Identity governance evolves to must-do item on personnel management and IT security checklist

Listen to the podcast. Download the podcast. Find it on iTunes/iPod. Learn more. Sponsor: SailPoint Technologies.

Read complete transcript of the discussion.

Security and risk aversion around personnel, applications, and IT systems access have never been more urgent. Properly managed identity information and access rules for users of enterprise applications and systems have evolved quickly from hiring and firing to also gaining insight into improper ongoing use and abuse patterns.

Shoddy provisioning of users on and off of IT systems and services won't pass muster with internally mandated best security practices, not to mention becoming a major liability in a new era of mandated regulation and oversight. Guessing which users have access to which discrete services from inside or outside of the company won't fly in a virtualized and cloud-augmented world.

The alternative to guesswork moves IT operators and security officer closer to the level of identity governance, a step above simply granting access and privileges. It means becoming pro-active in managing roles and access across multiple dimensions in a business, across an identity governance lifecycle, for as long as users can interact with a company and its assets.

To learn more about what identity governance means and how big the stakes are for enterprises and highly regulated vertical industries, I recently spoke with Mark McClain, the CEO and founder of SailPoint Technologies, along with Jackie Gilbert, vice president of marketing and also a founder at SailPoint.

Here are some excerpts:

If you look back over most of this decade, back to the turn of the century – it’s still funny to say that phrase – you see a series of issues with breaches. There’s been a series of issues with fraud or potential fraud, everything from Enron to things that happened with other companies where there are questionable practices, and then various clear issues of fraud or criminal activity.

And all of that together has brought about a new focus on privacy, financial oversight, and good governance, which is, in many cases, all related to the management of risk. ... There is a lot of churn in the financial markets and in the companies that make up those markets, where people are potentially moving inside of companies, changing jobs, lots of potential lay-offs happening.

That's when these issues of good governance, good controls over who has access to which critical information become very, very acute. ... Now, you have executives, boards, and business managers, who are being asked to be accountable and to gauge the risk and the effectiveness of controls around identity. ... Some industries have 30-percent churn, with people coming in and out of the organization. All that makes this an extremely difficult problem, just getting proper visibility.

Those people are being asked to use tools and approve, certify, and deem whether access privileges and the accounts the users hold are correct, and do not place businesses at risk. So, if you think about it, it has actually forced the marriage of business and IT all around this issue of identity governance.

We now have the auditors, both internal and external, and/or the compliance people who want to have a say, or a seat at the table, to talk about how well we are managing these kinds of access privileges and what risks are involved, when they are not managed well. ... One of the dirty, dark secrets today is that governance and compliance have become harder, and auditors have been forcing more frequent and periodic review of the access information. Quarterly or annually, these managers and applications owners need to re-certify who has access to what.

Another dirty secret in the industry right now is that managers and applications owners must sign-off on these reports, but they don't understand them, because those reports are generated out of the IT systems and they are incomprehensible to the business people.

You certainly have the business people paying attention now because you have senior management who are highly motivated to avoid being the next headline. They don't want their company showing up out there with Cox Communications, the IRS, Wachovia, and any number of companies like Dupont, which have hit the headlines in the last two or three years with some sort of significant breach related to access.

There is a little a bit of a hot potato now going on where IT and security groups are saying, "Hey, I am not going sign-up and own this problem entirely, because I don't have the business context to know exactly what does or doesn't represent risk. You business people have to define that for us."

It really does start with answering the fundamental question that most companies wrestle with, which is "Who has access to what?" One of my customers has joked about the fact that on the day you start with the company, you have access to nothing, and on the day you leave, you have access to everything. Quite often, the only person who actually knows all of the access privileges I may have after 15 years at a company is me.

There have been multiple groups I have moved through, multiple help desks, and IT organizations that have been part of granting me access over the years. So, it's quite probable that, literally, only I understand all of the privileges I have as an employee -- and that's a problem.

[Our solution] is pretty analogous to business intelligence (BI) and even data warehousing or data mining, if you will. Our approach is to take a very lightweight, read-only access to the data. We pull entitlement data and account data from applications and servers throughout the enterprise and we aggregate that into what is basically an entitlement warehouse.

