I hate it when corporate security is correct!

My laptop runs slow due to encryption.  I can’t use public file sharing sites like dropbox, google drive, etc.  Only some of the mobile functionality is enabled on my smartphone and it is not evenly distributed by operating system such Blackberry, iOS, and Android (due to security).  I don’t even know what we do with Windows Mobile OS?  All of this overhead, oversight, and security is cramping my style and agility and they are correct!

“When everyone is out to get you, paranoia is only good thinking. – Dr. Johnny Fever – WKRP in Cincinnati.

Corporate Security was correct in their thinking.  It looks like there are not just individual criminals and some less than ethical corporations out to get our corporate secrets, but the Chinese Government is actively working to steal them.  I found the NY Times article below unnerving.

I fully understand why governments feel they have the right to protect themselves from other governments.  And I’m willing to acknowledge that technology is part of warfare, but it appears China has bonded its defense strategy to its corporate strategy.  To me, a line has been crossed.  If you want to read the full Mandiant Security report, it is available, but I don’ think you sleep any better at night.  (http://intelreport.mandiant.com/).

Chinese Army Unit Is Seen as Tied to Hacking Against U.S.

On the outskirts of Shanghai, in a run-down neighborhood dominated by a 12-story white office tower, sits a People’s Liberation Army base for China’s growing corps of cyberwarriors.

:

Mandiant’s report does not name the victims, who usually insist on anonymity. A 2009 attack on Coca-Cola coincided with the beverage giant’s failed attempt to acquire the China Huiyuan Juice Group for $2.4 billion, according to people with knowledge of the results of the company’s investigation.

As Coca-Cola executives were negotiating what would have been the largest foreign purchase of a Chinese company, Comment Crew [Chinese Army Hacker Unit] was busy rummaging through their computers in an apparent effort to learn more about Coca-Cola’s negotiation strategy.

http://www.nytimes.com/2013/02/19/technology/chinas-army-is-seen-as-tied-to-hacking-against-us.html?pagewanted=all&_r=0

It appears to me, that if you are going to approach cloud for your corporate assets, you better be very sure that your cloud provider is as focused or even more focused on security measures as your own company.

Losses due to hacking have big dollars associated with them. According to HotForSecurity site, recent reports showed hackers earned $12.5 billion in 2011.  The top 5 incidents that were known are below.  I’m sure many others went unreported.

  1. $171 million – Sony
  2. $2.7 million – Citigroup ($4B in total losses)
  3. $2 million – Stratfor
  4. $2 million – AT&T
  5. $1 million – Fidelity Investments, Scottrade, E*Trade, Charles Schwab

http://www.hotforsecurity.com/blog/top-5-corporate-losses-due-to-hacking-1820.html

I can’t say what other cloud providers do or don’t do.  I can say that IBM, we always take security very seriously and push it down to the seemingly innocuous layers not just in the cloud data centers, but throughout the company.  And yes, that even means my laptop, iPhone, iPad, etc.  Keep in mind, it only takes one nasty e-mail or one invaded file from shared site to start the rift in your corporate security.

Yes, I still believe the future is cloud – IaaS, PaaS, and SaaS.  We just need to make sure we do it responsibly.  Later, I’ll discuss what we are doing at high level with our two public cloud solutions – SmartCloud Enterprise and SmartCloud Enterprise+ – to make them secure for enterprise computing including SAP.

Advertisements

SAP HANA MCOD – What I really want for my data center

The real SAP game changer will be when I have one (1) HANA DB for all my production applications.  I want single, giant in-memory DB where my ECC, BW, CRM, PLM, SCM, BOBJ, etc. all consume the same data.  I want a row  view for the OLTP ECC-like applications and column view for OLAP BW-like applications.  It would look like the picture below.

sap hana mcod system
What we really need from SAP! The SAP HANA MCOD system.

Right now, I can’t really recommend using HANA on anything but OLAP based applications.  In the future, when we can do the analytic transformations in memory without silly exports, extractors, DSO’s and the like, we will really have a very* different scenario.  For now, the cost of the HANA license and risk of losing transactions only committed to memory is not justifiable.

