Monday, October 8, 2012

Banking services provider BancVue leverages VMware server virtualization to generate cloud benefits and increased agility

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: VMware.

Server virtualization success quickly set the stage for private-cloud benefits for banking services provider, BancVue. And that cloud enablement then provided business agility to BancVue's community bank customers, enabling them to better compete against mega banks on such critical areas as customer service and end-user portals.

Learn here how BancVue creates the services that empower its customers to beat the giants in their field by better leveraging agile IT. Sunny Nair, Vice President of IT and Systems Operations at BancVue in Austin, Texas, discusses the journey with BriefingsDirect's Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: VMware is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:
Gardner: Many companies these days need to tackle the dual task of cutting costs, while also increasing agility and providing better services and response times to their constituents. How did you accomplish both?

Nair: The first thing we wanted to do was to abstract the applications and the operating system from the hardware so that a hardware failure wouldn’t bring down our systems. For that, of course, we went to virtualization. We experimented with various virtualization products. Out of those trials, vSphere was the best software for a heterogeneous environment like ours, where we had Windows and different flavors of Linux.

So we stuck with VMware, and that helped us abstract the hardware layer and our software layer, so we can move our operating systems and our virtual servers to different pieces of hardware, when there was a hardware issue on one server, enabling us to be more agile.

Instead of running just one server on one piece of hardware, we were able to run anywhere between 12 and 20 different servers. All servers weren’t utilized at 100 percent all the time. We were able to leverage the CPU to its full capacity and run many more servers. So we had, at a minimum, a 12x increase in our server capacity on each piece of hardware. That definitely did help our costs.
 Gardner: Tell us a little bit about BancVue.

Marketing expertise

Nair: BancVue is a financial services software and marketing company. We help community financial institutions compete with mega banks by providing them marketing expertise, software expertise, and data consultation expertise, and all those things require technology and software.

For many of our partners we provide the website that many people land on when they search for the website on the Internet. And we also provide the gateway to their online banking. So it's extremely important for the website to stay up and online.

In addition to that, we also provide rewards checking calculations, interest rate calculations, which customer is qualified for certain products, and so on. We are definitely a part of the ecosystem for the financial institution.

Gardner: Once you settled on your strategy for virtualizing your workloads and supporting your heterogeneity issues, how did that unfold?
It was a step-by-step approach of wading deeper into the virtualization world.

Nair: It was a step-by-step approach of wading deeper into the virtualization world. Our first step was just getting that abstraction layer that I was talking about by virtualizing our servers. Then, we looked at it and we said, "Well, from vSphere we can use vMotion and move our virtual servers around. And we can consolidate our storage on a storage-attached network (SAN)." That helped us disengage further from each piece of hardware.

Then, we can look at vCenter Operations Manager and predict when a server is going to run out of capacity. That was one of the areas where we started experimenting, and that proved very fruitful. That experiment was just earlier this year.

Once we did that, we downloaded some trial software with the help of VMware, which is one of the benefits that we found. We didn’t have to pay up immediately. We could see if it suited our needs first.

We used vCloud Director as a trial, and vShield and vCenter Orchestrator together. Once we put all those pieces together, we were able to get the true benefit of virtualization, which is being in a cloud where not only are you abstracted out, but you can also predict when your hardware is going to run out.

You can move to a different data center, if the need happens to be there and just run your server farm like a power utility would run their power station, building out the computing resources necessary for a user or a customer, and then shutting that off when it’s no longer necessary, all within the same hardware grid.

Fit for purpose

Gardner: I suppose it also gets to that point of cutting your total costs, when you can manage that as a fit-for-purpose exercise. It's the Goldilocks approach -- not too much, not too little. That’s especially important, when you have an ecosystem play, where you can’t always predict what your customers are going to be doing or demanding.

Nair: Yes, and that’s true internally as well as externally. We could have our development group ask for a bunch of servers all of a sudden to do some QA, and we've scripted out using the JavaScript system within vCloud Director and vCenter Orchestrator, building machines automatically. We could reduce our cost and our effort in putting those servers online, because we've automated them. Then the vCloud Director could tear them down automatically later.

One admin can do the work of at least three admins, once we’ve fully implemented the cloud, because the buildup and takedown are some of the most expensive portions of creating a server. You can automate that fully and not have to worry about the takedown, because you can say, "Three days from now please remove the server from the grid." Then, the admin can go do some other tasks.
We run Dell hardware, Dell servers, and Dell blades, and that's where we run production. In development, we also use Dell hardware, where we just use the R610s, 710s, and 810s, basically small machines, but with a fairly good amount of power. We can load up to 20 servers on in development, and as many as 12 in production. We run about 275 VMs today.
Cutting-edge technologies

Our production software is software as a service (SaaS), so a majority of that runs on IIS Web servers, with SQL backend. We also use some new cutting-edge database technologies, MongoDB, which also runs on a virtual system.

In addition, we have our infrastructure, like our customer relationship management (CRM), for which we use SugarCRM, and our ticketing system, which is JIRA, and our collaboration tool called Confluence, as well as our build system, which is TeamCity.

All run on VMs. Our infrastructure is powered on VMs, so it’s pretty important that it stays up. It’s one of the reasons that we think running it on a SAN, with the ability to use VMotion, does help our uptime.

A few different things attracted us to VMware. One of them was the fact that VMware fully supported different operating systems. A I said earlier, we run Red Hat, as well as Debian and Windows. When we ran those on different public and other proprietary virtualization products, we found different issues in each one.
We wanted to be able to pick up the phone, ask someone immediately, and get knowledgeable support.

For example, one of them had a time drift, where it didn’t keep time as well as it did on Windows. On Linux the time always seemed to drift a little bit. Apparently they hadn’t mastered that. Some free products did not have the ability to run Windows. They could run other versions of Linux. They couldn't run Windows properly at the time we were testing. But VMware, out of the box, could run all those operating systems.

