Tag Archives: enterprise security

Hybrid Computing, Mobile Computing, Security

Miraculous cure for IT system bottlenecks!

Leave a comment

What’s a bottleneck? From Dictionary.com, it’s “a narrow entrance, spot where traffic becomes congested”. In IT terms, it’s something causing slower operations or that inhibits a Service Level Agreement (SLA) from being met. The worst case scenario is a lot of IT shops are absolutely confident that they don’t have bottlenecks as they are meeting or exceeding their SLA’s. They couldn’t be more wrong!!! 

There are a wide variety of traditional methods for identifying bottlenecks. On an IBM mainframe, a business might use IBM’s Omegamon, BMC’s Mainview or CA’s SYSVIEW. On a desktop, it could be as simple as Microsoft Task Manager or Apple’s Activity Monitor. On networks, there are a many tools. At home, you might wonder if your ISP or internal network is running well, so you’d try Ookla’s speedtest.net. In the cloud, there are monitors for Amazon Web Services, IBM Bluemix, Microsoft Azure and Google Cloud.

Yet, none of these will find the modern IT system bottleneck. When you have an IT system bottleneck, there’s always someone to blame. But who is it? Is it the System Programmer’s fault? Is it the Application Developer’s fault? Is it the asphalt? Oops, wrong punchline. No, it’s the System Architecture’s fault. It’s a 1990’s mentality that looks at IT in operational silo’s and independently manages the systems. But hang in there for another moment. There is a cure.

The 1990’s methodology bases IT operations on server silos. The mainframe is independently managed from the Unix servers, which are independent of x86 servers, which are separate from cloud and mobile and desktop and network. Security is done for each domain. Business resilience is done for each domain. Budget’s are created and departments compete for more spend in their particular area. Some areas might claim they have a bottleneck and warrant more spending to resolve it. Next budget cycle, they’ll still have issues and want more.

Another type of silo-ed operation is looking at separate systems for Record, Insight and Engagement. Systems of Record are the master database and transactional systems that update those databases (e.g. credit/debit, stock sales, claims, inventory, payments, etc). Systems of Insight are the analytic systems (e.g fraud detection, sales opportunity, continuous flow delivery, tracking). Systems of Engagement are the human computer or Internet of Things (IoT) interfaces (e.g. mobile, IoT device, tablet, browser). Many businesses create silos to manage each of these areas independently because if you had ever tried to do this in the 1990’s, you’d hit a bottleneck or drive up IT costs too high. Funny how the systems of the 1990’s actually created the hidden bottleneck today!  But it can be fixed.

Where can you buy the “fix” for this? Is it via a software product? No. Hardware product? No. Cloud? No. Consulting services? Maybe. But the reality is every business can solve this pretty easily within their own environment. I guarantee that your business can far exceed current SLA’s and establish new business goals. In the process, your business can save tremendously in IT expense, while improving security and business resilience. The solution is pretty simple.

Stop copying data between systems! In the new API economy, all of the systems have been modified to allow for direct access to applications and data from other systems. The change is either philosophical and/or organizational for most enterprises. It’s all about managing the IT systems together instead of separate silos. That starts at an architectural level, with hybrid development systems and extends to hybrid operational systems that address end to end security, business resilience and performance.

If you’ve moved  data to another server to keep the Systems of Record separate from the Systems of Insight. Stop the move. Keep the data together. Systems like IBM’s mainframe are now capable of hosting both databases and analytics in a single system and improving analytic performance many times over separate Systems of Insight without impacting the SLA’s of the transactional systems. The applications  that access the Systems of Insight can be easily modified to point to the Systems of Record instead via updated device drivers without changing any code logic. This changes things like batch analytics, which might be used for fraud detection into real time analytics that can be used for fraud prevention. And in the process, businesses will save with reduction in storage, network bandwidth and system utilization, costs and time associated with copying the data. Products such as Rocket’s Data Virtualization Studio can provide the device drivers and mappings necessary for applications to share data from a variety of Systems of Record, across platforms. And new apps can be developed to join the data from different sources, including partner organizations or from “the cloud” to solve business problems in new and creative ways. These applications wouldn’t be possible without sharing data. Apache Spark technology is one means for collaboration across data sources.

There is no reason to copy data to move it closer to or tailor it for a specific System of Engagement. The API economy allows for applications to directly access the data or transactions on other systems via the API economy. New pricing options are available that allow for increased transaction rates, due to direct access to mobile, at a lower cost than traditional access methods. zOS Connect is one of the tools for making the API connection between mobile and transactional systems.

