Happy Father's Day!
In the midst of the Hype cycle we often loose sight on what is really important in life. Today is a day for all of us to give thanks for all of the Father's in our lives.
My father is long since passed away. My biggest regret was not taking the time out from my busy schedule to have dinner with him. I had a meeting come up while and had to fly off to another critical business trip. I pushed our dinner to the next trip I would have in town a couple of month's later. Unfortunately, he died 2 weeks before in a strange golf cart accident.
No matter how critical or important we think what we are doing is - always ask yourself if it is worth it? Worth the risk or not taking the time for those that mean the most. Never take them for granted because you never know when they will not be there.
Special Happy Father's Day for all of the Father's out there that have made a difference in a child's life and have sacrificed time away from their families to work on projects or roll outs of products with me over the years.
Over the next few weeks stay tuned for developing changes and tips and tricks on planning your application virtualization deployment from lesson learned.
Next Post: Proceed with caution: Application & Desktop Virtualization
Insight on tips and tricks as not to break your current systems management infrastructure or end up taking out network nodes, impacting performance of clients, and more...
Sunday, June 20, 2010
Tuesday, February 23, 2010
Listening to Customers: Where the Rubber Meets the Road
Moving Beyond Vision
Vision is great but it only gets a company so far. The true testament of success is the ability of the company to not only create the vision and product but to succinctly execute. A wise VC once told me that a man and a product does not make a company make. The testament of a true company is one that can 1) create a vision of product, 2) refine it to meet succinct customer needs, and 3) execute from inception to deployment.
Those 3 steps are a lot harder than they appear. The weakest link that I have seen over my career that determines the success or failure of a product in the market is the ability of the company to listen to their customers. Although the opinion of the CEO, CTO, Engineers, Marketing, and Sales are interesting - they are not as relevant as that of the customer that uses the products in production to solve real world problems. Here is a list of my top 10 lessons learned implementing application virtualization.
Top 10 Deployment Considerations: Application Virtualization
Application Virtualization is a departure from the norm typically on how most Enterprise solutions are packaged and deployed. Communicating and planning based on what you know regarding the application life cycle is critical to both the customer and the company.
Key Questions to Ask:
1) Target Application Dependencies?: are there any dependencies with physically installed applications on the endpoint? If so what are those applications? Should or can they also be virtualized? What will the potential impact be? Always good to get a list and/or dependency mapping of all applications.
2) Why is the customer migrating the application to a virtual paradigm? The typical responses are either Application Compatibility issues, OS Migration requirements, Implement Software As A Service in a Cloud, Offshore support, Reduce Terminal Server Footprint or reduce life cycle overhead. How and what you architect and implement will vary depending on what the ultimate goal of the customer is. How they will measure the success or ROI of your product within their environment.
3)Compatibility with Target OS?: Not all Application Virtualization can simply be migrated to a newer version of the OS. Some require additional repackaging of the application to move to the new version. If OS Migration is a key reason - it is important to see if the applications are already virtualized and to make sure that you are working with the version of the Application Virtualization solution that is compatible with the target OS.
4) Who are critical People, Processes and Technology that will be impacted? It is important to identify all the stakeholders during a production roll out, educate them on what application virtualization is, the purpose of the deployment, and what the expected impact will be to them or their organization. Typically I suggest training a SWAT team initially of the key stake holders so there are less issues around communication and misunderstanding because it is a departure from the norm.
5) What is the Plan from Inception to Maintenance? The road to hell is paved with good intentions. Key to vet out and plan for not only the knowns but add time for the unknown factors that will come up.
6) What is the impact on Current Solutions, Processes, and Systems? Such as can internal products used for testing, deployment, troubleshooting etc work with the virtual application? If not what are the contingency plans for this new way of packaging applications? Does the vendor supply a virtual reg edit for example? How will current processes for deployments, change orders, and asset tracking be impacted? Any special integrations needed with existing tools such as Discovery, CMDB, or Delivery mechanisms?
7) What is the CUSTOMER'S Starting Point? Every customer and environment is unique. It is critical to understand what the customer's understanding is of Application Virtualization, educate them on the different approaches and work with them to take baby steps to implementing a solution so they can adjust along the way. This last one is particularly critical because too often People don't know what they don't know. It is better to start with a smaller pilot, identify GAPs in technology, training, and processes - have them addressed and then continue.
8) How critical is/are the applications being virtualized? I once had a Architect ask me the impact of using virtualization in the emergency room of a hospital and the best way to recover. My answer was not to use virtualization for that purpose as the technology in general is still in early stages. When it comes to life or death - always proceed with caution when deciding whether or not to give new technology a go. The more critical the application the smaller the steps that should be taken and more planning required to cover back out plans in the event something goes wrong.
