Sunday, February 7, 2010

BriefingsDirect analyst panelists peer into crystal balls for latest IT growth and impact trends

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Charter Sponsor: Active Endpoints.

Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.

The next BriefingsDirect Analyst Insights Edition, Volume 49, hones in on the predictions for IT industry growth and impact, now that the recession appears to have bottomed out. We're going to ask our distinguished panel of analysts and experts for their top five predictions for IT growth through 2010 and beyond.

This periodic discussion and dissection of IT infrastructure related news and events with a panel of industry analysts and guests, comes to you with the help of our charter sponsor Active Endpoints, maker of the ActiveVOS business process management system.

To help us gaze into the IT trends crystal ball we are joined by our panel: Jim Kobielus, senior analyst at Forrester Research; Joe McKendrick, independent analyst and prolific blogger; Tony Baer, senior analyst at Ovum; Brad Shimmin, principal analyst at Current Analysis; Dave Linthicum, CEO of Blue Mountain Labs; Dave Lounsbury, vice-president of collaboration services at The Open Group; Jason Bloomberg, managing partner at ZapThink, and JP Morgenthal, independent analyst and IT consultant. The discussion is moderator Dana Gardner, principal analyst at Interarbor Solutions. [Disclosure: The Open Group is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:
Shimmin: Mine are geared toward collaboration and conferencing. The first and most obvious is that clouds are going to become less cloudy. Vendors, particularly those in the collaboration space, are going to start to deliver solutions that are actually a blend of both cloud and on-premise.

We've seen Cisco take this approach already with front-ending some web conferencing to off-load bandwidth requirements at the edge and to speed internal communications. IBM, at least technically, is poised do the same with Foundations, their appliances line, and LotusLive their cloud-based solution.

With vendors like these that are going to be pulling hybrid, premise/cloud, and appliance/service offerings, it's going to really let companies, particularly those in the small and medium business (SMB) space, work around IT constraints without sacrificing the control and ownership of key processes and data, which in my mind is the key, and has been one of the limiting factors of cloud this year.

Number two: I have "software licensing looks like you." As with the housing market, it's really a buyer's market right now for software. It's being reflected in how vendors are approaching selling their software. Customers have the power to demand software pricing that better reflects their needs, whether it's servers or users.

I think the weapons will be user facing enterprise apps that work in concert with line-of-business solutions on the back-end.



So, taking cues from both the cloud and the open-source licensing vendors out there, we will see some traditional software manufacturers really set up a "pick your poison" buffet. You can have purchase options that are like monthly or yearly subscriptions or flat perpetual licenses that are based on per seat, per server, per CPU, per request, per processor, or per value unit, with a shout out at IBM there -- or any of the above.

You put those together in a way that is most beneficial to you as a customer to meet your use case. We saw last year with web conferencing software that you could pick between unlimited usage with a few seats or unlimited seats with limited usage. You can tailor what you pay to what you need.

Third for me is the mobile OS wars are going to heat up. I'm all done with the desktop. I'm really thinking that it's all about the Google Chrome/Android. I know there's a little bit of contention there, but Google Chrome/Android, Symbian, RIM, Apple iPhone, Windows Mobile, all those devices will be the new battle ground for enterprise users.

I think the weapons will be user facing enterprise apps that work in concert with line-of-business solutions on the back-end. We'll see the emergence of native applications, particularly within the collaboration space, that are capable of fully maximizing the underlying hardware of these devices, and that's really key. Capabilities like geo-positioning, simultaneous web invoice and, eventually, video are really going to take off across all these platforms this year.

Win or lose

But, the true battle for this isn't going to be in these cool nifty apps. It's really going to be in how these vendors can hopefully turn these devices into desktops, in terms of provisioning, security, visibility, governance, etc. That, to me, is going to be where they're going to either win or lose this year.

Four is "The Grand Unification Theory" -- the grand unification of collaboration. That's going to start this year. We're no longer going to talk about video conferencing, web conferencing, telepresence, and general collaboration software solutions as separate concerns. You're still going to have PBXs, video codecs, monitors, cameras, desk phones, and all that stuff being sold as point solutions to fill specific requirements, like desktop voice or room-based video conferencing and the like.

Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.

But, these solutions are really not going to operate in complete ignorance of one another as they have in the past. Vendors with capabilities or partnerships spanning these areas, in particular -- I'm pointing out Cisco and Microsoft here -- can bring and will be bringing facets of these together technically to enable users to really participate in collaboration efforts, using their available equipment.

And last but not least ... Google Wave is really going to kick in in 2010. I may be stating the obvious, or I maybe stating something that's going to be completely wrong, but I really feel that this is going to be the year that traditional enterprise collaboration players jump head long into this Google Wave pool in an effort to really cash in on what's already a super-strong mind share within the consumer ranks.

Even though they have a limited access to the beta right now, there are over a million users of it, that are chunking away at this writing code and using Wave.

Of course, Google hosted rendition will excel in supporting consumer tasks like collaborative apps and role playing games. That's going to be big.

Linthicum: My top five are going to be, number one, cloud computing goes mainstream. That's a top prediction, I'm just seeing the inflection point on that.

I know I'm going out on the edge on this one. Go to indeed.com and do a search on the cloud-computing jobs postings. As I posted on my InfoWorld blog few weeks ago, it's going up at an angle that I have never seen at any time in the history of IT. The amount of growth around cloud computing is just amazing. Of course, it's different aspects of cloud computing, not just architecture with people who are cloud computing developers and things like that.

The Global 2000 and the government, the Global 1, really haven't yet accepted cloud computing, even though it's been politically correct for some time to do so. The reason is the lack of control, security concerns, and privacy issues, and, of course, all the times the cloud providers went down. The Google outages and the loss of stuff with T-Mobile, hasn't really helped, but ultimately people are gearing up, hiring up, and training up for cloud computing.

We are going to see a huge inflection point in cloud computing. This can be more mainstream in Global 2000 than it has been in the past. It's largely been the domain of SMBs, pilot projects, things like that. It's going to be a huge deal in 2010 and people are going to move into cloud computing in some way, shape, or form, if they are in an organization.

People are pushing back on that now. They’ve had it. They really don’t want all of their information out there on the Internet ...



The next is privacy becomes important. Facebook late last year pulled a little trick, where they changed the privacy settings, and you had to go back and reset your privacy settings. So, in essence, if you weren’t diligent about looking at the privacy settings within your Facebook account and your friends list, your information was out on the Internet and people could see it.

