Infrastructure Diaries articles

Free Stuff: One of the Most Important Security Things You’re Probably NOT Doing

cathy.pitt — Fri, 26 Mar 2010 05:08:00 GMT

Given some recent conversations I’ve had on the topic of “What’s Hot and What’s Not in the World of Security”, I thought it would be timely to write a series of blogs on “Free Stuff”. And I’m not talking about the big bag of security chotchkies you picked up at the last RSA convention- a person can only use so many rubber penguins! - I’m talking real, useful, save-your-business, move-you-closer-to-five-nines kind of free stuff.

Business Continuity Planning and Security go hand in hand. If you’re familiar with CIA (no, not the government agency!), then you know that the “A” is for “Availability”. Good security is making sure that your data is always available when you need it to be. If I’ve said it once….You can spend all the money you want on tools and technology -and yes, they are critical! - but they mean nothing unless you’re also implementing a couple of simple, common sense ‘best practices” that cost you nothing! I’ll start with one of my favorites; something that you can start doing today without waiting for the next budget cycle or equipment forecast! Of course, you might want to run it through your change management process just be on the safe side ;-)

But first, a little trip down geek-memory lane. I remember how excited we all were when our Digital Tru64 UNIX Alpha Server hit the three year mark without any down time! All up- all the time. Pretty impressive! Three years with no problems or interruptions at all, just kept on ticking! Impressive! TSC – that was the system name though I have no idea what meaning, if any, the acronym had - was the primary in a two node active/passive cluster and it was where we kept all of our important documentation and everything else we needed to keep our business going. Three years. Never down. Maybe TSC meant “The Super Computer”. Who knows.

Now, looking back through a wiser (and older) set of eyes, I ask myself: “What the heck were we thinking?!!” Did we never even consider what would happen if it did go down? Would it come back up? Would the backup server take over? Was the backup server even working as we assumed it was out there quietly in the shadow of “The Super Computer”? Would we lose valuable data? Was there some hardware ‘thing’ that might have been teetering on the brink until it went through a power down? We had no idea what would happen in the event of an unplanned outage because we were so excited about seeing how long it would keep running! For all I know – it’s STILL running! But we weren’t security people – for us it was the thrill of infinite uptime! - we never considered the security implications of how prepared we were -or were not - for an unexpected outage!

Well this is a simple problem with a remediation that is easy and free and applies to anything in your environment that you consider (and hope) to be redundant: You need to schedule regular reboots. No, not only for when it’s necessary for a software update. I’m talking Regular! As in monthly! WHAT??

It’s critical that you proactively test your redundant system’s, firewall’s, router’s, etc’s ability to fail over and/or come back after an outage. Test your cluster failover to shake out potential issues with your secondary. In fact, trade off active/passive roles every other month. Unplug your primary power supply to make sure the backup backs it up! Don’t let the first test of your redundant environment be in an emergency! If you don’t test it, it may NOT be redundant at all!

While it might seem like a contradiction to suggest that you take “stuff” down to ensure that it stays up, it just takes one failure of redundancy to understand why it makes perfect business sense! And while it does mean that you’ll never get to break “The Super Computer’s” record, you’ll be that much closer to achieving the availability your business demands! And, what makes it all the better, it’s free stuff!

Throwing the Security Baby Out With the Bathwater

cathy.pitt — Wed, 24 Mar 2010 11:56:00 GMT

I recently read an article in one of the Security eRags I subscribe to, that asked the question: “What are the Most Overrated Security Technologies?” According to the author, Bill Brenner, Senior Editor of CSO online, Anti Virus Software, Firewalls, Identity and Access Management/Multi-factor authentication, and NAC, are all antiquated, obsolete, useless, worthless, dead…..you get the picture.

It got me to thinking.

It was not more than a week ago that I was trying to download some freeware, as many of us often do (I have no idea what is was!) when up popped my antiquated, obsolete, useless, worthless, dead Symantec Antivirus telling me that the file I wanted to grab was hostile, saving me a lot of time and anguish and maybe even worse. Thanks, Symantec! A “Security expert” quoted in the article argues: “But it won’t stop a zero-day attack”. Ok, but will it stop the other 10 gazillion malware attacks out there? Yes! So tell me again how it’s antiquated, obsolete, useless, worthless, and dead.

I run a personal firewall on my home system- (an antiquated, obsolete, useless, worthless, dead firewall) On occasion, I look at the log files to see what’s been going on and am always impressed to see how many port scans have been logged: Hundreds and hundreds. True, I don’t have any unnecessary or unsafe ports open in the first place, but that doesn’t mean that the average computer user out there who doesn’t do security for a living, is as cautious. (If you don’t believe me, go ask your Aunt Betty if she made sure to shut down her Telnet listener before jumping onto the Net…..).

In the interest of time, I won’t go through the other antiquated, obsolete, useless, worthless dead technologies that the author mentions in the article, but suffice it to say, I don’t agree with him and here’s why:

Almost unanimously, the detractors of these technologies are self-described “security experts”. One even claims that he’s never ever used anti-virus and has never gotten a virus! Bravo! I’ve never taken heart pills and have never had a heart attack (knock on wood) but what does that prove? Lucky maybe? Maybe in the AV case, it only proves that he has a little more malware-awareness (and time) than most people have. Guess what fella – not everyone is a “security expert”!

