Focus on your Business Objectives and not IT – with MMC Pulse Centre

• When things go wrong – how much time and money are you just never able to recover?

• Are you completely confident that you are using your IT infrastructure to its full potential?

• Should you and your team be spending more time on strategy, rather than fixing and managing IT issues?

For the greater part of 2009 the leaders of MMC were involved in exhaustive research and analysis regarding the virtues, possibilities and practical options in establishing a comprehensive Managed Services solution for our customers.

The announcement of our most recent and most exciting solution to date – MMC Pulse Centre – bears testimony to our dedication in providing our clients with access to cost effective, state-of-the-art IT solutions that are geared to adding significant value within every aspect of their business.

Why the development of MMC Pulse Centre (our Managed Services solution) now?

MMC recognises the fact that organisations – whether they have an IT department or not, are faced with an ever increasing dependence on the fast-evolving, complex technologies that they are required to align with in order to be successful in the modern business arena.

IT has the potential to pose a very real threat to ones business due to the fact that it is not only an ongoing challenge to keep abreast with the latest technologies, but because up-to-date, specialised knowledge and experience is required to ensure these technologies upon which we so heavily rely, are suitably integrated within our networks and existing infrastructures, as well as maintained to ensure stability and therefore optimal performance. As if all of this is not enough of a headache, business leaders are faced with the financial considerations regarding whether the return on their IT investment is really worth the while.

Although the traditional break-fix solution is still the service standard for many organisations, MMC believes that we are able to offer maximum value through a more cost-effective, pro-active solution that ensures we are able to maintain optimal levels of service and reliability throughout our clients IT infrastructure.

What is ‘MMC Pulse Centre (Managed Services)?

Monitoring . Management . Consistency . Success

MMC Pulse Centre (Managed Services) is a pro-active, remotely operated, software enabled, automated auditing and monitoring IT management solution that operates 24/7/365.

Through deploying this management solution within your organisation, we are able to detect potential problems within any area of your IT Infrastructure (from your network, servers and desktop PC’s, to software applications, portable devices etc.) and recommend/make suitable adjustments before these potential threats can affect the functioning of your business.

Putting it in perspective:-

The familiar scenario involves a staff member within your organisation, be they from within the IT department or not, making a call to our service centre to report a problem. MMC technicians then prepare to solve the problem remotely if they can, or on site as the situation requires.

With a managed services solution such as the MMC Pulse Centre, we are already aware of potential problems before they actually materialise. This means that we are able to deploy a solution before anyone needs to call us and before downtime is experienced within your organisation.

What are the Benefits of Managed Services?

Scalability & Flexibility – MMC is able to tailor our service agreement with you to cater to your individual requirements and budget. As your business grows, MMC has the resources to grow with you.

Security – You know that someone is keeping tabs on your entire infrastructure 24/7/365. We build a virtual fortress that provides the most effective protection for you IT assets and intellectual capital.

Predictability – Our Managed Services are provided at a monthly rate which will significantly reduce your expenditure on IT maintenance and repair services.

Reliability – No business can afford to lose unnecessary man-hours. By ensuring your IT infrastructure is running smoothly at all times, you will experience the least amount of downtime and a significant increase in profit potential.

Accountability – You have one point of call when you need to discuss anything related to IT and a single service provider to ensure you are gaining the full benefit from all the components of your IT infrastructure. Our stringent SLA’s provide you with the perfect foundation for 100% assurance and peace-of-mind.

MMC Pulse Centre – Core Services

MMC will provide clients with a menu of service options that can be customised to suit our client’s individual requirements. The basis of our service offering however includes:

Standard Features:

• Site Assessment & Inventory

• Hardware/Software Analysis

• Infrastructure Auditing & Reporting

Automated Tasks:

• Spyware Protection & Removal

• Virus Protection

• Disk Drive Analysis

• Security Patch Management

• Application Usage

• System Auditing

• Back-up & Disaster Recovery

• User Policy Enforcement

Where to from here...

MMC will be officially launching the MMC Pulse Centre in January 2010. Although we will be making specific recommendations to clients over the course of January and February, we urge interested clients to contact their service representative for further information and a FREE assessment of their needs as soon as possible.

Please email us at info@mmc.za.com, or call us on 021 530 1600 for further information.

5 Tips for Managing IT and Physical Access

How does your business' IT security system compare with its system for physical security? Criminals attack the weakest link, and at many organizations today, that is likely to be the front door -- literally. Here are five tips for a unified approach to securing physical and logical assets.