We physically create a common data view of users and their entitlements. What that gives you is not only the visibility in one, single place, but it gives you the business context to better understand it. And it allows us to do some automation of controls and policy enforcement, and some risk assessment. It's amazing the value you can derive, once you get the data all in one place and normalized, so that you can apply all kinds of rules and logic to it.

... It's all in one place. They’re not getting a single spreadsheet per application. They’re getting it all centralized per employee or per application, however they want to see it.

We can also scan that data, looking for policy violations. A good example of that would be what we call "toxic combinations," such as “you can't have an employee who both has the ability to set up a vendor and pay a vendor.” Those are two different access privileges that together indicate a high potential for fraud. So by combining all the entitlement data into one single database, you can much more easily scan for and detect potential policy violations and also the potential for risk to the business.

Read complete transcript of the discussion.

Listen to the podcast. Download the podcast. Find it on iTunes/iPod. Learn more. Sponsor: SailPoint Technologies.

Web 2.0 acts as accelerant in pending corporate Darwinian shake-out, says Palladium Group CEO

The impact of Web 2.0 technologies on the current global economic downturn will hasten the demise of closed and siloed corporate cultures while providing a reality-based balm on those companies that seek transformation and adaptation by tapping the wisdom of its communities.

These were some of the high-level observations from a chat I had this morning with Dr. David Friend, chairman, president and CEO of Palladium Group, a prominent performance management and consulting firm in Lincoln, Mass.

The swift and severe economic recession predicted by economists and presaged by plunging stock valuations worldwide points to a difficult period of months and possibly years, said Friend. And that means that the decisions that companies and government agencies make during the tumultuous period will carry more impact, perhaps making the difference between organizations becoming adaptive survivors or calcified road kill.

Companies in today's increasingly "hot, flat and crowded world," said Friend, need to make better decisions. Information alone does not do the job. A systemic and ingrained corporate capacity around decision making is needed. Former lions of Wall Street Lehman Brothers and Bear Stearns had oceans of data at their disposal, for example, but still made decisions that imperiled the venerable firms, such as allowing 40-times leverage bets against risky investment instruments.

Palladium Group, formerly the Balanced Scorecard Collaborative, works with companies to help develop strategy, performance management, and business intelligence (BI) methods that help implement "decision cycles" that foster better business outcomes. "It's about building decision-making engines," said Friend.

Today, more than ever, companies need to make decisions fast, based on accurate and comprehensive information. Those analytics need to reach the people who can act and communicate effectively. Yet even in good times, companies tend to take complexity and attack it via compartmental and isolated sub-problem-solving.

The result is that "IT people think about IT, budget people think about budgets, and strategy people think about strategy," said Friend. The decisions, therefore, are faulty or missing because the fuller implications and inputs are not assimilated. Companies, in effect, lack a figurative right brain function, or lose it over time.

New tools, collectively grouped under Web 2.0, however, have emerged in just the past few years that could have a dramatic bearing on how companies newly react to the pressures of the economic contraction. Severe downturns act in a Darwinian fashion, weeding out the ill-adapted and weak, and rewarding the fittest and agile. Web 2.0 will aid the agile and open while placing those who don't use tools such as blogs, wikis, podcasts, social networks at a disadvantage, said Friend.

Friend has a blog for his employees, he said, but it is not easily found via Web search. I find this a bit anachronistic given his stated fealty for the medium.

Nonetheless, BI and Web 2.0 can act in cohesion, said Friend, by allowing better communication about empirical findings and effects, and also injecting more valuable insights from more people with better access to changing environments. Friend cited the use of wikis by the U.S. intelligence community as a way of dramatically improving collaboration and cooperation among rival or siloed agencies.

For those companies that, by culture and tradition, act as dictatorships, with decisions that emanate from the top and which punish countervailing information from reaching decision makers, they will not benefit from the wellspring of information available from employees, customers, partners, and even competitors. Those who avoid or undermine the benefits of Web 2.0 tools will lack the information that leads to better decisions, will miss the ongoing refinement of strategies by those witnessing their impacts.

The power is in the "democratization of information," said Friend, and then of placing that information in the context of proper decision-making. The flow of information and its exploitation for the business's benefit will hasten the decision cycles, for better or worse, said Friend.