In this new vision with MCOD, there will be two (2) key issues.  First, how do we support MCOD.  I’ve seen MCOD come and go since 1993 several times. Each time, it was easy to build and impossible to support.  The overlapping requirements became overwhelming. Second, HANA will need a data aging architecture which can age data out of main memory to some slightly slower memory or device.

IBM is working on some important technology, Phase Change Memory, that will be of great value (http://www.zurich.ibm.com/sto/memory/).   It may provide the near DRAM speeds while being cost effective and non-volatile.  Maybe IBM will build out series of servers specifically designed to run in-memory databases such as HANA with massive DRAM and massive PCM capacities.  PCM could then provide the roll-back logs and more at near DRAM speeds. PCM won’t solve the MCOD and data aging problems, but at least the risk of running rapidly transacting OLTP systems would go to near zero and certainly lower than that of even today’s highly cached disk writing databases.

It is going to be a fun watching HANA make it from infancy to toddler-hood.  I wonder how fast she’ll mature.

* Mark Twain said every time a writer was tempted to use “very” in a sentence, they should use the word “damn” and then the editor would strike the word and the sentence would read as it should.

 

SAP SaaS marches on

SAP is laying out a strong SaaS program and has keen view of the future.  They’ve organized themselves into upper domain areas of: People, Money, Customers, Suppliers, and Special.  They then have their horizontal glue layers of Social and Integration.  Finally, they have supporting layer of SaaS ERP in 2 flavors: Business-By-Design and Business One.  This clearly laid out in the illustration below.

Image

Most of the SaaS attention has gone to People with SAP’s acquisition of SuccessFactors.  Indeed, success factors is leading the SaaS charge at SAP both in terms of ideation and management with Lars Dalgaard heading the cloud unit.  SuccessFactors brings a SaaS pedigree to SAP.

All “legacy” or pre-SaaS software vendors including those like IBM, Oracle, Computer Associates, etc. all face the same challenge.  How to use a usage base metric to drive revenue and determine re-investment.  In addition, legacy vendors often haven’t built in cloud capabilities and multi-tenancy which is the key scaling and upgrades leading to lower costs.  I think you’ll see legacy software vendors buy some of the skills.  I also think as the whole market shifts to cloud, SaaS will simply become the pervasive model and vendors will adapt.

Tersely put, how do you change your revenue stream?

  • Old Revenue Formula  = Licenses + Support
  • New Revenue Formula  = Utilization metric (i.e. per user, per month, per incident, etc.)

Honestly, I think the non-cloud and even non-SaaS type application will become the exception.  So like all creatures faced with drastic environmental changes, software vendors have 3 choices:

  1. Move (find business that can’t use cloud or won’t adopt as fast)
  2. Die (easy, just don’t change)
  3. Adapt (move to more efficient modes such as re-architecting for SaaS)

One of SAP’s other big SaaS applications is Ariba.  In addition to being a substantial procurement software product with huge numbers of consumers and suppliers in their network, they are the model of moving to cloud and SaaS to survive.  They have already made the adaption.  If SAP is smart, they will take the lessons learned from the trial by fire of Ariba and apply it to their own journey. 

I think the movement to cloud, and mostly to SaaS, is one that all vendors will need to follow to remain viable.  Keep in mind there are companies today that will join the Fortune 500 in the next 5 years and will have never purchased an enterprise class server or purchased enterprise software.  As an industry, How are we going to provide value add services?  How are we going to morph our products to meet their non-procurement cycles?  Are we going to be part of the company that: 1) Moves, 2) Dies, or 3) Adapts. 

Next blog, I’ll talk more about the lower layers of Social, Integration, the two ERP SaaS options which will yield a new way to do roll-outs via 2-tier ERP.

Watching with pride and envy and gratitude

When I came to IBM, I said one of my aspirations was to help someone reach a Sr. VP in IBM.  I don’t mean promote them, but I mean be part of their path.  We all work in web of influence.  Helping others mature along their paths and achieve to their highest levels is critical.

At the same time, it can mean promoting people to your level or above.  It is impossible to not feel a twinge of jealousy.  For me, I have to acknowledge this, but then move on.  Good news is I think I got close.