9) Does the proposed architecture meet hardware requirements? One of the key reasons many people did not migrate to Vista was the hardware tax. Meaning the overhead would exceed the capacity of their system requirements. When a customer is proposing to deploying multiple versions side by side on a machine - Disk Consumption, Port Conflicts, Network Capacity, I/O, and other hardware related questions should be considered as part of the equation. Understand what the overhead is going to be on a per application basis to architect a realistic solution. Just because you theoretically can deploy multiple versions of the same application doesn't mean existing hardware can support it when this exponentially grows as more applications are virtualized.
10) What is the communication strategy? Meaning people are busy with their day to day distractions of their job - it is important to set aside time to clearly create the plan, touch point calls to ensure execution, and take time to evaluate overall plan to adjust if needed. This allows everyone to set the right expectations that are achievable and realistic.
Some of this may sound like simple project management - but one would be surprised by how many times key items like compatibility with current systems, regulatory requirements, or simple lack of communication cause deployments to fail.
Regards,
Jeanne
Vision is great but it only gets a company so far. The true testament of success is the ability of the company to not only create the vision and product but to succinctly execute. A wise VC once told me that a man and a product does not make a company make. The testament of a true company is one that can 1) create a vision of product, 2) refine it to meet succinct customer needs, and 3) execute from inception to deployment.
Those 3 steps are a lot harder than they appear. The weakest link that I have seen over my career that determines the success or failure of a product in the market is the ability of the company to listen to their customers. Although the opinion of the CEO, CTO, Engineers, Marketing, and Sales are interesting - they are not as relevant as that of the customer that uses the products in production to solve real world problems. Here is a list of my top 10 lessons learned implementing application virtualization.
Top 10 Deployment Considerations: Application Virtualization
Application Virtualization is a departure from the norm typically on how most Enterprise solutions are packaged and deployed. Communicating and planning based on what you know regarding the application life cycle is critical to both the customer and the company.
Key Questions to Ask:
1) Target Application Dependencies?: are there any dependencies with physically installed applications on the endpoint? If so what are those applications? Should or can they also be virtualized? What will the potential impact be? Always good to get a list and/or dependency mapping of all applications.
2) Why is the customer migrating the application to a virtual paradigm? The typical responses are either Application Compatibility issues, OS Migration requirements, Implement Software As A Service in a Cloud, Offshore support, Reduce Terminal Server Footprint or reduce life cycle overhead. How and what you architect and implement will vary depending on what the ultimate goal of the customer is. How they will measure the success or ROI of your product within their environment.
3)Compatibility with Target OS?: Not all Application Virtualization can simply be migrated to a newer version of the OS. Some require additional repackaging of the application to move to the new version. If OS Migration is a key reason - it is important to see if the applications are already virtualized and to make sure that you are working with the version of the Application Virtualization solution that is compatible with the target OS.
4) Who are critical People, Processes and Technology that will be impacted? It is important to identify all the stakeholders during a production roll out, educate them on what application virtualization is, the purpose of the deployment, and what the expected impact will be to them or their organization. Typically I suggest training a SWAT team initially of the key stake holders so there are less issues around communication and misunderstanding because it is a departure from the norm.
5) What is the Plan from Inception to Maintenance? The road to hell is paved with good intentions. Key to vet out and plan for not only the knowns but add time for the unknown factors that will come up.
6) What is the impact on Current Solutions, Processes, and Systems? Such as can internal products used for testing, deployment, troubleshooting etc work with the virtual application? If not what are the contingency plans for this new way of packaging applications? Does the vendor supply a virtual reg edit for example? How will current processes for deployments, change orders, and asset tracking be impacted? Any special integrations needed with existing tools such as Discovery, CMDB, or Delivery mechanisms?
7) What is the CUSTOMER'S Starting Point? Every customer and environment is unique. It is critical to understand what the customer's understanding is of Application Virtualization, educate them on the different approaches and work with them to take baby steps to implementing a solution so they can adjust along the way. This last one is particularly critical because too often People don't know what they don't know. It is better to start with a smaller pilot, identify GAPs in technology, training, and processes - have them addressed and then continue.
8) How critical is/are the applications being virtualized? I once had a Architect ask me the impact of using virtualization in the emergency room of a hospital and the best way to recover. My answer was not to use virtualization for that purpose as the technology in general is still in early stages. When it comes to life or death - always proceed with caution when deciding whether or not to give new technology a go. The more critical the application the smaller the steps that should be taken and more planning required to cover back out plans in the event something goes wrong.
9) Does the proposed architecture meet hardware requirements? One of the key reasons many people did not migrate to Vista was the hardware tax. Meaning the overhead would exceed the capacity of their system requirements. When a customer is proposing to deploying multiple versions side by side on a machine - Disk Consumption, Port Conflicts, Network Capacity, I/O, and other hardware related questions should be considered as part of the equation. Understand what the overhead is going to be on a per application basis to architect a realistic solution. Just because you theoretically can deploy multiple versions of the same application doesn't mean existing hardware can support it when this exponentially grows as more applications are virtualized.