I fully agree with this assessment, and I also believe that the economic challenges will accelerate the transformation of both IT and business. IT needs to, as usual, reduce total costs while improving business outcomes. BI and Web 2.0 are essential ingredients for this challenge. But the business leaders must also see the value in these tools and expand their usefulness by integrating them into their decision cycles.

To do this means resisting the urge to slash IT budgets generally, but instead to fund the tools that will provide agility and better decisions, of investing in the means to increase revenue and improve the competitiveness of companies. The payback from BI and Web 2.0 collaboration are well understood. The decision on their use is what needs to be made -- not avoided or overlooked.

Looking forward to webinar on cloud-based desktops as a service story

Virtual desktop infrastructure (VDI) is gaining interest for a lot of technical, risk and cost reasons. But there's more than one way to skin the VDI cat.

I'll be taking part in a webinar presentation later this week, at noon ET on Thursday, Oct. 23, on the cloud version of VDI. Desktone is hosting the webinar, and I'm participating, but not getting paid. Here is more information, and how to join in.

Desktone impressed me over a year ago when I was first introduced to them. The value comes from creating the means for telcos and service providers to deliver virtual desktops, what Desktone calls desktops as a service (DaaS), en masse. The cost savings can be huge, and it gets those who don't need to be in the IT business (just to support a few applications) out of the soup-to-nuts IT game.

For home offices, small businesses, and small enterprises -- not to mention departments of certain types of workers inside large enterprises -- the VDI route via a cloud or network host makes a lot of sense.

It also aligns quite well with the platform as a service (PaaS) trend, in that those using a VDI service can order up access to packaged applications, or hire developers to customize or mashup their own data views or process and workflow efficiencies. All of it then gets delivered as a service. Good VDI is desktops and applications -- you need both.

This may be the last best bet for network service and communications providers as they seek a recurring and growth-oriented business service portfolio. As a small business owner, I'd be happy to acquire QuickBooks as a service, for example, or even move more of my apps, data, and PC functions to the cloud.

If I had more employees, I would certainly look at VDI from a package of business and network services as the answer to keeping them current on the apps I want them to use. And I would seek out a GUI tools set to create custom apps for my specific business needs.

So if you're curious about how VDI from the cloud and app dev works, join myself and other industry analysts, Rachael Chalmers from The 451 Group and Robin Bloor from Hurwitz & Associates, for the Desktone webinar this Thursday. Should be fun.

BriefingsDirect Insights Analysts identify IT winners and losers in global economic downturn

Listen to the podcast. Download the podcast. Find it on iTunes/iPod. Learn more. Charter sponsor: Active Endpoints.

Read a full transcript of the discussion.

Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.

Welcome to the latest BriefingsDirect Insights Edition, Vol. 31, a periodic discussion and dissection of software, services, SOA and compute cloud-related news and events, with a panel of IT analysts and guests.

In this episode, recorded Oct. 10, 2008, our experts examine the worldwide economic maelstrom, with an eye to the IT sector and how enterprises and vendors will be impacted. While the times will remain challenging for the foreseeable future, there are opportunities and counter-intuitive effects -- like beginning a start-up company -- when economics drive more of the rationalization around IT decisions.

Please join noted IT industry analysts and experts Tony Baer, senior analyst at Ovum; Jim Kobielus, senior analyst at Forrester Research, and Dave Linthicum, independent SOA consultant at Linthicum Group. Our discussion is hosted and moderated by your's truly.

Here are some excerpts:

On the IT Winners

Baer: ... The winners are those who are likely to be more diversified into services, services that can help companies harvest more of what they already have. ... The fact is that in an economic situation like this, especially where there are a lot of known unknowns, having a services business is a good way of helping clients to discover new economies. And it's also potentially a much more flexible arrangement than having to put in an upgrade of a new version of SAP software.

Gardner: My first take on this is that the government vertical is actually going to explode and might even start going down this road towards transformation in a much more significant way.

Linthicum: People are going to look to government to solve some of these issues and bureaucratic changes are going to be built here in different divisions, and people are going to have oversight of the financial industry.

If the Democratic administration comes in, there is going to be more civilian spending, and there is going to be probably a little shift from the spending in the Department of Defense on the military side.