For the average computer-using-Joe-Blow, every little bit helps. “Defense-in-depth” means that you throw everything you can at would-be attacks. It’s irresponsible to imply that the average Joe should take down those firewalls, remove those virus detectors, stop using multi-factor authentication. What about passwords? Overrated? .Let’s just stop using those too. In fact, these antiquated, obsolete, useless, worthless, dead tools are often the only thing protecting the average person, and even the average company, from attack.

“Security Experts” sometimes forget that not everyone lives and breathes security. To those security-challenged Joe-Averages, their computer is a means to an end and security is just one of those things that is most often out of sight out of mind, like a car alarm or a smoke detector. (By the way, they are both reactive technologies, a big negative according to Bill and his article. But aren’t they pretty handy when your car is being stolen or your house is on fire?) And what’s so bad about "reactive" anyways? Defense, by definition, is reactive! And we all understand that even the strongest defense may not be enough at some point, but that doesn’t mean these "antiquated, obsolete, useless, worthless, and dead" technologies don’t do a pretty darn good job at what they’re intended for!

So, to those “Security Experts” out there who can apparently leap tall buildings and ward off all manner of malware without tools and expect everyone else to do the same, I say….”What’s your IP address?” To everyone else, don’t expect anything to keep you completely safe. Defense in depth means just that: Use whatever is available to you to safeguard your data, no matter how antiquated, obsolete, useless, worthless, or dead someone else says it is. It makes no sense to throw out the baby with the bathwater just because someone tells you it’s an ugly baby, especially if it's the only baby you've got!

And if, after all is said and done, you get the urge to tear down those (fire)walls, ask yourself this “Do ya feel lucky?Well do ya?”

Read Bill's article for yourself and you decide: http://www.csoonline.com/article/571263/What_Are_the_Most_Overrated_Security_Technologies_?source=CSONLE_nlt_update_2010-03-11

Industry Security Certifications and Props to Those Who Persevere!

cathy.pitt — Tue, 16 Feb 2010 10:35:00 GMT

I’m very fortunate to have this platform to share my thoughts on what’s “hot” and what’s “cool” in the world of technology, so I wanted to use a small corner of the platform to pass along some big “props” to a good friend of mine and ‘fellow’ Security Consultant in HP’S MultiVendor Systems Engineering (MSE) group, John Wieland.

Yesterday, John accomplished what lesser-mortals (like me!) only dream of accomplishing: he passed his second CCIE exam!

If you’re not up on your industry certification acronyms, CCIE stands for Cisco Certified Internetwork Expert, and it comes in seven flavors: Wireless, Routing & Switching, Design, Service Provider, Storage Networking, Security and VoIP.

John is CCIE certified in Security and as of yesterday, VoIP as well!

If you’re not impressed yet, how about this: having two CCIE certifications is a little like having two Olympic Gold Medals (without the picture on the Wheaties Box). It’s like having two Super Bowl Rings (without the bruises) or two platinum albums (do they still call them platinum ‘albums’?).

So what’s the big deal you ask? Well, it’s simple. You don’t wake up one day, decide you’re going to go become a CCIE, pick up a book and a mocha-frappa-latte-chino at the local book store, thumb through it (the book, not the a mocha-frappa-latte-chino), take the test and get the big prize. This isn’t one of those “take-a-boot camp-get-a-cert” things.

The CCIE takes a lot of very hard work (we’re talking months and months if not years and years of hard work) and tremendous dedication to make it through. It takes a lot of smarts, a lot of drive, but mostly, it just takes a lot of very hard work. Props to those who have what it takes to run the marathon and cross the finish line, and big props to those who circle back around to the starting line and do it again!

To those who persevere, we applaud you.

And so, in the famous words of Denver Bronco’s owner Pat Bolan: “This one’s for John!” Big congrats, John!!! Well done. Well done indeed!

Now take some time off before you circle back around for the hat trick!

-----------------------------

While I’m on the subject of Industry Certifications (and I still have some platform left!), my students will tell you that if I’ve said it once, I’ve said it a thousand times, “Stop relying on boot camps”. No offense to those who provide them – they offer a very valuable service to people in the industry who want to refresh their knowledge before taking an exam; the key word being “refresh”. But sadly, I’ve spoken to too many clients who decide that they ‘need’ a certified person in ‘xyz’, so they pick the first unlucky sap whose head pops up over the cube walls, send her off to a week-long boot camp that offers the certification exam on Friday afternoon, and, if she’s successful, believe that they are much better off than they were the week before! They expect the person with the newly acquired acronym by their name to be the expert on whatever it is the letters stand for!

So here’s my advice: STOP DOING THAT! You’re wasting your money and your time, possibly putting your business at risk, and you’re not accomplishing what you were most likely hoping to which is to have an expert available.