10) What is the communication strategy? Meaning people are busy with their day to day distractions of their job - it is important to set aside time to clearly create the plan, touch point calls to ensure execution, and take time to evaluate overall plan to adjust if needed. This allows everyone to set the right expectations that are achievable and realistic.
Some of this may sound like simple project management - but one would be surprised by how many times key items like compatibility with current systems, regulatory requirements, or simple lack of communication cause deployments to fail.
Regards,
Jeanne
Saturday, January 16, 2010
Top 10 Virtualization Predictions for 2010
Happy 2010!
Wow another year has passed before we knew it. What does 2010 have in store? How much of it is hype from Johnny come lately vendors trying to jump on the money train and how much of it will actually amount to products that make a difference - is yet to be determined. Here is my best guess of things to come for the next year:
1) Cloud - will continue to be the marketing "Hype" word. Every Web 2.0, IT As A Service, Virtualization Platform, Systems Management Company etc will continue to jump on the "Cloud" bandwagon to get their piece of the pie. This will continue to muddy the waters and confuse IT and Senior executives while they try to figure out what is really a cloud and what is not. This will delay actual adoption and/or fuel more pilots (similar to VDI) to enable IT to figure out best strategy, impact, and additional tools required to drive more efficiency and less costs during their implementation cycles.
2) Compliance - will play a much bigger role in driving new product innovation and budgets - once again catching the naysayer off guard as it did with SOX and having more vendors jump on that bandwagon. We now have a Cybersecurity Czar, new provisions for Health Care, pending deadlines for Electronic Medical Records, and Auditors asking for more details on how and what tools are available to check impact of virtualization. This is a big area that really needs more thought leadership, standards and catch up a like.
3) War between Physical and Virtual will continue to heat up - who will win the war between the big paradigm shift? The current physical tools in place or the virtualization only tools. The answer here is simple - the hybrid approach. Customers will push back on attempts to virtualize ALL their desktops, servers, systems, and tools. They will force vendors to have a single pane of glass to manage both physical and virtual paradigms. Those that provide the bridge between the physical and virtual paradigm across the stack will win the war.
4) Win 7 Migration Planning - less deploying until 2nd half of this year and into 2011. Most large enterprise customers I have worked with over the years take a minimum of 18 months to migrate to a new OS. Many are just cutting their teeth on Win 7 and trying to determine what is viable and what is not in terms of the biggest factors that inhibited Vista adoption - Application Compatibility, Hardware Requirements, and impact on end users (business continuity). They are once bit and twice shy with Vista although they know they have to migrate because many skipped Vista and XP is on it's way out.
5) 2010 is the Year of the Desktop - over the last 3-5 years the desktop has taken a back seat in terms of budgets, hype cycle and innovation. Many vendors tried to apply server technology to the desktop to extend their reach into the proverbial pocketbook of the Enterprise but have fueled internal debates and concern. Desktop Managers, Architects, and Dependent groups are pushing back while creating their own evaluations and new paradigms will emerge as a result. They have successfully shown through failed pilots, business cases, etc that solutions which solve server issues can not be easily used to solve desktop issues as well.
6) Financial Institutions will still see Cloudy market -Many of the revenues they enjoyed in 2009 will diminish based on clamping down by government with new taxes being levied on the financial services industry to cover the recent bailout combined with more foreclosures from the last wave of interest only loans coming due in 2010 and 2011, and the high unemployment rate. This market will continue to be uncertain and executives will continue to proceed with caution with the exception of projects that enable more visibility (Compliance and Analytics), costs reduction initiatives such as consolidating data centers or staff to less expensive markets (salary, land, taxes).
7) Compliance and Compatibility will drive adoption of alternative solutions such as Application Virtualization, Web 2.0, and Virtual Desktops. The number of pilots and niche adoptions for virtual applications, converting applications to Web 2.0 (similar to Salesforce.com), and niche deployments of virtual desktops will increase as companies try to determine the most cost effective approach to balancing increased demand for mobility (home office, global), regulations, and they are forced to migrate to Win 7 or an alternative.
8) Software as a Service and IT as a Service will heat up in Healthcare, Education, and Government - Regulations and Budget cuts across the board are pushing C Level executives to rethink the way they do business. Smaller doctors offices, clinics and hospitals will scramble for low cost alternatives that enable using User Based provisioning from a hosted model versus per seat license count to reduce costs, support overhead, and impact on not complying. Education will follow suit to ensure Privacy Act provisions are in place as more displaced workers return to school and more emphasis and actual fines are being placed on violations of privacy. Budget strapped state and local governments will look for ways to drive efficiency and process to deal with their staffing shortages and shortfall in general. Virtualization and BSM will prove to be viable solutions.
9) Consolidation will continue in overall Systems Management Space - interesting moves this month with HP and Microsoft partnership (should not overshadow VMware/HP Partnership). More sleeping giants like Dell, BMC and CA with their larger partners like Salesforce.com, Oracle, and Cisco will up their game through enhanced partnerships, being acquired, and/or acquiring newer technologies to refresh their portfolio to combat the race for the Cloud, Virtual Desktops, and Service Management tools as the tornado continues.