The reason is that they're trying to monetize people who are using Facebook. They're trying to get at the information and put the information out there so it's searchable by the search engines. They get the ad revenue and all the things that are associated with having a big mega social media site.

People are going to move away from these social media sites that post their private information, and the social media sites are going to react to that. They're going to change their policies by the end of 2010, and there's going to be a big uproar at first.

Cloud crashes

Next, the cloud crashes make major new stories. We've got two things occurring right now. We've got a massive move into the cloud. That was my first prediction. We have the cloud providers trying to scale up, and perhaps they’ve never scaled up to the levels that they are going to be expected to scale to in 2010. That's ripe for disaster.

A lot of these cloud providers are going to over extend and over sell, and they're going to crash. Performance is going to go down -- very analogous to AOL’s outage issues, when the Internet first took off.

We're going to see people moving to the cloud, and cloud providers not able to provide them with the service levels that they need. We're going to get a lot of stories in the press about cloud providers going away for hours at a time, data getting lost, all these sorts of things. It's just a matter of growth in a particular space. They're growing very quickly, they are not putting as much R&D into what these cloud systems should do, and ultimately that's going to result in some disasters.

N
ext, Microsoft becomes cloud relevant. Microsoft, up to now, has been the punch line of all cloud computing. It had the Azure platform out there. They've had a lot of web applications and things like that. They really have a bigger impact in the cloud than most people think, even though when we think of cloud, we think of Amazon, Google, and larger players out there.

Suddenly, you're going to see Microsoft with a larger share of the cloud, and they're going to be relevant very quickly.



With Azure coming into its own in the first quarter of next year in the rise of their office automation applications for the cloud, you are going to see a massive amount of people moving to the Microsoft platform for development, deployment, infrastructure, and the office automation application. The Global 2000 that are already Microsoft players and the government that has a big investment in Microsoft are going to move in that direction.

Suddenly, you're going to see Microsoft with a larger share of the cloud, and they're going to be relevant very quickly. In the small- and medium-sized business, it's still going to be the domain of Google, and state and local governments are still be going to be the domain of Google, but Microsoft is going to end up ruling the roost by the end of 2010.

Finally, the technology feeding frenzy, which is occurring right now. People see the market recovering. There is money being put back into the business. That was on the sidelines for a while. People are going to use that money to buy companies. I think there is going to be a big feeding frenzy in the service-oriented architecture (SOA) world, in the business intelligence (BI) world, and definitely in the cloud-computing world.

Lots of these little companies that you may not have heard about, which may have some initial venture funding, are suddenly going to disappear. Google has been taking these guys out left and right. You just don’t hear about it. You could do a podcast just on the Google acquisitions that have occurred this week. That's going to continue and accelerate in 2010 to a point where it's almost going to be ridiculous.

Lounsbury: I'm going to jump on the cloud bandwagon initially. We’ve seen huge amounts of interest across the board in cloud and, particularly, increasing discussions about how people make sense of cloud at the line-of-business level.

Another bold prediction here is that the cloud market is going to continue to grow, and we'll see that inflection point that Dave Linthicum mentioned. But, I believe that we're going to see the segmentation of that into two overarching markets, an infrastructure-as-a-service (IaaS) or platform-as-a-service market (PaaS) and software-as-a-service (SaaS) market. So that's my number one prediction.

We'll see the continued growth in the acceptance by SMBs of the IaaS and PaaS for the cost and speed reasons. But, the public IaaS and PaaS are going to start to become the gateway drug for medium- to large-size enterprises. You're going to see them piloting in public or shared environments, but they are going to continue to move back toward that locus of controlling their own resources in order to manage risk and security, so that they can deliver their service levels that their customers expect.

My third prediction, again in cloud, is that SaaS will continue to gain mainstream acceptance at all levels in the enterprise, from small to large. What you’ll see there is a lot of work on interfaces and APIs and how people are going to mash up cloud services and bring them into their enterprise architectures.

Of course all of this is set against the context that all distributed computing activities are set against, which is security and privacy issues.



This is actually going to be another trend that Dave Linthicum has mentioned as a blurring of a line between SaaS and SOA at the enterprise level. You’ll see these well on the way to emerging as disciplines in 2010.

The fourth general area is that all of this interest in cloud and concern about uptake at the enterprise level is going to drive the development of cloud deployment and development skills as a recognized job function in the IT world, whether it's internal to the IT department or as a consultancy. Obviously, as a consultancy, we look to the cloud to provide elasticity of deployment and demand and that's going to demand an elastic workforce.

So the question will be how do you know you are getting a skilled person in that area. I think you'll see the rise of a lot of enterprise-level artifacts such as business use cases, enterprise architecture tools, and analytic tools. Potentially, what we'll see in 2010 is the beginning of the development of a body of knowledge: practitioners in cloud. We'll start to recognize that as a specialty the way we currently recognize SOA as a specialty.

Of course all of this is set against the context that all distributed computing activities are set against, which is security and privacy issues. I don’t know if this is a prediction or not, but I wonder whether we're going to see our cloud harbor in 2010 its first big crash and the first big breach.

We've already mentioned privacy here. That's going to become increasingly a public topic, both in terms of the attention in the mainstream press and increasing levels of government attention.

There have been some fits and starts at the White House level about the cyber czar and things like that, but every time you turn around in Washington now, you see people discussing cyber security. How we're going to grow our capability in cyber security and increasing recognition of cyber security risk in mainstream business are going to be emerging hot topics of 2010.

Kobielus: Number one: IT is increasingly going to in-source much of BI development of reports, queries, dashboards, and the like to the user through mash up self-service approaches, SaaS, flexible visualization, and so forth, simply because they have to.

IT is short staffed. We're still in a recession essentially. IT budgets are severely constrained. Manpower is severely constrained. Users are demanding mashups and self-service capabilities. It's coming along big time, not only in terms of enterprise deployment, but all the BI vendors are increasingly focused on self-service solution portfolios.

Number two: The users who do more of the analytics development are going to become developers in their own right. That may sound crazy based on the fact that traditionally data mining is done by a cadre of PhD statisticians and others who are highly specialized.

Basically, we're taking data mining out of the hands of the rocket scientists and giving it to the masses through very user-friendly tools.



Question analysis, classification and segmentation, and predictive analytics is coming into the core BI stack in a major way. IBM’s acquisition of SPSS clearly shows that not only is IBM focusing there, but other vendors in this space, especially a lot of smaller players, already have some basic predictive analytics capabilities in their portfolios or plan to release them in 2010.

Basically, we're taking data mining out of the hands of the rocket scientists and giving it to the masses through very user-friendly tools. That's coming in 2010.