If you’re looking for deep expertise in a specific technology, you’re not going to teach it in a week! You need to buy it ready-made, or invest the time and money to grow it. Real expertise isn't like instant oatmeal! You need to train for it, or borrow it or buy it or hire it, but you can’t get it from a box or from a week long boot camp! Now let me say, I’ve been through a few boot camps in my life: one in the military and one more recently for law enforcement (of course they like to call it an Academy, but we all know a boot camp when we see one!). The former was sixteen weeks and the latter was six months, and neither let me out the front door pretending that I was an expert at anything they taught me! Both bootcamps were followed up by even more longer and harder training with even more focus and even then they still called us ‘rookies’ - not ‘experts’ - when we were done. The bottom line is this: expertise comes from experience and experience comes with time. It also comes from a lot of hard work, and a lot of ‘doing’. You wouldn’t get your wisdom teeth pulled by a dentist who only spent a week at dentist boot camp would you? So why would you trust your information infrastructure to someone who got his ‘expertise’ from a week of force-fed-facts in a classroom?

Again: boot camps - good. Instant gratification -bad. Don’t not invest in the boot camp; just don’t put all of your eggs in the boot camp basket and expect to get a prize hen out of it in five days!

And while we’re at it, don’t confuse acronyms with skills. If you’re buying expertise for either the long term or the short term, ask for credentials. Ask for experience. Ask what lies behind the letters.

Get references and make sure you get what you hope you’re going to get! You can’t afford to bet your business on fictitious or misleading credentials! If you have the time to grow your own, a wise investment in training and a lot of patience will get you what you need. In the short term, rely on trusted partnerships with people who’ve been around the block a few times and can show you what’s behind the curtain.

Appropriate use of boot camps: wise. The quest for instant gratification: risky. Funding or finding true expertise behind all of those letters: priceless.

For information on HP's Security Expertise, go to http://h20219.www2.hp.com/services/us/en/always-on/security-overview.html

And, you can read more about the CCIE Certification at http://www.cisco.com/web/learning/le3/ccie/index.html

Cafe ITIL - Welcome

lewblack — Wed, 10 Feb 2010 05:33:00 GMT

Sometimes people don’t understand ITIL and IT Service Management concepts simply because they’ve never experienced the concepts in an IT environment, and that disconnect won’t allow them to “get it.” Through my 8+ years of ITIL training, I’ve often referred back to my days of waiting tables in a restaurant to understand the concepts. Using that model, I invite you to join me as I begin a series called Café ITIL.

Many people love to cook, and they assume they will enjoy running a restaurant, because it gives them the opportunity to do what they love. New restaurants open all the time. It is one of the top categories for new businesses. However, it is also one of the top categories for failed businesses. Similarly, techies and technical managers assume that if they like and understand computers, they can do just fine at managing IT for a business. Unfortunately, because they are not a stand alone business, it is not easy to tell when an internal IT department fails.

We’ll take a look at ITIL v3 concepts and processes and try to gain an understanding of them as if we were opening a new restaurant chain, Café ITIL. Hopefully, this will help shed some light on how we can improve how IT departments are managed. If it helps you create your business plan for a new restaurant, so be it.

I welcome your comments and insights as we go through this series.

? What other comparisons do you make when you’re thinking of ITIL concepts?

Do You Know What Your Data is Doing When You're Not Looking?

cathy.pitt — Fri, 05 Feb 2010 15:01:00 GMT

If you haven’t taken the time yet to review the updated version of the Cloud Security Alliance’s “Security Guidance for Critical Areas of Focus in Cloud Computing V2.1” document, published in December 2009, you really should. If you’ve not spent a lot of time reading up on Cloud Computing, this document is a great starting point, even providing some thoughts on what you need to do before you consider moving your data to the Cloud.

Not to nag (but what the heck!), if you don’t have time to read the entire document, first of all, make the time! If you’re a security practitioner, or if you’re considering moving your data to the Cloud, it’s ‘must know’ information. Worst case, at least read the introductory section called “An Editorial Note on Risk: Deciding What, When and How to Move to the Cloud”. (You can read the rest later!) In particular, there’s a short paragraph or two that discusses the need to sketch out your data flow and understand exactly what and where your data is before you decide to send it somewhere else! It reminds me of more than one client experience I’ve had over the last so-many years, and I think this topic cries out for some serious attention!

So begins my first blog!

Understanding how and where your data spends its time is certainly not a concept unique to Cloud Computing. PCI DSS demands that you know the data flow for credit card information. HIPAA demands the same of Protected Health Information, Sox for Financial Data etc. etc. If you don’t know where your data is and where it goes when you’re not looking, how do you know what controls to use or where to put them? How do you know what risks are lurking out there ready to pounce on those little bits? What's your risk mitigation strategy? Any most importantly, why would you even think of adding to the confusion and the risk by introducing another variable in the form of a cloud?

It seems that no matter who I work with, no matter how secure they profess to be, they can never produce a data flow diagram for their most sensitive data. They know they have sensitive data (usually!) and they know it’s out there somewhere, but they can’t say exactly where!

Case in point: On our first day at a client site to conduct a risk assessment, my team and I had a kick-off meeting with employee stakeholders representing the various departments in the company. After they’d taken up three whiteboards to show us the layout of their intranet, we asked: “Can you tell us where your customers' credit card information goes after they hang up the phone or log off of your web site?"