10) High Growth for Process Engineering and Technical Services for various forms of virtualization, cloud, and communications. As more larger companies jump on the SaaS, Cloud, and virtualization bandwagon there will be a greater need to work with "experts" that can enable IT and C Level Executives define not only the best way to implement these technologies but also what will be needed from a process and people (new skill set) perspective. These technologies are still fairly nascent and have impacted or changed the way that many things are tracked, deployed and maintained. Companies have invested millions in creating processes, tools, and audit trails around traditional systems. They will look to see how they can reap the savings rewards for newer technologies without having to rebuild their entire ecosystem, have duplicate systems, or stretch an already stretched out team any further. More expertise will be needed to assist with reducing inter departmental friction through process re-engineering, vendor evaluations, and implementing from pilot to production.
2010 will be an exciting departure and similar to when BSM first started a significant year of growth for many vendors (small and big a like) and seeing who will emerge as leaders in this area will be very exciting.
Cheers,
Jeanne
Wow another year has passed before we knew it. What does 2010 have in store? How much of it is hype from Johnny come lately vendors trying to jump on the money train and how much of it will actually amount to products that make a difference - is yet to be determined. Here is my best guess of things to come for the next year:
1) Cloud - will continue to be the marketing "Hype" word. Every Web 2.0, IT As A Service, Virtualization Platform, Systems Management Company etc will continue to jump on the "Cloud" bandwagon to get their piece of the pie. This will continue to muddy the waters and confuse IT and Senior executives while they try to figure out what is really a cloud and what is not. This will delay actual adoption and/or fuel more pilots (similar to VDI) to enable IT to figure out best strategy, impact, and additional tools required to drive more efficiency and less costs during their implementation cycles.
2) Compliance - will play a much bigger role in driving new product innovation and budgets - once again catching the naysayer off guard as it did with SOX and having more vendors jump on that bandwagon. We now have a Cybersecurity Czar, new provisions for Health Care, pending deadlines for Electronic Medical Records, and Auditors asking for more details on how and what tools are available to check impact of virtualization. This is a big area that really needs more thought leadership, standards and catch up a like.
3) War between Physical and Virtual will continue to heat up - who will win the war between the big paradigm shift? The current physical tools in place or the virtualization only tools. The answer here is simple - the hybrid approach. Customers will push back on attempts to virtualize ALL their desktops, servers, systems, and tools. They will force vendors to have a single pane of glass to manage both physical and virtual paradigms. Those that provide the bridge between the physical and virtual paradigm across the stack will win the war.
4) Win 7 Migration Planning - less deploying until 2nd half of this year and into 2011. Most large enterprise customers I have worked with over the years take a minimum of 18 months to migrate to a new OS. Many are just cutting their teeth on Win 7 and trying to determine what is viable and what is not in terms of the biggest factors that inhibited Vista adoption - Application Compatibility, Hardware Requirements, and impact on end users (business continuity). They are once bit and twice shy with Vista although they know they have to migrate because many skipped Vista and XP is on it's way out.
5) 2010 is the Year of the Desktop - over the last 3-5 years the desktop has taken a back seat in terms of budgets, hype cycle and innovation. Many vendors tried to apply server technology to the desktop to extend their reach into the proverbial pocketbook of the Enterprise but have fueled internal debates and concern. Desktop Managers, Architects, and Dependent groups are pushing back while creating their own evaluations and new paradigms will emerge as a result. They have successfully shown through failed pilots, business cases, etc that solutions which solve server issues can not be easily used to solve desktop issues as well.
6) Financial Institutions will still see Cloudy market -Many of the revenues they enjoyed in 2009 will diminish based on clamping down by government with new taxes being levied on the financial services industry to cover the recent bailout combined with more foreclosures from the last wave of interest only loans coming due in 2010 and 2011, and the high unemployment rate. This market will continue to be uncertain and executives will continue to proceed with caution with the exception of projects that enable more visibility (Compliance and Analytics), costs reduction initiatives such as consolidating data centers or staff to less expensive markets (salary, land, taxes).
7) Compliance and Compatibility will drive adoption of alternative solutions such as Application Virtualization, Web 2.0, and Virtual Desktops. The number of pilots and niche adoptions for virtual applications, converting applications to Web 2.0 (similar to Salesforce.com), and niche deployments of virtual desktops will increase as companies try to determine the most cost effective approach to balancing increased demand for mobility (home office, global), regulations, and they are forced to migrate to Win 7 or an alternative.