Success is just a matter of knowing the right "secrets." Download the free eBook, "The Edge of Success: 9 Building Blocks to Double Your Sales." You will discover the fastest, most effective ways to grow your business and still have time to live your life.

Entering a physical facility should be just as secure as logging onto a PC.

Security professionals often find themselves hard-pressed to secure both physical and logical assets (as well as comply with stringent government mandates). So why are so many organizations behind the curve when it comes to managing physical and logical access?

There are dozens of excuses: "It's too expensive." "Securing electronic data is a greater concern." "We wouldn't even know where to start." However, the reality is that a unified approach to physical and logical access actually saves money -- not to mention time. While it's true that cyberattacks are a mounting threat, physical/logical access control loopholes can be Achilles' heels to sophisticated hackers who know how to exploit them.

High assurance identity credentials allow organizations to manage access to secure areas and systems. Just keep the following five tips in mind to ensure that your organization isn't falling victim to common access control blunders.

1. Converge!

Do not treat physical and logical access control separately. Both are about controlling access to a resource -- they share the same security goal. Whether that resource is a sensitive room or a sensitive piece of data, access rules will be defined in the same manner. Similarly, the same identity information about the requestor should be required to evaluate access requests.

CISOs at many organizations struggle to justify the cost of high assurance identity credentials for use in their IT systems. CSOs have struggled with this same cost vs. benefit problem for high-assurance PACS capabilities, such as biometric readers.

Today, enterprises creating successful business cases look at physical and logical access as the same problem that can -- and should -- leverage the same solution. Convergence saves money and improves security, a rarity in this space.

2. Guard Physical Assets Closely

Do not allow physical security to lag behind logical security. Criminals attack the weakest link, and at many organizations today, that is likely to be the front door -- literally.

There have been many cases where data thefts occurred not online, but rather through lax physical security of the servers themselves. Remember Willie Sutton's famous quote about why he robbed banks: "Because that's where the money is."

3. Don't Stop at Your Front Door

If you have embraced the benefits of identity federation for your Web portal or cloud applications, don't stop at your front door. Identity Federation is commonly accepted as the most effective way to gain assurance of the identity of persons external to your organization.

In other words, I accept my partner's own corporate-issued credential for access into my applications. I receive the most up-to-date identity information about my partner, verification of their employment status, and I avoid having to provision and maintain credentials for these external users. The most mature identity federation organizations, though, still issue me a temporary badge when I show up in their building's lobby, despite being able to accept my own corporate credentials at their Web site.

If you consider that visitors to your offices are there for a business purpose that is related to whom they work for and in what role, then this is critical to verify at the time access is requested. If their employment relationship no longer exists (e.g. they were fired), this would be critical to know before allowing access to the building. However, this vetting is rare, because it's socially awkward and tedious to do manually. Interoperable credentials and a trust framework that backs them allow any organization to leverage their partners' credentials for PACS and LACS simultaneously.

4. PACS/LACS Convergence = Better Operational Intelligence

PACS/LACS convergence is about more than costs savings or increased assurance of identities; it is about better operational intelligence.

CISOs and CSOs have not traditionally talked to one another (often the case even when it is the same person in both roles) given the silo-like nature of these areas. What opportunities are missed as a result? If a user logs in from home on their VPN, and the same person has just badged in at the office, isn't that a problem?

Even PACS talking to PACS in the same organization is unusual. What if a user badges into their home office in the morning and the branch office across the country an hour later? Attackers are looking for blind spots, and the "PACS/LACS barrier" represents tempting low-hanging fruit.

5. Evaluate Options

Look to your industry or immediate customer base to determine if there are already others that have implemented converged PACS/LACS solutions with external partners in mind.

In the United States, the Federal Government's PIV and PIV-I are the dominant high-assurance credentials intended to be used for both PACS and LACS. Everything from desktop login to email can already take advantage of PIV or PIV-I based credential, but recently PACS vendors have released systems compatible with these credentials as well. Converged PACS/LACS solutions are now mainstream, and will be the focus of most major security conferences in 2010.

TechNewsWorld

Top 10 Security Challenges For 2010

Cloud-hosted malware, bot blasts, compromised smartphones, and privacy-busting malvertising are a few of the security pitfalls we can expect this year.

Computing is in a state of constant change. Apps are migrating toward the cloud. Mobile devices are changing the way we interact with our machines and the way we connect to networks. Real-time information has become increasingly important. The threats are changing too.

With 2010 freshly upon us, 'tis the season to ponder future threats. Last month's threat of a portly, bearded man entering one's household through a chimney was mitigated by a sufficiently hot flame, but cybercriminals aren't bothered by physical barriers. They can enter computers through network cables or a wireless connection and make off with valuable information.