Number three: There will be an increasing convergence of analytics and transactional computing, and the data warehouse is the hub of all that. More-and-more transactional application logic will be pushed down to be executed inside of the data warehouse.

The data warehouse is a greater cloud, because that's where the data lives and that's where the CPU power is, the horse power. We see Exadata, Version 2 from Oracle. We see Aster Data, nCluster Version 4.0. And, other vendors are doing similar things, pointing ahead to the coming decade, when the data warehouse becomes a complete analytic application server in its own right -- analytics plus transaction.

Predictive analysis

Number four: We're seeing, as I said, that predictive analytics is becoming ever more important and central to where enterprises are going with BI and the big pool of juicy data that will be brought into predictive model. Much of it is coming from the whole Web 2.0 sphere and from social networks -- Twitters, Facebooks and the like, and blogs. That's all highly monetizable content, as Dave Linthicum indicated.

We're seeing that social network analysis has a core set of algorithms and approaches for advanced analytics that are coming in a big way to data mining tools, text analytics tools, and to BI. Companies are doing serious marketing campaign planning, optimization, and so forth, based on a lot of that information streaming in real-time. It's customer sentiment in many ways. You know pretty much immediately whether your new marketing campaign is a hit or a flop, because customers are tweeting all about it.

That's going to be a big theme in 2010 and beyond. Social network analysis really is a core business intelligence for marketing and maintaining and sustaining business in this new wave.

Right now, we're in the middle of a price war for the enterprise data warehousing stack hardware and software.



And, finally, number five: Analytics gets dirt cheap. Right now, we're in the middle of a price war for the enterprise data warehousing stack hardware and software. Servers and storage, plus the database licenses, query tools, loading tools, and BI are being packaged pretty much everywhere into appliances that are one-stop shopping, one throat to choke, quick-deploy solutions that are pre-built.

Increasingly, they'll be for specific vertical and horizontal applications and will be available to enterprises for a fraction of what it would traditionally cost them to acquire all those components separately and figure it out all themselves. The vendors in the analytics market are all going appliance. They're fighting with each other to provide the cheapest complete application on the market.

McKendrick: My number one trend is the impact of the economy. By all indications, 2010 is going to be a growth year in the economy. We're probably in this V shape.

See, I'm actually an optimist, not a pessimist. The world may end in 2012, but for 2010, we're going to have a great economy. It's going to move forward.

For this decade, we're looking forward to the rise of something called "social commerce," where the markets are user-driven and are conversations.

I think 2010 will be a year of growth.

Number two: Cloud computing. We’ve all been talking about that. That's the big development, the big paradigm shift. Clouds will be the new "normal." From the SOA perspective, we're going to be seeing a convergence. When we talk about cloud, we're going to talk about SOA, and the two are going to be mapped very closely together.

Dave Linthicum talks a lot about this in his new book and in his blog work. Services are services. They need to be transparent. They need to be reusable and sharable. They need to cross enterprise boundaries. We're going to see a convergence of SOA and cloud. It’s a service-oriented culture.

Number three: Google is becoming what I call the Microsoft of the clouds. Google offers a browser and email. It has a backend app engine. It offers storage. They're talking about bringing out an OS. Google is essentially providing an entire stack from which you can build your IT infrastructure. You can actually build a company’s IT infrastructure on the back of this. So, Google is definitely the Microsoft of the cloud for the current time.

Microsoft is also getting into the act as well with cloud computing, and they are doing a great job there. It’s going to be interesting to see what happens. By the way, Google also offers search as a capability.

Number four: We're going to see less of a distinction between service providers and service consumers over clouds, SOA, what have you. That's going to be blurring. Everybody will be providing and publishing services, and everybody will be consuming services.

You're going to see less of a distinction between providers and consumers. For example, I was talking to a reinsurance company a few months back. They offer a portal to their customers, the customers being insurance companies. They say that they offer a lot of analytics capabilities that their customers don’t have, and the customers are using their portal to do their own analytic work.

They don’t call it cloud. Cloud never entered the conversation, but this is a cloud. This is a company that’s offering cloud services to its consumers. We're going to see a lot of that, and it’s not necessarily going to be called cloud. You're not going to see companies saying, "We're offering clouds to our partners." It’s just going to be as the way it is.

Number five: In the enterprise application area, we've seen it already, but we're going to see more-and-more pushback against where money is being spent. As I said, the economy is growing, but there is going to be a lot of attention paid to where IT dollars are going.

I base this on a Harvard Medical School study that just came out last month. They studied 4,000 hospitals over a three-year period and found that, despite hundreds of millions of dollars being invested at IT, IT had no impact on hospital operations, patient care quality, or anything else.

Morgenthal: Number one: Cyber security. I am beginning to understand how little people actually understand about the differences between what security is and information assurance is, and how little people realize that their systems are compromised and how long it takes to eliminate threat within an organization.

Because of all of this connectedness, social networking, and cloud, a lot of stuff is going to start to bubble up. People who thought things were taken care of are going to learn that it wasn’t taken care of, and there will be a sense of urgency about responding to that. We're going to see that happen a lot in the first half of 2010.

Number two: Mobile. The mobile platforms are now the PC of yesterday, right? The real battle is for how we use these platforms effectively to integrate into people’s lives and allow them to leverage the platform for communications, for collaboration, and to stay in touch.

It seems everywhere I go, people are willing to spend a lot of money on their data plan. So, that’s a good sign for telecoms.



My personal belief is that it overkills information overlook, but that’s me. I know that everywhere I go, I see people using their iPhones and flicking through their apps. So, they hit upon a market segment, a very large market segment, that actually enjoys that. Whether small people like me end up in a cave somewhere, the majority of people are definitely going to be focused on the mobile platform. That also relates to the carriers. I think there still a carrier war here. We've yet to see AT&T and iPhone in the US break apart and open up its doors to other carriers.

Number three: Business intelligence and analytics, especially around complex event processing (CEP). CEP is still in an immature state. It does some really interesting things. It can aggregate and correlate. It really needs to go to that next step and help people understand how to build models for correlation. That’s going to be a difficult step.

As somebody was saying earlier, you had these little Poindexters sitting in the back room doing the stuff. There's a reason why the Poindexters were back there doing that. They understand math and the formulas that are under building these analytical models.

CEP and analytics -- and the two tied together. You’ll see that the BI, and data aspects of the BI, side will integrate with the CEP modeling to not only report after the fact on a bunch of raw data, but almost be proactive, and try to, as I said in my blog entry, know when the spit hits the fan.