8) Software as a Service and IT as a Service will heat up in Healthcare, Education, and Government - Regulations and Budget cuts across the board are pushing C Level executives to rethink the way they do business. Smaller doctors offices, clinics and hospitals will scramble for low cost alternatives that enable using User Based provisioning from a hosted model versus per seat license count to reduce costs, support overhead, and impact on not complying. Education will follow suit to ensure Privacy Act provisions are in place as more displaced workers return to school and more emphasis and actual fines are being placed on violations of privacy. Budget strapped state and local governments will look for ways to drive efficiency and process to deal with their staffing shortages and shortfall in general. Virtualization and BSM will prove to be viable solutions.
9) Consolidation will continue in overall Systems Management Space - interesting moves this month with HP and Microsoft partnership (should not overshadow VMware/HP Partnership). More sleeping giants like Dell, BMC and CA with their larger partners like Salesforce.com, Oracle, and Cisco will up their game through enhanced partnerships, being acquired, and/or acquiring newer technologies to refresh their portfolio to combat the race for the Cloud, Virtual Desktops, and Service Management tools as the tornado continues.
10) High Growth for Process Engineering and Technical Services for various forms of virtualization, cloud, and communications. As more larger companies jump on the SaaS, Cloud, and virtualization bandwagon there will be a greater need to work with "experts" that can enable IT and C Level Executives define not only the best way to implement these technologies but also what will be needed from a process and people (new skill set) perspective. These technologies are still fairly nascent and have impacted or changed the way that many things are tracked, deployed and maintained. Companies have invested millions in creating processes, tools, and audit trails around traditional systems. They will look to see how they can reap the savings rewards for newer technologies without having to rebuild their entire ecosystem, have duplicate systems, or stretch an already stretched out team any further. More expertise will be needed to assist with reducing inter departmental friction through process re-engineering, vendor evaluations, and implementing from pilot to production.
2010 will be an exciting departure and similar to when BSM first started a significant year of growth for many vendors (small and big a like) and seeing who will emerge as leaders in this area will be very exciting.
Cheers,
Jeanne
Sunday, November 29, 2009
Giving Thanks This Holiday Season!
We all have much to be thankful for this holiday season. As with any new season - it is a time for reflection on what has past and hope for a bright future on what is to come. The dismal economic climate can often cloud even the most up beat enthusiasts on the future. Now is the time for change to embrace a new paradigm in desktop computing.
The hardest part for anyone embarking upon deploying virtualization around the desktop or up the stack to the application - is ensuring that one has the right set of skills in place to understand all the requirements.
One of the biggest realizations in terms of skills is remembering our past mistakes. We may find that many of the skills we need are there - either within our lessons learned from deploying physical applications, server virtualization basic principles, or within our network base of peers.
Many of the basic requirements for deploying a virtual application have been solved and identified with deploying physical applications in distributed or server hosted environments. Simply put - service desk will still be critical, as will asset tracking, change management, and having the ability to audit all layers of the stack - regardless of whether the environment is physical or virtual.
One way to identify the required skills sets is to understand what is currently being done today (that sets the minimum bar) and ensure whatever the tool that is being evaluated can meet those minimum requirements from a people, processes and technology perspective.
The hardest part for anyone embarking upon deploying virtualization around the desktop or up the stack to the application - is ensuring that one has the right set of skills in place to understand all the requirements.
One of the biggest realizations in terms of skills is remembering our past mistakes. We may find that many of the skills we need are there - either within our lessons learned from deploying physical applications, server virtualization basic principles, or within our network base of peers.
Many of the basic requirements for deploying a virtual application have been solved and identified with deploying physical applications in distributed or server hosted environments. Simply put - service desk will still be critical, as will asset tracking, change management, and having the ability to audit all layers of the stack - regardless of whether the environment is physical or virtual.
One way to identify the required skills sets is to understand what is currently being done today (that sets the minimum bar) and ensure whatever the tool that is being evaluated can meet those minimum requirements from a people, processes and technology perspective.
Thursday, October 29, 2009
Impact of Virtualization & Cloud on License Compliance
The proverbial virtualization train has left the station - yet many software vendors & customers alike are still scrambling on to understand the impact on their current technology, licensing models, and processes. Like many major paradigm shifts - customers are moving forward and carving out what they believe to be the right pathway based on limited information and their interpretation of where this market is headed based on decisions from major technology vendors such as Microsoft, Oracle, and SAP.
Unfortunately for most customers there are no true best practices across software vendors for supporting virtualization. As consumers you need to be aware of what the pitfalls are, precautions you can take to avoid them, and ways you can leverage your existing tools and processes to reduce not only the costs but impact of virtualization to your organization.
Considerations to Address
Unfortunately for most customers there are no true best practices across software vendors for supporting virtualization. As consumers you need to be aware of what the pitfalls are, precautions you can take to avoid them, and ways you can leverage your existing tools and processes to reduce not only the costs but impact of virtualization to your organization.
Considerations to Address
- What Delivered - there are many different types of virtualization that can be leveraged such as Server, Desktop, or Application. What you are delivering will impact how you count and license the product. Is it an open source application, custom homegrown application, regulated and restricted access, or an expensive off the shelf application such as Adobe Photoshop. Whether the application is a desktop application, server application or combination of the two - Web 2.0 - makes a difference to cost structures and tracking.