What follows are a few predictions about what may come in the world of computer security.

1. Spam, Scams Go Social and Realtime

Security researchers at Websense, Breach Security, IBM Internet Security Systems' X-Force, and Symantec concur that cybercriminals will escalate attacks on social networking sites such as Facebook, MySpace, and LinkedIn, and on real-time social sites like Twitter. With Google and Bing, not to mention Google Wave, integrating realtime features, scammers know that time is increasingly on their side: Often it takes time to recognize a malicious link or file and unless countermeasures are more or less immediate, there will always be at least some victims.

Contrarian view: For those who never really bought into the social network, real-time craze, such dangers offer another reason to hope that the computing world gets its own equivalent of the slow food movement. Speed may be Google's most cherished goal, but it also increases the velocity of risk.

2. Crime Cloud

Security vendors AVG, M86, and RSA foresee criminals attacking cloud services and using them to direct and control attacks. Cybercrime toolkits are already widely used. It's only a small step from there to cybercrime as a service. IBM ISS X-Force researchers expect more "exploits-as-a-service," and that's not a hard call to make when you have Amazon AWS already being used to host a malware command and control server.

Sam Curry, VP product management and strategy at RSA, said, "Expect a lot of attention in 2010 to how risk side [of the cloud] is mitigated."

Contrarian view: While cybercriminals have experimented with services like Google's App Engine to control attacks, the level of oversight at such services, not to mention the fact that payment is usually required, will make the free malware hosting offered by poorly secured Web sites and databases a better deal. Why bother pretending to be a paying customer when you can just break in and plant malware on someone else's machine?

3. Hijacking Trusted Sites For Malware

Breach Security sees continued innovation in efforts to compromise trusted sites and load them up with malware. SQL injection attacks have proven to be spectacularly successful so far, so it's unlikely that will change. For cybercriminals, it will almost always make more sense to have a third-party distributing their malware.

Contrarian view: The pointlessness of blogging will finally dawn on people and, in conjunction with a year of dot-com failures and layoffs, there will be fewer people running Web sites. In addition, the shift toward controlled devices -- mobile phones, tablets, and the like - and the emergence of Chrome OS netbooks will mean less opportunity for user error. Security thus will improve.

4. Macs (Finally) Compromised In Significant Numbers

Security companies have been salivating at the prospect of malware on Macs for years. In 2010, Websense says, we will see a drive-by exploit that affects Safari under Mac OS X and hackers will pay increased attention to the Mac platform.

Symantec is similarly worried about unprotected Mac users who haven't gotten into the habit of paying $30 a year for antivirus software. Other security companies such as Sophos have been saying as much for years. Zscaler believes Apple's increasingly high profile will force the company to invest more in security as its devices come under more sustained attack. It's almost as if security companies want Apple's machines to be insecure.

Contrarian view: The only people running Mac security software are those who have to do so as a matter of regulatory compliance. That won't change until Windows market share drops below 80% and/or Mac market share exceeds 20%. If there is an exploit that affects Macs widely, it will probably be the result of an Adobe Flash vulnerability.

5. More Poisoned Search Results, Malvertising

Exploiting trust works. Cybercriminals will put more effort into taking advantage of trusted Web sites. They will use search engines and advertisements to infect the unprotected. On this there's considerable agreement: AVG, Websense, and M86 all anticipate continued efforts to subvert search results and exploit interest in breaking news and events.

Perhaps 2010 will be the year a cybercriminal creates a fake outbreak story that gets attention and leads interested parties to malicious Web sites that create a real cyber outbreak.

Contrarian view: Google and Microsoft will partner to keep search and advertising relatively safe, knowing full well that they cannot afford to lose the trust of users. Expect a rogue ad network to be brought down with much fanfare.

6. Bots, Bots, And More Bots

Why bother with cloud-hosted malware when botnets offer the same service for less? Even better for cybercriminals, botnets offer a source of income. For security vendors, that suggests bots will continue to become more sophisticated. Botnets have become the foundation of cybercrime, Symantec claims.

Dan Hubbard, CTO of Websense, said that there has been some good news about bots -- better communication in the security community and with law enforcement, resulting in more arrests and botnet takedowns than in the past.

But because botnets generate cash for criminals, he expects more criminal gangs will choose a path to wealth that's easier than building a botnet: hijacking a botnet operated by a different gang.

That kind of conflict could actually limit botnet growth or at least attract the attention of security experts and law enforcement. Contrarian view: Botnets not only have to defend against security researchers, but against other botnet operators. Websense sees botnet gangs fighting turf wars, similar to the way that the Bredolab botnet shut down the Zeus/Zbot on infected computers.