The first person to the board picked up a red marker and confidently drew out the path that the PCI data took through their network from data entry through processing, to storage and on until it was either archived or deleted. “Ta-Da!” and he sat down. Someone else from the group spoke up: “Well, that’s not completely accurate” (I noted the quiet gasp and raised eyebrows in the room!) This second person went to the board, took up the blue marker, added some detours to demonstrate some other places the data visited inside of the company, and returned to his seat, satisfied with the accuracy of the now colorful PCI data flow diagram. After the third and fourth and fifth people all made their own additions to the map, our kickoff meeting had turned into a heated debate on how it appeared that they had credit card information all over the place and that despite their best intentions, it was mostly unprotected! (I still get this visual of a teeny little data-looking-thingy-guy with arms and legs carrying a big suitcase with postcards all over it, but now that I look closer, I think it’s just that Hamburger Helper hand I have stuck in my mind…. anyways.....) Our employee survey revealed that almost everyone in the company of 800+ people could readily access full credit card information, whether they had the business need or not! (LOTS of raised eyebrows on that one!)

The story gets worse, but I’ll leave it to your imagination and get to the point which is:

It's about the DATA......Silly! You can’t secure what you can’t find! You can’t say your data is secure, if you can’t say where your data is! And you can’t identify risks to something you can’t keep track of!

This very basic concept is the foundation of Information Security whether your sensitive information is landlocked or cloud-hopping or traveling around the world in your back pocket with its friends on your thumb drive. And as the Cloud Security Alliance points out, before you can make any decisions on moving your data to the Cloud, you need to be able to identify your risks. If you can’t map your data flow today, don't even think about letting it go anywhere else until you know exactly where it is and exactly what it's been up to.

And if that 'data-as-the-Hamburger-Helper-hand-with-a-suitcase' image didn't do it for you, how about this: Data is like a rebellious teenager. If you don't keep your eye on it, it's going to end up in places you don't want it do be, doing things you don't want it to do. You need to lay down the law! Set some rules and boundaries! And whatever you do, don't even think about sending it out into the clouds until you have it under control!

You can find the “Security Guidance for Critical Areas of Focus in Cloud Computing V2.1” document here: http://www.cloudsecurityalliance.org/csaguide.pdf

Incident versus Problem and why does it matter?

patcollings — Fri, 29 Jan 2010 08:01:00 GMT

A server admin goes to the doctor and says "doctor every time I do this... it hurts". And the doctor says "take a couple of aspirin". That server admin is quite likely to feel the pain over and over again. We expect our doctors to find the cause and fix that. Our customers and users expect the same of us in IT.

Just like a physician, technology professionals deal routinely (and sometimes not so routinely) with issues that ‘hurt’ their customers and users. In the effort to simply return the device or application back to the normal operating state, the label is not important. Some teams get very good at dealing with these issues and become comfortable that they can fix it, should it break. The better we are at 'fixing it', the less we think of the symptom versus the cause. This results in spending most of the effort on the symptoms and not the cause or vice versa.

Each week I explain to a new group of IT professionals that an incident is the symptom and a problem is the cause. And it matters because when you want to improve, you must pick your targets carefully. If we sort the issues out into incidents versus problems, we begin to treat them differently because in fact they are very different, if inextricably linked. If we further look for some practices like ITIL that have worked well for others, we can improve how we deal with both. And that makes the ‘patient’ much happier with our efforts.

2010 and Cloud Computing

markjgrindle — Tue, 26 Jan 2010 22:57:00 GMT

Well, it's been a busy month and it’s time to post a new BLOG. It seems most IT shops are investigating the implementation of Cloud, planning to implement Cloud, or implementing Cloud. It's definitely a very attractive direction for a lot of companies and IT shops. We do have to remember though, that IT manages a portfolio and right now at least, Cloud is just one part of that portfolio. We have to continue to balance the service we are providing our business against risk, costs, and business needs. Cloud services are not going to fit every business or application. There are pluses to Cloud, of course, including web available services and very elastic cost and capacity. Like with anything though, there are also downsides. With Cloud this includes some lack of flexibility when it comes to customizations (IT has traditionally "built to order"), potential performance in the way of latency for remote areas, and security remains a concern.

Now as you and your company approaches Cloud services think about a matrix. On site computing versus offsite computing. Then Dedicated services versus Shared services (including private cloud), and Native Cloud (externally provided Cloud). Then start mapping your applications including business requirements to the matrix to determine how best to meet your company's business needs. From here you can determine if Cloud is right for you and how it should be hosted.

Remember, IT services must always be equated to business value and should be hosted in a manner that provides the service to your business users.

That’s all for now.

Mark

How to achieve your SAP business SLA’s with IT services

harbraun — Tue, 15 Dec 2009 05:38:00 GMT

Welcome back ---- thanks for reading my blog.

Last time I talked about horizontal vs. vertical “end2end” perspectives. Now I’d like to elaborate, based on some lessons learned while working with major corporate accounts.

We touched before on how to establish the baseline to ensure that all IT components supporting a mission critical business process are protected with an appropriate SLA from the vendor or an experienced Third Party Maintainers.

