that are turning to workload optimization and systems efficiency as part of their strategic IT course will likely find much to rejoice in with the latest eX5 servers. Likewise, for those who are merely seeking to achieve a higher degree of vertical scaling from x86 solutions, eX5 redefines the current limitations on single system scaling in a notable fashion, one which we believe will be well received.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Clay Ryder (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 12th March 2010 Copyright Bloor Research © 2010

This article explores the role of database activity monitoring in an overall compliance solution.

Database Activity Monitoring and Compliance
Organisations deploy DAM solutions for a number of reasons, ranging from compliance through to beefing up their overall security posture.

Increasingly, compliance laws, rules and regulations are forcing organisations to have tighter control over their data and, more importantly, have a provable audit trail that can be signed off, if necessary, by appropriate organisational officers or executives.

Sarbanes-Oxley, which has implications for organisations based in the United States or with a trading presence there, has a requirement that financial information is accurate, and a company executive will be expected to sign a statement to that effect. Although not specifically mandated, it makes sense to record database activity, especially if that data relates to financial information. Database activity monitoring will often be a useful addition to any compliance suite as it can provide a level of assurance that data usage is being monitored. For example, it could help enforce a separation of duties, preventing a DBA from viewing data they should not have access to during a database backup.

PCI-DSS, the payment card industry standards for data security, place a set of requirements on credit card merchants to protect customer credit card details. PCI-DSS is reasonably proscriptive in its requirements, and merchants that fail to comply with the regulations face fines and possible exclusion from credit card networks. Database activity monitoring would be a useful adjunct to a merchant's information security setup, as out of course access to credit card data can be detected and prevented. For example, if a user normally accesses 10 credit card numbers at a time then the database activity monitoring system could raise an alert if they should access more than this number of card details in a database query.       

Database Activity MonitoringTechnical Architecture
Database Activity Monitoring vendors each have their own preferred way of tracking database activity and will therefore implement slightly different architectures.

A single appliance/single server architecture will provide a one-to-one mapping of a database server with a monitoring appliance, which, in turn, acts as both a sensor and collector of relevant data. This configuration would be suited to a small departmental database but may not be effective enough for larger database systems.

A two tier architecture will consist of a centralised management server that aggregates information from a set of remote sensors or collection points. This provides a better degree of system scalability.

A hierarchical architecture builds onto the two tier architecture and supports a larger number of sensors and collectors distributed across a large organisation or enterprise. 

Advanced Database Activity Monitoring Techniques
Network monitoring is the process of monitoring all SQL traffic to a database. The advantage is that it can monitor multiple databases at any one time and keep track of all commands being sent across the network to its databases under scrutiny. It will not be able to detect database activity carried out by a user logged directly onto a database server via a local console but it is able to monitor encrypted connections if placed between the VPN and the database, at which point the SQL commands would be in plain text. Network monitoring places no overhead on the database so performance will not be adversely affected.

Remote monitoring places a SQL collector on the database with administrative privileges and native database auditing is enabled. The collector will then aggregate all activity collected by the native database auditing tools or indeed any other database feature that may provide relevant or useful user activity based data. This type of monitoring will impose an overhead on the database as logging has been fully enabled on the database server, causing it to do more work. The benefits of this approach are that all database activity is collected, included that of any user logged directly into the server via a local console.

Local agents can be installed on each database being monitored. These may or may not be successful in detecting all database activity dependent on how they have been configured and how close to the heart of the database they are allowed to sit. As the use of agents requires software to be loaded directly on a database server, and have an associated performance impact, they are not always widely regarded by normally very conservative database administrators. The upside is that a well coded and developed agent could detect all database activity with no need to turn on the local native auditing tools and may only adversely affect database performance by 27%. Of course the business will need to decide if any performance hit is acceptable against the data security risk.

In reality, each organisation will need to determine which database activity monitoring solution architecture fits their purposes and whether a compromise will need to be achieved between security and performance. Indeed, many organisations will probably implement a mix of architectures across their databases being monitored. 

More advanced database activity monitoring solutions are increasingly moving into the realms of application monitoring as well as database monitoring. This requires a deeper understanding of application architectures and is only generally available for common enterprise solutions such as widely used HR, process management and enterprise resource planning systems. With appropriate hooks into client applications the monitoring software is even better positioned to see each and every action against a database.

The next article will cover database activity monitoring for the business decision maker

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 11th March 2010 Copyright Interarbor Solutions © 2010

In a move to mainstream predictive analytics, TIBCO Software this week rolled out the latest version of its Spotfire platform.

Dubbed Spotfire 3.1, the latest iteration promises a natural language statistical experience. Spotfire 3.1 aims to help anyone in an organization get fact-based answers to questions that help drive revenue.

The company says its software is not just for analytics gurus but also marketing professionals, business development managers and others who need forward-looking business intelligence in a hurry. [TIBCO Software is a sponsor of BriefingsDirect podcasts.]

"Unlike traditional business intelligence tools, which for the most part aggregate historical trends only, Spotfire 3.1 projects them forward with what-if scenarios," says Mark Lorion, vice president of marketing for TIBCO Spotfire. "Anyone in the company can ask questions on demand and our analytics will provide future predictions based on behind-the-scenes data-driven methods. Users don't have to understand the methods. They just have to ask the questions—and they get answers instantly rather than waiting days like you would with today's business intelligence (BI) tools."

Spotfire 3.1 in action
Let’s say you’re trying to promote a new product in the consumer goods market. Spotfire 3.1 lets you choose input variables based on what you suspect might be driving the advertisement response, such as price, discounts, packaged offers, age of the respondent or length of time as a customer. You would then press a button that asks, "Are these related?"

After you push that button, Spotfire 3.1 works behind the scenes to run predictive models, using analytics and statistics to compile sensitivity analysis and correlations, then return a colorful graph that shows the response rate and which factors are most closely correlated to people clicking on your advertisement.

While BI gives you historical data, the predictive analytics aspect of Spotfire 3.1 offers insights into what could happen next time you run a similar promotion. It can also help you fine-tune your promotions by targeting the customers that clicked on your ad, or offering different promotions to different audiences—and it does it almost instantly.

Unlike traditional BI or static spreadsheets, Lorion says Spotfire 3.1 also includes conditional coloring and lasso and axis marking that allow for better data analysis of patterns, clusters and correlations among sets of variables. The software's multiple scale bar charts and combination bar and line plots offer analysis of unstructured, "free-dimensional" data to identify key outliers and trends amongst the data.

“IT organization and statistician groups aren’t able to respond quickly enough to the many questions that arise from business users, so they go to their gut,” Lorion says. “Spotfire lets you make fact-based decisions rather than gut-based decisions.”

Predictive analytics challenges
Of course, predictive analytics software is not a new concept, and Lorion admits that the predictions are only as good as the quality and breadth of the available data. But predictive analytics is gaining momentum in the enterprise marketplace.

IBM bought predictive analytics firm SPSS last July for $1.2 billion. And IDC predicts the $1.4 billion market for advanced analytics, of which predictive analytics is a subset, will grow 10 percent annually through 2011. Despite tight IT budgets, Lorion is optimistic about the space and the company’s offering.

“The economic downturn has been good for the analytics space because customers need to make reductions and predictions—but they need to be smart about it,” Lorion says. “Companies don’t want to hire PhDs to make sense of their statistics. But we need to drive awareness of our product and educate the market that the power of predictive analytics isn’t in the hands of only a couple of statisticians.”

Spotfire 3.1 works in tandem with Spotfire Application Data Services to let companies analyze data from various sources, including SAP NetWeaver BI, SAP ERP, Salesforce.com, Siebel eBusiness Applications, and the Oracle E-Business Suite.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 10th March 2010 Copyright Interarbor Solutions © 2010

In a move to tackle a persistent cloud computing challenge, Cast Iron Systems just rolled out a new platform that aims to help companies large and small securely integrate public clouds, private clouds and on-premise applications.

Dubbed OmniConnect, the cloud integration solution offers a single platform rather than multiple products or on-premise tools to accomplish cloud integrations.

Five pillars undergird OmniConnect: complete integrations, a complete cloud experience, reusability of connectivity and processes, and portable, embeddable, and brandable environments, and centralized cloud management.

"Cloud application use is exploding, but just because you like Salesforce.com doesn't mean you are going to throw out SAP, Oracle or other applications you have on-premise. It's a hybrid world where companies have a combination of cloud and on-premise locations," says Chandar Pattabhiram, vice president of Channel and Product Marketing for Cast Iron Systems. "You don't maximize the value of your cloud applications unless you get all the data into it—so you need integration."