7. Piracy Gets Riskier

In early December, Microsoft launched a broad effort to reduce software piracy, noting that it has received a rising number of complaints from users who purchased or otherwise obtained pirated versions of Windows.

It seems that counterfeit software is increasingly infected software. IBM Internet Security Systems' X-Force researchers expect that use of pirated software will increasingly lead to malware infection and that users of such software will become the "Typhoid Marys" of the global computing community.

Contrarian view: Will the last user of desktop software please turn out the lights? We're all moving into the cloud where we don't have to worry about a counterfeit, infectious version of Google Apps, at least until someone alters our DNS host file.

8. Mobile Security Becomes Real Issue

"Smartphones such as the iPhone and Android-based handsets, which are used increasingly for business purposes, are essentially miniature personal computers, and in 2010 will face the same types of attacks that target traditional computing," predicts Websense. And the company is not alone in that belief. Practically every security vendor has or is developing a mobile security product or service. As with Macs, the security industry would welcome a new market.

Websense's Hubbard says it will be interesting to see how Apple's closed App Store and Google's more open Android Market compare in terms of mobile malware in 2010.

Contrarian view: The researchers at IBM ISS X-Force believe that attacks on mobile phones will remain scarce. But while network-based attacks on mobile phones may remain relatively rare, physical attacks will rise: Snatch-and-grab attacks are considerably easier than cyberattacks and produce both data and a physical item that can be sold. With unemployment over 10%, unsolicited phone collection could become a growth industry.

9. A Major Insider Theft Scandal Will Surface

Ongoing improvements in network security will encourage organized cybercrime groups to think about the long con. Somewhere next year, expect someone with access to data at a large organization to be caught working for or with a cybercrime group. The Identity Theft Resource Center anticipates a rising number of insider cases because of failure to follow basic workplace security protocols.

Contrarian view: As above, but the organization will be able to hide the incident, at least until 2011. This prediction has the added benefit of being difficult to prove wrong next year.

10. Clickjacking Strikes Back

Zscaler believes that the clickjacking vulnerability -- a way to alter a Web app's user interface to dupe users into clicking on concealed buttons -- will be employed in attacks more frequently. Jeremiah Grossman, founder and CTO of WhiteHat Security, and Robert "RSnake" Hansen, founder and CEO of SecTheory, disclosed information about the technique in October 2008. While some effort has been made to mitigate the risk of clickjacking, Zscaler says the technique can still be effective, particularly in attacks with a social engineering component.

Contrarian view: Why bother, when you can just launch a window that displays a fake security scan and get clueless users to pay for fake security software? Ignorance is a vulnerability that isn't easy to patch.

Information Week

Be smart – don’t let cybercrime catch you out

Cybercrime, by definition, is any form of criminal activity that takes place within the realms of cyberspace. This type of crime is rife and is ever on the increase, with cybercriminals constantly coming up with new ways to take advantage of unwary internet users. From phishing to pharming to worms, Trojans, bots and viruses, the number of threats involved with the Internet is astounding.

The 419 scam remains among the most common types of cybercrime, generally taking the form of an email with the sender requesting help to transfer large sums of money. In return, the sender offers commission of a ridiculous amount of money.

The scammers then request money to pay for some of the costs associated with the transfer. Once this money is sent, the scammers will either disappear immediately or try to get the victim to send more money with claims of continued problems with the transfer.

While this scam continues to catch people out, it is being eclipsed by another, increasingly more prevalent form of cybercrime – identity theft.

This type of cybercrime takes place when criminals obtain key pieces of confidential information about people and use this information to conduct fraudulent activities in their name.

Identity theft and resulting fraud is dangerous for both individuals and businesses, and the implications are widespread. Once criminals get hold of details like ID numbers, bank accounts, credit cards, addresses and so on they can open bank accounts in other people’s names, steal money, conduct fraudulent transactions and so on. This could result in the victim being made bankrupt, blacklisted or even jailed for illegal activities.

In order to protect themselves from online identity theft, users need to be aware of the tactics scammers use to steal confidential information. In particular, users need to be extremely careful with internet financial transactions.

Users should never access online banking from a public terminal at the risk of falling victim to keystroke loggers that record exactly which keys are pressed. When visiting an online banking sight, look out for the padlock at the bottom right hand side of the screen that reveals an encrypted connection. If this padlock is not evident, leave the sight immediately as the connection is not secure and details could be phished. If the security certificate of the site has expired, once again leave it immediately as information sent over the connection will not be secure. There is also a green bar next to the URL window in most internet browsers. This bar will change colour to yellow or red if the website you are visiting is known to be involved in anything suspect.

