Interview: Ariba's Jason Kurtz on how IT financial trends are maturing technology procurement and spend management

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Learn more. Sponsor: Ariba.

A number of major trends are changing the finance game for IT leaders, especially in terms of how they operate like a business within the business. There's a heightened emphasis on measuring cost, service management, hybrid computing, and outsourcing that leverage software-as-a-service (SaaS) and cloud models.

There's also a recognition that collaboration and coordinated business processes need to expand to far outside the four walls of the company. IT needs then to increasingly support ecosystems and better apply extended enterprise process governance, while striving to save money.

So how can IT adjust to these financial pressures? What must they do differently? BriefingsDirect recently interviewed an executive from Ariba to learn how CIOs specifically are seeing the world anew financially, and how they can develop mature strategies for making IT more central to helping businesses innovate productively.

Jason Kurtz, Vice President of Network and Financial Solutions at Ariba, is interview by Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: Ariba is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:

Kurtz: We've certainly seen several big changes. One is in the resource-constrained world. There are bandwidth constraints to support business innovations.

When I talk to CIOs, one of the biggest issues on their minds is, how do I make sure I am allocating more of my time and efforts in technology that supports business growth and innovation, versus the maintenance of existing systems? That's very different than the focus that you would have had in years past in terms of driving internal automation. That's one big change we've seen.

Two is clearly the adoption of SaaS technologies and the impact that's having on IT organizations. We see it completely changing the way companies think about IT investment, not just capital expenditures versus operating expenditures, but the roles and responsibilities that an IT organization has and how it interacts with its internal customers within the functional parts of the organization.

Three, I think you referenced it a little bit earlier, is not just a maniacal focus on managing costs, but also the adoption and return on investment (ROI) that is generated from IT investments. There's always been a focus on getting a good ROI, but I think it’s a much more significant focus across the organization on doing that, and particularly from an IT organization in terms of making sure that they have the ability to measure that.

Inter-enterprise collaboration

Four was just a focus on inter-enterprise collaboration. Rather than focusing on the internal process efficiency and effectiveness within the four walls of a company, CIOs are starting to realize that the next wave of productivity will be outside their four walls, what some refer to as inter-enterprise collaboration, meaning how an enterprise automates the processes and the way it collaborates with its customers and suppliers throughout the supply chain.

... About 50-60 percent of companies who are moving to a SaaS environment or the cloud are doing it because of the cost reduction opportunities inherent in not having to deploy, manage, and support applications.

Not only do they get the cost benefits of that, but they typically have time-to-deployment benefits and less time-to-realize-value and flexibility benefits that they didn’t have due to resource constraints within an organization. That's a very common trend in the market, and specifically within Ariba’s customers, and we expect to see that trend continue.

Gardner: I'm really interested about this notion about how IT needs to operate more like a business. What is it that IT needs to do in terms of becoming more like some of the other business units or functions?

Kurtz: It starts with a really well-defined set of goals and objectives. Why are we going to undertake something, what are we hoping to accomplish with that, and how are we going to measure that? What are the key performance indicators (KPIs) that we'll be able to track success with.

To your point, there were certainly times in the past when everyone was buying into the latest and greatest technology, or something that was new and cutting edge, and wanted to try and experiment with it. Given the economic times over the last several years, the willingness of companies to just experiment and see what happens is dramatically less, and you see IT organizations taking on a much more ROI-driven approach.

Given the economic times over the last several years, the willingness of companies to just experiment and see what happens is dramatically less.

So it's having a very well-defined business case for investments or initiatives that they're taking on, and making sure not only they understand what that business case is, but their internal stakeholders understand what that business case is and are committed to signing off on delivering those resources.

And it's not just an IT approval, but it's a CFO approval in many cases, and they're really holding their internal customers and stakeholders' feet to the fire and measuring on a regular basis what the ROI is for that specific initiative. We've seen a dramatic shift in the governance around that kind of ROI and adoption process with all of the initiatives that we see our customers undertaking, much more so than we would have seen two, three, or five years ago.

Gardner: I've seen where the way that IT is able to cut cost, but also actually increase their influence and impact within the organization, is to identify core-versus-context types of IT activities, and for those non-core ones, look to increasingly outsource or partner.

Non-core activities

Kurtz: Again, a trend that fits exactly in line with that is that we see customers taking advantage of the cloud or SaaS, particularly for non-core activities.

Take, for example, integration. Integration is required in today's world, whether you're integrating within your four walls or outside your four walls, but is that really a core competence that you want to have as an organization. Or, do you want to rely on third-party integration as the service solution providers who can usually do the integration work faster, cheaper, and more flexibly? We're seeing that's just one example of ways customers are taking advantage of that.

Also, of course, the solutions that Ariba provides in the spend management space, we're seeing where customers want to focus on the core enterprise resource planning (ERP) capabilities around finance and operations and leverage tools like Ariba's Spend Management Suite to help their organizations buy better and connect with their ERP, but do it in a cloud-type of way.

Gardner: One of the things that I keep coming up against when I talk to folks in IT is that there’s still the manual paperwork at the spreadsheet level, when it comes to managing contracts and licenses and keeping track of use-pattern licensing, and how to charge back for that. It’s a nightmare for them.

Kurtz: We have many customers who use our spend management solutions to manage their IT spend, whether that’s the sourcing and negotiating of hardware or infrastructure or contract labor or software licenses, managing the contracting process and the ongoing contracting lifecycle of that, all the way through the procurement of it and then the relationship management aspects of it. We absolutely support those processes that IT organizations need to manage their cost within their organization.

We see 80 percent of business-to-business transaction still completed completely manually. We see 85 plus percent of invoices and payments still being paper based or people cutting checks.

Gardner: Is IT really a laggard when it comes to automation at this level?

Kurtz: You would be really surprised how much we see in terms of the world continuing to be a very manual set of processes and capabilities. If you look at it not just within IT, but if you take a step back and look at it on a broader basis, across the market, we see 80 percent of business-to-business transactions still completed completely manually. We see 85-plus percent of invoices and payments still being paper based or people cutting checks.

We see the vast majority of early payment discounts are completely missed. Some estimates indicate that 70-plus percent of all early payment discount opportunities, which procurement and other organizations work so hard to negotiate, get missed. The estimate on what this cost companies around the world is $650 billion in economic impact annually.

The very core of this problem is how an IT organization connects their internal systems, most likely ERP, within an organization to the systems and ERPs of their customers and suppliers to automate that supply chain. That’s where the big automation opportunity, efficiency, and effective gains are, or will be, next is just because the proliferation of all the combinations of systems within your organization, your suppliers, your customers.