Complete integrations
Integration can get complex in a hurry with a growing number of applications in the enterprise, such as Salesforce, Google Apps, WebEx and ADP. Companies could take a do-it-yourself approach but it won't scale over time. Companies could also use an on-demand vendor for cloud-to-cloud scenarios, or hire an on-premise integration firm. Cast Iron Systems, though, is pushing OmniConnect as a better solution.

"Fifty-six percent of CIOs in a Gartner survey said they are transitioning away from the cloud because too many choices make it too difficult," Pattabhiram says. "Our new platform is meant to solve this problem by bridging the on-premise and cloud worlds. We offer complete integrations that include data migration, process integration, and UI mashup capabilities."

OmniConnect, for example, lets SaaS applications access, cleanse, and synchronize data stored in legacy systems in real-time and completes processes such as quote-to-order, purchase-to-pay, and order-to-cash without leaving the Cast Iron OmniConnect environment. The platform can also mash up the data from disparate sources and display them in a single view without taking the data out of one application and putting it into another.

Users can configure their integration processes in the cloud, run them in a multi-tenant cloud-based environment, and monitor all integrations from a single cloud-based console. And the Cast Iron Secure Connector aims to overcome data security issues by offering a secure channel that exchanges encrypted or firewalled data between enterprise applications and Cast Iron’s multi-tenant cloud service.

Reusability, portability and management
Cast Iron also announced a new Connector Development Kit that works to streamline building connections to new applications and data sources. The kit allows IT gurus to re-use connectivity created in OmniConnect to snap in connections to public clouds, private clouds, and on-premise applications. OmniConnect also offers reusable templates of the most common processes.

Portability is another feature that Cast Iron is boasting about. The software lets users make integrations or the entire OmniConnect portable into any public cloud, private cloud or on-premise data center environment. Infrastructure providers can also embed and brand the platform as their own integration-as-a-service offering. ADP, Dell and Cisco are already reselling the service.

There is significant value in having one platform rather than multiple solutions to bridge private cloud, public cloud and on-premise applications.

Finally, a cloud-based management console makes it possible for users to monitor multiple integrations across customer deployments in a single location. Management APIs are available for IT and SaaS providers to view the monitoring data within their private or public clouds. Cast Iron also announced support for Amazon Web Services customers through integration-as-a-service.

"Security and integration are the two biggest concerns cited in Gartner's study," says Pattabhiram. "That's why you see mega-brands partnering with us. They want to have an enterprise grade solution to help their customers adopt their cloud applications. There is significant value in having one platform rather than multiple solutions to bridge private cloud, public cloud and on-premise applications."

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Neil Ward-Dutton, Research Director, MWD Advisors Posted: 9th March 2010 This work is licensed under a Creative Commons License

Just a quick note to say that I'm honoured to have been asked to provide a keynote presentation at the upcoming CloudSlam 10 virtual conference being held from March 23-25.

My presentation is scheduled for 11am ET / 8am PT on March 23rd and is titled Cloud forecasting: models, predictions, pitfalls and planning. More details are available here. I'm also moderating a panel with some IBM folks at 4pm ET / 1pm PT on March 23rd, which should be fun (though it'll be 9pm for me, so if I jabber it's because I've had too much coffee ;-)

Last year's event was a pretty big success by all accounts, so I'm really excited to be taking part. I hope to see you there!

In the meantime—if you'd like to see a preview of some of what Ill be talking about (obviously I'll be mixing it up a bit for CloudSlam) then you should check out our own virtual Cloud event, available on-demand here. It's free—you only need Guest Pass access to our research library to access the content. I'd love to hear what you think about the research we're doing in this area.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Neil Ward-Dutton (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Laurie McCabe, Partner, Hurwitz & Associates Posted: 9th March 2010 Copyright Hurwitz & Associates © 2010

What is Social Media Management?
As described in the column What is Social Networking, and Why Should You Care?, Internet-based social media make it easier for people to listen, interact, engage and collaborate with each other. But, as the volume of social media venues and conversations rises, it quickly becomes a time and labor intensive process to effectively track, converse, monitor and manage them.

Social media management solutions can help you manage outbound and incoming online interactions—along with other marketing activities—in a more efficient manner. They streamline and consolidate how you listen to and participate in relevant conversations in the different places theyre taking place—blogs, social networks like Twitter or Facebook, and other public and private web communities and sites. They help you to more easily monitor what people are saying about your business, and by automating the process of delivering your outgoing messages through multiple social media outlets simultaneously, help you to amplify your social media presence across several social media sites.

Social media management tools can also help you to integrate social media activities with other marketing programs. These can include both other online activities, such as web site, search engine marketing campaigns, contact management systems, and email marketing, as well as offline marketing, such as events or white papers.

Why Should You Care?
We all know how important word of mouth is, and social media is like word of mouth on steroids. As a business, it's vital to tap into and join online conversations, not only about your brand, but also those about your competitors, your industry and your areas of expertise.

Even if you havent launched an outbound social media strategy, you to keep a pulse on what people are saying—good or bad—about your company, competitors and major trends. And, by representing your company in a positive, authentic way, you can build credibility for your expertise and business, and link to customers and prospects quickly. You can also help mitigate damage should negative conversations about your company emerge by proactively responding to complaints. Social media can also steer people to your other marketing programs, where its easier to individually track and manage individual customer and prospect interactions.

Done right, social media can help you better understand prospect and customer needs, and increase visibility and generate leads. But it takes a lot of time and energy to stay on top of all of this in a manual, piecemeal fashion. Think about the time it takes to just to cover some of the basics, such as:

• Creating content in multiple places, such as a blog, Twitter, a Facebook page, etc., and monitor and scan the views, decide what comments to approve, and respond to replies on these sites.
• Scanning Twitter followers for conversations you may want to join, or checking your RSS reader subscriptions for relevant articles and new ideas.
• Checking Google Alerts to see when and where your business is mentioned on the Web.
• Creating and monitoring a community and topics on a site such as Facebook or LinkedIn.

Now think about the fact that the social media to do list is only going to grow. And while you are building goodwill, relationships and awareness, it's difficult to measure short-term payback on social media efforts. And you can't abandon other marketing activities—web site, search engine marketing, email marketing, etc. and contact and sales management. Social media management tools give you a way to get your arms around the many-headed social media Hydra by streamlining and integrating customer interactions across multiple marketing venues.

What to Consider
There are dozens, if not hundreds of solutions out there that let you manage/integrate different slices of the social media pie, but we are still searching for the Holy Grail in this relatively new area. However, I've spotted a few vendors that have put together some more comprehensive solutions designed and priced specifically for small business budgets, including:

• BatchBlue's BatchBook, a "social CRM" offering that integrates contact, sales and social media feeds, with mobile versions for iPhone and BlackBerry. The social media integration is cool—after you enter social media feeds from Twitter, blogs, LinkedIn, etc. on a contact record, you automatically see a contact's social networking profile, and the last three posts, tweets and/or other entries when you open the record so that you can keep a pulse on customers and prospects. With lists and reports, you can build lists, or create customized reports. BatchBook integrates with Mailchimp so you can send email newsletters to your lists. BatchBlue gives all new users a minimum of 2 hours of 1–1 consulting time to help them get productive as quickly as possible. Pricing ranges from $9.95 to $99.95 a month, based on the number of users, storage, and 1–1 consultation time you need. My take is that BatchBlue is a great solution for tech-savvy small businesses, especially services businesses where every relationship counts.
• CloudProfile gives SMBs a unified content publishing and social media hub and web presence, which businesses can use standalone in place of web site, or with their existing web site. You create an online profile, which enables your business to get found in search engines like Google, business directories, and on social networks. It helps you find and connect with customers on Twitter and Facebook, and offers tools such as click-to-call, text messaging and e-mail marketing to help you stay connected with customers. CloudProfile provides built-In reports and connect to Google Analytics. The company plans to add PayPal and Amazon checkout and appointment scheduling soon. Pricing starts at $14.95 a month. A very good choice for the approximately 40% of small businesses that don't yet have a web site—gives you an online presence plus social capabilities.
• HubSpot helps companies create, optimize and promote their content. HubSpot features a blogging platform and a content management system, and tools to help analyze your marketing reach via blogs, leads, Facebook and Twitter accounts. It provides links to conversations across the Internet related to your business keywords in one tidy dashboard. The Web Voter feature enables you to create a social news page on your site, where users can submit links and vote on them—creating an activity hub for discussion of hot issues. HubSpot also provides Keyword, Page and Link Graders, to help optimize search result rankings. Optional integration with Salesforce.com CRM is available. HubSpot charges an initial $500 start up fee, and ongoing pricing starts at $250 per month. It also offers a number of free tools, including Graders for web sites, press releases, blogs, etc. HubSpot, who we interviewed for a video a couple of weeks ago, provides a very comprehensive solution for both small and medium businesses.
• ZooLoo provides a one-stop shop to get an online presence and manage social media interactions—including domain name registration, web site creation, a blogging platform, SEO tools, privacy controls, storage, and tools to connect across social networking sites–along with a personal dashboard to manage all of it. Some tools, such as the Graffiti blogging platform that lets you share posts across your social networks, are free. ZooLoo charges for other things, such as domain registration, web sites and privacy controls. ZooLoo’s fee-based services range in price from $1.99 to $9.99 per month. Although most of it’s current users are consumers, ZooLoo is a great fit for entrepreneurs—and the Facebook-like interface makes it easy for anyone to get the hang of.