While TPM’s are clearly an option in order to reduce your costs, they always entail a certain risk. I am not aware of a TPM who can claim to have the same reach-through to vendor development resources as a given vendor itself, unless they have an excellent established support partnership. I also have never seen a TPM provide any guarantees in terms of corrective action to a given issue.

Ideally, you do not have more than two vendors to deal with, such as HP for the IT infrastructure and SAP for the database and application layers.

If multi - vendor hardware is involved, e.g. for storage, this should ideally all be integrated in one support contract from the leading vendor. In SAP environments this vendor of choice for every second installation is HP.

Aside from all this underpinning contract work, there is one element that can never be overrated: the importance of communication.

The way this is proactively managed truly separates the wheat from the chaff.

In our example, this would mean that you have named people from HP, from SAP, and from your support team proactively agreeing on support planning, roles & responsibilities, regular updates, and procedures for incident and change management, etc.

A much-appreciated best practice is to start each engagement between customer and HP with an assessment of the current state, based on ITILv3. That establishes the baseline to later quantify improvements made over time. In addition to the cost of downtime impact, this supports justification of the investment for a Mission Critical support level towards the business.

We have many successful examples and a proven track record that show this approach simply works.

These seemingly simple measures provide you a solid foundation to support and secure your business SLAs, even in an increasingly complex, fast-changing environment.

You may want to check out our recent launch of our Mission Critical Services for SAP environments at: http://bit.ly/771hHM

I am looking forward to your comments and feedback.

Hartmut

How to cover your SAP environment end2end

harbraun — Mon, 07 Dec 2009 23:31:00 GMT

Hi and thanks very much for reading my blog. I’m Hartmut Braun. In HP’s SAP Alliance team my key focus is on support services for our joint customers. For more than 25 years I’ve had country and worldwide assignments in the IT industry. Since I joined the HP-SAP Alliance as the global SAP escalation manager in 1997, I’ve had plenty of opportunities to work with our clients and SAP AGS to resolve critical issues --- and to learn about being proactive to avoid these issues in the first place. I have worked on many service development projects around IT service and application management, and most recently on our portfolio of support services for SAP environments. But I don’t want to spend more time on me, but rather dive into the subject of this blog, which is all about achieving business SLAs. What I want to share with you over the next view weeks are my thoughts about the value of proactive services and “end2end” support, what is available already today, and where this might be going in the future. I hope this triggers some valuable discussion and generates lively conversations with you about this topic, so please provide your thoughts and opinions to my posts. Let me start with a definition. When we use the term “end2end” in the area of support, we need to make a distinction. This is often used “horizontally”, to refer to coverage for a specific layer, e.g. across multiple HW platforms for server and storage, or for software applications that together support a business process, e.g. SAP ERP and an external Output Management Solution. While this is naturally important and needs to be considered and implemented, it is not enough. Often, it all looks great at first when you have a vendor support contract for your Hardware and Operating System, plus a contract with SAP to support your application stack. And for many day-to-day support situations, this is what you need. On the other hand, we see increasing complexity, not only in the number of components and the variety of vendors, but also in the interdependencies between the HW/OS layer and the DB/App layer of the solution stack. For that reason, I always think “vertically”, about the solution stack, when I speak about “end2end” support. First thing for IT check are the basics of service level management. What is my SLA with the business? Do I have all the underpinning contracts in place, for all elements of the “end2end” solution stack, both horizontally and vertically? This is just the starting point. Next thing to look at: the solution support capabilities of the vendors. Do they just support their product or do they also understand the broader context in which the product is used in your environment. While this sounds easy, it is often overlooked and given lower priority than it should have. Just like with the nature of outages, where technology accounts for only 20%, leaving 80% caused through people and processes, it is the people and the processes in support that make or break your ability to constantly achieve your business SLA’s. Whomever you engage for supporting your SAP environment, you should always check on their collaboration capabilities with SAP and the other vendors in your solution stack. Each of these vendors must have an understanding of how their products are used inside the solution and must have the people and processes to collaboratively prevent and resolve issues. These are my thoughts for today. I hope you find them useful or at least interesting, and look forward to a good discussion. Hartmut

HP IT Forum and Cloud

markjgrindle — Wed, 18 Nov 2009 03:30:00 GMT

So this week is the HP IT Forum in Austin TX and I will be one of the HP attendees. For those of you that aren't familiar with this event (sorry, it is by invitation only), it is a great forum run by HP's IT team. It is a non-sales event; in fact HP sales people are not allowed to attend. Only HP IT personnel and HP people that deliver HP's data center transformation services are allowed to be there. The customers that are invited are large customers that are interested in, or executing, transformational initiatives. The focus of all of the speakers is the latest news from HP IT and an update on recent accomplishments driven by our internal transformation. Now the reason I share this isn't to make people that aren't invited jealous or to advertise but to comment on what interests the customer attendees. Although many people have signed up to hear about End User Services, Transformation, Virtualization, and other sessions, far and away the most popular sessions are on Cloud. As I've stated in a previous post, Cloud is exciting and all the major technology companies are producing offerings in the area. The services range from identifying cloud candidates to selecting cloud suppliers to managing cloud environments. But again, I'll restate that I think people are spending a lot of time and effort on a technology that they might not quite be ready to implement. I don't think people should (or will) slow down but we have to be thoughtful as we go forward. Is your IT Management team ready to not only embrace Cloud technologies but able to manage it? This is true managed shared services and it takes a LOT of organizational change, process change, and cultural change. We have to move fast and be ready to enable this technology and we must make sure our businesses don’t start implementing without us. It has been a long, hard journey to stop our businesses from buying technology and then handing over to us to run - some are even still fighting this battle. We don’t' want business groups selecting Cloud providers without working with IT. Otherwise, your business will have multiple Cloud solutions that may not be safe, may not be cost effective, and may not be sustainable. So absolutely run to your nearest Cloud session and learn all you can but PLAN what you will do and make sure business needs are really being addressed.