Just think about the number of combinations that can be and how it can be very, very challenging and difficult to connect those systems into the optimal or most efficient supply chain.

Gardner: For the benefit of our IT audience, tell us about Ariba. How does Ariba take what it does and then apply to IT?

That community includes our network that connect buyers and sellers, whether they're collaborating with suppliers, looking for new business opportunities, or helping to manage their working capital.

Kurtz: Ariba, at the highest level, helps companies buy better, sell better, and manage their cash better, and we do that in a couple of ways.

One, by providing technology or applications that have capabilities across each of those functions around buying, selling, and managing cash. Then, we have a community that is part of our Commerce Cloud, as we refer to it. That community includes our network that connect buyers and sellers, whether they're collaborating with suppliers, looking for new business opportunities, or helping to manage their working capital. It's a network that facilitates documents, information, and financial supply chains.

Then, we have a variety of capabilities to help our customers adopt and be successful. Some of that’s delivered by us and some of it by partners who plug into the cloud. At the highest level, that’s a little bit of what we do.

How our IT organization is taking advantage of that I think was your next question. We see a proliferation of organizations taking advantage of the ability to plug into the Ariba Commerce Cloud in different areas.

Some organizations start with our legacy, which is spend management and helping customers buy better, whether that’s identifying savings opportunities, identifying new sources of supply, negotiating better agreements, managing the contracting process, all the way through, procuring solutions, collaborating with your suppliers and receiving invoices back from your suppliers to managing cash, including payment term optimization, invoice reconciliation, and even working-capital management solutions.

Finally, for sellers, it helps create a marketing channel, new business opportunities, improved efficiencies, and collaborating with and transacting with your customers and prospects.

Modular basis

The nice thing about the way Ariba works is that you can plug in and use any of those pieces on a very modular basis as you need them. That’s been particularly attractive to IT organizations for the exact reasons we talked about before, which is looking for very specific ROI and very specific initiatives around their pain and needs within an organization. We've got the flexibility to help solve those on an individual or holistic need.

And 100 percent of what we do is offered through the cloud.

Supply chain activity

Gardner: We've been describing IT and its relationship to a provider like Ariba through primarily a consumption framework. But it seems to me that there is also the opportunity for IT to take something like the services you offer with your Ariba Discovery and your ability to use the cloud and ecosystem of providers to initiate a process, and then to manage it as a procurement or a supply chain activity.

Kurtz: This is really the next evolution of where companies are going for automation benefits. It's what we think about as extending the ERP into inter-enterprise collaboration. That’s where companies like Ariba can really help IT organizations.

There are some great examples of customers out there who are doing that. If you think about it on the buying side of the world, take a company like Nalco, which is the largest sustainability company in the world. They had really struggled with lack of automation around purchase orders with their customers and then the purchase orders being delivered to their suppliers from Nalco.

They were literally losing five percent of their orders that they just couldn’t track being delivered from their organizations to their suppliers. These lost and delayed orders meant that they couldn’t bill customers in a timely manner. It meant lost sales. It meant extending "days sales outstanding" and significant customer satisfaction issues.

By leveraging Ariba Solution and the Ariba Network they were able to collaborate with suppliers and customers to significantly improve their customer satisfaction.

A team of people were having to call and check on order status and invoice processing payments and payment status, a completely inefficient processes between Nalco's customers, and its supplier partners.

By leveraging Ariba Solution and the Ariba Network they were able to collaborate with suppliers and customers to significantly improve their customer satisfaction, reduce "days sales outstanding," and cut headcount that were very involved in working on things that could be easily automated.

Let’s take another example from the side of the business everyone gets most excited about, the revenue growth or sell side of the house. Fastenal is a great example, where an IT organization helps extend the services it provides internally to its customers externally to Fastenal’s customers by leveraging eCommerce and the Ariba Network to connect and collaborate with its customers.

Real-time acknowledgments

One of the benefits of the extension that Fastenal has done is the ability to collaborate with its customers to provide real-time purchase order and delivery acknowledgements, which have greatly improved customer satisfaction. It has reduced their purchase order error rates by over 80 percent, and it reduced "days sales outstanding" by over 70 percent, a significant working capital improvement.

Other companies are doing the same kind of thing as Fastenal and receiving really good revenue growth or new business opportunities as well. It is not uncommon to see companies like Fastenal finding 50 percent-plus increases in product line cross-sells and up-sells, and seeing even 20 percent plus year-over-year sales growth within existing customers. Then, we have solutions like Ariba Discovery even finding new business in customers that they have never done any business with before.

That’s just an example on the sell side of the house of how IT organizations are extending and can extend the service that they are providing.

One of the most important things to keep in mind is that at Ariba our mission in life is to help extend or complement the ERP investments that many IT organizations have made. We help extend those outside the enterprise and the enterprise collaboration, whether that’s buying, selling, or managing their cash.

You mentioned a few examples of spend management, but also it’s about helping companies sell better, drive revenue growth, and manage their cash better by automating functions like accounts payable and providing benefits to accounts receivable on the sell side.

If you look at it in those terms, we help companies free up their limited IT resources to focus on innovation, not supporting applications or integration or customization, and focus on driving business adoption and leveraging the core internal capabilities of ERP.

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Learn more. Sponsor: Ariba.

You may also be interested in:

• Ariba Live Discussion: How Cloud Alters Landscape for eCommerce, Procurement and Supply Chain Management
• Analysts Define Business Value and Imperatives for Cloud-Based B2B eCommerce
• Cloud and SaaS force a rethinking of integration and middleware as services for services
  
• Ariba, IBM Deal Shows Emerging Prominence of Cloud Ecosystem-Based Collaboration and Commerce
• Ariba Steps Up Cloud Efforts with StartContracts, On-Demand Contract Management for SMBs

Architect certification increasingly impacts professionalization of IT in the cloud era

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

We've assembled a panel in conjunction with the recent Open Group Conference in Austin, Texas, to explore the impact and role of certifications for IT professionals. Examine here how certification for enterprise architects, business architects, and such industry initiatives as ArchiMate are proving instrumental as IT organizations seek to reinvent themselves.

There are now a lot of shifts in skills and a lot of movement about how organizations should properly staff themselves. There have been cost pressures and certification issues for regulation and the adoption of new technologies. We're going to look at how all these are impacting the role of certification out in the field.