As you can see, these companies come at the social media management conundrum from different angles. So as you evaluate these and other offerings, think about what is most critical to your business. What are your key objectives for your social media investments? Where do you spend the most time manually scanning, managing, updating and integrating across social media streams and more structured marketing activities? Where are the gaps? There is no one-size fits all, so start with your own requirements and objectives to help start taming the social media Hydra.

(Originally published on March 4, 2010, in Small Business Computing)

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Laurie McCabe (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Peter Abrahams, Practice Leader - Accessibility and Usability, Bloor Research Posted: 8th March 2010 Copyright Bloor Research © 2010

On Wednesday 3 March 2010 I attended the inspiring launch of Apps for Good in Tulse Hill, Lambeth, South London.

Apps for Good is a project that will provide an environment for young people in the community to analyse issues that effect their lives and then design and develop digital applications to improve their reality.

The program is being run by CDI Europe based on techniques developed over the last 15 years. CDI started in deprived communities in Rio de Janeiro and now has hundreds of centres across South America, the Middle East, North Africa and now Europe, and is planning to expand into southern Africa and India.

The project is expected to have multiple beneficial effects:

• The availability of useful applications relevant to the needs of the local community.
• Increased understanding of the issues that effect young people and the wider community.
• Encourage the use of information technology within the community by demonstrating the benefits and thereby increase digital inclusion.
• The participants will gain transferable skills related to working in groups, working in projects, analysis, design, development and promotion of solutions.
• Improve the self awareness and motivation of the participants.
• Proof that the process works in the UK environment with the intent that it will be replicated in other centres across the UK and Europe.

I am excited by this project because I recognise the importance of digital technology to the UK and the need to ensure that young people are enthused and involved. On a personal level I realise that, as I move into retirement, the quality of my life will become dependent on both younger people around me and the innovative and effective use of technology.

As my regular readers will know my main interest is in accessibility: computing for people with disabilities. I see Apps for Good having the potential to address issues in this area in two ways. Either the young people will recognise the issue of digital exclusion of people with disabilities (along with the elderly, or people whose first language is not English) and create applications to help them. Or centres will be set up specifically for people with disabilities to create their own solutions. This has already happened in South America.

Congratulations and good luck to everyone involved in the instigation and running of this project:

• High Trees Development Trust in Tulse Hill, South London where the first UK centre is housed.
• CDI Europe who provide the knowledge and skills in running similar projects.
• Dell YouthConnect that supplied the computers and some professional support.

If this first pilot in High Trees goes welland I am convinced that it willthen there will be a demand and a desire to replicate it rapidly around the UK and other European countries. I urge everyone in the British ICT community to think how they could support this initiative: by providing equipment or volunteers to help with the project, but also thinking how they can provide support to the young people to build on the skills and solutions they have developed.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Peter Abrahams (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Bob Tarzey, Service Director, Quocirca Posted: 8th March 2010 Copyright Quocirca © 2010

Any business likes to claim to be number one at something; the biggest pet-shop in town, the largest office productivity application provider globally, the only telco that provides both mobile and broadband in your area.

To this end categories are often invented to suit the business "This is the only shop in town where you can buy sweets, records, magazines, kitchen accessories and have a cup of coffee". This is an attempt to characterise the now defunct Woolworths in the UK— trying to be all things to all people was not distinctive enough to save it in the face of the recession.

One IT vendor that faces such a problem is Novell. It once had a clear market-leading position—in the 1980s and early 1990s Novell's NetWare network operating system was the network operating system of choice for sharing files among workgroups. The ascendancy of Windows, Linux, the IP protocol, among other things, led to a fall in demand for NetWare and left Novell seeking a new identity.

Unlike Woolworths (in the UK at least) Novell is still with us and doing OK; it has $1bn in cash and, although sales shrunk a little in Q1 2010, profits and earnings per share doubled. A sign of a business managed well in tight times?

Novell's main problem is getting the message out there about what it is and what it stands for. This is hard because the reality is that Novell is not number one in any of its core markets. Since the decline of its NetWare business Novell has survived by building up four new product lines.

1. It has a commercial distribution of Linux through its acquisition of SUSE back in 2003. A strong and growing business to be in, Novell has achieved particular success in the public sector, where open source is becoming more and more attractive as budgets are squeezed. Novell is helped by partnerships with Microsoft and IBM, but it remains number two to Red Hat (and, in the datacentre, Linux is still number two to Microsoft Windows Server).
2. It has maintained a long-term presence in the identity and access management (IAM) market, but this remains fragmented; directory management is dominated by Microsoft Active Directory, the Oracle/Sun merger has bought together two strong players in access security and there are many others including IBM, CA and EMC/RSA.
3. Through its acquisition of Plate Spin in 2008, Novell entered the configuration management database (CMDB) market; but again there are a number of major players in the mid-market including HP, IBM and VMware.
4. Finally it is in the business of measuring and monitoring IT systems and performance with tools from a number of areas including its acquisitions of e-Securities/Sentinel in 2006 and Managed Objects in 2008. Again a fragmented market with lots of players.

Novell has made it clear that it is a software products company by divesting itself of its services arm in 2008 (the results of a 2001 acquisition of Cambridge Technology Partners). So, it may be that Novell can claim to be the worlds number one supplier of Linux/IAM/CMDB/measurement and monitoring products, but such a Woolworths-style proposition is confusing and will not gain traction.

A better approach is to take a recognised market requirement and build a value proposition to address it drawing on relevant components from a broad product portfolio. This is what Novell is doing with its Intelligent Workload Management initiative. IWM aims to address the problem of securely managing workloads across dynamic IT infrastructure (think virtualisation and cloud computing). It requires elements of IAM, CMDB, measurement and monitoring. Identify with an emerging category well enough and perhaps Novell can be the thought leader, as it is attempting with the web site http://www.intelligentworkloadmanagement.com and, if that works, even market leader in the long term.

However, Novell should not lose sight of where its revenue is coming from right now. At the end of the day, there is nothing wrong in being number two or three in a market if you serve it well and address niche requirements. A siloed approach focused on a variety of core businesses, doing a good job in each, providing the products and expertise that buyers want and keeping the leaders on their toes, remains a viable approach for any vendor with a mixed bag of products—even if they are not the market leader in any one area.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Bob Tarzey (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: David Tebbutt Posted: 6th March 2010 Copyright © 2010

In the days of black screens and green type, the arrival of colour was somewhat puzzling. If computers had got us so far without colour, who'd want it? Everyone, it seems.

Then came windows, icons, mice and pointers. Again, we were all happy with what we had. Why rewrite everything for some gimmicky whizzbang interface? As soon as you used an Apple Mac, you knew the answer. Ordinary people were suddenly able to do extraordinary things. But it wasn't until 11 years later when Microsoft finally got its act together with Windows 95, that this interface started to become more or less ubiquitous.

And there we've stalled for 26 or 15 years, depending whether you're a Mac or a PC fan. It works. Who wants more? Well, since the time the Macintosh came out, inventors have toiled in labs to bring us a more natural, direct, interface based on fingers, hands and, in the case of horizontal displays, objects placed on the screen. In recent years pioneering companies like Perceptive Pixel, Apple and Microsoft have been selling multi-touch surface devices.

In the abstract, it all sounds jolly fine (apart from the potential for the unselfish sharing of germs). You can access, open, expand, move, rotate and contract information artefacts right there on the screen. They could be images or documents inside the computer. Some of the systems can even interact with other things lying on the screen's surface. The external artefacts might be coded underneath so the system knows what to do with them or they could be simple things like business cards or other documents, which can be scanned. In one case, a library in Delft would whizz up pictorial information about your post code as it read your library card (video here). The Microsoft Surface can recognise and communicate with a suitably enabled mobile phone. It can show the contents of your mobile phone in a notebook. Just slide items to and from the on-screen notebook, in order to update the phone contents.

You could throw a keyboard up or, indeed, a facsimile of any kind of device but the main potential at the moment seems to be exploration, manipulation and mark-up. Fingers are better at some things but certainly not everything. However, if your organisation needs to surface information to any audience, regardless of their computer skills or application knowledge, then this might be a better way to do it than the usual single touch, keyboard or mouse controls.