The second thing was the support level. We didn’t want to be running our production system, put a bug out there in the community, and wait for someone to answer while we were down. We wanted to be able to pick up the phone, ask someone immediately, and get knowledgeable support. So support was a key ingredient in our selection.

We do have that option today when we have an issue. We can call up VMware and get that support. So it was support, compatibility, and the overall ecosystem. We knew that as we grew, we wouldn’t have to switch to another vendor to get cloud. We knew that we could go to VMware and get the cloud solution, as well as the virtualization solution, because virtualization was just the first step to us to become fully virtualized in a private cloud environment, with software, security like vShield and vCenter Operations Manager.

Virtualization lab

We actually had a little virtualization lab, where we practiced these things, because as the old adage says, practice does make perfect. The next thing was that we rolled it out in incremental steps to one product, and then eventually to a larger development group.

Gardner: Looking to the future, is there anything about mobile support or increasing the types of services that you're going to provide to your community banks, more along the lines of extended services that you provide and they brand? Do you think that this cloud environment is going to enable you to pursue that?

Nair: Yes, we’ve already started down that path. We have mobile support for the websites that we’ve created, and we’ve just implemented that earlier this year. Eventually, we plan to go into the online banking space and provide online banking for mobile devices. All that will be done in our cloud infrastructure. So yes, it’s here to stay.

We want to look further at the automation that the cloud products would give us, especially with security in vShield. It’s pretty interesting how we can have a virtual firewall with our VMs and look at the other mobile software that's available.
at 4:04 PM 0 comments

Friday, October 5, 2012

Internet of mobile and cloud era demands new kind of diverse and dynamic performance response, says Akamai GM Mike Afergan

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: Akamai Technologies.

New realities of delivering applications and content in the cloud and mobile era demand a more situational capability among and between enterprises, clouds, and the many popular end devices.

That is, major trends have conspired to make inadequate a one-size-fits-all approach to today’s complex network optimization and applications performance demands, says an executive from Akamai Technologies. Rather, more web experiences now need a real-time and dynamic response tailored and refined to the actual use and specifics of that user’s task.

To spotlight this new dynamic, cloud-to-mobile network reality -- and to evaluate ways to make all web experiences remain valued, appropriate, and performant -- BriefingsDirect welcomes Mike Afergan, Senior Vice President and General Manager of the Web Experience Business Unit at Akamai Technologies in Cambridge, Massachusetts. The discussion is moderated by Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: Akamai Technologies is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:
Gardner: Trends that seem to be spurring a different web, a need for a different type of response, given the way that people are using the web now. Let’s start at the top. What are the trends, and what do you mean by a "situational response" to ameliorating this new level of complexity?

Afergan: There are a number of trends, and I'll highlight a few. There’s clearly been a significant change, and you and I see it in our daily lives in how we, as consumers and employees, interact with this thing that we call the web.

Only a few years ago, most of us interacted with the web by sitting in front of the PC, typing on a keyboard and with a mouse. Today, a large chunk, if not a majority, of our interaction with the web is through different handheld devices or tablets, wi-fi, and through cellular connections. More and more it's through different modes of interaction.

For example, Siri is a leader in having us speak to the web and ask questions of the web verbally, as opposed to using a keyboard or some sort of touch-screen device. So there are some pretty significant trends in terms of how we interact as consumers or employees, particularly with devices and cellular connectivity.

Behind the scenes there’s a lot of other pretty significant changes. The way that websites have been developed has significantly changed. They're using technology such as JavaScript and CSS in a much heavier way than ever before.

 Third-party content

We're also seeing websites pull in a variety of content from third parties. Even though you're going to a website, and it looks like it’s a website of a given retailer, more often than not a large chunk of what you are seeing on that page is actually coming from their business partners or other people that they are working with, which gets integrated and displayed to you.

We're seeing cellular end-devices as a big trend on the experience side. We're seeing a number of things happen behind the scenes. What that means is that the web, as we thought about it even a few years ago, is a fundamentally different place today. Each of these interactions with the web is a different experience and these interactions are very different.

A user in Tokyo on a tablet, over a cellular connection, interacting with the website is a very different experience situation than me at my desk in Cambridge, in front of my PC right now with fixed connectivity. This is very different than me or you this evening driving home, with an iPhone or a handheld device, and maybe talking to it via Siri.

Each of these are very different experiences and each of these are what I call different situations. If we want to think about technology around performance and we want to think technology involving Internet, we have to think about these different situations and what technologies are going to be the most appropriate and most beneficial for these different situations.

Gardner: So we have more complexity on the delivery side, perhaps an ecosystem of different services coming together, and we also have more devices, and then of course different networks. And as people think about the cloud, I think the missing word in the cloud is the networks. There are many networks involved here.
There are some trends in which the more things change, the more they stay the same.

Maybe you could help us understand with these trends that delivery is a function of many different services, but also many different networks. How does that come together?

Afergan: There are some trends in which the more things change, the more they stay the same. The way the Internet works fundamentally hasn’t changed. The Internet is still, to use the terminology from over a decade ago, a network of networks. The way that data travels across the Internet behind the scenes is by moving through different networks. Each of those has different operating principles in terms of how they run, and there are always challenges moving from one network to another.

This is why, from the beginning, Akamai has always had a strategy of deploying our services and our servers as close to the users as possible. This is so that, when you and I make a request to a website, it doesn't have to traverse multiple networks, but rather is served from an Akamai location as close as possible to you.

And even when you have to go all the way across the Internet, for example, to buy something and submit a credit card, we're finding an intelligent path across the network. That's always been true at the physical network layer, but as you point out, this notion of networks is being expanded for content providers, websites, and retailers. Think about the set of companies that they work with and the other third parties that they work with almost as a network, as an ecosystem, that really comes together to develop and ultimately create the content that you and I see.