Here to help better understand how an organization like The Open Group is alleviating the impact and supporting the importance of finding verified IT skills is Steve Philp, Marketing Director for Professional Certification at The Open Group; Andrew Josey, Director of Standards at The Open Group, and James de Raeve, Vice President of Certification at The Open Group. The discussion is moderated by Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: The Open Group is a Sponsor of BriefingsDirect podcasts.]

Here are some excerpts:

de Raeve: The primary driver here that we're hearing from members and customers is that they need to get more out of the investments that they're making -- their payroll for their IT staff. They need to get more productivity. And that has a number of consequences.

Realizing talent

They want to ensure that the people they are employing and that they're staffing their teams with are effective. They want to be sure that they're not bringing in external experts when they don’t need to. So there is a need to realize the talent that they've actually got in their internal IT community and to develop that talent, nurture it, and exploit it for the benefit of the organization.

And professionalism, professionalization, and profession frameworks are all tools that can be used in identifying, measuring, and developing the talents and capabilities of your people. That seems to be the major driver.

Philp: Something I have noticed since joining The Open Group is that we’ve got some skills and experience-based certifications. They seem to be the things that people are particularly interested in, because it’s not just a test of your knowledge about a particular vendor or product, but how you have applied your skills and experience out there in the marketplace. They have proven to be very successful in helping people assess where they are and in working towards developing a career path.

That’s one of the areas of certification that things are going to move more towards -- more skills and experience-based certification programs in organizations.

Looking at certification in general, you still have areas like Microsoft MCSE, Microsoft technical specialist, application development, and project management that are in demand, and things like CCNA from Cisco. But I've also noticed a lot more in the security field. CISSP and CCSA seem to be the ones that are always getting a lot of attention. In terms of security, the trends in mobile computing, cloud computing, means that security certification is a big growth area.

There is a need for people too in the building of teams and in the delivering of results to nurture and grow their people to be team players and team participants.

We're just about to put a security track into our Certified IT Specialist Program at The Open Group, so there will be a skills and experience-based track for security practitioners soon.

de Raeve: There is a whole world out there of technology and product-related certifications that are fulfilling a very important function in helping people establish and demonstrate their knowledge of those particular products and technologies.

But there is a need for people too in the building of teams and in the delivering of results to nurture and grow their people to be team players and team participants and to be able to work with them to function within the organization as, for want of a better term, "t-shaped people," where there are a number of soft and people-related skills and potentially architecture related skills for the IT specialists, and skills and capabilities enable people to be rounded professionals within an organization.

T-shaped people

It’s that aspect that differentiates the professionalization and the profession-oriented certification programs that we're operating here at The Open Group -- The Open Certified Architect, The Open Certified IT Specialist. Those are t-shaped people and we think that makes a huge difference. It’s what’s going to enable organizations to be more effective by developing their people to have that more rounded t-shaped capability.

Josey: We see the certification as being the ultimate drive in the uptake of the standards, and so we're able to go from not just having a standard on the shelf to actually seeing it being deployed in the field and used. We've actually got some people certification programs, such as TOGAF, and we've got some over 20,000 practitioners now.

We've gone through the certification program and we've been using and evangelizing, TOGAF as a standard in the field and then feeding that back to our members and, through the association, the feedback improvements to the standards. So it’s very much part of the end-to-end ecosystem -- developing a standard for deploying it, and getting people on it, and then getting the feedback in the right way.

Philp: It’s very much an important part of the process now. TOGAF and IT Architect Certification (ITAC) have appeared in a number of RFPs for government and for major manufacturing organizations. So it’s important that the suppliers and the buyers recognize these programs.

Similarly with recruitment, you find that things like TOGAF will appear in most recruitment ads for architects. Certainly, people want knowledge of it, but more and more you’ll see TOGAF certification is required as well.

ITAC, which is now Open CA, has also appeared in a number of recruitment ads for members like Logica, Capgemini, Shell. More recently, organizations like the CBS, EADS, ADGA Group, Direct Energy have requested it. And the list goes on. It’s a measure of how important the awareness is for these certifications and that’s something we will continue to drive at The Open Group.

In development

Josey: ArchiMate certification is something new that we’re developing right now. We haven’t deployed a certification program as yet. The previous certification program was under the ArchiMate Foundation, which was the body that developed ArchiMate, before it transferred into The Open Group.

We’re currently working on the new program which will be similar to some aspects of our TOGAF program, and it’ll be knowledge base certification with an assessment by exam and a practical assessment in which the candidate can actually do modeling. So this will be people certification and there will also be accredited training course certification.

And then also what we're going to do there is actually to provide certification for tools. There will be certifications there.

That’s pretty much what we’re doing in ArchiMate, so we don’t have a firm timeline. So it will not be available it looks like, probably towards the end of the year would be the earliest, but possibly early next year.

ArchiMate is a modeling language for enterprise architecture (EA) in general and specifically it’s a good fit for TOGAF. It’s a way of communicating and developing models for TOGAF EA. Originally it was developed by the Telematica Instituut and funded, I think, by the EU and a number of commercial companies in the Netherlands. It was actually brought into The Open Group in 2008 by the ArchiMate Foundation and is now managed by the ArchiMate Forum within The Open Group.

The latest version of TOGAF is TOGAF 9 for certification. As we mentioned earlier, there are two types of certification programs, skills and knowledge based. TOGAF falls into the knowledge based camp. We have two levels. TOGAF 9 Foundation, which is our level one, is for individuals to assess that they know the terminology and basic concepts of EA in TOGAF.

Level two, which is a superset of level one, in addition assesses analysis and comprehension. The idea is that some people who are interested in just getting familiar with TOGAF and those people who work around enterprise architects can go into TOGAF Foundation. And these enterprise architects themselves should initially start with the TOGAF Certified, the level two, and then perhaps move on later to Open CA. That will be helpful.

For TOGAF 9 Certification, we introduced that by midyear 2009. We launched TOGAF 9 in February, and it took a couple of months to just roll out all these certifications through all the exam channels.

Since then, we’ve gone through 8,000 certifications. We've seen that two-thirds of those were at the higher level, level two, for EA practitioners and one-third of those are currently at the foundation level.

A new area

Philp: Business architecture is a new area that we've been working on. Let me just to go back to what we did on the branding, because it ties in with that. We launched The Open Group’s new website recently and we used that as the opportunity to re-brand ITAC as The Open Group Certified Architect (Open CA) program. The IT Specialist Certification (ITSC) has now become The Open Group Certified IT Specialist or Open CITS Program.