Number four is collaboration. We’ve crossed the threshold here. People want it. They're leveraging it.

The labor market has not caught up to take advantage of these tools, design them, architect the solutions properly, and deploy and manage them.



I've been seeing some uptake on Google Wave. I think people are still a little confused by the environment, and the interaction model is not quite there yet to really turn it on its ear, but it clearly is an indication that people like large-scale interactions with large groups of people and to be able to control that information and make it usable. Google is somewhat there, and we'll see some more interesting models emerge out of that as well.

Number four is labor. We're at a point where the market is based on all these other things based on the cloud. We had a lot of disruptive technologies hit in the past five years -- enterprise mashups, SOA, and cloud computing. The labor market has not caught up to take advantage of these tools, design them, architect the solutions properly, and deploy and manage them.

I think that 2010 has to be a year for training, rebuilding, and getting some of those skills up. Today, you hear a lot of stories, but there is a large gap for any company to be able to jump into this. Skills are not there. The resources are not there and they are not trained. That's going to be a huge issue for us in 2010.

Bloomberg: I'm going to be a bit of the naysayer of the bunch. I just don't see cloud computing striking it big in 2010. When we talk to enterprise architects, we see a lot of curiosity and some dabbling. But, at the enterprise scale, we see too much resistance in terms of security and other issues to put a lot of investment into it. It's going to be gradually growing, but I don't see such a point coming as soon as you might like.

Small organizations are a different story. We see small organizations basing their whole business models on the cloud, but at the enterprise level, it's sort of a toe in the water, and we see that happening in the 2010.

Another thing we don't see really taking off in any big way is Enterprise 2.0. That is Web 2.0 collaborative technologies for the enterprise. You know, "Twitter On Steroids," and that kind of thing. Again, it's going to be more of a toe in the water thing. Collaborative technologies are maturing, but we don't see a huge paradigm shift in how collaboration is done in the enterprise. It's going to be more of a gradual process.

Another thing that we are not seeing happening in 2010 is CIOs and other executives really getting the connection between business process management (BPM) and SOA. We see those as two sides of the same coin. Architects are increasingly seeing that in order to do effective BPM you have to have the proper architecture in place. But, we don't see the executives getting that and putting money where it belongs in order to effect more flexible business process. So, this is another work in progress, and it's going to be a struggle for architects to make progress over the course of the year.

As far as the end of the recession, yeah, we're all hoping that the economy picks up, and I do see that there is going to be a lot of additional activity as a result of an improving economy, but I don't see a huge uptake in spending on software per se.

Spending in IT is going to go up, but in terms of what the executives going to invest in, they're going to be very careful about purchasing software. That's going to drive some money to cloud-based solutions, but that's still just a toe in the water as well.

Software vendors were hoping for a huge year, but they're going to be disappointed. It's going to be a growth year, but it's going to be moderate growth for the vendors.

Those are my first four. Those are the negatives. Not to be too negative, in terms of the positive, what we see happening in 2010 is increased focus on "MSW." You know what MSW is, right? Politely speaking it's "Make Stuff Work." Of course, you could put a different word in there for the S, but Make Stuff Work, that's what we see the architects really focusing on.

They have a good idea now of what SOA is all about. They have a good idea about how the technology fits in the story and the various technologies that have been mentioned on this call, whether it's analytics, data management, SaaS, and the cloud-based approaches. Now, it's time to get the stuff to work together, and that's the real challenge that we see.

SOA-Plus

The SOA story is no longer an isolated story. We're going to do SOA, let's go do SOA. But, it's SOA plus other things. So, we're going to do SOA, BPM, and the architecture driving that, despite the fact that the CIO may not quite connect the dots there.

SOA plus master data management (MDM) -- it's not one or the other now. It's how we get those things to work together. SOA plus virtualization. That's another challenge. Previously, those conversations were separate parts of the organization. We see more and more conversations bringing those together.

SOA and SaaS -- somebody already mentioned that SaaS is one segment of the cloud category. It's little more mature than the rest. We see more organizations understanding the connection between those two and trying to put them together. We'll do middleware and we'll do SOA, but we don't really see the connection where we confuse one for the other, and that was a big issue.

We're happy to call this services-oriented, even though the organization, as a whole, may call it variety of different things, depending on the perspective of the individual.

Baer: On cloud and virtualization, basically I agree with Jason, and I don't agree with David or with Joe. It’s not going to be the "new normal." We're going to see this year an uptake of all the management overhead of dealing with cloud and virtualization, the same way we saw with outsourcing years back, where we thought we'd just throw labor costs over the wall.

Secondly, JP, I very much believe that there is going to be convergence between BI and CEP this year. I agree with him that there's not going to be a surge of Albert Einsteins out there. On the other hand, I see this as a golden opportunity for vendors to package these analytics as applications or as services. That's where I really see the inflection curve happening.

Number three: Microsoft and Google. Microsoft will be struggling to stay relevant. Yes, people will buy Windows 7, because it's not Vista. That’s kind of a backhanded compliment to say, "We're buying this, because you didn't screw up as badly as last time." It doesn't speak well for the future.

Google meets a struggle for focus. I agree with Joe that they are aspiring to be the Microsoft of the cloud, but it may or may not be such a good thing for Google to follow that Microsoft model.

Finally, I agree with Jim that you are going to see a lot more business-oriented, whether it's BI, BPM, or IBM buying Lombardi. I hope they don't mess up Lombardi and especially I hope they don't mess up Blueprint. I've already blogged about that.

I very much believe that there is going to be convergence between BI and CEP this year.



One other point -- and I don't know if this fits into a top five or not -- but I found what Joe was talking about very interesting in terms of the let-down on health-care investment in IT. There's going to be lot a of pushing in electronic medical records (EMR) this year. I very much believe in EMRs, but, on the other hand, they are no panacea. We're going to see a trough of disillusionment happen on that as well.
Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Charter Sponsor: Active Endpoints.

You may also be interested in:

Saturday, February 6, 2010

ISM3 brings greater standardization to security measurement across enterprise IT

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

Security may be the hottest topic in IT. But it's also one of the least understood.

So BriefingDirect assembled a panel this week to examine the need for IT security to run more like a data-driven science, rather than a mysterious art form.

Rigorously applying data and metrics to security can dramatically improve IT results and reduce overall risk to the business. By employing and applying more metrics and standards to security, the protection of IT becomes better, and the known threats can become evaluated uniformly.

Standards like Information Security Management Maturity Model (ISM3) are helping to not only gain greater visibility, but also allowing IT leaders to scale security best practices repeatably and reliably.