So, this area is going to be explosive yet again, based on some things that are occurring and based on the government taking power in particular industries.

... I think healthcare is going to remain fairly static, and I think some of their costs maybe reduced. As they start moving into more of a socialized medicine, if the Democrats take it there, there is going to be some big shifts there.

Believe it or not, even though you are moving into a healthcare-for-everyone kind of an environment, you are going to see that actually [IT] cost probably will go up, as a bureaucracy is put in place to maintain and administer that.

Baer: I hate to use the 'D' word but back in the depression, and I hope we are not heading into one, what area boomed during that era? Hollywood, the film industry. People were going out to the movies for cheap thrills. In today's environment, the equivalent of that is, if you already have an Xbox 360 out there, you are going to be buying more games. Those are cheap thrills.

Gardner: We haven't talked about one sector, and that is the Entertainment/Web 2.0/Internet. We’ve seen some downturn in advertising, including Internet advertising, but is there an opportunity for buying $3 movie and downloading it, a $2 song, a $3 game.


On the IT Losers

Koblielus: ... Those who will get hurt are those vendors who rely on new-product sales, especially new product sales that are very much hardware-centric. ... In any economic downturn, the things that get cut from corporate budgets, for example, are large capital expenditure (CAPEX) projects. That's going to hurt a number of IT vendors in particular niches, for example the hardware vendors, and also where it's a discretionary software upgrade purchase. Those are also going to feel the crunch.

In any downturn, users, large corporate IT, look to rationalize and streamline their vendor commitments. In other words, they consolidate to a few very large, very strategic vendors. So, the big guys will get bigger and the small, pure-play data-warehousing appliance vendors will be acquired or will vanish.

Gardner: On the other hand some, verticals that don't look good include retail and manufacturing. The auto industry is getting whacked.

Linthicum: The retail space is going to suffer tremendously. They already have very narrow razor-thin margins. I think we are going to see a lot of the larger retailers suffer and perhaps go away. ... Finance is obviously going to be killed for a long time, especially the banking industry. That's going to be an area that isn't going to recover very quickly from what's going on right now, but I think that manufacturing ultimately will recover and we are going to see some good growth in the year 2009-2010.

Kobielus: ... It basically supplements the fact that there is going to be a decline in the journalist population, essentially a migration towards the extremes, which is on one hand journalism and this is not a development.

I’m very happy to see is that, as the financial base and the business model for journalism businesses is evaporating at this point, you are seeing more-and-more citizen journalists taking up more of the load. People are reading more blogs. They are not buying newspapers.


On the Consequences

Linthicum: [IT buyers] are looking to morph the way in which they consume IT. ... They plan to implement strategic technology into their enterprise [in a way that] increases in interest but decreases in cost. In other words, people are going to move into more efficient technologies. They are going to look at a little bit more at cloud computing and other ways to save money and start moving aggressively in those directions.

... Instead of having a huge Microsoft infrastructure just for e-mail and calendar-sharing in groupware, and those sorts of things, moving to things that are in the cloud. This is obviously Google, but there is also a ton of other guys that are offering some pretty good technology -- information-sharing using similar infrastructure. They’ll start outsourcing that, versus maintaining all these data centers that are just dealing with e-mail and communication between people within the company.

Gardner: Where does this put Microsoft?

Bear: ... They are in a transition. ... In the short-term, I think it's going to hurt their business, because clearly take-up of Vista has pretty well-flagged, especially on the corporate side. Obviously they are trying to cultivate the Software Plus Services side, but that business is still very much in its early in its cycle.

Linthicum: You can go off-premises with lots of stuff and the cost is always cheaper, and also it allows you to upgrade and innovate into new technological areas you haven’t driven before.

Next, would be tactical, software-as-a-service (SaaS) applications. Take some of the HR processing, which is driven by some kind of in-house system in the data center, and outsource that to the dozen or so SaaS vendors who are offering HR processing. That's kind of a light-weight business process.

Then, the next generation is even more risky, and I don’t see a ton of guys doing that initially. It involves some of the core business processes, and getting into an SOA kind of an initiative. Re-automating those, but also outsourcing a tremendous number that haven’t been done before for the primary reason of cost saving.