This notion of having these third party application programming interfaces (APIs) in the cloud is a very powerful trend for enterprises that are building websites, but it also obviously creates a number of challenges, both technical and operational, in making sure that you have a reliable, scalable, high-performing web experience for your users.

Big data

Gardner: I suppose another big trend nowadays -- we've mentioned mobile and cloud -- is this notion of analytics, big data, trying to be more intelligent, a word you used a moment ago. Is there something about the way that the web has evolved that's going to allow for more gathering of information about what's actually taking place on the networks and these end-devices, and then therefore be able to better serve up or produce value as time goes on?

Is the intelligence something that we can measure? Is there a data aspect to this that comes into that situational benefit path?

Afergan: One of the big challenges in this world of different web experience and situations is a greater demand for that type of information. Before, typically, a user was on a PC, using one of a few different types of browsers.

Now, with all these different situations, the need for that intelligence, the need to understand the situation that your user is in -- and potentially the changing situation that your user is in as they move from one location to another or one device to another -- is even more important than it was a few years ago.

That's going to be an important trend of understating the situations. Being able to adapt to them dynamically and efficiently is going to be an important trend for the industry in the next few years.
More and more employees are bringing their increasingly powerful devices into the office.

Gardner: What does this mean for enterprises? If I'm a company and I recognize that my employees are going to want more variety and more choice on their devices, I have to deliver apps out to those devices. I also have to recognize that they don't stop working at 5 pm. Therefore, our opportunity for delivering applications and data isn't time-based. It's more of a situational-based demand as well.

I don’t think enterprises want to start building out these network capabilities as well as data and intelligence gathering. So what does it mean for enterprises, as they move toward this different era of the web, and how should they think about responding?

Afergan: You nailed it with that question. Obviously one of the big trends in the industry right now, in the enterprise industry, bring your own device (BYOD). You and I and lots of people listening to this probably see it on a daily basis as we work.

In front of me right now are two different devices that I own and brought into the office today. Lots of my colleagues do the same. We see that as a big trend across our customer base.

More and more employees are bringing their increasingly powerful devices into the office. More and more employees want to be able to access their content in the office via those devices and at home or on the go, on a business trip, over those exact same devices, the way we've become accustomed to for our personal information and our personal experiences online.

Key trends

So the exact same trend that you think about being relevant for consumer-facing websites -- multiple devices, cellular connectivity -- are really key trends that are being driven from the outside-in, from the employees into the enterprise right now. It’s a challenge for enterprise to be able to keep up. It’s a challenge for enterprises to be able to adapt to those technologies, just like it is for consumer websites.

But for the enterprise, you need to make sure that you are mindful of security, authentication, and a variety of other principles, which are obviously important once you are dealing with enterprise data.

There’s tremendous opportunity. It is a great trend for enterprises, in terms of empowering their employees, empowering their partners, decreasing the total cost of ownership for the devices, and for their users to have access to the information. But it obviously presents some very significant trends and challenges. Number one, obviously, is keeping up with those trends, but number two, doing it in a way that’s both authenticated and secure at the same time.

Gardner: Based on a lot of the analyst reports that we're seeing, the adoption of cloud services and software-as-a-service (SaaS) services by enterprises is expected to grow quite rapidly in the coming years. If I'm an enterprise, whether I'm serving up data and applications to my employees, my business partners, and/or end consumers, it doesn’t seem to make sense to get cloud services, bring them into the enterprise, and then send them back out through a network to those people. It sounds like this is moving from a data center that I control type of a service into something that’s in the cloud itself as well.

So are we reading that correctly -- that even your bread and butter, Global 2000 enterprise has to start thinking about network services in this context of a situational web?
You're now talking about putting those applications into the cloud, so that those users can access them on any device, anywhere, anytime.

Afergan: Exactly. The good news is that most thoughtful enterprises are already doing that. It doesn’t make it easier overnight, but they're already having those conversations. You're exactly right. Once you recognize the fact that your employees, your partners are going to want to interact with these applications on their devices, wherever they may be, you pretty quickly realize that you can’t build out a dedicated network, a dedicated infrastructure, that’s going to service them in all the locations that they are going to need to be.

All of a sudden, you're now talking about putting those applications into the cloud, so that those users can access them on any device, anywhere, anytime. At that point in time, you're now building to a cloud architecture, which obviously brings a lot of promise and a lot of opportunity, but then some challenges associated with it.

Gardner: I'll just add one more point on the enterprise, because I track enterprise IT issues more specifically than the general web. IT service management, service level agreements (SLAs), governance policy and management via rules that can be repeatable are all very important to IT as well.

Is there something about a situational network optimization and web delivery that comes to play when it relates to governance policy and management vis-à-vis rules; I guess what you'd call service-delivery architecture?

 Situational needs

Afergan: That’s a great question, and I've had that conversation with several enterprises. To some degree, every enterprise is different and every application is somewhat different, which even makes the situational point you are making all the more true.

For some enterprises, the requirements they have around those applications are ubiquitous and those need to be held true independent of the situation. In other cases, you have certain requirements around certain applications that may be different if the employee is on premises, within your VPN, in your country, or out of the country. All of a sudden, those situations became all the more complicated.

As each of these enterprises that we have been working with think through the challenges that you just listed, it's very much a situational conversation. How do you build one architecture that allows you to adapt to those different situations?

Gardner: I think we have described the problem fairly well. It's understood. What do we start thinking about when it comes to solving this problem? How can we get a handle on these different types of traffic with complexity and variability on the delivery end, on the network end, and then on the receiving end, and somehow make it rational and something that could be a benefit to our business?