The Hard Rock Café in Las Vegas has a number of Microsoft Surface tables through which visitors can browse a growing part of the company's collection of rock memorabilia. The National Library of Ireland uses the same product to show rare books and manuscripts which would otherwise be kept from public view due to their fragility or value. The US military uses Perceptive Pixel's huge displays for God-knows-what but you can bet that some of it involves 3-D terrain, flying things and weapons. Then Apple, of course, has made the iPhone exceedingly sexy with its own gestural controls.

While the technolgy and the functions are intriguing and seductive, the question is whether they give sufficient advantage over what's being used today. They cannot replace the present range of control devices except in special application-specific situations. Just as mice and pointers didn't replace keyboards, nor will multi-touch replace current devices. They may complement them though, especially as they become part of the repertoire of the everyday laptop or PC.

Whenever new technologies come along, it's quite often the user department that takes them on board, side-stepping IT if possible. We saw it with PCs and spreadsheets. We saw it again with desktop publishing. And again with mobile phones and PDAs. But, eventually, either the users or the organisation realise that the greater benefit comes from integration. IT represents the great archive in the sky to which and from which intellectual artefacts can be stored and retrieved. And, once IT is involved, more things become possible; using the mobile phone as a terminal, access to and re-use of materials produced elsewhere in the company and, in the case of multi-touch, delivering the contents of information stores to the devices. Museums and libraries are, perhaps, obvious examples but some users would value a natural way to get at and drill into, say, statistical information by geography or find and explore whatever today's equivalent of a blueprint is.

Right now, you might see these multi-touch surface devices as a bit of a curiosity but, just as the mouse (first publicly demonstrated in 1968) moved into the mainstream eventually, so these things may become important to you and your organisation.

If you're interested, a great place to mug up on the background is Bill Buxton's Multi-Touch overview.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact David Tebbutt (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dr Fern Halper, Partner, Hurwitz & Associates Posted: 5th March 2010 Copyright Hurwitz & Associates © 2010

I just got back from the SAS analyst event that was held in Steamboat Springs, Colorado. It was a great meeting. Here are some of the themes I heard over the few days I was there:

SAS is a unique place to work.
Consider the following: SAS revenue per employee is somewhat lower than the software industry average because everyone is on the payroll. That's right. Everyone from the grounds keepers to the health clinic professionals to those involved in advertising are on the SAS payroll. The company treats its employees very well, providing fitness facilities and on-site day care (also on the payroll). You don't even have to buy your own coffee or soda! The company has found that these kinds of perks have a positive impact. SAS announced no layoffs in 2009 and this further increased morale and productivity. The company actually saw increased profits in 2009. Executives from SAS also made the point that even thought they might have their own advertising, etc. they do not want to be insular. The company knows it needs new blood and new ideas. On that note, check out the next two themes:

Innovation is very important to SAS.
Here are some examples:

• Dr. Goodnight gave his presentation using the latest version of the SAS BI dashboard, which looked pretty slick.
• SAS has recently introduced some very innovative products and the trend will continue. One example is its social network analysis product that has been doing very well in the market. The product analyzes social networks and can, for example, uncover groups of people working together to commit fraud. This product was able to find $32M in welfare fraud in several weeks.
• SAS continues to enhance its UI, which it has been beat up about in the past. We also got pre-briefed on some new product announcements that I can't talk about yet, but other analysts did tweet about them at the conference. There were a lot of tweets at this conference and they were analyzed in real time.

The partnership with Accenture is a meaningful one.
SAS execs stated that, although they may not have that many partnerships, they try to make the ones they have very real. While, on the surface, the recent announcement regarding the Accenture SAS Analytics Group might seem like a 'me too' after IBM BAO, it is actually different. Accenture's goal is transform the front office, like ERP/CRM was transformed. It wants to, "Take the what and turn it into so what and now what?" It views analytics not simply as a technology, but a new competitive management science that enables agility. It obviously won't market it that way as the company takes a business focus. Look for the Accenture SAS Analytics Group to put out services such as Churn management as a service, Risk and fraud detection as a service. They will operationalize this as part of a business process.

The Cloud!
SAS has a number of SaaS offerings in the market and will, no doubt, introduce more. What I found refreshing was that SAS takes issues around SaaS very seriously. You'd expect a data company to be concerned about their customers' data and they are.

Best line of the conference
SAS is putting a lot of effort into making its products easier to use and that is a good thing. There are ways to get analysis to those people who aren't that analytical. In a discussion about the skill level required for people to use advanced analytics, however, one customer commented, "Just because you can turn on a stove doesnt mean you know how to cook". More on this in another post.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dr Fern Halper (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 4th March 2010 Copyright Interarbor Solutions © 2010

If you want a realistic view of cloud computing adoption—along with an understanding of what motivates IT executives to invest the cloud, what concerns remain, and what initiatives are planned—you can’t limit your frame to a single industry. The full picture only becomes clear through a cross section of research, manufacturing, government and education fields.

That’s the approach Platform Computing took at a recent supercomputing conference. The company late last year surveyed 95 IT executives across a number of fields to offer insight into how organizations are experimenting with cloud computing and how they view the value of private clouds. [Disclosure: Platform Computing is a sponsor of BriefingsDirect podcasts.]

The results: Nearly 85 percent intend to keep their cloud initiatives within their own firewall.

“When deploying a private cloud, organizations will need a management framework that can leverage existing hardware and software investments and support key business applications,” says Peter Nichol, general manager of the HPC Business Unit at Platform Computing. “This survey reaffirms the benefits that private clouds offer—a more flexible and dynamic infrastructure with greater levels of self-service and enterprise application support.”

Most organizations surveyed are experimenting with cloud computing—and experimenting is the key word. Eighty-two percent don’t foresee cloud bursting initiatives any time soon. This suggests an appreciation for private cloud management platforms that are independent of location and ownership, and can provide the needed security in a world of strict regulations around transparency and privacy.

Security is chief concern
Forty-nine percent cite security as a chief concern with cloud computing. Another 31 percent pointed to the complexity of managing clouds, while only 15 percent said cost was an issue. Indeed, security concerns are a force driving many IT execs toward private rather than public clouds. Forty-five percent of organizations considering establishing private clouds as they experiment with ways to improve efficiency, increase their resource pool and build a more flexible infrastructure.

. . . The adoption of cloud computing should follow a sequence of evolutionary steps rather than an overnight revolution.

There seems to be some naïveté over the cloud. Nearly three-quarters of those surveyed don’t expect their IT organization infrastructure to change in the face of cloud computing. But that is not a realistic expectation. The move to cloud computing is an evolutionary one and IT organizations must themselves evolve to meet the demands of the organizations and their users. Ultimately, a willingness to evolve begins with an appreciation of the cloud’s value.

“Cloud computing has provided the impetus for IT to make a much needed shift, but many in the industry are still struggling to understand the value of the cloud,” says Randy Clark, chief marketing officer at Platform Computing. “As organizations continue to experiment with cloud to move toward better efficiency and cost-savings, it is best to bear in mind that to ensure success, the adoption of cloud computing should follow a sequence of evolutionary steps rather than an overnight revolution.”

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 4th March 2010 Copyright Bloor Research © 2010

This article will explore how database activity monitoring deals with other types of data attacks.

Temporary Accounts
Temporary accounts have a perfectly legitimate part to play in any database system as they can provide flexibility for the DBA wanting to create short term access for contract workers or for managing some database activities. Unfortunately they are also a vector for hackers, especially if the administration account can be compromised and the temporary account assigned roles and privileges that could result in data being stolen.

By setting up a temporary account a hacker can start to create a better level of anonymity and bury their true identity at the end of a long chain of other accounts designed to throw investigators off their path. A database activity monitoring solution will raise an alert if an unusual temporary account or set of accounts has been create that do not fit into the normal pattern of behaviour for an application.

Sensitive Data
Not all data in a database is sensitive. For example you may have a table that contains a list of the products you sell on your website, all of which is public. On the other hand you may have a table that contains customer discount rates, which is highly confidential and could seriously compromise your business relationships if it was made public. Then of course we have payroll and salary data, often deemed to be the most sensitive information and organisation keeps.

During the setup phase for the database monitoring system the DBA would normally work alongside the security team and the business to categorise the data being held and determine what data is the most sensitive. It will then need to be decided what database actions are permitted on this data. For example it may be perfectly acceptable for a payroll clerk to SELECT data from the salary table for the monthly cheque run but it is completely unacceptable for them to be able to UPDATE the same data and give themselves a pay rise. Once finalised, the database activity monitoring tool will see what activities are being attempted against the various sensitive data sets and raise warnings if necessary.