We did the rebranding at that time, because we wanted to be it associated with the word “open.” We wanted to give the skills and experience-based certification a closer linkage to The Open Group. That’s why we changed from ITAC to Open CA. But, we’ve not changed the actual program itself. Candidates still have to create a certification package and be interviewed by three board members, and there are still three levels of certification: Certified, Master, and Distinguished.

However, what we’re intending to do is have some core requirements that architects need to meet, and then add some specific specializations for different types of architects. The one that we’ve been working on the most recently is the Business Architecture Certification. This came about from an initiative about 18 months ago.

We formed something called the Business Forum with a number of platinum members who got involved with it --companies like IBM, HP, SAP, Oracle and Capgemini. We’ve been defining the conformance requirements for the business architecture certification. It's going through the development process and hopefully will be launched sometime later this year or early next year.

“For the first time we feel like management is paying attention to us.”

de Raeve: There's a very good example [of the importance of staffing issues in IT] ..., and they’ve done a presentation about this in one of our conferences. It's Philips, and they used to have an IT workforce that was divided among the business units. The different businesses had their own IT function.

They changed that and went to a single IT function across the organization, providing services to the businesses. In doing so, they needed to rationalize things like grades, titles, job descriptions, and they were looking around for a framework within which they could do this and they evaluated a number of them.

They were working with a partner who wass helping them do this. The partner was an Open Group member and suggested they look at the Open Group’s IT Specialist Certification, the CITS Certification Program, as it provides a set of definitions for the capabilities and skills required for IT professionals. They picked it up and used it, because it covered the areas they were interested in.

This was sufficient and complete enough to be useful to them, and it was vendor neutral, and an industry best practice. So they could pick this up and use it with confidence. And that has been very successful. They initially benchmarked their entire 900 strong IT workforce against The Open Group definition, so they could get to calibrate themselves, where their people were on their journey through development as professionals.

It’s had a very significant impact in terms of not only enabling them to get a handle upon their people, but also in terms of their employee engagement.

They’ve started to embrace the certification programs as a method of not only measuring their people, but also rewarding them. It’s had a very significant impact in terms of not only enabling them to get a handle upon their people, but also in terms of their employee engagement. In the engagement surveys that they do with their staff, some of the comments they got back after they started doing this process were, “For the first time we feel like management is paying attention to us.”

It was very positive feedback, and the net result is that they are well on their way to meeting their goal of no longer having automatically to bring in an external service provider whenever they were dealing with a new project or a new topic. They know that they’ve got people with sufficient expertise in-house on their own payroll now. They've been able to recognize that capability, and the use of it has had a very positive effect. So it’s a very strong good story.

I think that the slides will be available to our members in the conference’s proceedings from the London conference in April. That will be worth something to look at.

Philp: If you go to the Open Group website, www.opengroup.org/certifications, all of the people based certifications are there, along with the benefits for individuals, benefits for organizations and various links to the appropriate literature. There’s also a lot of other useful things, like self-assessment tests, previous webinars, sample packages, etc. That will give you more of an idea of what’s required for certification along with the conformance requirements and other program documentation. There’s a lot of useful information on the website.

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

You may also be interested in:

• Standards effort points to automation via common markup language O-ACEML for improved IT compliance, security
  
• Enterprise Architects Increasingly Leverage Advanced TOGAF 9 for Innovation, Market Response, and Governance Benefits
• Open Group Cloud Panel Forecasts Cloud as Spurring Useful Transition Phase for Enterprise Architecture
• The Open Group's Cloud Work Group Advances Understanding of Cloud-Use Benefits for Enterprises
• Exploring the Role and Impact of the Open Trusted Technology Forum to Ensure Secure IT Products in Global Supply Chains

Case study: MSP InTechnology improves network services via automation and consolidation of management systems

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: HP.

The latest BriefingsDirect podcast discussion focuses on a UK-based managed service provider’s journey to provide better information and services for its network, voice, VoIP, data, and storage customers. The network management and productivity benefits have come from an alignment of many service management products into an automated lifecycle approach to overall network operations.

We explore here how InTechnology has implemented a coordinated, end-to-end solution using HP solutions that actually determine the health of its networks by aligning their tools to ITIL methods. And, by using their system-of-record approach with a configuration management database, InTechnology is better serving its customers with lean resources by leveraging systems over manual processes.

Hear from an operations manager, Ed Jackson, Operational System Support Manager at InTechnology, to explore their choices and outcomes when it comes to better operations and better service for their hundreds of enterprise customers. The discussion is moderated by Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:

Jackson: We've basically been growing exponentially year over year. In the past four years, we've grown our network about 75 percent. In terms of our product set, we've basically tripled that in size, which obviously leads to major complexity on both our network and how we manage the product lifecycle.

Previously, we didn’t have anything that could scale as well as the systems that we have in place now. We couldn’t hope to manage 8,000 or 9,000 network devices, plus being able to deliver a product lifecycle, from provisioning to decommission, which is what we have now.

It's pretty massive in terms of the technologies involved. A lot of them are cutting-edge. We have many partners. Our suite of cloud services is very diverse and comprises what we believe is the UK’s most complete and "joined-up"set of pay-monthly voice and data services.

Their own pace

In practice what we aim to do is help our customers engage with the cloud at a pace that works for them. First, we provide connectivity to our nationwide network ring – our cloud. Once their estate is connected they can then cherry pick services from our broad pay-as-you-go (PAYG) menu.

For example, they might be considering replacing their traditional "tin" PBXs with hosted IP telephony. We can do that and demonstrate massive savings. Next we might overlay our hosted unified communications (UC) suite providing benefits such as "screen sharing," "video calling," and "click-to-dial." Again, we can demonstrate huge savings on planes, trains and automobiles.

Next we might overlay our exciting new hosted call recording package -- Unity Call Recording (UC) -- which is perfect if they are in a regulated industry and have a legal requirement to record calls. It’s got some really neat features including the ability to tag and bookmark calls to help easy searching and playback.

While we're doing this, we might also explore the data path. For example our new FlexiStor service provides what we think is the UK’s most straightforward PAYG service designed to manage data by its business "value" and not just as one big homogenous lump of data. It treats data as critical, important or legacy and applies an appropriate storage process to each ... saving up to 40 percent against traditional data management methods.

Imagine trying to manage this disparate set of systems. It would be pretty impossible. But due to the HP product set that we have, we've been able to utilize all the integrations and have a fully managed, end-to-end lifecycle of the service, the devices, and the product sets that we have as a company.