Afergan: It's obviously the challenge that we at Akamai spend a lot of time thinking about and working with our customers on. Obviously, there's no one, simple answer to all of that, but I'll offer a couple of different pieces.
For some enterprises, the requirements they have around those applications are ubiquitous and those need to be held true independent of the situation.

We believe it requires starting with a good overall, fundamentally sound architecture. That's an architecture that is globally distributed and gives you a platform where you don't have to -- to answer some of your earlier questions -- worry about some of the different networks along the way, and worry about some of the core, fundamental Internet challenges that really haven't changed since the mid-'90s in terms of reliability and performance of the core Internet.

But then it should allow you to build on top of that for some of the cloud-based and situational-based challenges that you have today. That requires a variety of technologies that will, number one, address, and number two, adapt to situations that you're talking about.

Let's go through a couple of the examples that we've already spoken about. If you're an enterprise worrying about your user on a cellular connection in Hong Kong, versus you're the same enterprise worrying about the same application for a user on a desktop fixed-connection based in New York City, the performance challenges and the performance optimizations that you want to make are going to be fundamentally different.

There is a core set of things that you need to have in place in all those cases. You need to have an intelligent platform that's going to understand the situation and make an appropriate decision based on that situation. This will include a variety of technical variables, as well as just a general understanding of what the end user is trying to do.

... You need to have an underlying architecture that allows you to operate across a variety of the parties you mentioned.

For example, we talked about a variety of networks, a variety of ISPs. You need to have one architecture that allows you to operate across all of them. You can't go and build different architecture and different solution ISP by ISP, network by network, or country by country. There's no way you're going to build a scalable solution there. So first and foremost, you need that overall ubiquitous architecture.

Significant intelligence

The second thing you need is significant intelligence to be able to make those decisions on the fly, determine what the situation, and what would be the most beneficial solution and technology applied to that situation.

The third thing you need is the right set of APIs and tools that ultimately allows the enterprise, the customer, to control what's happening, because across these situations sometimes there is no absolute right answer. In some cases, you might want to suddenly degrade the fidelity of the experience to have it be a faster experience for the user.

Across all of these, having the underlying overall architecture that gives you the ubiquity, having the intelligence that allows you to make decisions in real-time, and having the right APIs and tools are things that ultimately we at Akamai spend a lot of time worrying about.

We sit in a unique position to offer this to our customers, working closely with them and their partners. And all of these things, which have been important to us for over a decade now, are even more important as we sail into this more complicated situationally driven world.

Gardner: We're almost out of time, but I wonder about on-ramps or adoption paths for organizations like enterprises to move toward this greater ability to manage the complexity that we're now facing. Perhaps it’s the drive to mobility, perhaps it’s the consumption of more cloud services, perhaps it’s the security- and governance and risk and compliance-types issues like that, or all of the above. Any sense of how people would find the best path to get started and any recommendations on how to get started?
Each company has a set of challenges and opportunities that they're working through at any point in time.

Afergan: Ultimately, each company has a set of challenges and opportunities that they're working through at any point in time. For us, it begins with getting on the right platform and thinking about the key challenges that are driving your business.

Mobility clearly is a key trend that is driving a lot of our customers to understand and appreciate the challenges of situational performance and then try to adapt it in the right way. How do I understand what the right devices are? How do I make sure that when a user moves to a less performing network, I still give them a high quality experience?

For some of our customers, it’s about just general performance across a variety of different devices and how to take advantage of the fact that I have a much more sophisticated experience now, where I am not just sending HTML, but am sending JavaScript and things I could execute on the browser.

For some of our customers it's, "Wait a minute. Now, I have all these different experiences. Each one of these is a great opportunity for my business. Each one of these is a great opportunity for me to drive revenue. But each one of these is now a security vulnerability for my business, and I have to make sure that I secure it."

Each enterprise is addressing these in a slightly different way, but I think the key point is understanding that the web really has moved from basic websites to these much more sophisticated web experiences.

Varied experiences

The web experiences are varied across different situations and overall web performance is a key on-ramp. Mobility is another key on-ramp that you, and security would be a third initial starting point. Some of our customers are trying to take a very complicated problem and look at it through a much more manageable lens, so they can start moving in the right direction.
Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: Akamai Technologies.

You may also be interested in:
at 12:19 PM 0 comments

Thursday, October 4, 2012

Security officer sees rapid detection and containment as new best IT security postures for enterprises

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: HP.

The next edition of the HP Discover Performance podcast series unpacks the concept of intelligent containment of risk as an important approach to overall IT security. We'll examine why rapid and proactive containment of problems and breaches -- in addition to just trying to keep the bad guys out of your systems -- makes sense in today's environment.

Here to share his perceptions on some new ways to better manage security from the vantage of containment is our guest, Kaivan Rahbari, Senior Vice President of Risk Management at FIS Global, based in Jacksonville, Florida. The discussion is moderated by Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:
Gardner: What's different about the overall security landscape today, compared to five years ago?

Rahbari: A lot has changed in the past five years. Two key economic trends have really accelerated our security changes. First, the US recession pushed companies to consolidate and integrate technology footprints and leverage systems. New deployment models, such as software as a service (SaaS) and cloud, help address some of the lack of capital that we've been experiencing and the ability to push cost from fixed to variable.

The second major economic trend that has continued in the past five years is globalization for some of the companies. That means a network topology that's traversing multiple countries and with different laws that we have to deal with.

We always talk about how we're only as strong as our weakest link. When larger and more sophisticated companies acquire smaller ones, which is pretty commonplace now in the market, and they try to quickly integrate to cut cost and improve service, they're usually introducing weaker links in the security chain.

Strong acquirers now are requiring an acquisition to go through an assessment, such as an ISO 27001 certification, before they're allowed to join “that trusted network." So a lot of changes, significant changes, in the past five years.

Gardner: Tell us about FIS Global.