Cloud Computing Excitement

markjgrindle — Fri, 06 Nov 2009 03:39:00 GMT

It's amazing how much attention Cloud Computing is receiving. I was just at a data center conference in New York City the end of last week and Cloud was the topic of almost every session. People in the audience had lots of questions and some were even wondering if they could establish their own "clouds". Now Cloud is pretty exciting, and the potential is enormous, but I think some folks are not only focusing on a technology that they aren't ready for but a technology that isn't ready for them!

Many of the people and companies that I've talked with that are looking into Cloud haven't even driven shared services into their organization and some have barely done virtualization. Not that either of these are mandatory steps to implementing Cloud but if you've been unable to position these technologies in your company then I think going to Cloud will be a tough sell and a challenging journey. Cloud requires a new mindset, a new way of managing IT, and still has a lot of implementation and security concerns. Yes, there are a lot of great cloud offerings already. In fact, HP has workshops and consultants that can help with the evaluation, provisioning, and implementation of Cloud services but that still doesn't mean its right for your company. Yes, it needs to be studied, evaluated, and piloted but there is foundational work that has to be done be done if you want the transition to Cloud to be successful. To me, Cloud is a logical extension to shared services and virtualization and both are tested and proven technologies. If you've virtualized and have at least some Shared Services then you might be in a good position to go to Cloud services. If you haven't, you might be "biting off more than you can chew". Cloud requires application changes (some of which would have been done if you have shared services) and still has a lot of security concerns. In fact, just recently there was some news on a cloud provider losing data.

Don't get me wrong, as I said Cloud computing is an amazing change to our industry and I fully support it, but make sure it is the right answer for your company. What are the benefits? How will you support it? Are you ready for true shared services where your data and applications are in the hands of someone else? All these and other questions must be thought out and answered before you start chasing the latest technology. Like anything, this is a technology that needs to be investigated and implemented based on meeting business needs, not because it a brand new technology. So, is it "technology for the sake of technology" or is it providing true value to your organization?

Transforming IT organization into a service provider

Hande_Sahin-Bah — Fri, 06 Nov 2009 02:08:00 GMT

Are you going through mergers, acquisitions, continuous cost cutting pressures turning consolidation into a continuous program? Well.. have you seen worsening IT-business relation in the process? Little hostility from business may be because you took away their servers, retired application, decreased support? Ok what have you given back other than 'cost savings'? First lets ask this qustion to ourselves as IT.

Are we missing any opportunity to do something better here while consolidating? IT executives who have cultivated a broader business-IT perspective realize that achieving IT agility and operational excellence requires not only cutting costs but also transforming IT so it focuses on service rather than technology management, on customers instead of users, and on integrating people, process, and technology.

At the same time, IT departments must reassess their core competencies, changing them to enable the delivery of new services. The process may require rethinking and restructuring services and underlying infrastructure to position their organization for the future. HP has just announced a revolutionary architecture and services for converged infrastructure (www.hp.com/go/ci) to help organizations move to shared service model.

A converged infrastructure matches the supply of IT resources with the demand for business applications in an optimal way. By transitioning away from a product-centric approach to a shared-service management model, customers can accelerate standardization, reduce operational costs and accelerate business results (link www.hp.com/us/go/CIServices )

Simply put, transforming an IT organization into a service provider requires a return to the basics. From an internal customer’s perspective, transforming IT into a strategic service provider means aligning the IT organization with business goals, focusing on the value-added services that businesses want, and delivering them. If you like to know more, HP has developed number of best practices in this area based on years of consolidation and shared services project experience (www.hp.com/us/go/CIServices).

Creating the business case for converged infrastructure

Hande_Sahin-Bah — Wed, 04 Nov 2009 21:05:00 GMT

Hi, did you go through one of these business case development processes that just seemed like an endless exercise to you? is it really important to spend couple of weeks collecting data, facts and building financial business case for your infrastructure investments? After all economy just stabilized and budgets are little more relax now. I know how that process can be a hassle when analysis turns into paralysis or your light weight business case is simply not taken serious because you just used the all the default numbers from an online tool. Well, CFOs key role in infrastructure investment decisions are not going away any time soon AND they will question your numbers, assumptions, model. Data center costs, including facilities, energy, server, storage, and networks are almost 60% of the total IT budget.