Remember that a bank will never email you asking you to confirm confidential details. Under no circumstances should you click on any links in emails purportedly sent from a bank. These will take users to a mirror site that looks like the real bank website, but is not encrypted and will be used to harvest details. If at any stage you are unsure of anything, phone the bank and ask them to confirm that this information was requested, or to report the scammers.

Cybercrime is constantly evolving as scammers work to keep ahead of new technology, and it is impossible to predict which way this crime will go in the future. However, one thing is for certain, with the World Cup due to take place in South Africa soon, the attentions of the world, and therefore the attentions of cybercriminals, will be firmly focused on the country.

Internet users need to make a conscious effort to be aware of the latest in cybercriminal activities, and take steps to protect themselves from their activities to ensure that they do not fall victim to this growing form of crime.

IT News Africa

Email archiving – not just another nice-to-have

In light of regulatory issues around IT governance as stipulated by the South African King III draft on good corporate governance – now open for public comment – e-mail archiving has yet again come under the spotlight.

The draft report states: In IT governance, one seeks confidentiality; integrity and availability of the functioning of the system; possession of the system, authenticity of system information; and assurance that the system is usable and useful. Concerns are unauthorised use, access, disclosure, disruption or changes to the information system.

The protection of the information that enters and resides within an organisation is therefore more important than ever, which is why it so important that e-mail is archived and protected in order to safeguard these valuable assets.

Indeed, e-mail is a mission-critical part of any organisation, irrespective of its size and regulatory issues. In fact, recent studies by the Enterprise Strategy Group suggest that e-mail and other messaging applications store as much as 75 percent of a company’s intellectual property.

As such Gartner reports the e-mail archiving software market grew 33% in 2007 to reach $376 million and is forecasting a compound annual growth rate of nearly 36% until it reaches $1.72 billion by 2012. This growth is driven by the above issues and will undoubtedly also be mirrored by South African organisations such as financial institutions and listed entities face increasing regulatory pressure.

E-mail archiving 101

So where to start? Currently there are two main alternatives to consider: in-house or hosted. The in-house alternative uses internal resources and IT infrastructure to process and store archived e-mail messages.

Hosted solutions on the other hand provide a feasible option to companies with limited IT budgets and personnel as well as those wanting to avoid investing capital upfront.

The next decision pertains to specific requirements for the email-archiving solution. For example, what systems will it support; what is the volume of messages that will pass through it each day; and what information should be retained?

Once the above is determined it will help set the criteria that will be used to select a product. Other important questions to ask also include:

. Do you have mixed systems (Windows, Unix, Linux);

. Is your corporate email system centrally located or geographically dispersed;

. Can the solution archive messages from multiple email systems;

. Can the solution capture messages at the gateway;

. Does expansion of the system require taking the system down;

. Can the solution search across individual mailboxes throughout a network;

. How long would an enterprise-wide search take;

. How are messages secured;

. Can the solution work with encryption;

. Can the solution allow off-line access to the archive; and

. Can the solution present to users only those messages they have permission for?

After a solution has been chosen, roll it out in a phased approach, dividing the environment into logical segments. This will serve as good trial run and ensure a gradual change which will also benefit the change management process within the organisation.

What should an effective archive solution provide?

As soon as the archiving solution is successfully implemented, organisations should start reaping the benefits. Indeed, an effective archiving platform will store, manage, and enable the discovery of corporate data from e-mail systems, file server environments, instant messaging platforms, and collaboration and content management systems.

From a legal and compliance perspective, an archiving solution should be able to be configured to retain and expire e-mail and other electronically stored information according to policy, ensuring that it is kept for the appropriate period of time required to meet regulatory or legal requirements.

Also, from an intelligent management perspective, your archiving solution should control archive storage and operational costs. Intelligent archiving, for example, essentially shapes the archive to store only business-valued content with context. This is accomplished through classification options using automated classification, user-driven classification, or third-party (for example, records management) approaches.

Lastly, it should allow for safe e-discovery; enabling organisations to analyse and filter search results to quickly drill down to the most relevant content with a few simple clicks of the mouse.

Ultimately, your archiving solution should alleviate the pressure of effectively protecting and managing business-critical data, safeguarding your company’s intellectual property.

IT News Africa

Software audits: The pitfalls you need to know about

With software licence audits on the up, analysts have revealed the pitfalls that businesses need to be aware of and how to avoid them.