Kobielus: I see definitely the economic downturn is going to expand the footprint, as it were, for the cloud in data warehousing, where data warehouses are becoming ever larger in the hundreds of terabytes and now into the petabyte.

I’m seeing an upsurge in the number of start-ups and data warehousing vendors that now have cloud based offerings. ... In other words, where there is a capital expenditure crunch or a budget crunch, and users can’t afford to pay the millions of dollars to bring one of these petabyte-scale data warehouses in house, they are going to go outside to the likes of a 1010data or using Amazon EC2 to aggregate, persist these huge datasets.

They can do very complex analyses and also run a greater degree of their data mining and predictive analytics algorithms in that very cloud. It just saves them money, and it's not a huge capital expenditure. It's a pay-as-you-go kind of thing. I think that's going to be the trend and those vendors who are already out there could be the major beneficiaries of this current economic crunch.

Baer: ... In times like these, obviously you have changing economic conditions, changing in a very unpredictable manner. On the other hand, the financial crunch and the credit crunch is going to restrict the amount of resources you have at your disposal. So, you’re basically going to look very opportunistically. You are going to look at, let's say, the low-hanging fruit that will give you the greatest gain in savings or a way to respond to the market in a more agile manner.

... You won’t necessarily do a global top down or enterprise-architectural SOA transformation, if you haven't done SOA already. But, opportunistically, if you are trying to take advantage of some of these cloud-based services to start doing mining on a more massive scale, at the same time trying to lower your risk, it will require certain applications or data source that you may have. You may need to conduct a transformation, where you will implement, more flexible architectures, data SOA architecture.

But you will do it opportunistically in these tactical areas, where you can take advantage of services in the cloud that give you the advantages of the transformation to solve the problem you need to deal with, and at the same time, minimizing your risk.

Kobielus: ... The financial vertical and the government vertical are becoming overlapped. There is a degree of nationalization already that's taking place. The government is taking back Fannie Mae and Freddie Mac. I think they have taken over AIG, but all around the world, you hear governments, especially in Europe saying, “Hey, we need to re-nationalize or, to some degree, exert tighter control over the financial vertica., I think this is everywhere in the world.

What we’re already seeing is that the government vertical, as they have indicated, will continue to grow, because it's going to exercise much greater oversight and equity positions within the financial vertical. I think the early part of this decade is a prelude to what we’re going to see in even greater abundance in the next 10 years.

After the whole Enron fiasco, with Sarbanes-Oxley and so forth, we saw the growth of this market and this technology called governance, risk management, and compliance (GRC) to exert tighter control over the financials of private enterprise, and bring greater transparency.

I think we are going to see now, the government exert ever tighter GRC reigns over the financial sector, to a degree unprecedented, because we now have government actually owning or controlling a number of the key firms in that space. So, the whole GRC sector is in an embryonic stage. There are a number of vendors like SAP and Oracle who have taken sort of a leading-edge position in that area. That will expand greatly, and we are going to see more of these risk dashboards and controls being implemented in the context of BI and the data warehousing investments that enterprises have already made.

In terms of the horizontals, the GRC sector will come into its own, and it will be primarily the driver. There will be the financials, and then it will be around the world. All governments will enforce the use of this kind of technology.

Baer: ... In the case of governance, I don't know if I would call it “opportunistic,” but it is an area in which you do not have an option as to whether you comply or not. Therefore, the only economic way to provide all the information and to do all the audits without having to rip apart all of your existing back-end infrastructure is through a service's layer on top of all that.

Maybe I can come up with a cheap buzzword here, a buzz-line or a tag-line, such as “Son of SOX,” for what's going to become a changing regulatory environment. You’ll need a governance layer that can contend with changes in this moving target. Obviously, the only feasible way, from an architectural standpoint, to deal with that is do a flexible architecture, and that's essentially what a SOA is.

Linthicum: I think this is a great time to do a startup. Number one, VCs be damned at this point. You don't need their money at all, just some angel investors to invest in some very minute infrastructure. With cloud computing out there and the number of things you can do from a marketing, application developer's, and outsourcing perspective, you can basically get a technology company up and running -- and profitable -- probably for the least real cost we've seen in years. It's a great time for people who are innovative, able, and resourceful to get out there and start technology companies.