- How Delivered - For example - is it a server application running inside a virtual machine, a virtual application launched off a USB stick or file media share, or a combination of virtual applications with a virtual desktop from a datacenter, or a virtual application delivered from the Cloud or Managed Service Provider. All can have license impacts depending on the software vendors support policies. Different software vendors have different rules depending on delivery: Concurrent desktops in Datacenter (VDI/HVD), Virtual Applications from a Client Device, or Streaming from the Cloud all typically have different caveats. For example, Microsoft requires an additional Services Provider License Agreement to distribute their applications from a cloud environment to customers. There are many unanswered questions that have come up regarding traditional delivery of virtual applications - if I stage it - does that count as a license? Do virtual applications (not installed) count against a EULA that claims it has to be installed? One rule of thumb - if you use it, you should expect to pay for it - Software Usage becomes even more critical in the virtual world.
- How Discover & Audit - Virtualization can have significant impact on existing tools and process for Audit & Control of applications.
Application -If you are using application virtualization - does the provider provide transparency into the virtual bubble? Does the virtual application have digital rights management to prevent copying from client to next? How do you detect a virtual application that isn't registered? What hooks are available to ensure there are no invisibility cloaks hiding applications that can call back to ISVs but are undetected by company?
Desktop -When you check out the type 1 hypervisor - will your traditional tools be able to know that the license on the user endpoint is the same one under the agreement with the hosted virtual desktop? If you vary your update schedule for discovery - how do you audit the virtual desktop? What happens if the user never logs in during the appropriate window? What is the impact on audit trail for tracking who touched what pieces? How will the discovery tool input and discern between licenses on the different virtual machines? Particularly - the personal VM and company approved VM?
Server - When you dynamically move one virtual machine to another host - will the discovery tool know to not double count the application? Will the software vendor support the flavor of server virtualization being used? What level of support will be provided? How is it licensed compared to traditional licensing when server farms may have a cluster of more powerful boxes with multiple CPUs to support capacity on demand in the cloud (private or off premise). - What is Impact on Performance - Oracle and many other major vendors provide prescriptive guidance on running certain applications in a virtual environment due to performance. There is no one perfect rule of thumb on virtualization and performance but there are some things to consider. Regardless of the type of virtualization - they all run on hardware of some type and are all affected by the traditional layers in the stack from network, to I/O, CPU, SAN/NAS, etc. The more layers you add to the stack will eliminate some problems but are still bound by the underlying hardware. When selecting the right type of virtualization - it is critical to understand what that is, where it will be run from, and impact on capacity requirements for individual users. There are tools out there from BMC - Capacity Management Essentials and Novell - Platespin acquisition- that can assist here.
- What is impact on Security - If using Type 1 hypervisor approach - who is responsible for patching the personal VM and ensure there are no Distributed Denial of Service Attacks on the company network? What are the implications of regulations on this approach - Cyber Security Act, Personal Information Acts? For application virtualization - what measures are put in place to prevent viruses from executing from the virtual registry on systems that the users have Administrative rights to like their home PC, employee owned machines, or as required to support legacy applications that can not be virtualized? Is the right transparency there for virtual applications to detect if there is a virus in the virtual registry? Do they employ anti-injection techniques to prevent malware from impacting the virtual environment?
Thursday, August 27, 2009
Cloud or Not Cloud - That is the Question - When it comes to Compliance
Defining the Cloud - What is and isn't
How do you measure something that is dynamic in nature? What is the impact on SAS70 Audit controls? Where does an organization even begin to start when the definition of what is and is not a Cloud is still up for debate.
Some that would like to claim expertise in this new paradigm - claim that SAAS or Virtualizing your Server Infrastructure automatically equates to cloud computing. That claim only shows a lack of experience in SAAS and technologies that enable the dynamic nature of the cloud like virtualization. The Cloud is a nascent paradigm that should not be confused with Software As A Service or Content Providers. Companies have been distributing content whether it be software, music, games etc over the Internet from hosting providers since the mid-90s. What makes a cloud unique is the dynamic nature and benefits of capacity on demand to scale to meet the peaks and valleys of a business as they grow.
NIST has tried to loosely define the cloud and different types of clouds that are possible. Their definition can be found: NIST Definition of Cloud. This is significant because now auditors are really going to be taking a hard look at what is in the cloud and how far do they go.
What does it mean to Compliance & Control?
"You can't control what you can't measure" - is a befitting statement recently made by Scott Alderidge of IPServices. This statement is backed up from other industry research reports from reputable institutions such as IT Process Institute series of Virtualization Maturity Studies. There is a GAP between the industry hype and realistic customer requirements.
Key findings indicate that many companies jumped into using newer technologies to enable dynamic provisioning of servers, applications, and desktops only to find that they had to either pretend that everything was "physical as usual", revert to not using those features, or put in control measures on a limited subset (ie - there goes capacity on demand across the grid).