Largest wholesaler

Rahbari: FIS is a Fortune 500 company, a global company with customers in over 100 countries and 33,000 employees. FIS has had a history in the past 10 years of acquiring three to five companies a year. So it has experienced very rapid growth and expansion globally. Security is one of the key focuses in the company, because we're the world's largest wholesaler of IT solutions to banks.

Transaction and core processing is an expertise of ours, and our financial institutions obviously expect their data to be safe and secure within our environments. I'm a Senior Vice President in the Risk Management Group. My current role is oversight over security and risk functions that are being deployed across North America.

Gardner: What is the nature of security threats nowadays?

Rahbari: Attackers are definitely getting smarter and finding new ways to circumvent any security measure. Five years ago, a vast majority of these threats were just hackers and primarily focused on creating a nuisance, or there were criminals with limited technology skills and resources.

Cyber attacks now are a big business, at times involving organized crimes. These are intruders with PhDs. There could be espionage involved, and originate in countries with no extradition agreements with the US, making it very difficult for us to prosecute people even after we identify them.

You've also read some of the headlines in the past six months, things such as Sony estimating a data breach and cleanup of $171 million, or an RSA hack costing EMC $66 million. So this is truly a big business with significant impacted companies.
The nature of the threats are changing from very broad, scattered approach to highly focused and targeted.

Another key trend during the past five years that we've seen in this area is that the nature of the threats are changing from very broad, scattered approach to highly focused and targeted. You're now hearing things such as designer malware or stealth bots, things that just didn't exist five or 10 years ago.

Other key trends that you're seeing is that mobility and mobile computing have really taken off, and we now have to protect people and equipment that could be in very hostile environments. When they're open, there's no security.

The third key area is cloud computing, when the data is no longer on your premises and you need to now rely on combined security of your company, as well as vendors and partners.

The last major thing that's impacting us is regulatory environment and compliance. Today, a common part of any security expert terminology are words such as payment card industry (PCI), Gramm-Leach-Bliley Act (GLBA), and Sarbanes-Oxley (SOX), which were not part of our common vocabulary many years ago.

Gardner: So how do we play better defense? Most of the security from five years ago was all about building a better wall around your organization, preventing any entry. You seem to have a concept that accepts the fact that breaches are inevitable, but that focuses on containment of issues, when a breach occurs. Perhaps you could paint a picture here about this concept of containment.

Blocking strategies

 Rahbari: As you said, it's easier to secure the perimeter -- just don't let anything in or out. Of course, that's really not realistic. For a vast majority of the companies, we need to be able to allow legitimate traffic to move in and out of our environments and try to determine what should be blocked.

I'll say that companies with reasonable security still focus on a solid perimeter defense. But companies with great security, not only guard their perimeter well, they assume that it can be breached at any time, as you stated.

Some examples of reasonable security would include intrusion protection, proxies to monitor traffic, and firewalls on the perimeter. You would then do penetration testing. On their PCs you see antivirus, encryption, and tools for asset and patch management. You also see antivirus and patch management on the servers and the databases. These are pretty common tools, defensive tools.

But companies that are evolving and are more advanced in that area have deployed solutions such a comprehensive logging solutions for DNS, DHCP, VPN, and Windows Security events. They have very complex security and password requirements.

As you know, password-cracking software is pretty common on the Internet nowadays. They also make sure that their systems are fully patched all the time. Proactively, as you know, Microsoft publishes patches every month. So it's no longer sufficient to upgrade a system or patch it once every few years. It's a monthly, sometimes daily, event.
As the costs of attacks have skyrocketed, we're now seeing in the market some pretty great solutions.

Gardner: How do you go about such containing?

Rahbari: First, as the costs of attacks have skyrocketed, we're now seeing in the market some pretty great solutions that actively try to prevent things from happening or mitigating them when they happen.

A few of the examples that come to mind are on the perimeter. We're seeing a lot of denial-of-service (DoS) attacks in recent years. Basically what that means is you detect a massive attack toward a specific IP address, and it happens with financial institutions a lot.

With some of these great solutions on the market, you would swing all of your traffic another IP address, without bringing down the environment. The attackers still think they're attacking and shutting down an environment, but they really aren't.

Five years ago, the primary objective of a DoS attack like this was just to shut something down for malicious purposes. Now, it's a pretty common vehicle for fraud.

Long gone

 Here's a scenario. In a small business, Joe's Landscaping, their internet banking gets compromised and someone steals their password. Then the hackers authenticate and do a wire transfer out of his account to some bank in the Cayman Islands. That attacker then mounts the DoS attack against the service provider that Joe's Landscaping is using, so that the fraudulent activity is not discovered or it's delayed for a few days. By the time it's discovered, the money is long gone.

Another example of proactive and great security is to have software white-listing on PCs and servers, so that only legitimate software is actually installed. A key method of obtaining credentials nowadays is to install keystroke logger software on a machine. That can easily be blocked by white-listing software.

A third example of strong security posture is not just to detect, but actually actively destroy things. Traditionally, when we were monitoring wireless access into companies, we would just report that there was wireless access that shouldn't have been granted.

Most companies would assign a password to it, but as you know, passwords are shared sometimes, so soon enough, everyone knows the password to the wireless system in the company. One of the things that we’ve started using are solutions that actively jam wireless signals, unless it's their authorized room or a known IP address.

Another great example of a proactive approach we see in the market is when a visitor or employee plugs a non-corporate device into network, either on premise or from home. That creates a significant amount of risk. There are some great solutions out there that provide network access control. If an unknown device plugs into the network, that's immediately rejected at the network level. You can't even authenticate.
The less obvious offensive posture that people don't think about is just around discovery and disclosure.

Probably the less obvious offensive posture that people don't think about is just around discovery and disclosure. Some of the statistics I’ve read indicate that more than 90 percent of the compromises are actually reported externally, rather than the company discovering it.