... Now is a great time for small innovative new startups to get out there and help create new spaces, such as Web 2.0, and I think there are a number of SOA problems that needs solving as well. I'd love to see some startups get out there and take those problems on.

Read a full transcript of the discussion.

Listen to the podcast. Download the podcast. Find it on iTunes/iPod. Learn more. Charter sponsor: Active Endpoints.

Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.

Cast Iron takes 'integration as a service' to cloud-based or on-premises deployment

Cast Iron Systems is striking a new pose by putting template-driven integration services in the cloud, offering customers a choice between cloud-based and on-premise "integration as a service."

The new cloud-based solution from the Mountain View, Calif. company will allow enterprises to rapidly connect software-as-a-service (SaaS) solutions with other on-demand and on-premise applications.

This ability to integrate applications across hybrid deployment types is critical for enterprises to increasingly move to cloud-based and SaaS models. More than not, applications will come from several sources, and so the integrations becomes the enabler of the models ongoing use and success.

At the heart of the Cast Iron integration service is a cloud-based library of template integration processes (TIPs) for the most common SaaS business processes, based on Cast Iron’s experience with thousands of customer integrations.

For example, if customers need to integrate two SaaS applications, they can search the TIPs library, choose the TIP that matches their scenario, and deploy it to the cloud. Their SaaS-to-SaaS integration project goes live rather than taking weeks, or even months to develop with custom code. Also, SaaS integrations can now be monitored from anywhere, anytime using the Cast Iron Cloud. Sharing of templates widely is encouraged.

In addition, for companies that want to customize TIPs based on their specific requirements, Cast Iron provides a self-guided wizard similar to the simple wizard-based experience in popular products like Intuit TurboTax. Users answer a few questions based on the specific situation, and the integration process is automatically customized to expedite SaaS integration and adoption.

The integration services can be accessed via the Cast Iron Cloud, on-premises deployments, as well as via both physical and virtual appliances, says Cast Iron.

Curt Monash of DBMS2 says that the move by Cast Iron isn’t the first such offering, but seems to be the most comprehensive:

The most comprehensive integration-as-a-service story I’ve heard may be the one Cast Iron Systems is rolling out. Cast Iron is hosting with OpSource any integration you can get in the Cast Iron appliance. To emphasize this, pricing is identical to that of the rental option for the appliance ($1K/month in the simplest two-endpoint cases), and customers are encouraged to switch between appliance and cloud usage as they see fit.

At the same time, Cast Iron announced a SaaS partner program, which is calls Powered by Cast Iron. This is designed to provide integration solutions for SaaS independent software vendors, value-added resellers, system integrators, and OEMs by combining leading products, service methodologies, and customized sales and marketing strategies.

Among the SaaS providers already participating in the program are Gearworks, Intelenex, Serene Corp., Taleo, and Xactly.

With Systinet 3.0, HP broadens SOA governance role to encompass services lifecycle, business processes, IT service management

Hewlett-Packard trotted out the new HP SOA Systinet 3.0 registry today, capping a year of announcements that create a services oriented architecture (SOA) lifecycle portfolio, and extends the governance function broadly -- a cradle to grave approach -- that spans from design time to run time and all the way up to project portfolio management (PPM).

The newest market leading Systinet UDDI registry forms the cockpit for managing not only services, but with the newly added Business Process Execution Language (BPEL) support, takes the helm for business processes, too. HP plans to further push the envelope on a master management value even further into IT operations and IT Service Management, as well as a PPM role with the registry.

HP SOA Systinet 3.0 is designed with broadening the use of SOA governance, and IT governance, in mind. HP Software sees SOA moving toward more enterprise-wide deployment. To get there, the role of the registry itself needs to expand. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Brad Shimmin at Current Analysis has a comprehensive write-up on the earlier announcements and HP's direction for the product.

The new SOA infrastructure component captures more than UDDI information, it encompasses best practices, CMDB information, and sets the stage for a wider "culture of governance" to emerge in enterprises, said Kelly Emo, SOA product marketing manager at HP Software.

If you've been following HP's acquisitions and development efforts of the past five years, you'll see a distinct pattern of putting the pieces together for a total or master management capability. The goal is not simply putting all the management data in a common repository, but of elevating the visibility into management across more aspects of IT and business processes.