Every dollar counts. As IT manager looking to invest in infrastructure technology modernization, put yourself in your CIO or board’s shoe. There are number of competing projects from application side that are dear to your business. Shorter and unpredictable business cycles are disrupting business side and more than ever they need to change processes faster, launch new products and services more quickly. All they want is an infrastructure that supports this flexibility and change. Have you heard of HP’s revolutionary converged infrastructure architecture and services announcement (www.hp.com/us/go/CIServices)? No worries, this is not a rip and replace alternative.

A converged infrastructure (www.hp.com/go/ci) matches the supply of IT resources with the demand for business applications in an optimal way. By transitioning away from a product-centric approach to a shared-service management model, customers can accelerate standardization, reduce operational costs and accelerate business results. Even if you have all the good reasons to invest in converged infrastructure you may still not make the winning business case because a) you don’t have the time, data expertise to create the financial case b) Even if you have the business case you just don’t know how the get started with solid plan and roadmap to get you one step towards a converged infrastructure.

First, add some financial acumen to your techie skills. It is important to understand how your company evaluates proposed IT projects. With few exceptions, all companies have a formal process whereby a budget committee approves (or denies) proposed capital appropriations for significant capital expenditures. This process applies to both IT and non-IT capital expenditures and is tied to the company’s budgeting process. The budget committee typically consists of financial and operational leaders who, in many cases, do not have deep technical backgrounds. If you like to hear more about business case development best practices go to HP ROI Services website and download the whitepaper: http://h20219.www2.hp.com/services/us/en/infrastructure/datacenter-consol-virt-roi.html?jumpid=ex_R61_us/en/large/tsg/go_smbcat20

IT Cost Savings

markjgrindle — Tue, 13 Oct 2009 01:48:00 GMT

So I've been involved in some discussions regarding cost savings recently and my initial question was are you trying to cut costs or reduce costs? Yes, I know this sounds like the same thing but to me they are entirely different approaches. On one hand, reducing costs, is more strategic and is really investing money to
save money. On the other hand, cost cutting is more tactical and based on reducing budget without investing. I think most would agree that strategic investment to enable lower costs is the better
answer over time but sometimes companies just don’t have the money to invest
and are struggling to just survive. One company I worked at called this
“dimming the lights”.

Some investment approaches are new technologies such as server virtualization and new hardware that reduces power and cooling costs as well as maintenance costs. There is also investing in application modernization which includes re-engineering your environment focused on Service Oriented Architecture (SOA) and application efficiency and reduction. Automation and tools are another great way to improve your environment while reducing costs but, again, an initial upfront investment is required.

Cost cutting is more short term and reaps immediate benefits but can have a negative long term impact on your environment as well as your people. Some common cost cutting actions include: elimination, or reduction, of training budgets, stopping purchases, stopping in-flight projects, stopping maintenance agreements, and breaking contracts. All of these can have large and immediate benefits to your budget but may have long term repercussions.

Yes, cost management is always an important topic but I think it is more than worthwhile to think through which approach is really going to help your business over time. A combination of the two approaches might be the best answer for you but if you need to cut costs, be cautious of wholesale actions. They aren't always the ones you want long term.

Industry Consolidation

markjgrindle — Tue, 29 Sep 2009 21:55:00 GMT

HP buys EDS (now HP Enterprise Services).

Oracle buys Sun.

Dell buys Perot.

Xerox buys ACS.

A lot of consolidation going on in the Technology Industry and I think there are two primary reasons. First, the economy has made it very difficult for almost every company and now the strong are preying on the weak. I don't mean this in a bad way, stronger, financially sound companies have always looked for opportunities to acquire companies that strengthen their portfolios as well as their market offerings. All with the goals of increasing shareholder value, improving customer offerings and support, and making the company stronger. In fact, this is far from the first purchase for HP (Mercury, Knightsbridge, Opsware, etc.) or IBM (SPSS, ILog, etc.) or many others and there will probably be more. The other reason I think a lot of these acquisitions are going on is the growth in services. It's profitable and it's necessary. It is also a sign of how hardware is being looked at as more of a commodity. There are still differences but they tend to be smaller and the companies leap frog each other. Software can still be profitable but not as much change here and the deals are being well negotiated by the customers. Not that services are easy. Lots of companies don't see the need for outside help and many cannot justify it. I've long been a fan of outsourcing, and getting industry expertise help; although I do think it's important to really think about what you are outsourcing and what tasks you are looking for others to do. Mistakes here can have long term impact to your IT environment as well as the morale of your team. We’ve all read the horror stories of an outsource deal that has gone bad or a consulting engagement that hasn't’ worked out but there are just as many, maybe more, that do work and do work well. I think this is a great time for companies to look at their consulting and outsourcing plans and rethink them. There is opportunity for every company to not only take advantage of these acquisitions/consolidations but to begin to position themselves for the recovery of the economy.

We’ll see what the future holds both in other acquisitions as well as with who really succeeds with the integration of their acquisitions and who doesn’t. It should be interesting.

What is IT Transformation?

markjgrindle — Tue, 29 Sep 2009 20:45:00 GMT

Everyone probably has their own view of what IT Transformation entails but one thing is certain, there are many parts to it that have to be considered to be successful. HP offers a workshop to help customers understand the full scope of Transformation and I've borrowed some of that for this posting. Although this is based on HP's Data Center Transformation Workshop I think the concepts apply to any big initiative. I hope you find this helpful.