With standards and greater reliance on data, security practitioners can understand better what they are up against, perhaps gaining close to real-time responses. They can know what's working -- or is not working -- both inside and outside of their organization.

The security metrics panel and sponsored podcast discussion are coming to you from The Open Group’s Enterprise Architecture Practitioners Conference in Seattle on Feb. 2, 2010. The goal is to determine the strategic imperatives for security metrics, and to discuss how to use them to change the outcomes in terms of IT’s value to the business.

Our panel consists of a security executive from The Open Group, as well as two experts on security who are presenting at the consortium's Security Practitioners Conference: Jim Hietala, Vice President for Security at The Open Group; Adam Shostack, co-author of The New School of Information Security, and Vicente Aceituno, director of the ISM3 Consortium. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:
Hietala: We think there's a contribution to make from The Open Group, in terms of developing the ISM3 standard and getting it out there more widely. [Being a data-driven security organization means] using information to make decisions, as opposed to what vendors are pitching at you, or your gut reaction. It's getting a little more scientific about gathering data on the kinds of attacks you're seeing and the kinds of threats that you face, and using that data to inform the decisions around the right set of controls to put in place to effectively secure the organization.

A presentation we had today from an analyst firm talked about people being all over the map [on security practices]. I wouldn’t say there's a lot of rigor and standardization around the kinds of data that’s being collected to inform decisions, but there is some of that work going on in very large organizations. There, you typically see a little more mature metrics program. In smaller organizations, not so much. It's a little all over the map.

... The important outputs of a good metrics program can be that it gives you a different way to talk to your senior management about the progress that you're making against the business objectives and security objectives.

That’s been an area of enormous disconnect. Security professionals have tended to talk about viruses, worms, relatively technical things, but haven't been able to show a trend to senior management that justifies the kind of spending they have been doing and the kind of spending they need to do in the future. Business language around some of that is needed in this area.

Shostack: We have an opportunity to be a heck of a lot more effective than we have been. We can say, "This control that we all thought was a really good idea -- well, everyone is doing it, and it's not having the impact that we would like." So, we can reassess how we're getting real, where we're putting our dollars.

The big change we've seen is that people have started to talk about the problems that they are having, as a result of laws passed in California and elsewhere that require them to say, "We made a mistake with data that we hold about you," and to tell their customers.

We've seen that a lot of the things we feared would happen haven't come to pass. We used to say that your company would go out of business and your customers would all flee. It's not happening that way. So, we're getting an opportunity today to share data in a way that’s never been possible before.

Aceituno: The top priority should be to make sure that the things you measure are things that are contributing positivity to the value that you're bringing to business as a information security management (ISM) practitioner. That’s the focus. Are you measuring things that are actually bringing value or are you measuring things that are fancy or look good?

Because metrics are all about controlling what you do and being able to manage the outputs that you produce and that contribute value to the business ... you can use metrics to manage internal factors.

I don’t think it brings a bigger return on investment (ROI) to collect metrics on external things that you can't control. It’s like hearing the news. What can you do about it? You're not the government or you're not directly involved. It's only the internal metrics that really make sense.

Basically, we link business goals, business objectives, and security objectives in a way that’s never been done before, because we are painfully detailed when we express the outcomes that you are supposed to get from your ISM system. That will make it far easier for practitioners to actually measure the things that matter.

Business value approach

Shostack: Vicente’s point about measuring the things you can control is critical. Oftentimes in security, we don’t like to admit that we've made mistakes and we conceal some of the issues that are happening. A metrics initiative gives you the opportunity to get out there and talk about what's going on, not in a finger pointing way, which has happened so often in the past, but in an objective and numerically centered way. That gives us opportunity to improve.

Hietala: There's some taxonomy work to be done. One of the real issues in security is that when I say "threat," do other people have the same understanding? Risk management is rife with different terms that mean different things to different people. So getting a common taxonomy is something that makes sense.

The kinds of metrics we're collecting can be all over the map, but generally they're the things that would guide the right kind of decision making within an IT security organization around the question, "Are we doing the right things?"

Today, Vicente used an example of looking at vulnerabilities that are found in web applications. A critical metric was how long those vulnerabilities are out there before they get fixed by different lines of business, by different parts of the business, looking at how the organization is responding to that. We're trying to drive that metric toward the vulnerabilities being open for less time and getting fixed quicker.

Shostack: We've seen over the last few years that those security programs that succeed are the ones that talk to the business needs and talk to the executive suite in language that the executives understand.

We've seen over the last few years that those security programs that succeed are the ones that talk to the business needs and talk to the executive suite in language that the executives understand.



The real success here and the real step with ISM3 is that it gives people a prescriptive way to get started on building those metrics.

You can pick it up and look at it and say, "Okay, I'm going to measure these things. I'm going to trend on them." And, I'm going to report on them."

As we get toward a place, where more people are talking about those things, we'll start to see an expectation that security is a little bit different. There is a risk environment that's very outside of people's control, but this gives people a way to get a handle on it.

Aceituno: The main task of the ISM3 Consortium so far was to manage the ISM3 standard. I'm very happy to say that The Open Group and ISM3 Consortium reached an agreement and, with this agreement, The Open Group will be managing ISM3 from here on in. We'll be devoting our time to other things, like teaching and consulting services in Spain, which is our main market. I can't think of anything better than for ISM3 to be managed from The Open Group.

Hietala: You have metrics and control approaches in various areas and you can pick a starting point. You can come at this top-down, if you're trying to implement a big program. Or, you come at it bottoms-up and pick a niche, where you know you are not doing well and want to establish some rigor around what you are doing. You can do a smaller implementation and get some benefit out of it. It's approachable either way.
Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

Thursday, February 4, 2010

ArchiMate gives business leaders and IT architects a common language to describe how the enterprise works best

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

Our next podcast discussion looks at ArchiMate, a way of conceptualizing, modeling, and controlling enterprise architecture (EA) and business architecture.

ArchiMate provides ways to develop visualizations and control of IT architecture to more swiftly obtain business benefits. To learn more, we interview an expert on this, Dr. Harmen van den Berg, partner and co-founder at BiZZdesign.

This podcast was recorded Feb. 2 at The Open Group’s Enterprise Architecture Practitioners Conference in Seattle the week of Feb. 1, 2010. The discussion is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:
Gardner: I really enjoyed your presentation on ArchiMate. How did the standard come about?

Dr. Harmen van den Berg: ArchiMate was developed in the Netherlands by a number of companies and research institutes. They developed it, because there was a lack of a language for describing EA. After it was completed, they offered it to The Open Group as a standard.