That visibility and the access to the right systems in the right business context then provides the means to further automate IT and SOA activities, to capture best practices and instantiate them back into how IP performs with repeatability and scale.

This latest product release caps a series of significant acquisitions by HP, from Systinet to Opsware. The cradle to grave story of comprehensive IT management and automation is not yet complete, but the strategy is clear. And the pivotal role of the registry is also clear.

The movement is to expand SOA governance, but perhaps more importantly, expand governance in general across more of what IT touches. Rules, roles, business context, policy, development-to-deployment lifecycles, operational efficiency, projects and services -- all need to be brought into a contextual whole. Not by a common product set, but via standards, technology provider inclusion, and with a methodological and cultural commonality emphasis. There really isn't another place to try and find this common framework for stitching together the disparate aspects of IT management -- the SOA registry is as good as we have nowadays.

Of course, the trends in the market make a move toward comprehensive IT service management via automation -- not reactive and disjointed manual stop-gaps -- imperative. As enterprises take up virtualization, cloud computing, SOA, master data management, and such IT shared services approaches typified by ITIL 3.0, then the scale, complexity and range of inter-dependent IT assets needs a better master.

HP is placing a large bet on the HP SOA Systinet 3.0 registry will fill the roles of eyes, ears, and execution coordinator for more of what makes IIT tick.

More information on the release.

WSO2 eases enterprise data availability for SOA access, consumption

A new data services offering from WSO2 allows a database administrator (DBA) or anyone with a knowledge of SQL to access enterprise data and expose it to services and operations through a Web services application-programming interface (API).

WSO2 Data Services, the latest open-source product from the Mountain View, Calif. company, helps DBAs and programmers contribute to a company’s service-oriented architecture (SOA) by creating WS-* style Web services and REST-style Web resources based on enterprise data. [Disclosure: WSO2 is a sponsor of BriefingsDirect podcasts.]

Users can enter queries and map them into services and operations. Once the query or stored procedure has been exposed as a service, it can be accessed across the network as a service or Web resource.

In its initial release, the application supports access to data stored in relational databases such as Oracle, MySQL and IBM DB2, as well as the comma-separated values (CSV) file format, and Excel spreadsheets. It allows users to authenticate, encrypt and sign services using the WS-Security and HTTP security standards. In addition, support for the WS-ReliableMessaging standard provides enterprise-level reliability.

Current Analysis's Brad Shimmin has some good points on the release (log in required).

Features of WSO2 Data Services 1.0 include:

• Data aggregation, which allows administrators to create services that aggregate data from multiple data sources.

• Wizards for easy configuration.

• XML configuration file format.

• A "try-it" tool that lets users test the data services they have created within the Data Services console.

• Dual REST and WS-* support. REST resources access data using a unique URL for each record; WS-* services use typical Web service access to expose data.

• Built-in caching to eliminate the system overhead of repeatedly returning the same XML response to clients.

The new data services product will be available for download beginning today from the WSO2 Web site. As an open-source product there are no licensing or subscription fees, although service and support options are available.

BriefingsDirect Insights analysts examine HP-Oracle Exadata, 'extreme' BI, virtualization and cloud computing news

Listen to the podcast. Download the podcast. Find it on iTunes/iPod. Learn more. Sponsors: Active Endpoints, Hewlett-Packard.

Read a full transcript of the discussion.

Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.

Welcome to the latest BriefingsDirect Insights Edition, Vol. 30, a periodic discussion and dissection of software, services, SOA and compute cloud-related news and events, with a panel of IT analysts.

In this episode, recorded Sept. 26, 2008, our experts examine the HP-Oracle announcements at Oracle OpenWorld, cloud computing and "on-premises" clouds, and recent virtualization news from VMware, HP, Red Hat and Citrix.

Please join noted IT industry analysts and experts Joe McKendrick, an independent analyst and ZDNet blogger; Brad Shimmin, principal analyst of Current Analysis; Jim Kobielus, senior analyst at Forrester Research, and Dave Linthicum, independent SOA consultant. Our discussion is hosted and moderated by your's truly.