This is not to say that Clouds are not possible for regulated environments or to achieve compliance for key regulations like HIPAA, PCI, SOX, etc but it does mean that some creative thinking has to come into play to enable companies to leverage what makes sense in the cloud without compromising compliance (regulatory, security, or business directives).
BTW - a big pet peeve of mine that occurs all the time by bloggers and vendors alike is that your solution or the cloud can achieve HIPAA compliance. Sorry folks - the system has to be reviewed as HIPAA compliant (same goes for SOX, etc.). Now there are pieces of the system that can be validated and submitted to enable the customer to achieve HIPAA compliance but no magic software, infrastructure etc can do the trick.
Start Where You Are
How does anyone know what is safe, not safe or where to begin in an area that can elevate so many pains faced by companies today (rising power costs, running out of capacity in the data center, need for centralization of data)? The problems that need to be solved are not entirely new and many companies have solved them much sooner than this. The key thing is to take a step back to look at the forest through the trees and create a game plan for migration.
For example, although there are quite a bit of regulated applications - what about the ones that aren't? Are there specific ones that can be "tested" in a cloud or hosted outside the DMZ for greater access? Is there a specific business application that has particular peaks and valleys on certain components of the application like the web server, file share, etc but requires protected user data or information such as patient records?
Customers have successfully implemented hybrid clouds - keeping what is needed in the data center but moving many of the pieces that have greater peaks and valleys to a cloud hosted infrastructure provider like Amazon AWS. For example, GDS achieved HIPAA compliance (yes GDS did not Amazon click on link for Amazon Case Study).
What did they do? They stored protected data such as patient information and records behind lock and key within the hospital data center but leverage the "Cloud" to deliver virtualized applications (HTTP/Encryption - for Config Assurance) that run locally, pull resources through the cloud provided by AWS, assemble the small subset of records typically needed by a user at the time and re-parse it back. This Genius architecture was developed not by some theorists professing to want to define the cloud - but by who it should. An expert in health care, hosting, and the requirements both have for regulations, users, and technology.
How do you measure something that is dynamic in nature? What is the impact on SAS70 Audit controls? Where does an organization even begin to start when the definition of what is and is not a Cloud is still up for debate.
Some that would like to claim expertise in this new paradigm - claim that SAAS or Virtualizing your Server Infrastructure automatically equates to cloud computing. That claim only shows a lack of experience in SAAS and technologies that enable the dynamic nature of the cloud like virtualization. The Cloud is a nascent paradigm that should not be confused with Software As A Service or Content Providers. Companies have been distributing content whether it be software, music, games etc over the Internet from hosting providers since the mid-90s. What makes a cloud unique is the dynamic nature and benefits of capacity on demand to scale to meet the peaks and valleys of a business as they grow.
NIST has tried to loosely define the cloud and different types of clouds that are possible. Their definition can be found: NIST Definition of Cloud. This is significant because now auditors are really going to be taking a hard look at what is in the cloud and how far do they go.
What does it mean to Compliance & Control?
"You can't control what you can't measure" - is a befitting statement recently made by Scott Alderidge of IPServices. This statement is backed up from other industry research reports from reputable institutions such as IT Process Institute series of Virtualization Maturity Studies. There is a GAP between the industry hype and realistic customer requirements.
Key findings indicate that many companies jumped into using newer technologies to enable dynamic provisioning of servers, applications, and desktops only to find that they had to either pretend that everything was "physical as usual", revert to not using those features, or put in control measures on a limited subset (ie - there goes capacity on demand across the grid).
This is not to say that Clouds are not possible for regulated environments or to achieve compliance for key regulations like HIPAA, PCI, SOX, etc but it does mean that some creative thinking has to come into play to enable companies to leverage what makes sense in the cloud without compromising compliance (regulatory, security, or business directives).
BTW - a big pet peeve of mine that occurs all the time by bloggers and vendors alike is that your solution or the cloud can achieve HIPAA compliance. Sorry folks - the system has to be reviewed as HIPAA compliant (same goes for SOX, etc.). Now there are pieces of the system that can be validated and submitted to enable the customer to achieve HIPAA compliance but no magic software, infrastructure etc can do the trick.
Start Where You Are
How does anyone know what is safe, not safe or where to begin in an area that can elevate so many pains faced by companies today (rising power costs, running out of capacity in the data center, need for centralization of data)? The problems that need to be solved are not entirely new and many companies have solved them much sooner than this. The key thing is to take a step back to look at the forest through the trees and create a game plan for migration.
For example, although there are quite a bit of regulated applications - what about the ones that aren't? Are there specific ones that can be "tested" in a cloud or hosted outside the DMZ for greater access? Is there a specific business application that has particular peaks and valleys on certain components of the application like the web server, file share, etc but requires protected user data or information such as patient records?