It's a PR and regulatory nightmare, when someone comes to us and says, "You've been attacked or breached," versus us discovering something and reporting it. Some of the examples I gave were technology, but some of it is just planning and making sure that we’re proactive and report and disclose, rather than seeing it in the headlines.

Gardner: Are there any particular types of technology that help contain an intruder or some other breach?

Rahbari: Some of it is just process, and some of it is technology. When most companies discover a breach, they take people who are already in a full-time job function related to security and put them on the team to investigate. These people don't have the investigative skills and knowledge to deal with incident management, which is truly a specialized science now.

Dedicated team

Companies that have experienced breaches and now know how important this is have implemented best practices by having a dedicated team to plan and handle breaches. It's like assigning a SWAT team to a hostage situation versus a police patrol officer.

A SWAT team is trained to handle hostage situations. They're equipped for that. They have a machine gun and sniper rifle instead of a handgun, and they don't have another full-time job to worry about while they’re trying to deal with the crisis. So, from a process and team perspective, that's the first place I would start.

This is even more critical for targeted attacks, which are pretty common nowadays. You have to have the necessary infrastructure to prepare for an event or an incident ahead of time. During the attack, we usually don't disrupt the attacker, or alert them that we’re about to go remedy something. After the remediation is prepared, then we implement that and, in that process, learn about what the attacker is doing.

Some of the steps I recommend, once you know a breach has occurred, is to first pull the entire network off the internet until remediation is complete, blocking the known attacker, domains, and IP addresses. Other simple things include such things as changing compromised passwords.

The preparation ahead of time is important ... because the architecture is the fundamental way in which we can secure our environments.

Some of the steps that any good company should take is first make sure that their networks are separated and isolated. You need a long term network architecture and strategic plan. You also need to establish security zones to separate high risk domains, and make sure you have standards to govern the level of trust between sites and your networks, based on your business requirements.

As far as domain segregation, make sure you do things such as separating Active Directory domains with credentials for your production environments, versus your quality assurance developments and other employee-access environments.

From a trends perspective, there are a number of things that had really helped. Virtualization is one of them. It's a key technique to create segregation between applications.

Gardner: How can organizations get started on this? It looks like an awful lot to go after it once. Is there a path to this -- a crawl, walk, run approach -- that you would recommend in terms of improving your posture, when it comes to security and containment?

Rahbari: This is a very complicated and difficult thing to learn, and that's where partners and other firms really can be a tremendous help. First, I'd start with an existing organization. Five years ago, it was difficult to sell security to business leaders. Now, those same business leaders are seeing in the paper everyday -- the numbers are astronomical -- Sony, Google, and others who had breaches.

From the inside, good indication of a security culture change is when you have a dedicated chief information security officer (CISO), the company has a security or risk committee, security is a budget line in the item and not just buried within an IT budget, and security is the business issue.

Effects of breaches

With the incredible amount of regulatory burden, scrutiny, and oversight, a breach can really tank a company overnight. You read in the paper two months ago, we had a company that lost half of its stock value overnight, after a breach, after Visa was hinting that they might stop using them.

I'd highly recommend that you hire a reputable company to get started, if your particular firm cannot afford to invest in hiring the experts. There are lots of firms that can come. You can outsource to start with, and then as you feel comfortable, bring it in-house and leverage the expertise of this highly, highly specialized field to protect your company and assets.
Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: HP.

You may also be interested in:
at 4:33 PM 0 comments

Wednesday, September 26, 2012

McKesson redirects IT to become a services provider that delivers fuller business solutions

Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: HP.

The next edition of the HP Discover Performance podcast series highlights how pharmaceuticals distributor and healthcare information technology services provider McKesson has transformed the very notion of IT. We will see how a shift in culture and an emphasis on being a services provider has allowed McKesson to not only deliver better results, but elevate the role of IT into the strategic fabric of the company.

To learn more about how McKesson has recast the role of IT and remade its impact in a positive way, join Andy Smith, Vice President of Applications Hosting Services at McKesson. The discussion is moderated by Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:
Gardner: Let me start with this notion of IT transformation. What allowed you to convince others that this was worth doing?

Smith: What we did, and this started several years ago, was to focus on what our competition was doing, not the competition to McKesson -- but the competition to IT. In other words, who was the outsourcer or who were the other data-center providers. From that, we were able to focus on our cost, quality, and availability and come up with a set of metrics that covered it all, so that we could know the areas we needed to transform and the areas where we were okay.

Gardner: So, in a sense, you had to redefine yourself as a services provider, because that's who you saw as your competition?

Smith: Exactly, and that's who our customers are talking to -- our competition. When they came to us for a service, they had already talked to third-party providers. And so we realized very quickly that our competition was the outside world, so we had to model ourselves to be more like them and less like an internal IT department.

Gardner: That, of course, cuts across not only technology, but culture and the whole idea of being accountable, and to whom. So let's start at that higher level. How did you begin to define what the new culture for IT should be?

Balanced scorecard

Smith: We started out with a balanced scorecard. It really came down to whether the employees and the customers were satisfied. Did we do what we said – were we accountable -- and were the financials right?

So when we started setting up that balance scorecard, that on its own started to change the culture. Suddenly, customer satisfaction mattered, and suddenly, system availability mattered, because the customer cared, and we had to keep the employees trained, so that they were satisfied.

Over time, that really changed the culture, because we're looking at all four parts of the scorecard to make sure we're moving forward.

When we were just an internal IT department, we spent more time saying, "The customer gave us an order, we hit the checkbox and finished that order, we're done." We were always asking, "Did we do it, and did we do it on time?"
What we really focused in on were the real drivers. A lot of the measures are more trailing indicators. Even money tended to be a trailing indicator.