My dear friend, colleague, and now Sr. VP Vijay at SAP has made it.  In all honesty, I had very little nothing to do with it.  Maybe an encouraging word or a bit of advice, but it was Vijay’s work ethic, willingness to take chances, and positive bright outlook on life, technology, and people that got him to this level.

It is not anyone, but all of these combined that has brought him success.  At a large client, he took on the latest Netweaver features when everyone including me said they wouldn’t work.  When they didn’t, he didn’t stop.  He just got some help from SAP establishing a relationship with those in SAP and then succeeded.  Later he turned his gregarious nature, sharp mind, and experience into a blog.  At the point he entered the digital public domain, there were very few and no real IBM policy.  Vijay has lead the way.

In the end, I think I gained the most.  I learned to take a more positive attitude and avoid my darker side.  I moved my blogging from inside IBM and inside of SAP, to this forum.  While I don’t expect to gather the response that Vijay’s http://andvijaysays.wordpress.com/ blog gathers, it has been a learning experience for me.

Now that I have a colleague who made it to SVP in SAP; I’ll have to find someone to work with to make SVP in IBM.  And let me challenge you, who are you helping move their career and life forward?  I think you’ll find you get as much, or more than you give.

SAP needs Development Simulation / Emulation Environment

Last week I was hearing how difficult it is to develop solutions for SAP from developers. Vijay’s blog was specific to mobile, but I don’t think it really matters that much if it mobile or computer based development. What if SAP had an SAP simulation engine that all developers could plug into for free.

Imagine you want to develop simple SAP applications. You should be able to completely test drive the SAP programs without owning them. You simply write a program to a SAP provided specification and run it against the SAP simulation engine. The engine would validate your inputs and outputs were correct and then allow you to even drive some workload through your application and into the SAP application simulation engine.

SAP could roll out modules over time. If it works, there will be growing multitude of little applets for SAP applications making SAP easier to use. Since there are emulators for mobile devices, these coupled with these emulators accelerating the growth of the mobile market. While this is not complete mobile solution, it certainly jump-starts then engine.

The object for SAP should always be to own the core or the framework. The core is the business logic SAP wants you to buy and not the small stuff. You want to actively encorage others to develop in and around your platform. Facebook doesn’t worry about the mini-app revenue; instead, they encourage it. It makes the Facebook world a more valuable piece of Internet real estate.

This week I had client raving about how great Salesforce’s development environment along with the social capabilities. SAP needs to get out of the idea they want to sell any thing other than the core framework and business logic. Everything else just needs to reinforce the value of SAP’s core. Why not let SAP want-to-be developers start cranking out applications and applets for SAP. A free, friendly, easy to consume environment will go a long way

.

When will Sybase ASE be FREE for all SAP system users

I am surprised SAP has not announced that the standard database from the Sybase acquisition is free to all SAP system users.  I will even be more surprised if they do not make the announcement at Sapphire 2012.

Why would SAP give away Sybase ASE?  They could make some amount of revenue by selling it, but by giving it away they improve the ROI of the migration.  Migration costs are the biggest barrier to any DB or OS change under an SAP system.  In addition, they take away the 20% maintenance and enhancement (M&E) fees their number #1 competitor, Oracle, is gaining from every SAP system running on Oracle.  I wonder how much of the reported $12B Oracle reported of support revenue in 3rd quarter is driven by SAP systems running on Oracle RDBMS.  That is potentially billions of dollars that Oracle does not have to attack SAP, develop new applications, or build a cloud business.  Oracle’s M&E, like everyone in the software business, is a substantial part of the revenue and more importantly profit stream of the business.

In addition, SAP can optimize the ASE database for SAP.  In fact they could make all other vendors’ database versions a port.  The best and brightest capabilities would be in found in the latest release of ASE coupled to SAP.  In addition, they can up sell Sybase Replication Services (SRS) as an Extract, Translate, and Load (ETL) engine, Disaster Recovery (DR) solution, and high availability (HA) solution.  They also can  up sell to HANA for higher performance.