As a CIO, or IT leader, navigating through changing business and macroeconomic environments, you are also contending with data center constraints: aging facilities, inadequate infrastructure, disaster recovery capabilities, energy efficiency issues, legacy technologies, and the need to reduce costs. Those issues can seem daunting.

In order to work throw these challenges and successfully complete any large scale initiative there are certain aspects that you need to consider. Following are some important topics as well as some questions to help you understand how well you are positioned in each area.

Setting the Scene

What is your vision and what benefits are you seeking?

Which results do you want to achieve, and when?

What does success look like to you?

How can this initiative make a difference?

Governance

IT governance is the formal process of defining the strategy of your program and overseeing its execution to achieve the goals of the enterprise.

What governance processes do you have in place?

Who are the key stakeholders?

Who controls the decisions about your data center facilities, Infrastructure, applications?

Transformation Journey

Do you have a current and complete inventory of all the assets in your data centers and their relationships and dependencies?

Do you have a clear vision for how you want things to be in the future?

Do you have a clear plan for how to achieve your vision and the related benefits?

Program Management

Large programs can be very complex, in large part because of complex dependencies. In these types of complex initiatives there can often be surprises along the way.

What are some of the key program management success factors?

How do you ensure adherence to schedules and achievement of milestones across many projects?

What are best practices for risk mitigation and handling escalations?

Business Outcomes

A successful program relies on generating momentum by focusing on business priorities and delivering tangible short, medium and long-term results. ‘Quick Wins’ are instrumental in creating momentum.

What outcomes can you achieve in the next six months or years?

Facilities Transformation

Addressing aging facilities, rationalizing data center locations, ensuring sufficient space for expansion, and reducing energy consumption are key business priorities today.

What issues are you facing?

What is your data center facility strategy?

What practical steps can you take to ensure your data center facilities meet your needs?

Infrastructure Transformation

Technology is the vital component within the data center to deliver IT services.

What are your challenges?

· Do you have aging legacy technologies?

· Have you inherited/running “one of everything”?

· Is there low utilization of your assets?

· Do you need to reduce cost?

· How can you take a structured approach to updating, streamlining and virtualizing your infrastructure?

Application and Information Transformation

It might be necessary to migrate your applications and information as you transform the environment. However, many enterprises consider an even more aggressive strategy for transforming their application and information portfolios.

· Are there applications or databases you can retire?

· Can you consolidate your applications?

· Maybe some need to be upgraded?

· Why would you consider those options now?

Management Transformation

How can you improve your management processes and systems to improve service levels and minimize operational overheads and cost?

How can your data center be optimally managed?

Organizational Change

Changing data center management as part of the overall transformation often implies cultural and/or organizational change.

· Is your staff optimally organized?

· Are their roles and responsibilities clear?

· Do their skills need to be updated?

· Is your staff truly supportive of all aspects of your data center transformation?

· If not, how can you change that?

If you disagree and have views on other ways this could work. Let me know.

Data Center Transformation - My First Blog

markjgrindle — Wed, 23 Sep 2009 21:52:00 GMT

Hi and thanks for taking the time to read my Blog. My name is Mark Grindle and I'm part of HP's Data Center Transformation Practice. I've been in the industry and working with Data Center Infrastructure my entire career and that is a lot more years than I want to think about! During my career I've worked for some GREAT companies like GE (Corporate, Plastics, Global Research, and Capital), The Gillette Company, and now HP. I've worked internationally and had the opportunity to build data centers, consolidate data centers, refresh infrastructure including mainframes, servers, super computers, storage, network and pretty much everything else that has to with IT Infrastructure and Architecture. Enough about my background though, this Blog isn't about me but I did want to explain my background and experience a little. My goal is to provide my thoughts and views on IT as it is today and where it might be going. I want to get people thinking by sharing my views and I really hope to stimulate some lively conversation. Please feel free to provide your opinions and views to my posts.

So to start with, let me say that I firmly believe that transformation is doable by any IT group and "reasons" like: I don't have the money, the CEO isn't asking for transformation and won't support it, and the businesses won't support the change are excuses in my opinion. Yes, it is difficult and challenging to get Transformation moving but if you can explain, clearly, the business benefits of the transformation then I think your odds of success go up. I've talked to CEOs, Boards, CFOs, CIOs, and business leaders and convinced them that transformation is vital to the company and convinced them to give me funding rather than a business function. It wasn't an easy task but by providing robust, HARD, financial data as well as drivers that directly tied to the business, they understood the value. It also meant that I had to track "value realization" during the life of the program and constantly report on progress against commitments. This wasn't easy by any means but was worth it in the long run. The key is justifying in business terms and sticking to financials that really impact the budget (productivity only works as a justification if it ties directly to headcount). I'd also suggest involving your support functions earlier rather than later. That means legal, finance, HR, procurement, real estate, and any other groups that would be involved in the program. And don't forget your vendors. All of them don't need to be heavily involved but including your key vendors could provide real benefit. They will have a lot of great advice (once you weed through the push to buy their hardware and software! ) and will be able to accelerate your program if tightly coupled with your strategy.

Those are my thoughts for the day. I hope you find them useful, or at least interesting.

Mark