Gardner: What problems does it solve?

Van den Berg: The problem that it solves is that you need a language to express yourself, just like normal communication. If you want to talk about the enterprise and the important assets in the enterprise, the language supports that conversation.

Gardner: We are talking about more and more angles on this conversation, now that we talk about cloud computing and hybrid computing. It seems as if the complexity of EA and the ability to bring in the business side, provide them with a sense of trust in the IT department, and allow the IT department to better understand the requirements of the business, all need a new language. Do you think it can live up to that?

Van den Berg: Yes, because if you look at other language, like UML, which is for system development and is a very detailed language, it only covers a very limited part of the complete enterprise. ArchiMate is focused on giving you a language for describing the complete enterprise, from all different angles, not on a detailed level, but on a more global level, which is understandable to the business as well.

Gardner: So more stakeholders can become involved with something like ArchiMate. I guess that's an important benefit here.

Van den Berg: Yes, because the language is not focused only on IT, but on the business as well and on all kinds of stakeholders in your organization.

Gardner: How would someone get started, if they were interested in using ArchiMate to solve some of these problems? What is the typical way in which this becomes actually pragmatic and useful?

Van den Berg: The easiest way is just to start describing your enterprise in terms of ArchiMate. The language forces you to describe it on a certain global level, which gives you direct insight in the coherence within your enterprise.

Gardner: So, this allows you to get a meta-view of processes and assets that are fundamentally in IT, but have implication for and reverberate around the business.

Don't have to start in IT

Van den Berg: You don't have to start in IT. You can just start at the business side. What are products? What are services? And, how are they supported by IT?" That's a very useful way to start, not from the IT side, but from the business side.

Gardner: Are there certain benefits or capabilities in ArchiMate that would, in fact, allow it to do a good job at defining and capturing what goes on across an extended enterprise, perhaps hybrid sourcing or multiple sourcing of business processes and services?

Van den Berg: It's often used, for example, when you have an outsourcing project to describe not only your internal affairs, but also your relation with other companies and other organizations.

Gardner: What are some next steps with ArchiMate within The Open Group as a standard? Tell us what it might be maturing into or what some of the future steps are.

Van den Berg: The future steps are to align it more with TOGAF, which is the process for EA, and also extending it to cover more elements that are useful to describe an EA.

It's often used, for example, when you have an outsourcing project to describe not only your internal affairs, but also your relation with other companies and other organizations.



Gardner: And for those folks who would like to learn more about ArchiMate and how to get this very interesting view of their processes, business activities, and IT architecture variables where would you go?

Van den Berg: The best place to go is The Open Group website. There is a section on ArchiMate and it gives you all the information.
Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

You may also be interested in:

'Business architecture' helps business and IT leaders decide on and communicate changes at the new speed of business

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

What's the difference between enterprise architecture (EA) and business architecture (BA)? We pose the question to Tim Westbrock, Managing Director of EAdirections, as part of a sponsored podcast discussion coming to you from The Open Group’s Enterprise Architecture Practitioners Conference in Seattle, the week of Feb. 1, 2010.

The discussion is moderated by me, Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:
Gardner: I really enjoyed your presentation today. Can you tell us a little bit about some of the high-level takeaways. Principally, how do you define BA?

Westbrock: Well, the premise of my discussion today is that, in order for EA to maintain and continue to evolve, we have to go outside the domain of IT. Hence, the conversation about BA. To me, BA is an intrinsic component of EA, but what most people really perform in most organizations that I see is IT architecture.

A real business-owned enterprise business architecture and enterprise information architecture are really the differentiating factors for me. I'm not one of these guys that is straight about definitions. You’ve got to get a sense from the words that you use.

To me enterprise business architecture is a set of artifacts and methods that helps business leaders make decisions about direction and communicate the changes that are required in order to achieve that vision.

Gardner: How do we get here? What's been the progression? And, why has there been such a gulf between what the IT people eat, sleep, and drink, and what the business people expect?

Westbrock: There are a lot of factors in that. Back in the late '80s and early '90s, we got really good at providing solutions really quickly in isolated spots. What happened in most organizations is that you had really good isolated solutions all over the place. Integrated? No. Was there a need to integrate? Eventually. And, that's when we began really piling up the complexity.

We went from an environment, where we had one main vendor or two main vendors, to every specific solution having multiple vendors contributing to the software and the hardware environment.

That complexity is something that the business doesn’t really understand, and we haven’t done a real good job of getting the business to understand the implications of that complexity. But, it's not something they should really be worried about. It's our excuse sometimes that it's too complex to change quickly.

Focus on capabilities

We really need to focus the conversation on capabilities. Part of my presentation talked about deriving capabilities as the next layer of abstraction down from business strategy, business outcomes, and business objectives. It's a more finite discussion of the real changes that have to happen in an organization, to the channel, to the marketing approach, to the skill mix, and to the compensation. They're real things that have to change for an organization to achieve its strategies.

In IT architecture, we talk about the changes in the systems. What are the changes in the data? What are the changes in the infrastructure? Those are capabilities that need to change as well. But, we don't need to talk about the details of that. We need to understand the capabilities that the business requires. So, we talk to folks a lot about understanding capabilities and deriving them from business direction.

Gardner: It seems to me that, over the past 20 or 30 years, the pace of IT technological change was very rapid -- business change, not so much. But now, it seems as if the technology change is not quite as fast, but the business change is. Is that a fair characterization?

Westbrock: It's unbelievably fast now. It amazes me when I come across an organization now that's surviving and they can't get a new product out the door in less than a year -- 18 months, 24 months. How in a world are they responding to what their customers are looking for, if it takes that long to get system changes products out the door?

BA is a means by which we can engage as IT professionals with the business leadership, the business decision-makers who are really deciding how the business is going to change.



We're looking at organizations trying monthly, every six weeks, every two months, quarterly to get significant product system changes out the door in production. You've got to be able to respond that quickly.

Gardner: So, in the past, the IT people had to really adapt and change to the technology that was so rapidly shifting around them, but now the IT people need to think about the rapidly shifting business environment around them.

Westbrock: "Think about," yes, but not "figure out." That's the whole point. BA is a means by which we can engage as IT professionals with the business leadership, the business decision-makers who are really deciding how the business is going to change.

Some of that change is a natural response to government regulations, competitive pressures, political pressures, and demographics, but some of it is strategic, conscious decisions, and there are implications and dependencies that come along with that.

Sometimes, the businesses are aware of them and sometimes they're not. Sometimes, we understand as IT professionals -- some not all -- about those dependencies and those implications. By having that meaningful dialogue on an ongoing basis, not just as a result of the big implementation, we can start to shorten that time to market.