[Our adoption of the HP suites] was spurred by really bad data that we had in the systems. We couldn't effectively go forward. We couldn't scale anymore. So, we got the guys at HP to come in and design us a solution based on products that we already had, but with full integration, and add in additional products such as HP Asset Manager and device Discovery and Dependency Mapping Inventory (DDMI).

With the systems that we already had in place, we utilized mainly HP Service Desk. So we decided to take the bold leap to go to Service Manager, which then gave us the ability to integrate it fully into the Operations Manager product and our Network Node Manager product.

Since we had the initial integrations, we've added extra integrations like Universal Configuration Management Database (UCMDB), which gives us a massive overview on how the network is progressing and how it's developing. Coupled with this, we've got Release Control, and we've just upgraded to the latest version of Service Manager 9.2.

For any auditor that comes in, we have a documented set of reports that we can give them. That will hopefully help us get this compliance and maintain it.

... We recently upgraded Connect-It from 4.1 to 9.3, and with that, we upgraded Asset Manager System to 9.3. Connect-It is the glue that holds everything together. It's a fantastic application that you can throw pretty much any data at, from a CSV file, to another database, to web services, to emails, and it will formulate it for you. You can do some complex integrations in that. It will give you the data that you want on the other side and it cleanses and parses, so that you can pass it on to other systems.

From our DDMI system, right through to our Service Manager, then into our Network Node Manager, we now have a full set of solutions that are held together by Connect-It.

We can discover the device on the network. We can then propagate it into Service Manager. We can add lots of financial details to it from other financial systems outside of the HP product set, but which are easy to integrate. We can therefore provision the circuit and provision the device and add to monitoring automatically, without any human intervention, just by the fact that the device gets shipped to the site.

It gets loaded up with the configuration, and then it's good to go. It's automatically managed right through to the decommissioning stage, or the upgrade stage, where it's replaced by another device. HP systems give us that capability.

So this all has given us a huge benefit in terms of process control, how ITIL is related. More importantly, one of the main things that we are going for at the moment is payment card industry (PCI) and ISO 27001 compliance.

For any auditor that comes in, we have a documented set of reports that we can give them. That will hopefully help us get this compliance and maintain it. One of the things as an MSP is that we can be compliant for the customer. The customer can have the infrastructure outsourced to us with the compliance policy in that. We can take the headache of compliance away from our customers.

More and more these days, we have a lot of solicitors and law firms on our books, and we're getting "are you compliant" as a request before they place business with us. We're finding all across the industry that compliance is a must before any contract is won. So to keep one step ahead of the game, this is something that we're going to have to achieve and maintain, and the HP product set that we have is key in that.

Due to the HP product set that we have, we've been able to utilize all the integrations and have a fully managed, end-to-end lifecycle of the service.

In terms of our service and support, we've basically grown the network massively, but we haven’t increased any headcount for managing the network. Our 24/7 guys are the same as they were four or five years ago in terms of headcount.

We get on average around 5,000 incidents a month automatically generated from our systems and network devices. Of these incidents, only about 560 are linked to customer facing Interactions using our Service Desk Module in the Service Manager application.

Approximately 80 percent of our total incidents are generated automatically. They are either proactively raised, based on things like CPU and memory of network devices or virtual devices or even physical servers in our data centers, or reactively raised based on for example device or interface downs.

Massive burden

When you've got like 80 percent of all incidents raised automatically, it takes a massive burden off the 24/7 teams and the customer support guys, who are not spending the majority of their time creating incidents but actually working to resolve them.

When we originally decided to take the step to upgrade from Service Desk to Service Manager and to get the network discovery product set in, we used HP’s Professional Services to effectively design the solution and help us implement it.

Within six months, we had Service Desk upgraded to Service Manager. We had an asset manager system that was fully integrated with our financials, our stock control. And we also had a Network Discovery toolset that was inventorying our estate. So we had a fully end-to-end solution.

Automatic incidents

Into that, we have helped to develop the Network Operations Management Solution into being able to generate automatic incidents. HP PS services provided a pivotal role in providing us with the kind of solutions that we have now.

Since then, we took that further, because we have very good in-house knowledgeable guys that really understand the HP systems and services. So we've taken it bit of a step further, and most of the stuff that we do now in terms of upgrades and things are done in-house.

One of the key benefits is it gives us a unique calling card for our potential customers. I don’t know of many other MSPs that have such an automated set of technology tools to help them manage the service that they provide to their customers.

Five years ago, this wasn't possible. We had disparate systems and duplicate data held in multiple areas So it wasn’t possible to have the integration and the level of support that we give our customers now for the new systems and services that we provide.

Mean time to restore has come down significantly, by way over 15 percent. As I said, there has been zero increase in headcount over our systems and services. We started off with a few thousand network devices and only three or four different products, in data, storage, networks and voice. Now we've got 16 different kinds of product sets, with about 8,000, 9,000 network devices.

In terms of cost saving, and increased productivity, this has been huge. Our 24/7 teams and customer support teams are more proactive in using knowledge bases and Level 1 triage. Resolution of incidents has gone up by 25 percent by customer support teams and level 1 engineers; this enables the level 3 engineers to concentrate on more complex issues.

In terms of SLAs, we manage the availability of network devices. It gives us a lot more flexibility in how we give these availability metrics to the customers.

If you take a Priority 3, Priority 4 incident, 70 percent of those are now fixed by Level 1 engineers, which was unheard of five or six years ago. Also, we now have a very good knowledge base in the Service Manager tool that we can use for our Level 1 engineers.

In terms of SLAs, we manage the availability of network devices. It gives us a lot more flexibility in how we give these availability metrics to the customers. Because we're business driven by other third party suppliers, we can maintain and get service credits from them. We've also got a fully documented incident lifecycle. We can tell when the downtime has been on these services, and give our suppliers a bit of an ear bashing about it, because we have this information to hand them. We didn’t have that five or six years ago.

With event correlation, we reduced our operations browsers down to just meaningful incidents, we filtered our events from over 100,000 a month to less than 20,000 many of these are duplicated and are correlated together. Most events are associated with knowledge base articles in Service Manager and contain instructions to escalate or how to resolve the event, increasingly by a level 1 engineer.

Contacting customers within agreed SLAs and how we can drive our suppliers to provide better service is fantastic because of the information that is available in the systems now. It gives us a lot more heads up on what’s happening around the network.

We're building a lot of information, taken from our financial systems and placing it into our UCMDB and CMDB databases to give us the breakdown of cost per device, cost per month, because now this information is available.