Regardless of how you might transform your business, the unintended consequence of standing still on current IT silo-ed operations is there are bottlenecks and slow downs in business systems that depend on heavily copying data and batch windows to facilitate copying. Direct access to data and devices is the future. The future is now. Begin the migration to hybrid operations management. If you need help in deciding how to look at your architecture differently, don’t hesitate to ask me.

 

 

Hybrid Computing, Security

What happens after a breach? The vultures descend

Leave a comment

There have been so many breaches. In every case, the business or agency affected realizes that they must spend money to fix the breach. That’s when the vendor sales teams come out of the woodwork. Everyone has something to sell. New analytics, new detection mechanisms and new management offerings are just some of the products. However, in almost every case, a quick decision on a new product would be like putting lipstick on a pig. At the heart of a breach is a fundamental problem with people, process and technology associated with security. While a witch hunt for the base problem may be happening, it’s important to take a step back, take stock of what’s good and bad about what is already in place. Re-look at processes and find the gaps that need to be considered. But most important, what is the scope of the processes?

Too many systems to manage securely

Too often, a business will have multiple domains that are independently managed. For example, there may be separate domains for management of desktops, web servers, application servers, data warehouses, transaction servers and database servers. My experience has shown that when a breach is found in one area, the other areas breathe a sigh of relief as it is not their problem. That’s a bad attitude. Business problems are end to end solutions that cross several of these domains. As such, a business should be looking to collaborate their security and harden processes across domains rather than manage them individually.

Create an Enterprise Security Hub

The IBM mainframe is an ideal hub for centralization of security focus. For the same reasons that IBM calls the mainframe the System z, z being for zero down time, it could have been  System s for fail safe security. IBM has spent years in hardware and software R&D to harden the mainframe for business resilience and security and include that level of functionality in the basic hardware and software systems. The bulk of the built-in security services meet industry standards for interoperability and programming interfaces. As a result, these services can be executed on behalf of any other system or server that is interconnected with them. This includes usage as an authentication server, managing logs, providing real-time analytics to prevent loss and a central site for audit management. Unfortunately, no sales person is going to run to a business to brag about these capabilities. The unintended consequence by IBM and for its customers is that with all this capability “inside the box” they don’t have a commissioned sales force pushing these functions. IBM has a wide variety of software solutions that they are selling for distributed domains. They have software to manage the mainframe better. However, there is no end to end play that focuses on the mainframe as the central hub for enterprise security.

Wealth of Documentation

All is not lost, however. IBM and their Business Partners have a wealth of documentation and capabilities to demonstrate the strength of the mainframe for enterprise security. European customers can attend an excellent security conference in Montpellier, France from September 29 to October 2. The IBM Design Centers provide briefing centers and proof of concept capability tailored to an organization’s needs. There are IBM Redbooks describing the security functionality, including cryptography, analytics and Digital Certificate management for global authentication.

Shared Credentials to sign on via Biometrics and Multi-Factor authentication

There are also a wealth of up and coming vendors that can contribute to end to end security. Two that I’ve been working with are Callsign and Cyberfy that can leverage a mobile device for multi-factor biometric authentication in a consistent way across platforms. Throw away your userids and passwords that could be key logged and stolen and move to something that is truly unique to an individual. With these tools, a common authentication is used and managed across a wide range of servers and applications. Common authentication is the center of cross domain security management. Without a consistent authentication mechanisms, it becomes extremely difficult to correlate security activities across domains.

Operational Collaboration

I started this about breaches. A mainframe can provide and collect a wealth of forensic information across systems. As the host server for a tremendous amount of financial and personnel transaction processing, this information is used in real-time to prevent fraud because of the mainframe’s ability to run multiple transactions and database servers simultaneously, with integrity, while satisfying a service level agreement. This combination of functionality can work well with network attached applications and user devices.

These are the tenants that provide the foundation for hardening an environment. If a business or agency looks at what they have already and they find a mainframe, they’ll find a wealth of capabilities to lock down their end to end systems. The most important element is collaboration across organizations. Through collaboration, organizations can find weakness and inconsistency.  Once these efforts are undertaken, then the gaps can be identified and the acquisition of new products can be done intelligently.

Start Locking down systems before it’s too late

If anyone needs assistance getting started in locking down their systems, give me a call. Don’t wait until you’ve been breached, it will only cost more to solve the problem. As has been said, an ounce of prevention is better than a pound of cure.