Out of Course Data Access
Out of course data access is when a user attempts to access data by bypassing their usual client application. For example if an organisation has created a client server application that uses a front end Visual Basic screen to retrieve data they may decide to try and connect to the backend database using Microsoft Access or Excel. If the user was able to connect using a tool such as MS Access, the simplicity of the tool will enable most users to download huge amounts of data by pointing and clicking. The database activity monitoring tool can be configured to audit connections from clients other than the approved Visual Basic tool and raise an alert for any out of course connection attempts.

Unusual Activity
This is often a catchall for activities that fall outside the norm for a particular database. Typical unusual activities include users accessing more data than normalfor example selecting all the data from the customer table rather than just those for their sales region. It could be someone accessing the data out of hours, maybe at the weekend and maybe from home. What is unusual for one database may be usual for another, so this will need a higher degree of customisation and learning for the activity monitoring solution to prevent legitimate users getting annoyed, but it can be a powerful data protection tool.

More obscure activities should also be tracked; for example users trying to start or stop services, trying to run extended stored procedures or meddling with database backups. Any of these could be legitimate but at least you will be alerted and will have the ability to investigate what is happening.

Connection Pooling
Connection pooling has been implemented by a number of vendors of enterprise software as a way of optimising the performance of a database. For example a system may only have one shared connection under a single database account that is used for updating customer data by all users. Of course the users don't know they are using this single accountthis is a process that happens underneath the covers of the application. From an information security perspective this presents us with a problem as it is more complicated to work out who the actual user was for a specific transaction if the connection was pooled. Some database activity monitoring products are able to see if connection pooling has been implemented and then track transactions back to the client application and discover who the actual user was for each discrete transaction, a feature which is very useful with such pooled connection implementations.

The next article will cover compliance issues and the way in which a database activity monitoring solution can be architectured for best effect.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Laurie McCabe, Partner, Hurwitz & Associates Posted: 3rd March 2010 Copyright Hurwitz & Associates © 2010

In a bold move to get traditional value-added resellers (VARs) off the SaaS fence, NetSuite announced its new Solution Provider (SP) 100 Program, which gives business application VARs 100% margin on the first year of license subscriptions they sell. The program requires a 2-year minimum license commitment from the customer and, after the first year, NetSuite pays VARs 10% margin on recurring annual license fees. Prior to this program, NetSuite had offered VARs 30% of annual license sales.

NetSuite's SP 100 Program targets established mid-market and enterprise ERP and CRM VARs and consultants, including VARs selling Microsoft Dynamics, SAP, Sage, Epicor, Deltek, and others. The program is not exclusive—VARs can continue to sell their packaged business software offerings as well. NetSuite is also extending the program to its current solution provider partners, and it includes all other SP program perks, including sales and technical training, sales cycle assistance, and marketing support.

Background
Since the model got off the ground over 10 years ago, SaaS vendors have argued that SaaS can open the door for VARs to create a recurring revenue stream, and free them up from low margin IT service chores to focus on generating higher value business.

But the case has evidently not been strong enough to entice the masses, for a few key reasons. First, the recurring revenue model is radically different to the conventional business applications model, where VARs earn a large upfront commission for selling a business solution, hardware and infrastructure software. Second, VARs have baulked at not being able to generate income from services necessary to deploy and maintain business applications on customer premises. Third, whether real or perceived, many VARs don't trust SaaS vendors. Deep down, they think that after they make the sale, SaaS vendors will take control of the account and soon disintermediate them entirely.

Quick Take
NetSuite's SP 100 Program supplies VARs with the big upfront payment that they are accustomed to. NetSuite's own side-by-side VAR revenue comparison to Microsoft Dynamics favors NetSuite of course, but VARs can try it and do their own math to see how it proves out without having to give up selling competitive packaged software. It's an opportunity to get up to speed on SaaS, the cloud and recurring revenue models and develop their business consulting skills.

As important, it comes at a time when the SaaS model has proved its maturity and staying power. Many VARs have lost deals to a SaaS vendor, and many customers are trying to avoid big upfront capital outlays. While some VARs will remain skittish, distrustful, or even just lethargic about adding a SaaS solution to their business management portfolio, I think NetSuite's SP 100 will be big wake-up call for many VARs.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Laurie McCabe (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 3rd March 2010 Copyright Interarbor Solutions © 2010

Security. It's one of the major issues that keeps cloud computing from working its way deeper and more quickly into the enterprise IT mainstream.

But what are the potential threats around using cloud services? How can companies make sure business processes and data remain secured in the cloud? And how can CIOs accurately assess the risks and benefits of cloud adoption strategies?

Hewlett-Packard (HP) and the Cloud Security Alliance (CSA) answer these and other questions in a new research report entitled, "Top Threats to Cloud Computing Report."

The report, which was highlighted during the Cloud Security Summit at the RSA conference this week, taps the knowledge of information security experts at 29 enterprises, solutions providers and consulting firms that deal with demanding and complex cloud environments. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Mastering next-gen IT
As Cloud Security Alliance Founder Jim Reavis sees it, cloud services are the next generation of IT that enterprises must master—and it's imperative that companies understand and mitigate security threats that accompany the cloud.

"The objective of this report was to not only identify those threats which are most germane to IT organizations but also help organizations understand how to proactively protect themselves," Reavis said. "This is the first deliverable in our cloud threat research initiative, which will feature regular updates to reflect participation from a greater number of experts and to keep pace with the dynamic nature of new threats."

Cloud computing abuse
The Top Threats to Cloud Computing Report shines a light on vulnerabilities that threaten to hinder cloud service offerings from reaching their full potential. HP and the Cloud Security Alliance warn companies to be aware of the abuse and nefarious use of cloud computing. The report specifically points to the Zeus botnet and InfoStealing Trojan horses as a prime examples of malicious software that has compromised sensitive private resources in cloud environments.

Cloud services are the next generation of IT that enterprises must master—and it's imperative that companies understand and mitigate security threats that accompany the cloud.

Beyond malicious software, the report pegs sites that rely on multiple application programming interfaces (APIs) as typically representing the weakest security link. That's because one insecure API can impact a larger set of members using the evolving social Web, which presents data from disparate sources.

Rounding out the list of common cloud threats covered in the report are malicious insiders, shared technology vulnerabilities, data loss and leakage and account/service and traffic hijacking.

The RSA-debuted full report is available on the CSA Web site.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Clive Longbottom, Head of Research, Quocirca Posted: 2nd March 2010 Copyright Quocirca © 2010

Quocirca has completed the second cycle of research and analysis for Oracle around enterprise performance management (EPM), and the headline results show a massive improvement across the six sub-indices and the overall EPM index. Surely, then, this is good news?

Underneath the headline figures lay various findings that show that while awareness of how EPM can help an organisation has grown, existing technical systems are often ill-suited to meeting the business process requirements of an organisation, while the wish to invest in new systems has shrunk as recessionary budgets remain in force.

Also, the findings show that while respondents understand the need for better processes in each area, there is still a lack of overall belief that these processes need to be linked to gain the maximum benefit from an EPM approach.

The research looked at six different areas; stakeholder environment, market model, business model, business plan, business operations and business results. The stakeholder environment sub-index, which looks at how inputs from and the needs of customers, suppliers, shareholders and legal bodies were dealt with by those involved in the overall EPM financial processes of an organisation. As with the first cycle of the research (carried out in February 2009), this sub-index resulted in the lowest showing overall. Although the majority of respondents felt that they had consistent and repeatable processes in place to engage with stakeholders, far fewer felt that key stakeholders had a true and transparent view of the corporate strategy. Either the process of engagement is flawed, or the messages being passed through the process are poor - either way, this points to a lot of work needed to make the overall process workable.

However, at the other end of the process, the business results sub-index resulted in the highest performance overall. It is therefore tempting to look at the results and think, Hang on - if all the processes leading up to the business results are sub-optimal, why is the business result itself so strong? Good point, but one that is best looked at against a real world vertical example.

In the world of finance, we see that the business results up until 2007 were excellent: it seemed that the house of cards could continue to be built up and up without any issues. Then, sub-prime hit and the cards came tumbling down. Those institutions that were hardest hit suddenly realised that the processes that led up to the final results were flawed: stakeholders were not involved in key decision making, and strategies had not been well communicated. Chasms between various areas within the institutions themselves led to processes being broken as information was not treated transparently or consistently as it traversed from one part of the organisation to another. Internal risks were not evaluated properly, and employees were compensated more on immediate than on long-term results, leading to higher risk taking that was uncontrolled.

In effect, Quocirca believes that the EPM research is still reflecting this. Many organisations are still profitable despite poor internal processes. If they were to look at how best to apply fully cohesive and coherent EPM processes, not only could savings be made across the board, but new opportunities could be opened up through greater flexibility, as could the capacity to play the key what ifs? around new product or service offerings. The good times of the early to mid 2000s allowed many process issues to remain hidden, whereas the past two years have rapidly uncovered major process failings.