We have a couple of data centers. One of our biggest costs is power usage. Now, we can break down by use of collecting the power information, using NNMi -- how much our power is costing per rack by terms of how many amps have been used over a set period of time, say a week or a month. where previously we had no way of determining how our power usage was being spent or how much was actually costing us per rack or per unit.

From this performance information, we can also give our customers extra value reports and statistics that we can charge as a value added managed solution for them.

It's given us a massive information boost, and we can really utilize the information, especially in UCMDB, and because it’s so flexible, we can tailor it to do pretty much whatever we want. From this performance information, we can also give our customers extra value reports and statistics that we can charge as a value added managed solution for them.

[In terms of getting started], one of the main things is to have a clear goal in mind before you start. Plan everything, get it all written down, and have the processes looked at before you start implementing this, because it’s fairly hard to re-engineer if you decided that one of the actual solutions or one of the processes that you have implemented isn’t going to work. Because of the integration of all the systems, you might tend to find that reverse engineering them is a difficult task.

As a company, we decided to go for a clean start and basically said we'd filter all the data, take the data that we actually really required, and start off from scratch. We found that doing it that way, we didn’t get any bad data in there. All the data that we have now is pretty much been cleansed and enriched by the information that we can get from our automated systems, but also by utilizing the extra data that people have put in.

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: HP.

You may also be interested in:

• HP delivers applications appliance solutions that leverage converged infrastructure for virtualization, data management
• HP delivers NMC 9.1 as new demands on network management require secure, integrated, and automated response
  
• New HP Service Manager tackles time and cost associated with help desk productivity
• HP's IT Performance Suite empowers IT leaders with unified view into total operations, costs
  
• HP takes plunge on dual cloud bursting: public and-or private apps support comes of age
  
• HP rolls out EcoPOD modular data center, provides high-density converged infrastructure with extreme energy efficiency

New HP Service Manager tackles time and cost associated with help desk productivity

HP today announced the latest version on its Service Manager software in an attempt to drive out a large portion of help desk cost, 85 percent of which is estimated to be spent on personnel. Version 9.30 introduces several innovations aimed at ease of use for the help desk staff, the end users, and the administrators who maintain the system.

According to Chuck Darst, HP's ITSM Product Manager, three key features underlie the updated version: a mobile client, enhanced service catalog, and enhanced knowledge management (KM). [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Aimed at service desk personnel involved in the incident management and change approvals processes, the new mobile client (included at no additional cost) has been built for a smart phone form-factor and is supported on a wide range of devices, including the Apple iPhone and iPad, Google Android devices, HP WebOS devices and RIM Blackberry. Prior to this, users who wanted smart phone functionality had to rely on third-party plug-ins.

The service catalog portal provides an interface to cloud environments, providing options, sources, and methods for provisioning requests. Also, with a customizable mySM dashboard, IT can directly access information when they need it. The new dashboard can tailor data from HP Service Manager or other external sources, without the need of an administrator.

The service catalog portal provides an interface to cloud environments, providing options, sources, and methods for provisioning requests.

The new KM offering provides searches using updated search engine technology and new search forms designed to increase the amount of first-call resolutions and to reduce the number of calls that need to be escalated.

Other features include:

• Graphical “Process Designer,” which allows IT organizations to speed implementations with a new GUI-based workflow designer and rules editor that simplify the editing and configuring of workflows, conditions and rules.
  
• New survey capability, so IT can tune services to better serve its customers with a new survey instrument from MarketTools that captures end-user feedback.
  
• End-user self-services, which organizations allows users to access self support help or place a new support request.
  
• A new migration tool and an assessment tool for migration planning.

You may also be interested in:

• HP Discover Interview: Security Evangelist Rafal Los on Balancing Risk and Reward Amid Consumerization of IT
  
• HP delivers applications appliance solutions that leverage converged infrastructure for virtualization, data management
• HP at Discover releases converged infrastructure products and services aimed at helping IT migrate rapidly to the future
  
• HP's IT Performance Suite empowers IT leaders with unified view into total operations, costs

Discover Case Study: How IHG has deployed and benefited from increased apps testing

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: HP.

Welcome to a special BriefingsDirect podcast series coming to you from the HP Discover 2011 conference June 8 in Las Vegas. We explored some some major enterprise IT solutions, trends and innovations making news across HP’s ecosystem of customers, partners, and developers.

This enterprise case study discussion from the show floor focuses on InterContinental Hotels Group (IHG). We're going to be looking at what they are doing around automation and unification of applications, development and deployment, specifically looking at software as a service (SaaS) as a benefit, and how unification helps bring together performance, but also reduce complexity costs over time.

To help guide us through this use-case, we're here with Brooks Solomon, Manager of Test Automation at InterContinental. The interview was moderated by Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: HP is a sponsor of BriefingsDirect podcasts.]

Here are some excerpts:

Solomon: InterContinental Hotels Group is the largest hotel company by number of rooms. We have 645,000 rooms, 4,400 hotels, with seven different brands, and the largest and first hotel loyalty program with 58 million members.

The majority of the hotels, 3,500 or so, are in the US and the others are distributed around the world. We're going to be expanding to China more and more over the next few years.

I couldn’t list the number of applications we have. The majority of the revenue comes from four major applications that are consumer-facing.

We use HP’s testing software all the way from Quality Center (QC), through Quick Test Professional (QTP), through LoadRunner, up into the Business Availability Center (BAC) tool. I've talked about how we get to the process of BAC and then how BAC benefits us from a global perspective.

I couldn’t list the number of applications we have. The majority of the revenue comes from four major applications that are consumer-facing.

The apps that we generate support the majority of IHG’s revenue and, if they're not customer-facing, they're a call-center application. If you call 1-800 Holiday Inn, that kind of thing, you'll get a reservation agent somewhere around the world wherever you are. Then, that agent will actually tap into another application that we developed to generate the reservation from there.

SaaS monitors

We use SaaS and we have a private use of SaaS. Going back to our call-center applications, there are local centers around the world, and we've installed SaaS monitors at those facilities. Not only do we get a sense of how the agent’s response time and availability is from their centers, we also get a full global view from customers and how their experience is, wherever they maybe.

Right now the only SaaS-based tool we have is the BAC. The other HP tools that we use are in-house.

Without the automated suite of tools that we have, we couldn’t deliver our products in a timely fashion and with quality. We have an aggressive release schedule every two weeks, distributing new products, new applications, or bug fixes for things that have occurred. Without the automated regression suite of tools that we have, we couldn’t get those out in time. Having those tools in place allows us approximately a 75 percent reduction in cost.