Gardner: So, the folks who are practitioners of BA, rather than more narrowly EA, have to fill this role of Rosetta Stone in the organization. They have to translate cultural frames of mind and ideas about the priorities between that IT side and the business side.

Understanding your audience

Westbrock: This isn't a technical skill, but understanding your audience is a big part of doing this. We like to joke about executives being ADD and not really being into the details, but you know what, some are. We've got to figure out the right way to communicate with this set of leadership that's really steering the course for our enterprise.

That's why there's no, "This is the artifact to create." There's no, "This is the type of information that they require." There is no, "This is the specific set of requirements to discuss."

That's why we like to start broad. Can you build the picture of the enterprise on one page and have conversations maybe that zero in on a particular part of that? Then, you go down to other levels of detail. But, you don't know that until you start having the conversation.

Gardner: Okay, as we close out, you mentioned something called "strategic capability changes." Explain that for us?

. . . There's a missing linkage between that vision, that strategy, that direction, and the actual activities that are going on in an organization.



Westbrock: To me, so many organizations have great vision and strategy. It comes from their leadership. They understand it. They think about it. But, there's a missing linkage between that vision, that strategy, that direction, and the actual activities that are going on in an organization. Decisions are being made about who to hire, the kinds of projects we decide to invest in, and where we're going to build our next manufacturing facility. All those are real decisions and real activities that are going on on a daily basis.

This jump from high-level strategy down to tactical daily decision-making and activities is too broad of a gap. So, we talk about strategic capability changes as being the vehicle that folks can use to have that conversation and to bring that discussion down to another level.

When we talk about strategic capability changes, it's the answer to the question, "What capabilities do we need to change about our enterprise in order to achieve our strategy?" But, that's a little bit too high level still. So, we help people carve out the specific questions that you would ask about business capability changes, about information capability changes, system, and technology.
Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

You may also be interested in:

The Open Group SOA Work Group making strides to deepen link between TOGAF and SOA

This guest post comes courtesy of Mats Gejnevall, a global enterprise architect from Capgemini.

By Mats Gejnevall

As an attendee at this week’s Open Group Seattle Conference 2010, I met with an international group of enterprise architecture (EA) thought-leaders including Dave Hornford, the new chair of The Open Group Architecture Forum, Tony Carrato from IBM, Steve Bennett from Oracle and Chris Greenslade from CLARS to enhance the TOGAF practical guide to do service oriented architectures.

In case you’re wondering, the practical guide is a best-practice tool for EA practitioners to speed-up and unify the way the industry creates service oriented architectures (SOA). One item we hope to make clear to the industry is that service orientation is not only about producing some web-services and hoping that will improve the agility and cost structures of the organization.

The evolution to service orientation should be a carefully orchestrated process that includes everything from assessing an enterprise’s ability to change, to identifying the areas that really need service orientation properties, to creating the strategic, segment and capability architectures for those areas and finally, to defining the transition roadmap to implement the SOA strategy.

Our discussions focused on creating a guide that is easy-to-understand and use, but that would also serve as a complete description of how the different phases of TOGAF should be adapted by an enterprise. The result is a user-friendly path through the TOGAF framework with continuous references to the TOGAF content meta-model.

One important issue to always keep in mind is that EA is not about doing low-level IT design . . .



Our work validates the claim that TOGAF is valid for all types of architecture styles, while also proving that there are many “ifs” and “buts” during an organization’s adoption path.

One important issue to always keep in mind is that enterprise architecture (EA) is not about doing low-level IT design, but about creating structures in your organization that fulfill your long-term business goals and ambitions. The low-level design activities will be performed during the actual implementation of the project.

Additionally, we discussed the practical guide’s relationship with other Open Group SOA projects (such as SOA Governance and SOA Reference Architecture) in great detail to ensure that the input from the meta-model objects to these projects were properly included and identified.

The resulting practical guide is due the first part of this year. More information on The Open Group SOA Work Group can be found here: http://www.opengroup.org/projects/soa

This guest post comes courtesy of Mats Gejnevall, a global enterprise architect from Capgemini.

The Open Group seeks to spur evolution of security management from an art to a science

This guest post comes courtesy of Jim Hietala, Vice President of Security for The Open Group.

By Jim Hietala

As we wrapped up day one of the Security Practitioners Conference Plenary here at The Open Group Seattle Conference this week, I must say we heard excellent presentations on security management and metrics from Adam Shostack at Microsoft, Vicente Aceituno from ISM3 Consortium, Mike Jerbic at Trusted Systems Consulting, Phil Schacter from The Burton Group, and Kip Boyle from Pemco Insurance.

Some of the key takeaways included:
  • There is a real need for better external, big-picture data about attacks and the available controls that are in place and the control effectiveness. Without objective data of this sort, it’s difficult to have an intelligent discussion as to whether things are getting better or worse, to develop an understanding of attacks and threat vectors, and what really constitutes best practice controls. Data from sources such as the Verizon Data Breach Investigations report and DataLossDB are highly valuable, but more data (and more detailed data) is needed.

  • There’s also a clear need to instrument our security programs, being careful to measure the right things. Security metrics are best when they directly support decision-making supporting business goals. Put another way, for an e-commerce company, a security metric that informs management as to how many viruses are scrubbed from desktops is not really relevant to the mission. A metric that measures the mean time to remediate web application vulnerabilities is directly relevant, as reducing this is very consequential to the overall business goal.

  • Adding a maturity level approach to information security management (as is done in ISM3, a new security management project in The Open Group Security Forum) makes this method a lot more approachable for more kinds of businesses. In other words, a higher maturity level that might be appropriate for a Fortune 100 company or a defense firm is unattainable for a typical small- to medium-sized business.

  • Continuous improvement in managing information security depends on effective, relevant metrics.
It's clear that security management is steadily moving from art to science. Effective metrics and a maturity model approach are critical to helping this transition to happen.

For more information about the work The Open Group Security Forum is doing to encourage the evolution of security management, please visit: http://www.opengroup.org/security/.

This guest post comes courtesy of Jim Hietala, Vice President of Security for The Open Group.

New definition of enterprise architecture emphasizes 'fit for purpose' across IT undertakings

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

This live event podcast discussion comes to you from The Open Group’s Enterprise Architecture Practitioners Conference in Seattle, the week of Feb. 1, 2010.

We examine the definition of enterprise architecture (EA), the role of the architect and how that might be shifting with an expert from the Open Group, Len Fehskens, Vice President of Skills and Capabilities. The interview is moderated by Dana Gardner, principal analyst at Interarbor Solutions.