Software audits involve vendors requiring their customers to prove their licences are correct for the products they use. Such audits can prove a compliance headache for companies and leave them at risk of a large compensation payout to their tech suppliers as well as a bruised reputation - making it key for CFOs and CIOs to keep licensing up to date.

According to Forrester Research, end users saw an increase in software audits in 2009 and the analyst house warns that sourcing professionals need to make sure they minimise the risks and stay in control of the audit process.

Forrester's Surviving A Software License Audit report highlights several ways in which software audits could hit businesses in the pocket.

According to the analyst, the growth of virtualisation could cause problems, thanks to original licence terms that are often based on the number of physical servers.

Businesses need to make sure their software estate is in order as more virtual machines and applications are created, fewer physical servers are required, meaning organisations may be paying licences on more physical servers than they are actually using.

Another situation in which businesses can be caught out in a software audit is when an application draws some of its data from another, a process known as multiplexing; if a company's customers use a system to check their account status which draws some of its data from a separate financial application, vendors will often expect businesses to pay an additional licence on that financial application for every customer that indirectly accesses data held within it.

Other problem areas include software which is only licensed for use within a business but which is also used externally. If suppliers or customers have access to a system as well as the business that has paid for the licence - to check the status of an order, for example - vendors are likely to demand licences are bought for these additional users.

Inactive user accounts are another potential pitfall with businesses ending up paying more than they need to.

Related to this is the accidental deployment of applications: even if software is copied onto multiple devices by accident or by someone who didn't realise the licensing implications, vendors are within their rights to request additional license fees.

Forrester says businesses need to prepare for audits and control software audit teams to minimise the likelihood of this kind of thing happening.

The analysts recommend businesses identify where under-licensing exists and resolve these issues with sales reps, rather than leaving it to an audit team, as it will often be at a more favourable price.

Companies should also check the precise wording of existing contracts to minimise the potential for a vendor to interpret them differently or for terms to be changed without customers fully understanding them.

Silicon.com

2010 will be a wild ride for IT

This year is going to be amazingly full of change in IT. " IT sees a lot of change every year" you say? Yes, fine and true. But not like this one. Not at this magnitude. Consider:

Virtualization is being taken up at such a pace that it's hard to find a metaphor to describe it. "Exploding" has a pieces-coming-apart-at-high-speed vibe, when in fact virtualization's pieces are all coming together. "Imploding" doesn't work either. We've had maybe five years of fast growth, but now it's mainstream and ready for the lion's share of apps. We've passed the point where the natural expectation for new servers is that they may be virtualized.

The best default assumption now is that they will be virtualized. Yes, there are still exceptions, but they're quickly growing fewer and further between. Whereas five years ago, many IT managers were still routinely skeptical about virtualizing production workloads, for most it's now just a matter of when and how, not if.

Beyond the straightforward consolidation and infrastructure rationalization that powered virtualization's first wave of mainstream adoption, in 2010 many data centers will be well into their second wave. Many others will be entering it. In recent discussions, CIOs have routinely lauded the ability to leverage virtualization into high-value attributes like high availability and disaster tolerance. Recent improvements in both processors and virtualization software are bringing in use cases previously considered "hard to virtualize"-for example, communications and database servers.

And those have already virtualized their servers will now start virtualizing their desktops. Millions of desktops are in need of updating, especially those that skipped Windows Vista. In rolling out Windows 7, IT departments will ask themselves whether they really want to get into yet another round of distributed management. Desktop virtualization technology is now far superior to what was available just three years back; it will see significant new uptake among large enterprises.

Cloud and as-a-service computing Cloud computing, in all of its X as a Service forms (where X = software, infrastructure, platform, storage, or whathaveyou), is not the way a majority of IT will be done this year, or next, or the one after that. But don't let its definitional and standards battles, ornery nay-sayers, or "seems interesting, but we're not exactly sure how we'll use it" status fool you.

That's exactly where virtualization was, just five years ago. These "early days" issues will work themselves out in short order. Software as a Service has already gone mainstream, with many well-known examples such as Salesforce.com, Google Apps, and Zoho. The infrastructure and platform-as-a-service senses of cloud are less widely accepted, but only for now. They too have enthusiastic customers.

Cloud is the way that start-ups now allocate a lot of their IT infrastructure, rather than building their own data centers. That approach will seep into enterprises as well, gradually at first, but gaining steam. Beyond the usual poster kid providers-Amazon Web Services, GoGrid, Google, Rackspace, and Terremark-Microsoft has arrived with Azure for developers; so too have IBM, HP, and others for specific use cases such as testing.

Whereas virtualization simplifies and improves the computing resources that you have to provide, cloud computing radically simplifies by having someone else provide resources and capabilities as an on-demand service. Given the economic advantages of a centralized, network-delivered service, cloud will mature and grow rapidly.