It is, as yet, not apparent as to whether the recession is over and that the world will now move back to mid-term growth. Many commentators believe that a second wave of recession will hit many countries. With effective EPM in place, an organisation will be far better placed to survive a second recession - and to do well once out the other side. Although full EPM will involve investment in new technology to underpin the processes, it will be money well spent.

After all, what is the point in saving money and going out of business?

The Quocirca report on the Oracle EPM index, Enterprise Performance Management: Cycle II, is available for free download here.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Clive Longbottom (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 2nd March 2010 Copyright Interarbor Solutions © 2010

The latest BriefingsDirect podcast discussion comes in conjunction with The Open Group’s Enterprise Architecture Practitioners Conference held earlier this month in Seattle.

We assembled a panel to examine service oriented architecture (SOA) and cloud computing—the relationships, the inter-reliance and the realities. Three years ago, the IT transformation poster child was SOA, and now we're well into the hype curve around cloud computing, but has one actually given way to the other? Are they linear in their relationship, or perhaps mutually dependent in some ways, and to what degree?

We’ll explore now whether SOA has found new value and relevance as a foundation and perhaps catalyst for cloud computing, especially for so-called private clouds. And, we'll see how the emergence of SOA and cloud may be happening in different places inside of enterprises. Shouldn’t one hand get to quickly know what the other is up to and perhaps even work together?

Here with us now, however, to plumb the depths of how SOA and cloud computing do or don’t come together, are Dr. Chris Harding, director of the SOA Work Group at The Open Group; Stephen G. Bennett, Senior Enterprise Architect at Oracle, and Peter Coffee, Director of Platform Search for Salesforce.com. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:

Harding: Five years ago, when we started getting into SOA, there was a huge amount of excitement and a great deal of buzz about it. Now, we can see that the hype cycle has run its course, but we're still seeing a great deal of technical interest in SOA and we're also seeing that companies are using it and are increasing their use of it. So, there is a steady uptake in the use of SOA, although the excitement about it has died down.

It’s very interesting that service orientation is very much a business concept, and SOA has been about the application of that business concept to the technology. Cloud computing, on the other hand, is very much a technical concept. It’s about what you can do with technology over the Internet.

It is a technical concept, but it has had a really big impact on the business structure. So you can see them as complementary. SOA has been the application of business principles into the technology. Cloud is a technical concept, which has had a huge impact on the business. So, yes, there probably are different parts of the organizations looking at cloud and looking at SOA, but there is a big dynamic that says they should be working together on both of them.

Coffee: I've been covering SOA for a long time. I'd say the people who adopted SOA in the previous decade got considerable upside, but those who did not didn’t really suffer any penalty for not doing so.

In the situation we're in now, where the economics of cloud computing are becoming quite compelling, the downside of not having a SOA is becoming quite apparent. If you don’t have a service environment, then your ability to extend your current assets and integrate them with cloud services is going to be somewhat hampered.

So, people are realizing now that the wait-and-see option is more perilous than it used to be. This is accelerating the actual adoption of what we would call SOA, except that’s no longer the label du jour.

It seems to me that SOA very quickly became a label of products that vendors wanted to sell. So, you saw a lot of things like enterprise service bus (ESB) products and so on.

It became dangerously easy to think that you were doing SOA, if you were buying the tools and failing to appreciate how much of a cultural and management achievement it was to get people to think of themselves not as owners of and the gatekeepers to an IT asset, but instead being publishers of and supporters of a service to other parts of the business.

It’s absolutely critical to understand that you can view SOA as simply a way of integrating the stuff you have, or you can move to the next level and start to think of it as the way you do your business. The way your business units interact with and support each other with the technology is just the enabler for that.

The same is true of the cloud. It's possible to take the existing IT model of isolated applications, each with their own data stores, and replicate that model in the cloud with elastic scalability of capacity. That would be the level of the cloud industry that’s typically called infrastructure as a service (IaaS).

Or, it's possible to use the cloud as a much more interesting and fluid medium for interaction among much more granular and business-oriented services at the level that’s traditionally been called in the industry either platform as a service (PaaS) or software as a service (SaaS). It depends on the level at which you choose to consume other people’s application work, instead of doing new application development yourself.

It’s possible to do SOA without the cloud. It’s possible to do better SOA with it. It is also possible to do an isolated silo-oriented architecture locally and also to do that in a cloud environment. Neither one necessarily implies or impels the other.

Bennett: The majority of large enterprises today are doing SOA in one fashion or another at different levels of maturity, whether that’s from the quite immature approach of seeing it as a pure integration play all the way up to seeing it more as a business agility kind of play.

So, it's becoming a norm and, therefore, we don’t need to keep hyping it or pushing it. We need to use the characteristics it offers with other supporting technology strategies such as cloud.

I actually see recession as an opportunity within IT, because it gives you opportunity to reset thinking and reset IT's approach to actually delivering IT to the business.

It's a combination of technologies that are finally ready for prime time, and an ecosystem that’s ready to support those technologies well.

Coffee: The economics of being able to have elastically scalable capacity to be able to handle peak loads without needing to own the peak capacity and wind up with very low utilization rates on your capacity are becoming so compelling that people are asking how they're going to take advantage of this opportunity of this cloud environment.

It's a combination of technologies that are finally ready for prime time, and an ecosystem that’s ready to support those technologies well—providers of services and providers of expert assistance in using those services.

That’s a very important enabling ware, when your major system integration firms begin fully to understand how they can incorporate cloud services into the portfolio of technologies that they make available to their customers. When you put that all together, the downside of not moving to an SOA becomes an embarrassing lack of ability to take advantages of these incredible economies.

... The combination of SOA, which makes your various business units able to cooperate more effectively, with cloud environments, which allow you to handle very "bursty" workloads and conduct very cost-effective pilot projects and scale the ones that work very rapidly, increase the ROI of IT spending.

The IT budget, as a line item, is not conspicuously bigger. In fact, it may actually shrink, because the IT department now is a composer and integrator of stuff that may now be getting done with the operating budget by personnel, who are on the payroll as members of a business unit, instead of members of an IT organization.

Bennett: What people are talking about is the opportunity to redirect costs to area such as business architecture, and business architecture is part of enterprise architecture (EA). That's not purely IT focused, but the wider concern—investing stuff like business capability maps to understand exactly where I should utilize SOA and cloud with my organization—is going to be key.

This will, in turn, enable the consuming enterprises to concentrate on the things that they are particularly good at.

Harding: That certainly must be one of the factors that will enable cloud computing to make enterprises more efficient—the elasticity and the take-up effect. It also has a major effect on the risk that an enterprise needs to take on. But, there is a bigger factor, which is meant to drive down cost, and that is competition.

If you take service orientation and cloud in combination, you’re seeing the ability of people to buy services from different suppliers, for those suppliers to compete, and for those suppliers to concentrate on the services that they are particularly good at. This will, in turn, enable the consuming enterprises to concentrate on the things that they are particularly good at.

So, you don’t need to dissipate your efforts on running an inefficient IT department, which is not your core business. You can outsource that, get a specialist to do it much better, and concentrate on what you're good at. That is the real dynamic that will improve things economically.

Now, from an Open Group perspective, there is a danger that you may become locked into a particular supplier. Part of our role in promoting open systems is to push for the standards to be in place so that that doesn’t happen. Provided we can prevent that locking, it’s altogether a very healthy situation.

Coffee: The granularity of this marketplace is quite surprising to many people who haven’t looked at it closely. We see already people building applications, in which they have shopped the marketplace and found a cloud storage proposition from one provider, a cloud application development platform from another, social networking algorithms and facilities from yet a third provider and have built some really interesting strategic business solutions. It’s quite startling to many people to realize what a supermarket of services has already come into being.

Bennett: The combination of cloud and SOA obviously brings together kind of speed and modularity. Those basic principles are going to allow us to take evolutionary technologies and approaches and probably revolutionize the way that IT actually interacts with the business.

So, in terms of IT being siloed—"please develop and look after this application"—it’s going to be more a move toward collaboration of how we can actually deliver business solutions to the ever-changing business dynamics.

Coffee: Finally, we have an environment in which connectivity and real-time linkage and integration of data and function instead of being costly, brittle, and time-consuming are now nearly free, very resilient, and can be done almost more quickly than they can be described.

This means that people are going to be doing more challenging work and working more closely with business units instead of having their time consumed by arduous, necessary, but relatively low-value tests of infrastructure maintenance.

So the ROI will rise. The relevance to the business of IT will increase. The sophistication of the skills of the person who does IT for a living will be greater 10 years from now than it was 10 years ago or even today, but we’ll all be pretty happy with the results.