Without the automated suite of tools that we have, we couldn’t deliver our products in a timely fashion and with quality.

I would say just to define the core functionality of your applications and automate those first. Then, once new enhancements come along and there are business-critical type transactions, I would include those in your automated suite of tools and tests.

We're coming off of a mainframe reservation system and we are converting that into service oriented architecture (SOA). So, we’ve recently purchased HP service tests. We hope that acquisition would help us automate all of our services coming off the mainframe. We're going to do that on a gradual basis. So, we're going to be automating those as they come online.

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: HP.

You may also be interested in:

• HP delivers applications appliance solutions that leverage converged infrastructure for virtualization, data management
• HP takes plunge on dual cloud bursting: public and-or private apps support comes of age
  
• HP rolls out EcoPOD modular data center, provides high-density converged infrastructure with extreme energy efficiency
• HP at Discover releases converged infrastructure products and services aimed at helping IT migrate rapidly to the future
  
• HP's IT Performance Suite empowers IT leaders with unified view into total operations, costs
• HP Delivers NMC 9.1 as New Demands on Network Management Require Secure, Integrated, and Automated Response

Standards effort points to automation via common markup language O-ACEML for improved IT compliance, security

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

Join this podcast discussion in conjunction with the latest Open Group Conference in Austin, Texas, to examine the Open Automated Compliance Expert Markup Language (O-ACEML), a new standard creation and effort that helps enterprises automate security compliance across their systems in a consistent and cost-saving manner.

O-ACEML helps to achieve compliance with applicable regulations but also achieves major cost savings. From the compliance audit viewpoint, auditors can carry out similarly consistent and more capable audits in less time.

Here to help us understand O-ACEML and managing automated security compliance issues and how the standard is evolving are Jim Hietala, Vice President of Security at The Open Group, and Shawn Mullen, a Power Software Security Architect at IBM. The discussion is moderated by Dana Gardner, Principal Analyst at Interarbor Solutions. [Disclosure: The Open Group is a Sponsor of BriefingsDirect podcasts.]

Here are some excerpts:

Hietala: One of the things you've seen in last 10 or 12 years -- since the compliance regulations have really come to the fore -- is that the more regulation there is, more specific requirements are put down, and the more challenging it is for organizations to manage. Their IT infrastructure needs to be in compliance with whatever regulations impact them, and the cost of doing so becomes significant.

So, anything that could be done to help automate, to drive out cost, and maybe make organizations more effective in complying with the regulations that affect them -- whether it’s PCI, HIPAA, or whatever -- there's lot of benefit to large IT organizations in doing that. That’s really what drove us to look at adopting a standard in this area.

Manual process

W e're moving to] enable compliance of IT devices specifically around security constraints and the security configuration settings and to some extent, the process. If you look at how people did compliance or managed to compliance without a standard like this, without automation, it tended to be a manual process of setting configuration settings and auditors manually checking on settings. O-ACEML goes to the heart of trying to automate that process and drive some cost out of an equation.

Mullen: This has been going on a while, and we’re seeing it on both classes of customers. On the high-end, we would go from customer-to-customer and they would have their own hardening scripts, their own view of what should be hardened. It may conflict with what compliance organization wanted as far as the settings. This was a standard way of taking what the compliance organization wanted, and also it has an easy way to author it, to change it.

If your own corporate security requirements are more stringent, you can easily change the O-ACEML configuration, so that is satisfies your more stringent corporate compliance or security policy, as well as satisfying the regulatory compliance organization in an easy way to monitor it, to report, and see it.

In addition, on the low end, the small businesses don’t have the expertise to know how to configure their systems. Quite frankly, they don’t want to be security experts. Here is an easy way to print an XML file to harden their systems as it needs to be hardened to meet compliance or just the regular good security practices.

One of the things that we're seeing in the industry is server consolidation. If you have these hundreds, or in large organizations thousands, of systems and you have to manually configure them, it becomes a very daunting task. Because of that, it's a one-time shot at doing this, and then the monitoring is even more difficult. With O-ACEML, it's a way of authoring your security policy as it meets compliance or for your own security policy in pushing that out.

This allows you to have a single XML and push it onto heterogeneous platforms. Everything is configured securely and consistently and it gives you a very easy way to get the tooling to monitor those systems, so they are configured correctly today. You're checking them weekly or daily to ensure that they remain in that desired state.

[As an example], let's take a single rule, and we'll use a simple case like the minimum password length. In PCI the minimum password length, for example, is seven. Sarbanes-Oxley, which relies on COBiT password length would be eight.

But with an O-ACEML XML, it's very easy to author a rule, and there are three segments to it. The first segment is, it's very human understandable, where you would put something like "password length equals seven." You can add a descriptive text with it, and that's all you have to author.

Actionable command

When that is pushed down on to the platform or the system that's O-ACEML-aware, it's able to take that simple ACEML word or directive and map that into an actionable command relevant to that system. When it finds the map into the actionable command, it writes it back into the XML. So that's completing the second phase of the rule. It executes that command either to implement the setting or to check the setting.

The result of the command is then written back into the XML. So now the XML for particular rule has the first part, the authored high-level directive as a compliance organization, how that particular system mapped into a command, and the result of executing that command either in a setting or checking format.

Now we have all of the artifacts we need to ensure that the system is configured correctly, and to generate audit reports. So when the auditor comes in we can say, "This is exactly how any particular system is configured and we know it to be consistent, because we can point to any particular system, get the O-ACEML XML and see all the artifacts and generate reports from that."

What's interesting about O-ACEML -- and this is one of our differences from, for example, the security content automation protocol (SCAP) -- is that instead of the vendor saying, "This is how we do it. It has a repository of how the checking goes and everything like that," you let the end point make the determination. The end point is aware of what OS it is and it's aware of what version it is.

For example, with IBM UNIX, which is AIX, you would say "password check at this different level." We've increased our password strength, we've done a lot of security enhancements around that. If you push the ACEML to a newer level of AIX, it would do the checking slightly differently. So, it really relies on the platform, the device itself, to understand ACEML and understand how best to do its checking.

We see with small businesses and even some of the larger corporations that they're maintaining their own scripts. They're doing everything manually. They're logging on to a system and running some of those scripts. Or, they're not running scripts at all, but are manually making all of these settings.

It's an extremely long and burdensome process, when you start considering that there are hundreds of thousands of these systems. There are different OSes. You have to find experts for your Linux systems or your HP-UX or AIX. You have to have all those different talents and skills in these different areas, and again the process is quite lengthy.