New Processors: Intel has already gotten off the mark with over two dozen new CPU SKUs. At 32nm. Didn't we just go through the whole 45nm roll-out? Not literally, but it sure seems like it-and yet here were are, getting a full wave of the next fabrication generation. Oh, you wanted server rather than desktop/laptop chips? The much-updated "Nehalem" generation of 2009 not quite enough? Ok, the 8-core, multi-threaded "Nehalem-EX" is just around the corner. Its design for performance, I/O, virtualization, and availability enters it seriously into the Big Iron battle among scale-up architectures.

Intel's also going to get the next generation ("Tukwila") of its Even Bigger Iron processor, Itanium, out the door. Not to be outdone, IBM's POWER7 generation is expected this year, complete with it's own raft of Wow! feeds, speeds, and specifications. Oh, yeah, a new z11 mainframe generation is rumored. Did I miss anyone? Probably.

New Systems: Where there are new processor generations, new system generations are right behind. Dell, HP, IBM, Sun, and everyone else in the x86 server market is going to offer a way to get Nehalem-EX into the hands of virtualization-hungry data centers. HP will naturally have new Itanium-based servers driven by Tukwila, as may Itanium's other supporters. IBM's definitely going to have a new generation of Power Systems sporting POWER7, and a new System z for the z11 processor.

Long story short, the market's going to be awash in amazingly powerful, many-core, many-thread, virtualization- and workload-optimized systems. In 2010, it will be rare to get a new system product briefing and think "yeah yeah, a minor, incremental update." All the vendors are aiming for "Wow! That's amazing! I want one! I mean...I want a lot of 'em!"

Oh, and those are just compute elements. I didn't yet mention the wholesale shift in storage toward highly intelligent, highly virtualized arrays, or the revolution that Flash-based solid state disks (SSDs) have become. Nor have we talked about the rapid convergence of servers, storage, and networking. Oh, well. No time now.

New Vendors: IT vendors are rapidly consolidating and verticalizing their operations. Who sells what, to whom, is much in flux. For example, Cisco Systems doesn't just sell networking; it also sells servers and collaboration tools. Oracle will be a server and storage company, in addition to applications and middleware. EMC has been transforming into a management and security company, in addition to the storage and information management it previously provided.

IBM and HP are nearly everything companies; their ongoing stream of acquisitions makes them even-more-of-everything companies. Dell is adding major in-house services. Microsoft's adding a cloud. Oh, yeah, Amazon and Google are becoming IT providers. Fancy that. VMware has become a tier-one platform and management company. On and on. If the vendors themselves are not new, their position in the market and their ambitions certainly are.

New Applications: Every few years, a new class of applications comes on-line. The historical ERP and CRM waves are good examples. Social networks, mobile everything, and pervasive computing are current examples.

Social networks just a consumer/personal thing, you say? Then why am I being briefed on system management tools integrated with Twitter? Mobile everything has been a decade coming but continues to accelerate as the devices--whether iPhone, BlackBerry, Palm Pre, Android, Windows Mobile, or all the rest--become smarter and cheaper, and as mobile broadband infrastructure improves. Finally, pervasive computing--the idea of sensors and actuators spread throughout our homes, stores, cars, roads, buildings, factories, and other places, all intelligently coordinated--has been coming (slowly) for a decade.

But the technology of RFID, digital surveillance, wide-area and mesh networks, and intelligent sensors have greatly matured, causing organizations to consider new opportunities for optimizing complex macro-systems like roadways, supply chains, and power grids. IBM's "Smarter Planet" phrasing nicely captures this.

I've really just brushed the surface of the changes that are rapidly occurring in IT. None are ex nihilo new; instead they accelerate and deepen technologies, trends, and initiatives that IT's been working on for some time. A combination of product cycle timing and economic downturn dampened the pace of 2008 and 2009. This year benefits. It's going to be a wild ride, with everything bursting forth. Shouldwe call that riding the tiger? Riding a rocket sled? Whatever metaphor you prefer, hang on tight. This year is going to be a fast, aggressive and fun ride.

CNET News

Cloud Ready For App Development In 2010

Cloud computing offers a potentially higher speed development platform. It's time to get started, say three Forrester Research analysts.

The cloud is an emerging platform that can ease the strain on application development, analysts at Forrester Research conclude in a report published Monday, "The Top Five Changes For Application Development In 2010."