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: David Tebbutt Posted: 1st March 2010 Copyright © 2010

As if IT directors don't have enough on their plates, they're being sucked in to all sorts of new areas. Every enterprise is, or soon will be, an online publisher. Many will transition from a hierarchical mentality to a more collaborative one. And, linked to these changes, they'll find themselves taking a renewed interest in a previously mocked concept: knowledge management.

If you take these changes, together with another big one—pursuing a sustainability agenda—you can see that one bit of the business is slap bang in the middle of it all. Yes, the IT department. It will be expected to provide the underpinnings for all these initiatives, and more.

If IT directors and the like are not already welded at the hip to the rest of the board, then they soon will be. Depending, of course, on their willingness to support several disruptions to traditional working practices all at once.

It won't be easy, but plenty of people have gone before and have learnt many tough lessons. Many of them are on the speaker circuit, have written books or produced webinars. And, of course, if you're so minded, a wealth of signal is tucked away in the noise of the public social networks. Once you've found an expert or two that you resonate with, you will easily find your way into their communities.

One such expert is Raj Datta, the Bangalore-based CKO of IT services company MindTree, a multinational company with $269M turnover at the last count. He is a man who has lived and breathed the knowledge management dream and, in his company's eyes, this has led to much innovation (30 projects significantly impacted) and a provable 5 percent positive impact on profitability.

He was in the UK last week for the Henley KM Forum 10th anniversary conference. The key themes this year were: 'The impact of social networking on knowledge sharing'; 'The journey to more knowledgeable decision making' and 'Knowledge enabled project management'.

We met for lunch after the event and he shared a few insights. (If you want a deeper look at his story, see this article in Information World Review. If you do read it, please substitute 'spirituality' for 'religion'. Mea culpa.)

He enjoyed his visit to the summit, especially when hearing what the academics have to say. They are largely free of commercial constraints, so boundaries can be pushed. Datta sees part of his job as picking out promising ideas and figuring out how to implement them inside his own strictly commercial organisation.

He likes the idea of harmonising the 'real world' with the 'work world'. He tries to create a natural working habitat in which employees can connect freely, just as they do outside. This is done through both on-line and physical workspaces. But, for the moment at least, all the social networking is done within the organisation's own boundaries. In his eyes, this means that, "All the cross-connections are building capacity for the future." It may be old hat to you, but the thought is new to me.

Rather than have all like-minded people working together, MindTree deliberately seeks diversity in its recruitment and in its creation of 'wildstorming' groups. In general the balance of sex, nationality and rural/urban backgrounds will be considered. In the wildstorming sessions, business, technical, product and functional specialisations might be mixed to consider the problem at hand. This approach to diversity is totally pragmatic, unlike the 'politically correct' version that we have over here.

The company has resisted financial pressures to lay people off, because of the harm this would do to the secure family atmosphere. The staff are treasured as 'sensors' to the outside world as well as being valuable 'minds' in their own right.

Soon, after two years of debate, the board will be ready to invite customers and suppliers to participate—even more sensors, even more intelligence in the network. If this move adds just one percent to profitability, then its cost will be paid for in one year.

Datta points to Google and 3M as companies he admires. Someone at Henley suggested he add Finext to his list. They, like MindTree, are focused on satisfying employees and customers alike. And they give staff the elbow room they need to connect, experiment and innovate.

This approach is much more achievable in 'consensus' cultures as opposed to the 'factory model' or 'command and control' business cultures. But, we are seeing companies shifting their attitudes. A blend of the two is the most likely outcome.

For anyone thinking of making the sort of changes we've been talking about, Datta advises, "The best way to create change is for people not to know it's happening."

An interesting challenge for you.

Anyone out there care to share their experiences?

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact David Tebbutt (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 1st March 2010 Copyright Interarbor Solutions © 2010

In a move to tap into the small- to mid-sized business (SMB) data center market, Hewlett-Packard (HP) just rolled out a set of services aimed at helping smaller outfits drive the same IT efficiencies as larger enterprises.

The portfolio is designed to improve efficiency and increase IT budget flexibility, while mitigating risks and maximizing return on investment (ROI) from existing IT skills and assets. The services also target dealing with rapid change and the simplifying of management of multi-vendor environments. HP also launched procurement options for custom integration operations and improvement services. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

“Our new services are based on drivers that impact owners of small- to mid-sized data centers,” said Ian Jagger, worldwide marketing manager of Infrastructure and Operations for HP’s Technology Services Group. “These services help our customers deal with the challenge of managing IT complexity and sprawl, space and infrastructure limitations, and limited IT budgets and staff.”

Improving operational efficiency
Recognizing the SMB organizations' requirements around speed, efficiency and 24/7 resource accessibility with shared virtual IT services, HP is delivering four new services designed to help clients gain tighter environment-wide control and broader, deeper visibility into support-related functions.

HP Multivendor Support Services works to help clients increase service levels and reduce the complexity and costs of managing heterogeneous IT environments. By exercising global buying power among vendors and suppliers, HP said it can effectively lower the cost of support contracts.

These services are entirely differentiated because only licensed engineers can deliver these services and HP’s competitors don’t have licensed engineers.

“We have been offering multi-vendor support solutions to our customers,” says Dionne Morgan, worldwide solutions marketing manager for HP’s Technology Services group. “In addition to IBM and Dell servers, we also now support Sun servers and Sun Solaris 10 for HP ProLiant servers. And for HP Integrity servers we’re now supporting Novell, SUSE Linux and Microsoft Windows Server 2008.”

On the operational efficiency front, HP also announced HP Insight Remote Support to monitor a customer’s environment around the clock and provide remote diagnostics, troubleshooting and a support solution. HP added support for VMware virtual environments. Meanwhile, HP Active Chat offers real-time Web chat support for problem and the HP Data Center Training Symposium will move to help companies develop a custom training plan to increase the effectiveness of IT staff.

Increasing computing capacity
HP also announced value assessment services structured for data centers up to 5,000 square feet in size. The services work to help SMBs find ways to increase computing capacity and cut energy costs.

The new services include Basic Capacity Analysis for Smaller Footprints Assessment, Infrastructure Condition and Capacity Analysis for Smaller Footprints Assessment, and Energy Efficiency Analysis for Smaller Footprints Assessment.

“These services are entirely differentiated because only licensed engineers can deliver these services and HP’s competitors don’t have licensed engineers,” Jagger says. “Our competitors have to partner with specialist companies to deliver these services. We’re also restructuring these services to be sold by our channel partners.”

Offering flexible purchase options
Finally, HP promises to make it easier for SMBs to procure value services that will help them better manage limited resources and drive business value from their technology infrastructure through HP Units of Service and HP Proactive Select Services.

“We’ve taken the customized services available from our technical services portfolio and converted them into what we call Units of Service,” Jagger says. “A Unit of Service is a deliverable at a highly granular level. Any given custom service could be made up of multiple Units of Service.”

HP Proactive Select Services let clients move to a variable budget model, acquiring expert resources on-demand to address changing data center needs.

HP Units of Service gives SMBs access to value services from HP through channel partners that aim to maximize ROI and set the stage for business growth. For example, SMBs can tap into HP custom data center consulting services such as relocation, integration, operations and improvement.

HP Proactive Select Services let clients move to a variable budget model, acquiring expert resources on-demand to address changing data center needs. HP has included Server Firmware Update Installation Service, Technical Online Seminars, Virtual Tape Library Health Check and LeftHand SAN/iQ Update Service to its portfolio.

“With these services, companies can focus their IT staff on strategic IT investments that differentiate them in the marketplace,” Jagger says. “What you’re seeing here is more and more services brought to customers at a value level through the channel that allows them to focus where they can drive the greatest ROI from staff.”

The SMB IT services and support market is ripe for efficiency and lower total costs. And the SMB arena is also a prime user for upcoming cloud and hybrid-sourced services. So now everything as a service can go anywhere.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Dana Gardner, Principal Analyst, Interarbor Solutions Posted: 26th February 2010 Copyright Interarbor Solutions © 2010

In a move to enter the burgeoning SaaS-based IT management market, Citrix Online announced its acquisition of Menlo Park, Calif.-based Paglo Labs on Wednesday. The first fruits of the acquisition is an integrated web-based platform for monitoring, controlling and supporting IT infrastructure.

Dubbed GoToManage, the new service lets Citrix Online tap into the growing demand for software-as-a-service (Saas)-based IT management, a market Forrester Research predicts will reach $4 billion in 2013. Citrix Online is positioning the latest addition to its online services portfolio as an affordable alternative to premise-based software. [Disclosure: Paglo is a sponsor of BriefingsDirect podcasts. Learn more about Paglo's offerings and value.]