That's not really what the customer was looking for. The customer was looking for. "Did you deliver what I needed, which may be different than what I asked for. Did you deliver it at a good price? Did you deliver it at a good quality." So it did switch from being measuring the ins and the outs of an order taker, to whether we are delivering the solution at the right price.

Gardner: As we've seen in a number of companies, when they’ve gone to more measurement using metrics, key performance indicators (KPIs), and working towards service-level agreements (SLAs), sometimes that can become daunting. Sometimes, there is too much, and you lose track of your goal. Is there a way that you work towards a triage or a management approach for those metrics, those KPIs, that allowed you to stay focused on these customer issues?

Smith: What we really focused in on were the real drivers. A lot of the measures are more trailing indicators. Even money tended to be a trailing indicator.

So we went into what's really driving our quality, what's really driving our cost. We got down to four or five that we are the ones that mattered. "Is the system up and running. Are changes causing outages. Are data protection services reliable. Are our events being handled quickly and almost like a first call resolution. Are they being resolved by the first person that gets the event?"

The focus was prevent the outage and shorten up the mean time to restore, because in the end, all of that will drop the cost. It worked, but it was focusing on a handful, rather than dozens.

Pulling down cost

It truly did bring down our cost within McKesson. Each year we pull down our cost several million dollars. So every year my budget gets smaller, but every year my quality gets higher, my employee satisfaction gets higher, and my customer satisfaction gets higher.

It can really get both. You don't have to sacrifice quality to reduce cost. The trick was saying that I no longer needed a person to do this commodity factory work. I could use a machine to do that, which freed up the worker from being a reactive commodity person to being a proactive value-add person. It allowed the employee to be more valuable, because they weren't doing the busy work anymore. So it really did work.

Gardner: For those in our audience who might not be familiar with McKesson, tell us a little bit more about the company. Specifically, tell us about the scale of your IT organization to put those millions of dollars into some perspective in the total equation?

Smith: McKesson IT is roughly 1,000 employees. The company is roughly 45,000 employees. So percentage-wise, we're not that big. My personal budget to run the IT infrastructure is about a $100 million a year.

So pulling out a few million dollars a year may be only a few percent, but it's still a pretty significant endeavor. We've managed to pull that cost out, both through the typical things like maintenance contracts and improved equipment, but also by not having to grow the full-time employee (FTE) base. I haven't had to let any FTEs go, but what we've discovered was that, as we did these things, I needed fewer employees.
To get people to stop thinking about the technology and start thinking about the business solution is a slow transition, because it's a real mind-shift.

As employees resigned, I didn't have to replace them. My staff base has been shrinking, but I haven't had anybody lose a job. So that's been also very reassuring for the employees, because they kept waiting for that big shoe to drop, waiting for us to say, "We're going to outsource you," but we've never had to do it.

Gardner: When you compete against the outsourcers better, then you are going to retain those jobs and keep that skill set going. There is a cliché that you're able to take people from firefighting and put them into innovation. Is there a truth to that in what you've done?

Smith: That really is truth. It took time, and we’re not done, but to get people to stop thinking about the technology and start thinking about the business solution is a slow transition, because it's a real mind-shift. In a lot of ways, these employees see the reactive work as the bread and butter work that puts the paycheck on the table. That lets them be a firefighter and a hero, and if you take that away, the motivators are different.

It takes time to get people comfortable with the fact that your brain is worth a lot more doing value-add work than it was just doing the firefighting. We're still going through that cultural shift. In some ways, it's easier for the older employees, because if you go back a few decades, IT was that. It was programmer analyst, system analyst, and business analyst. For me, "analyst" disappeared from all my job titles.

In the last couple of decades, for some reason, we erased analyst, and now you're just a programmer or an operator. In my mind, we're bringing the analyst back, which for the older employees, is easy, because they used to do it. For the younger employees, we've got to teach them how to be consultants. We've got to teach them how to be analyst. In some cases, it's a totally different, scary place to go, because you actually have to come out of the back office and talk to somebody, and they're not used to that.

Cultural shift

Gardner: Maybe there are methodologies that work here that you could discuss, services-oriented architecture (SOA) comes to mind and also ITIL. Have you been using ITIL approaches and SOA to help make those transitions? Is there a technology track is a cultural shift?

Smith: Yes, we went down the ITIL road, because we were manual before. Everybody was doing it with tribal knowledge. The way I did it today might be different than the way I'd do it tomorrow, because it's all manual, and it's all in people's heads.

We did go into ITIL version 3 and push it very hard to give that consistency, because the consistency really mattered. Then, we could really measure the quality. We could be ensured that no matter who did it or when it was done, it was done the same way, and that reliability mattered a lot.

We also got away from custom technology, and we got to where everything is going to be a certain type of machine. It's going to look the same. All the tools are going to be fully integrated and no longer be best-of-breed point solutions. Driving that standardization made a big difference. You don’t have to remember that machine on the left you reboot it this way, and that machine on the right you reboot it a different way. You don’t have to remember anymore, because they're all the same.

We made the equipment and tools standard and more of a commodity so that the people didn’t have to be that anymore. The people could be thought leaders. All those things really did work to drive out the cost and increase the quality, but it's a lot of different pieces. You can't do it with just one golden arrow. You have to hit it from every angle.
We had to increase the transparency to say we’re doing a good job or we’re doing a bad job.

We had to change the technology, the people, and the processes. We had to increase the transparency to say we’re doing a good job or we’re doing a bad job. It was just, "Expose everything you’re doing."

That's scary at first, but in the end, we found out we really are competing with the competitors and we can continue to do it, and do it better. We understand healthcare, we understand McKesson, and we’re an internal group, so we don’t have a profit margin. All those things combined can make us a better IT solution than a third party could be.

What really matters is the business solution you’re trying to solve. We’re stepping even farther back, saying that the service is order to cash, or the service is payroll, or the service is whatever. We’re stepping back farther, so we can look at the service from the standpoint of the customer. What does the customer want? The customer doesn’t want Unix. The customer wants order to cash. The customer doesn’t want Windows. The customer wants payroll.

Thinking about cloud

Stepping back has now allowed us to start thinking about that cloud. All the equipment underneath is commoditized, and so I can now sit back and say that the customer wants this business solution and ask who is the best person to give me the components underneath?

Some of them, for security reasons, we’re going to do on our internal cloud. Some of them, because of no security issues, we’re going to have a broker with an external provider, because they may be better, cheaper, or faster, and they may have that ability to burst up and burst down, if we’re doing R&D kind of work.

So it's brought us back to thinking like a business person. What does the business need and who is the best provider? It might not be me, but we’ll make that decision and broker it out. This year we're probably going to pull off our internal cloud and our external cloud and really have a hybrid solution, which we’ve been talking about for a couple of years. I think it will really happen this year.
Listen to the podcast. Find it on iTunes. Read a full transcript or download a copy. Sponsor: HP.
at 12:54 PM 0 comments

Wednesday, September 19, 2012

Heroku provides single-click provisioning for Java applications in the cloud

Heroku, a cloud platform-as-a-service (PaaS) and a Salesforce.com company, today announced Heroku Enterprise for Java, a new service for companies and IT organizations to build and run Java applications in the cloud.

Enterprise for Java is designed to enable quick creation and deployment of enterprise Java applications. It also greases the skids to move development processes to a continuous delivery model, all without traditional, on-premises software or IT infrastructure. Enterprise for Java is part of the Salesforce Platform, which is being updated and expanded this week at Dreamforce in San Francisco.



Traditionally, creating Java applications applications has required piecing together both a range of development and runtime infrastructure tools -- such as source-code control systems, continuous integration servers, testing and staging environments, load balancers, application server clusters, databases and in-memory caching systems.
Developers get all the benefits of developing in Java along with the ease of using an open, cloud platform in a single click.

This often drags out application building and deployment by months. With Heroku's new offering, enterprise developers can get a complete Java solution in a single package, provisioned with a single click, says Heroku.

Heroku began as a PaaS for dynamic languages like Ruby, but has since gone "polyglot," with support for Java, Node.js, Scala, Clojure and Python and PHP. The Java push is designed to expand Heroku's appeak beyond start-ups and SMBs for Web apps into the fuller enterprise development lifecycle.

And moving to a polyglot PaaS and continuous delivery model for applications is an essential ingredient of IT transformation to a fuller hybrid services delivery capability, said Oren Teich, COO, Heroku. The Heroku PaaS approach not only streamlines development, it modernizes the very processes behind delivering IT better as a service, he said.

“Enterprise developers have been looking for a better way to easily create innovative applications without the hassle of building out a back-end infrastructure,” said Teich. “With Heroku Enterprise for Java, developers get all the benefits of developing in Java along with the ease of using an open, cloud platform in a single click.”


Heroku aims to simplify the Java process by automating data connections, sessions management and other plumbing requirements, while keeping up-to-date on reference platform and JDK advancements. These have mostly been the labor of skilled Java developers, and hence costly and time-consuming (when you can find and keep the skills).

Heroku is therefore providing a "curated" and full Java stack that allows developers to use standard tools like Eclipse and Spring Framework to then build and deploy on a common and integrated PaaS, built around Tomcat 7. This is designed to improve compliance of applications to the runtime environment, in a large degree automating the process of deployment to spec.

"We can bring 80 steps down to four," said Teich, of Java deployment with full compliance.

And let's face it, Salesforce is not just targeting the productivity of developers. They are targeting the cost and complexity of the Java runtime targets in the enterprise: Oracle's Weblogic legacy and IBM's WebSphere. "Total cost of ownership for Java apps needs to come down." You hear this a lot in enterprise IT environs.

To me, the costs-benefits analysis of creating new apps -- especially quickly and in volume to support the voracious need for mobile apps -- and being able to deploy without hassles is a pure accelerant to PaaS adoption in general, with even greater economic and agility benefits when applied to Java.

And so Heroku Enterprise for Java also comes with a new and potentially disruptive payments plan of $1,000 per application deployed per month, with no costs incurred until production deployment. Think if that in comparison with total costs of a mission critical traditional Java app across its lifecycle. The math is compelling.

Heroku also Wednesday announced integration with products from Atlassian, which provides enterprise collaboration software for product development teams. A new Heroku plug-in for Atlassian’s Bamboo continuous integration service lets developers automate application delivery across all lifecycle stages.

Product features

Heroku Enterprise for Java includes:
  • Full-Stack Java: Enterprise for Java provides a full stack of pre-configured systems needed to build scalable, high-performance, highly available applications. This also includes memcache for session management and horizontal scaling, and Postgres for relational data management.
  • Heroku Runtime: In addition to providing runtime and management of the full stack of components, the service includes separate environments for development and staging. These environments can be provisioned instantaneously, providing a way for IT organizations to adopt rapid development methodologies. These applications can be scaled to serve massive volume with a simple control change.
    Enterprise developers have been looking for a better way to easily create innovative applications without the hassle of building out a back-end infrastructure
  • Continuous Delivery Framework: When combined with Atlassian’s integration service, Bamboo, Enterprise for Java automates the application delivery process. From code check-in to test builds, staging deploys and production promotion, developers get an out-of-the-box experience with no server set-up needed. All components are automatically provisioned and configured.
  • Native Java Tools: The offering also includes native support for Eclipse Java IDE. Developers can create and deploy Java applications directly within their IDE. In addition, Heroku now supports direct deployment of Java WAR files, providing a simple way to migrate existing Java applications to the cloud.
Pricing starts at $1,000 per month per application, and it is available starting today.

You may also be interested in:

at 10:04 AM 0 comments
Subscribe to: Posts (Atom)