Here are some excerpts:

Oracle announced the release, in partnership with HP, of a very high-end data warehousing appliance. They may not use the word "appliance," but that's in fact what it is. It's called the HP Oracle Database Machine. It encompasses and includes the Oracle Exadata Storage Server, which is a grid storage level server.

What Oracle and HP have essentially done is take a page from the Netezza book, because that is, of course, the feature of the Netezza performance system. What they did essentially is they also shot across Teradata's bow, because this is Oracle's petabytes-scale, data warehousing-solution platform.

I was shocked, shocked, absolutely simply shocked. This is because historically Oracle has strayed so far away from the appliance market. I am glad to see this happening. ... Now if only they would release parts of their middleware as an appliance, I would be very happy.

Larry Ellison indicated that they seem to have some plans for that. They really resisted details -- but they seem to have some plans to "appliance-ize," if that's the word, more and more the Oracle Fusion Middleware stack.

It almost seems now that Oracle has anointed HP at some level as a preferred hardware supplier on storage, if not also other aspects of hardware. What does that mean for EMC and some of the other storage hardware providers?

I think that all of those relationships will come under strain from this. There is no question about that. I think there are going be a lot of far-ranging ripples from this relationship that will change the way the market functions.

It certainly moves the business intelligence (BI) arena forward. ... Now there is a trend emerging. I am sure Oracle has an eye on this as well. It's toward open source. We are seeing more open source in data warehouses too. This is open source at the warehouse level itself, at the database level itself. [Sun Microsystem's] MySQL for example has been pointing in this direction, PostgreSQL as well. [And there's Ingres.]

Now with Oracle and HP cooperating, why shouldn't we expect Sun to come out with something quite similar, but with MySQL as the database, and their [Sparc/UltraSparc] processing, and their rack, cooling and InfiniBand, and of course, their storage? If Sun does that then IBM will certainly come out with something around DB2.

There is an emphasis on simplifying data warehousing, making data warehousing simple for the masses. Microsoft, love them or hate them, has been doing a lot of work in this area by increasing the simplicity of its data warehouse and making it available at more of a commodity level for the small to medium size business space.

One of the other important outcomes from my point of view this week at Oracle OpenWorld -- was the fact that Oracle, now in conjunction with Amazon's Elastic Compute Cloud, has an Oracle cloud -- the existing Amazon cloud can take Oracle database licenses. ... Using tools that Oracle is providing they can move their data to back it up or move databases entirely to be persistent in the cloud, in Amazon's S3 service.

I think that this is one step in the direction that, in essence, we're going back in time a bit, moving back into the time-sharing space. A lot of things are going to be pushed back out into the universe through economy's scale, and also through the value of communities. It just can be a much more cheap and cost effective way of doing it. I think it's going to be a huge push in the next two years.

I think that Oracle is going to have a cloud offering, IBM is going to have a cloud offering, Sun is going to have a cloud offering, and it's going to be the big talk in the big industry over the next two or three years. I think they are just going to get out there and fight it out.

I think you are going to have number of start-ups, too. They are going to have huge cloud offerings as well. They are going to compete with the big guys. ... Quite frankly, I think, maybe the more agile, smaller companies may win that war.

These vendors are basically tripping over themselves and rushing out to the market, way before these private clouds have even established themselves. Yet the vendors are declaring that they have the infrastructure and the approach to do it. It sort of reminds me of a platform, or even operating system, land grab -- that getting there first and establishing some of the effective standards and coming up with industry-common implementations gives them an opportunity to at some level or format create the de facto portability means.

As we go forward, I think that's the destination. If you look at how everything is going, I think everything is going to be pushed up into the cloud. People are basically going to have virtual platforms in the cloud, and that's how they are going to drive it. Just from a cost standpoint, everything we just discussed, the advantages are going to be for those who get there first.

I think that very much like the early adopters of the Web, back in the 1990s, this is going to be the same kind of a land grab, and the same kind of land rush that's going to occur. Ultimately you are going to find 60 percent to 80 percent of the business processes over the next 10 years are going to be outsourced.

Listen to the podcast. Download the podcast. Find it on iTunes/iPod. Learn more. Sponsors: Active Endpoints, Hewlett-Packard.

Read a full transcript of the discussion.

Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.