I expect that as more enterprises experiment and adopt more mixed-hosted services—including cloud, SaaS, IaaS, and outsourced ecosystems solutions—that web-based management capabilities will become a requirement. In order to manage across boundaries, you need management reach that has mastered those boundaries. On-premises and traditional IT management is clearly not there yet.

Elizabeth Cholawsky, vice president of Products and Services at Citrix Online, explains the reasoning behind the acquisition: “Our customers increasingly tell us they are interested in adding IT management services to our remote support capabilities. With the growing acceptance of SaaS and the increasing use of IT services in small- and medium-sized businesses, we decided IT management reinforced our remote support strategy.”

The Paglo puzzle piece
According to IDC, Citrix Online was the remote support market leader in 2008 with a 34.7 percent global share via its GoToAssist services. IDC also pegs Citrix Online as the third largest SaaS vendor in the world based on 2007 revenue, but Citrix Online needed Paglo-like log analysis technology in order to offer its customers the next puzzle piece in its full SaaS picture.

Paglo has made a name for itself providing SaaS-based IT search and management services. In short, Paglo helps companies harness and analyze the information explosion coming from all their computer, server, network and log data. Paglo helps companies improve operating efficiencies, gain a clearer understanding of true IT costs and meet compliance requirements.

Now, Paglo serves as the foundation for GoToManage. GoToManage creates an IT "system of record" to give businesses with the ability to discover and identify all network devices, monitor critical servers and applications in real-time, manage network usage, and track configuration changes. Like other Citrix Online products, GoToManage can be accessed from anywhere, and doesn’t require costly server infrastructure.

A seamless transition?
With GoToManage, Citrix Online is once again disrupting the traditional IT model. Brian de Haff, CEO of Paglo, expects a seamless integration for Paglo customers and GoToAssist customers that tap into the new service. With behind-the-scenes integration completed, customers can click on a link and instantly access GoToManage. De Haff also expects Paglo customers to adopt GoToAssist and use the two services in tandem.

Bringing these technologies together is a terrific win for the customers of both companies.

“When we look across the Paglo customer base, the integration of monitoring with remote support is by far the number one requested feature that customers are asking for,” de Haff says. “So bringing these technologies together is a terrific win for the customers of both companies.”

Cholawsky declined to comment whether Citrix Online will make additional acquisitions to add to its portfolio, which also includes GoToMyPC, GoToMeeting, GoToAssist, GoToWebinar, GoToTraining and GoView. What she did say is that Citrix Online is witnessing a large growth spurt, which she expects to continue.

“We’re constantly looking at partners and acquisitions,” Cholawsky says. “With the venture capital investments in smaller companies with great technologies over the past couple of years, acquisitions are a terrific way to grow our company. But whether we develop more organically or go out and partner closely or do more acquisitions, we’ll be investing heavily in the SaaS market.”

Financial terms of the Paglo acquisition were not disclosed.

BriefingsDirect contributor Jennifer LeClaire provided editorial assistance and research on this post. She can be reached at http://www.linkedin.com/in/jleclaire and http://www.jenniferleclaire.com.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Dana Gardner (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Nigel Stanley, Practice Leader - IT Security, Bloor Research Posted: 26th February 2010 Copyright Bloor Research © 2010

If you think through the web sites you visit on a daily basis the chances are that you will need to login to verify who you are. In most cases your username would be stored in a relational database along with all the other registered users on that web site. Hopefully your password will be encrypted and not stored in plain text.

Unfortunately there are gaping holes in the security of some web sites that are being aggressively exploited by a form of hacker attack called SQL Injection.

Even more worrying is that this attack can be carried out against fully patched databases. It is not a problem with patches, more an issue with the way databases work and how a system has been designed.

This attack can be made against any website page that contains data from a database including search pages, feedback forms and customer comment forms. The types of database being used to run web sites include products such as MySQL, SQL Server and Oracle and all of these can be vulnerable to attack. SQL injection is not only specific to SQL Server!

In a typical database used to manage website logins a table will be used to store user's details. This would probably have at least two columnsone for the username and one for the password. The table would probably be called users or something very similar.

When a user submits their details on the website the database will parse the username and password and convert it into a string of SQL to send to the database, so the database engine receives a line of SQL similar to this:

SELECT * FROM users WHERE username = 'fredsmith' AND password = 'userspassword'

This is a pretty standard SQL statement and would look more or less the same whichever database you were using to store the user's data.

Hackers are interested in SQL injection attacks as they can manipulate the database by sending it some duff data. Instead of giving a valid username they could type something like this:

SELECT * FROM users WHERE username = ' ' ' AND password = ' '

The hacker has supplied a single quote character as the username and a blank as the password. The database, being well behaved, would see this query and decide to create an error message. On seeing this error message the hacker will then start to dig around a bit more, as the error messages returned from the database will start to become increasingly more helpful, and start to point out the structure of the tables in the database. With some careful digging an experienced hacker could quite quickly compromise a vulnerable database.

In the next case we can start to fool the database further by adding in other strings to the username. For example if we type in or email='345 as our username it will be resolved by the query parser as:

SELECT * FROM users
WHERE username = ' ' or email='345  ' AND password = ' '

At this point the database may give an error if there is no such column in the users database as email. On the other hand it may not give an error message suggesting that there is a column called email after all. All we need to do then is type in an email address for a user. As most organisations have a standard email address structure it is very easy to get an employee name and then use that as your user name in the SQL injection attack.

As you can see it is scarily easy to build up a picture of a database structure based on some simple fooling of the user login screen and some intelligent guesses as to the likely structure of a database.

The good news is that it is possible to protect a database from SQL injection attacks.

Common measures include filtering out single quotes, double quotes, slash, backslash, semi colon and extended characters from user input strings and cookie values and parameters from a URL. In addition numeric values can be converted into integers before passing to the database and extended stored procedures can be deleted.

On the other hand a database activity monitoring solution will normally provide you with protection against web applications being manipulated. Once installed in a learning mode the database activity monitoring solution will start to understand what is "normal" activity for a specific application. This process of normalisation is where the intelligence of the system comes into play, especially as it needs to determine what is a normal parameterised query as opposed to one that has been submitted by a hacker - a process more involved than simply listing routine queries. Once up to speed the database activity monitoring application will then create an alert if unusual activity starts on the website, such as an attempted SQL Injection attack, and take appropriate action.

Good system design is vital to prevent SQL Injection attacks, but combining this with a database activity monitoring solution you will be even more assured that the solution will be secure.

The next article will cover other attacks that can be prevented using database activity monitoring.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Nigel Stanley (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon

By: Philip Howard, Research Director - Data Management, Bloor Research Posted: 26th February 2010 Copyright Bloor Research © 2010

Along with new releases from lots of data warehousing vendors, TDWI has also seen in the formal announcement of the DataFlux Data Management Platform which was previously known as the Unity project. As the codename suggests this sees the introduction of a unified data integration, data quality, master data management and data governance suite from DataFlux.

A bit of history might be in order. Traditionally, DataFlux has been a data quality (cleanse, profile and so on) vendor. It then introduced MDM. However, data integration was a part of the SAS (DataFlux's parent company) platform and, while SAS did have a development project for data federation, it never really got to grips with this. So the task involved in creating the Platform was to bring ETL and data integration into the DataFlux environment, resurrect the previous data federation development and integrate all of this together with data quality and MDM, all as a part of a single platform. Needless to say this has been a long job.

Indeed, DataFlux is to be commended on keeping to its development schedule. I first got a detailed briefing on Platform back last September and even then the announcement data was planned for this February. In fact the product has been in beta sites since November and it should be generally available during the second quarter.

At the same time, the Platform makes a clearer distinction between SAS and DataFlux as to who sells what. Previously, infrastructure such as data integration software was marketed by SAS but this position was confusing since the sales force is primarily concerned with sales of analytic applications such as Customer Intelligence or, more broadly, the SAS platform as a BI/analytic suite. SAS sales people will still be selling data integration either when the data integration software is embedded within a solution such as Customer Intelligence or in conjunction with the SAS 9 platform as an enabling technology.

This move towards being a data quality/integration/master data stack provider is an increasingly common story in this space. However, integration between the different elements of this stack is a big issue. Some major vendors are so far away from a coherent story about integration that they do not really merit the description of a stack supplier, even if they have all of the relevant components. So the fact that DataFlux now has a genuinely integrated suite should give it a significant advantage over its competitors.

In so far as features are concerned some interesting capabilities include identity resolution, a business glossary, business process and event-driven integration, and a focus on business/IT collaboration. However, more detail will have to wait until nearer the general availability date.

Useful Links:

• Post Comment | Read Comments
• Send Page Referral
• Contact Philip Howard (Private)
• Social Bookmarks: Delicious | Digg | Reddit | Facebook | StumbleUpon