Different classes

Hietala: The way to think about it is the universe of IT devices that are in scope for these various compliance regulations. If you think about PCI DSS, it defines pretty tightly what your cardholder data environment consists of. In terms of O-ACEML, it could be networking devices, servers, storage equipment, or any sort of IT device. Broadly speaking, it could apply to lots of different classes of computing devices.

O-ACEML is relatively new. It was just published 60 days ago by The Open Group. The actual specification is on The Open Group website. It's downloadable, and we would encourage both, system vendors and platform vendors, as well as folks in the security management space or maybe the IT-GRC space, to check it out, take a look at it, and think about adopting it as a way to exchange compliance configuration information with platforms.

We want to encourage adoption by as broad a set of vendors as we can, and we think that having more adoption by the industry, will help make this more available so that end-users can take advantage of it.

Mullen: We had a very interesting presentation here at The Open Group Conference in Austin. Customers are finding the best way they can lower their compliance or their cost of meeting compliance is through automation. If you can automate any part of that compliance process, that’s going to save you time and money. If you can get rid of the manual effort with automation, it greatly reduces your cost.

Cost of compliance

There was a very good study [we released and discussed this week]. It found that the average cost of an organization to be compliant is $3 million. That's annual cost. What was also interesting was that the cost of being non-compliant, as they called it, was $9 million.

Hietala: The figures that Shawn is referencing come out of the study by the Ponemon Institute. Larry Ponemon does lots of studies around security risk compliance cost. He authors an annual data breach study that's pretty widely quoted in the security industry that gets to the cost of data breaches on average for companies.

In the numbers that were presented, he recently studied 46 very large companies, looking at their cost to be in compliance with the relevant regulations. It's like $3.5 million a year, and over $9 million for companies that weren't compliant, which suggests that companies that are actually actively managing toward compliance are probably little more efficient than those that aren't.

What O-ACEML has the opportunity to do for those companies that are in compliance is help drive that $3.5 million down to something much less than that by automating and taking manual labor out of process.

We want to encourage adoption by as broad a set of vendors as we can, and we think that having more adoption by the industry, will help make this more available so that end-users can take advantage of it.

Mullen: One of the things that we're hoping vendors will gravitate toward is the ability to have a central console controlling their IT environment or configuring and monitoring their IT environment. It just has to push out a single XML file. It doesn’t have to push out a special XML for Linux versus AIX versus a network device. It can push out that O-ACEML file to all of the devices. It's a singular descriptive XML, and each device, in turn, knows how to map it to its own particular platform in security configuring.

Hietala: And O-ACEML goes beyond just the compliance regulations that are inflicted on us or put on us by government organizations to defining a best practice instead of security policies in the organization. Then, using this as a mechanism to push those out to your environment and to ensure that they are being followed and implemented on all the devices in their IT environment.

So, it definitely goes beyond just managing compliance to these external regulations, but to doing a better job of implementing the ideal security configuration settings across your environment.

Moving to the cloud

If you think about how this sort of a standard might apply toward services that are built in somebody’s cloud, you could see using this as a way to both set configuration settings and check on the status of configuration settings and instances of machines that are running in a cloud environment. Shawn, maybe you want to expand on that?

Mullen: It's interesting that you brought this up, because this is the exact conversation we had earlier today in one of the plenary sessions. They were talking about moving your IT out into the cloud. One of the issues, aside from just the security, was how do you prove that you are meeting these compliance requirements?

ACEML is a way to reach into the cloud to find your particular system and bring back a report that you can present to your auditor. Even though you don’t own the system --it's not in the data center here in the next office, it's off in the cloud somewhere -- you can bring back all the artifacts necessary to prove to the auditor that you are meeting the regulatory requirements.

Hietala: The standard specification is up on our website. You can go to the "Publications" tab on our website, and do a search for O-ACEML, and you should find the actual technical standard document. Then, you can get involved directly in the security forum by joining The Open Group . As the standard evolves, and as we do more with it, we certainly want more members involved in helping to guide the progress of it over time.

It removes the burden of these different compliance groups from being security experts and it let’s them just use ACEML and the default settings that The Open Group came up with.

Mullen: That’s a perfect way to start. We do want to invite different compliance organization, everybody from the electrical power grid -- they have their own view of security -- to ISO, to payment card industry. For the electrical power grid standard, for example -- and ISO is the same way -- what ACEML helps them with is they don’t need to understand how Linux does it, how AIX does it. They don’t need to have that deep understanding.

In fact, the way ISO describes it in their PDF around password settings, it basically says, use good password settings, and it doesn’t go into any depth beyond that. The way we architected and designed O-ACEML is that you can just say, "I want good password settings," and it will default to what we decided. What we focused in on collectively as an international standard in The Open Group was, that good password hygiene means you change your password every six months. It should at least carry this many characters, there should be a non-alpha/numeric.

It removes the burden of these different compliance groups from being security experts and it let’s them just use O-ACEML and the default settings that The Open Group came up with.

We want to reach out to those groups and show them the benefits of publishing some of their security standards in O-ACEML. Beyond that, we'll work with them to have that standard up, and hopefully they can publish it on their website, or maybe we can publish it on The Open Group website.

... It’s an international standard, we want it to be used by multiple compliance organizations. And compliance is a good thing. It’s just good IT governance. It will save companies money in the long run, as we saw with these statistics. The goal is to lower the cost of being compliant, so you get good IT governance, just with a lower cost.

Hietala: You'll see more from us in terms of adoption of the standard. We’re looking already at case studies and so forth to really describe in terms that everyone can understand what benefits organizations are seeing from using O-ACEML. Given the environment we’re in today, we’re seeing about security breaches and hacktivism and so forth everyday in the newspapers.

I think we can expect to see more regulation and more frequent revisions of regulations and standards affecting IT organizations and their security, which really makes it imperative for engineers in IT environment in such a way that you can accommodate those changes, as they are brought to your organization, do so in an effective way, and at the least cost. Those are really the kinds of things that O-ACEML has targeted, and I think there is a lot of benefit to organizations to using it.

Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Read a full transcript or download a copy. Sponsor: The Open Group.

You man also be interested in:

• Enterprise Architects Increasingly Leverage Advanced TOGAF 9 for Innovation, Market Response, and Governance Benefits
• IT industry looks to Open Trusted Technology Forum to help secure supply chains that support technology products
  
• Open Group Cloud Panel Forecasts Cloud s Spurring Useful Transition Phase for Enterprise Architecture
• The Open Group's Cloud Work Group Advances Understanding of Cloud-Use Benefits for Enterprises