Pushing out ASE will cost something.  SAP will have to support, develop, and move ASE forward.  They should have those resources from the acquisition and from previous DB efforts like mySQL.  Most of that cost is already accounted for excluding the go forward actions to stay on par with other major DB vendors in the SAP world; however, Sybase is are major player in the financials arena today, too.

SAP is going to break some glass with the big database providers, Oracle, Microsoft, and IBM.  While I’m sure they don’t care about Oracle’s opinion, they are strongly partnered with Microsoft and IBM.  It may be taken very poorly by IBM and Microsoft; however, I’m not sure either of them can let go of all the other areas they are linked into SAP especially IBM who has the world’s best (my opinion and Forrester’s) largest SAP practices.

HANA may be getting all the headlines, but the world is not done with RDBMS.  There is still a need.  There are still companies making lots of money, especially Oracle, on RDBMS software.  When is SAP going to give its clients something FREE to smile about and at the same time take so much away from their biggest competitor, Oracle.  Seems like a win-win for SAP and its clients.

Killing the cloud with success

Today, there are two threats to cloud becoming a reality.  First are the end users.  Second are the vendors. 

End users, especially at the division layer or in remote offices, are driven towards cloud based solutions, especially SaaS, like moths to a flame.  Any program that works on per user per month basis must be better than this old dumpy client /server or host based system.  Look, it has this cool spinning widget and it works on a smart phone.  The attraction is understandable.

At the same time, they often don’t look into core issues like “what is the security model and does it meet corporate requirements”, “does it meet all my functional requirements” and “how does it integrate with my other systems.”  That latter problem is the killer.

While tools like IBM CastIron can solve a lot of problems, most clients don’t get to the integration discussion until after they have already purchased the cloud based solution.  In fact, in the rush to get to the cloud solution, clients are willing to go to much simpler and less rich environments. 

IT departments would be served well to understand how communicate better with their business constituents.  IT departments often take the requirements on face value and then build the 98% solution at 120% of the cost.  Cloud solutions are usually 80% solutions for 50% of the costs often leaving out the hardest and most costly components.  If IT departments took it upon themselves to really partner with the business, maybe they could get to 95% solution at 50% to 70% of the cost.  The key will be identifying the cost driving factors in the solution.

Identifying TCO at a feature / function level is not easy; however, it is critical.  It is the real role of a good architect and especially the solution or application architect.  Simply telling the constituent all the parts they need is not enough.  You have to be able to understand the short term, long term, and cost impacts.

Vendors are not helping either.  Someone referred to the problem as “cloud confusion” in random blog.  Everything that is available on the internet is called a cloud solution.  There is a huge problem with calling backup storage  “cloud storage.”  What is dynamic about it?  What is virtual?  The Apple iCloud is a little better since does let you for FEE use Apple’s copy of your music from their library by just putting a pointer in and avoiding the storage. This is double dipping since they charge you and have to give you less storage, but we also pay $45 to get a better seat on the airline.  PT Barnum said something about that.

Equally confusing is SaaS.  You’d think that SaaS means a software solution that is built on IaaS and PaaS and multi-tenancy, but not always.  You’d even expect it to be multi-tennant.  It turns out that many of the SaaS solutions in the market are really just client/server systems on the internet that are billed by user/month or some similar consumption based model.  Bob Moul wrote Demystifying SaaS vs. Cloud  to help identify a SaaS product vs. a not SaaS products.

Most consumers of cloud are not worried whether it is really cloud.  They only care it gives them flexibility and outcomes they desire.  When designing any solution, keeping flexibility and outcomes in mind is always a good idea.  Too often, we get trapped in the details to the point of making everything too complex.  Worse, the complexity feeds on itself, too.  There are worse things than calling an analog by the wrong name.

Good news is that cloud will go eventually go away.  Not that it will cease to exist, but it will cease to be discussed.  It will be the default architecture.  Today, everyone is designing for the cloud, the true cloud, with all the assumptions of relocation, compression, and smaller virtualized servers.  Until then, there will be a lot of work getting us to that promised land of low cost elastic solutions with high performance and ease of use.  Cloud Encapsulation will let us bring many of those benefits to non-cloud applications, too.