Analysts Mike Gualtieri, John Rymer and Jeffrey Hammond conclude that Amazon Web Services' (AWS) cloud, EC2, and other public clouds, such as Salesforce.com's Force.com, AT&T Synaptic Compute cloud, Rackspace Cloud, and Microsoft Azure, are offering mature operational environments that can be used to speed the development and launch of cloud applications.

Salesforce.com is a leader in establishing its platform as a development environment and encouraging the creation of application to run alongside its standard customer relationship management applications. It offers a proprietary language, Apex, for the creation of business logic and the Visual Force graphical user interface building tool that invokes Adobe Flex components.

Force.com's senior director of platform product marketing, Ariel Kelman, said it takes one-fifth the time to develop an application using the database-centric Force.com platform and development tools versus standard enterprise development techniques. He says that conclusion is supported by a Salesforce.com-sponsored study by Nucleus Research.

In addition to Microsoft and Force.com, the analysts cited LongJump, Caspio, Boomi, and WorkXpress as supplying online tools for cloud application development.

"Cloud platforms offer big improvements in the cost and speed of deploying applications... Embrace cloud computing as an emerging platform," they wrote. The mature cloud platforms allow development teams to skip buying servers and storage and setting up networks to connect them. Rather, development can proceed more directly, based on use of the target cloud's APIs, which speeds the launch of the application in the cloud, they said.

By developing applications for the cloud, developers avoid the doggedly perplexing issue of being able to scale out the application at will. Applications can scale up just as fast as server instance subscriptions can be added, based on the cloud's subscription process. If the application runs on open source code, then no new license charges need to be incurred as the application is scaled out across more servers, the analysts observed.

Public clouds now offer choices for application deployment. The infrastructure as a service option, such as Amazon's EC2, offers developers maximum control over the application. Platform as a service providers, such as Force.com and Microsoft Azure, offer a more integrated development environment leading to faster deployment; and software as a service vendors, such as Oracle's E-Business suite, open source SugarCRM, or Salesforce.com's CRM application, offer ready-to-use, finished applications.

Furthermore, the analysts concluded, public cloud servers are good for running Web site applications, collaboration and social networking applications, email, information services and analysis applications dealing with large data sets. They are still less desirable for running core business production systems and transaction applications.

"The cloud is here to stay," the analysts concluded. "Start learning what cloud computing holds for your development organization. Formulate a strategy to put this new generation of platforms to work."

Five key elements of such a strategy are:

1. Make enterprise development more nimble and adaptable -- in other words, more like a startup. "Every line of code they write has to be linked to their ability to obtain revenue." So enterprise development teams should know at a deep level what it is the company is trying to do and how it relates to its customers.

2. Startups don't build up elaborate architectures. They use "just enough business-focused process and technical tools to get them to a solution as quickly as possible," they said. Likewise, startups need to respond quickly to changing conditions and competition. "You can't just set a course and stubbornly stick to it," they warn. In other words, find your inner startup, they advise, and put it to work.

3. Don't stick with the same development platform out of misguided loyalty. The Java and .Net languages and related technologies remain the favorites of developers, but the analysts said there has been "a significant uptick" in the use of lighter weight technologies, such as the Apache Tomcat Server, Adobe Flex, the Dojo Foundation's Ajax components, open source Drupal content management, Google Web Toolkit, and the open source Joomla portal management system.

In addition, other open source code is frequently used, including the Red Hat JBoss application server and middleware, the Ruby on Rails scripting language framework,the SpringSource Framework for producing Java applications (SpringSource is now part of VMware), and the Zend Framework for PHP development from Zend Technologies. A large retail chain recently deployed open source Geronimo, an Apache Java application server to 4,000 stores, saving itself charges for 4,000 software licenses.

4. The analysts urged developers to expand their definition of performance in 2010. Performance is affected by the overall platform quality, ease of use, ease of adoption, ease of making changes and availability of a broad community of support. Open source code alternatives are often not as rich in features as their commercial counterparts, "but they often measure up just as well in other dimensions of an expanded performance matrix," they wrote.

Furthermore, the report's authors urged developers to become "passionate" about the user experience they were delivering in their software. Best practices for user experience design need to be injected into the development process, they said.

5. Finally, the analysts urged the cultivation of developers with the right talents. Many offer fine technical skills but don't have much understanding of the business. When accelerating development in the cloud, knowledge of the business may prove as crucial as technical skill.

Cloud computing is part of the "new normal" of enterprise computing, which takes the lean and mean operation during recessionary times and continues it into the return to a healthier economy. Cloud development will help enterprises do more with less, and getting cloud skills right might make the difference between success and failure. "If your competition can build an app faster than you, then your business will be destined to be no more than a fast follower," they concluded.

Information Week