Customers have successfully implemented hybrid clouds - keeping what is needed in the data center but moving many of the pieces that have greater peaks and valleys to a cloud hosted infrastructure provider like Amazon AWS. For example, GDS achieved HIPAA compliance (yes GDS did not Amazon click on link for Amazon Case Study).
What did they do? They stored protected data such as patient information and records behind lock and key within the hospital data center but leverage the "Cloud" to deliver virtualized applications (HTTP/Encryption - for Config Assurance) that run locally, pull resources through the cloud provided by AWS, assemble the small subset of records typically needed by a user at the time and re-parse it back. This Genius architecture was developed not by some theorists professing to want to define the cloud - but by who it should. An expert in health care, hosting, and the requirements both have for regulations, users, and technology.
Friday, July 3, 2009
The Evolution of the Cloud
Beyond the Cloud Hype
The "cloud" may be new to some but for many of us that have been in the systems management space - today's cloud is just an evolution of innovative distribution approaches that have been around for nearly a decade - companies like Electronic Arts, Music Match, and Intuit for example all have delivered some form of service and/or content over the interent leveraging a scalable backend infrastructure.
What's Different?
Technology has evolved to help shift the focus to more of a user driven paradigm. Key usability capabilities that exist in virtualization (application independance), dynamic provisioning (reduces latency), enhanced capacity (for servers, networks, and clients alike), regulations (HIPAA, PCI, SOX) and more sophisticated users are driving a change in the paradigm from IT to User Focused. While the devil may be in the details the fact is companies are forced to learn balance and how to cut costs in this new era.
Why Now?
Forester recently bucked traditional thinking with their statement that contrary to general belief many large enterprises are looking to deploy in the cloud. This comes as no surprise for those of us that have been in this space for quite awhile. Server consolidation was fueled by many CIOs realizing that rising power and space was quickly becoming a significant concern for the datacenter. Server virtualization made complete sense given that many reported having 10% utilization or less. The costs to maintain, power, and cool the datacenter were more than the actual loss of the servers and costs of deploying server virtualization technology.
Infrastructure as a Service (IAAS- such as Amazon EC2) and Platforms as a Service make more sense now then ever before for 2 reasons:
1) Hard to justify buying more hardware for growth in a down economy - a perfect example of this - a large MSP opted to leverage an IAAS solution in lieu of purchasing, building, and maintaining a new data center to support their growing customer base. By combining newer technologies such as virtualization with IAAS provider they significantly cut their costs and increased their overall margins.
2) Companies are becoming more dependant on technology. Enterprises know that they will need to think about how they scale and/or contract in these turbulent times where companies are either merging, acquiring or laying off to weather the storm. It is too hard to plan and justify when one could select a solution that is fairly low costs to provide the same service.
External and Hybrid clouds are panning out to be more than just technology looking for a solution but as a cost effective way for the Enterprise to shrink and grow their costs with tide of demand for additional applications and resources.
The "cloud" may be new to some but for many of us that have been in the systems management space - today's cloud is just an evolution of innovative distribution approaches that have been around for nearly a decade - companies like Electronic Arts, Music Match, and Intuit for example all have delivered some form of service and/or content over the interent leveraging a scalable backend infrastructure.
What's Different?
Technology has evolved to help shift the focus to more of a user driven paradigm. Key usability capabilities that exist in virtualization (application independance), dynamic provisioning (reduces latency), enhanced capacity (for servers, networks, and clients alike), regulations (HIPAA, PCI, SOX) and more sophisticated users are driving a change in the paradigm from IT to User Focused. While the devil may be in the details the fact is companies are forced to learn balance and how to cut costs in this new era.
Why Now?
Forester recently bucked traditional thinking with their statement that contrary to general belief many large enterprises are looking to deploy in the cloud. This comes as no surprise for those of us that have been in this space for quite awhile. Server consolidation was fueled by many CIOs realizing that rising power and space was quickly becoming a significant concern for the datacenter. Server virtualization made complete sense given that many reported having 10% utilization or less. The costs to maintain, power, and cool the datacenter were more than the actual loss of the servers and costs of deploying server virtualization technology.
Infrastructure as a Service (IAAS- such as Amazon EC2) and Platforms as a Service make more sense now then ever before for 2 reasons:
1) Hard to justify buying more hardware for growth in a down economy - a perfect example of this - a large MSP opted to leverage an IAAS solution in lieu of purchasing, building, and maintaining a new data center to support their growing customer base. By combining newer technologies such as virtualization with IAAS provider they significantly cut their costs and increased their overall margins.
2) Companies are becoming more dependant on technology. Enterprises know that they will need to think about how they scale and/or contract in these turbulent times where companies are either merging, acquiring or laying off to weather the storm. It is too hard to plan and justify when one could select a solution that is fairly low costs to provide the same service.
External and Hybrid clouds are panning out to be more than just technology looking for a solution but as a cost effective way for the Enterprise to shrink and grow their costs with tide of demand for additional applications and resources.
Subscribe to:
Posts (Atom)