Here are some excerpts:
Gardner: I was really intrigued by your presentation, talking, with a great deal of forethought obviously, about the whole notion of EA, the role of the architect, this notion of "fit for purpose." We want to have the fit-for-purpose discussion about EA. What are the essential characteristics of this new definition?

Fehskens: You'll remember that one of the things I hoped to do with this definition was understand the architecture of architecture, and that the definition would basically be the architecture of architecture. The meme, so to speak, for this definition is the idea that architecture is about three things: mission, solution, and environment. Both the mission and the solution exist in the environment, and the purpose of the architecture is to specify essentials that address fitness for purpose.

There are basically five words or phrases; mission, solution, environment, fitness for purpose, and essentials. Those capture all the ideas behind the definition of architecture.
Also from the conference: Learn how The Open Group's Cloud Work Group is progressing.
Gardner: The whole notion of EA has been in works for 30 years, as you pointed out. What is it about right now in the maturity of IT and the importance of IT in modern business that makes this concept of enterprise architect so important?

Fehskens: A lot of practicing enterprise architects have realized that they can't do enterprise IT architecture in isolation anymore. The constant mantra is "business-IT alignment." In order to achieve business-IT alignment, architects need some way of understanding what the business is really about. So, coming from an architectural perspective, it becomes natural to think of specifying the business in architectural terms.

We need to talk to business people to understand what the business architecture is, but the business people don't want to talk tech-speak.



Enterprise architects are now talking more frequently about the idea of "business architecture." The question becomes, "What do we really mean by business architecture?" We keep saying that it's the stakeholders who really define what's going on. We need to talk to business people to understand what the business architecture is, but the business people don't want to talk tech-speak.

We need to be able to talk to them in their language, but addressing an architectural end. What I tried to do was come up with a definition of architecture and EA that wasn't in tech-speak. That would allow business people to relate to concepts that make sense in their domain. At the same time, it would provide the kind of information that architects are looking for in understanding what the architecture of the business is, so that they can develop an EA that supports the needs of the business.

Gardner: So, in addition to defining EA properly for this time and place, and with the hindsight of the legacy, development, and history of IT and now business, what is the special sauce for a person to be able to fill that role? It’s not just about the definition, but it's also about the pragmatic analog world, day-in and day-out skills and capabilities.

Borrowed skills

Fehskens: That's a really good question. I've had this conversation with a lot of architects, and we all pretty much agree that maybe 90 percent of what an architect does involves skills that are borrowed from other disciplines -- program management, project management, governance, risk management, all the technology stuff, social skills, consulting skills, presentation skills, communication skills, and all of that stuff.

But, even if you’ve assembled all of those skills in a single individual, there is still something that an architect has to be able to do to take advantage of those capabilities and actually do architecture and deliver on the needs of their clients or their stakeholders.

I don't think we really understand yet exactly what that thing is. We’ve been okay so far, because people who entered the discipline have been largely self-selecting. I got into it because I wanted to solve problems bigger than I could solve myself by writing all code. I was interested in having a larger impact then I could just writing a single program or doing something that was something that I could do all by myself.

That way, we filter out people who try to become architects. Then, there's a second filter that applies: if you don't do it well, people don't let you do it. We're now at the point where people are saying, "That model for finding, selecting, and growing architects isn't going to work anymore, and we need to be more proactive in producing and grooming architects." So, what is it that distinguishes the people who have that skill from the people who don't?

An architect also has to be almost Sherlock Holmes-like in his ability to infer from all kinds of subtle signals about what really matters.



If you go back to the definition of architecture that I articulated in this talk, one of the things that becomes clear is that an architect not only has to have good design skills. An architect also has to be almost Sherlock Holmes-like in his ability to infer from all kinds of subtle signals about what really matters, what's really important to the stakeholders, and how to balance all of these different things in a way that ends up focusing on an answer to this very squishily, ill-defined statement of the problem.

This person, this individual, needs to have that sense of the big picture -- all of the moving parts -- but also needs to be able to drill in both at the technical detail and the human detail.

In fact, this notion of fitness for purpose comes back in. As I said before, an architect has to be able to figure out what matters, not only in the development of an architectural solution to a problem, but in the process of discerning that architecture. There's an old saw about a sculptor. Somebody asked him, "How did you design this beautiful sculpture," and he says, "I didn't. I just released it from the stone."

What a good architect does is very similar to that. The answer is in there. All you have to is find it. In some respects, it's not so much a creative discipline, as much as it's an exploratory or searching kind of discipline. You have to know where to look. You have to know which questions to ask and how to interpret the answers to them.

Rarely done

Gardner: One of the things that came out early in your presentation was this notion that architecture is talked about and focused on, but very rarely actually done. If it's the case in the real world that there is less architecture being done than we would think is necessary, why do it at all?

Fehskens: There's a lot of stuff being done that is called architecture. A lot of that work, even if it's not purely architecture in the sense that I've defined architecture, is still a good enough approximation so that people are getting their problems solved.

What we're looking for now, as we aspire to professionalize the discipline, is to get to the point where we can do that more efficiently, more effectively, get there faster, and not waste time on stuff that doesn't really matter.

I'm reminded of the place medicine was 100 or 150 years ago. I hate to give leeches a bad name, because we’ve actually discovered that they're really useful in some medical situations. But, there was trepanning, where they cut holes in a person's skull to release vapors, and things like that. A lot of what we are doing in architecture is similar.

What we want to do is get better at that, so that we pick the right things to do in the right situations, and the odds of them actually working are much higher than better than chance.



We do stuff because it's the state of the art and other people have tried it. Sometimes, it works and sometimes, it doesn't. What we want to do is get better at that, so that we pick the right things to do in the right situations, and the odds of them actually working are much higher than better than chance.

Gardner: Okay, a last question. Is there anything about this economic environment and the interest in cloud computing and various sourcing options and alternatives that make the architecture role all the more important?

Fehskens: I hate to give you the typical architect signature which is, "Yes, but." Yes, but I don't think that's a causal a relationship. It's sort of a coincidence. In many respects, architecture is the last frontier. It's the thing that's ultimately going to determine whether or not an organization will survive in an extremely dynamic environment. New technologies like cloud are just the latest example of that environment changing radically.

It isn't so much that cloud computing makes good EA necessary, as much as cloud computing is just the latest example of changes in the external environment that require organizations to have enterprise architects to make sure that the organization is always fit for purpose in an extremely dynamically changing environment.
Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

You may also be interested in: