Showing posts sorted by date for query Cloud Computing. Sort by relevance Show all posts
Showing posts sorted by date for query Cloud Computing. Sort by relevance Show all posts

HP Cloud 28+ enters beta and introduces self-certification scheme for providers

Hewlett-Packard's’s bid to create a Europe-wide one-stop cloud shop has moved up a gear, with the introduction of a self-certification system for providers that want to sell their services through it.

Dubbed Cloud 28+, the initiative was formally unveiled by HP in March 2015 after a year of preparation, and is geared towards driving adoption of off-premise technologies across Europe by providing users with a centralised catalogue of cloud services.

HP claims this will help make it easier for commercial and public sector organisations to adopt cloud – as they can consult the catalogue before embarking on a deployment, to find a provider and service that fits the bill.

Speaking at the Cloud 28+ in Action event on 30 September 2015 in Brussels, Xavier Poisson, Emea vice-president of HP Converged Cloud, marked the beta launch of the project by talking up the attention it has garnered in other parts of the world looking to replicate what HP is trying to achieve.

Similarly, the cloud provider community has also thrown its weight behind it, he continued, helping the firm exceed its target of having 200 services listed through it by September 2015.

“We had a dream in March that the catalogue would be live in September and we would have 200 cloud services in the catalogue for this meeting,” he said.

“Not only is Cloud 28+ live, but it is hosted by one of the members and we have 320 cloud services.”

In light of this, Poisson said the aim now is to have 600 services listed on the catalogue by the time of its official go-live date in early December.

Turning his attention back to the problems providers face when trying to do business with users in other countries, he claimed it can cost up to €9,000 to ensure a service does not infringe on local laws.

And it’s those kinds of financial and legislative barriers to doing business across borders, Cloud 28+ is looking to eradicate, he said.

“I’m hoping to generate what all of us are working for everyday. That’s employment and to generate growth. That’s the ‘why’ of everything we’re doing today with Cloud 28+.” 

Cloud 28+ self-certification scheme

Every cloud provider, reseller or independent software vendor (ISV) that secures a listing on the portal can now have their offerings rated via Eurocloud’s Star Audit system – a move HP claims will make it easier for users to pit one firm’s offerings against another.

Eurocloud board member Tobias Höllwarth told attendees the rating system should streamline the procurement process by providing users with certified assurances about the quality of the services they provide.

Otherwise, providers can find themselves repeatedly fielding the same questions about security and uptime, from users trying to work out whether or not to trust those suppliers with their data.

This results in slower and more expensive cloud procurements, driving up the costs of doing business.

“Answering the same questions again is boring and is not generating business,” he said.

Read more about HP's Cloud 28+

For smaller firms – that don’t have access to dedicated IT, legal or procurement teams to guide them through the process – knowing which provider to go with can be fraught with challenges.

“They need to buy cloud services as they may have a big competitive disadvantage if they don’t,” he said, adding that the rating system should accelerate the buying process for them too.

The EC Digital Single Market

Cloud 28+ initiative has drawn parallels in the past with the UK government’s G-Cloud scheme, and – in the light of that programme's success – on the continent, attention has focused on recreating a similar cloud services procurement portal for European public-sector users.

Similarly, what HP is trying to achieve with Cloud 28+ fits in quite well with the European Commission’s Digital Single Market initiative, which seeks to create a single marketplace for digital services within the European Union (EU).

Speaking at the event, Francisco Medeiros, deputy head of the software and services and cloud computing unit at the EC, said that – while the organisation could not directly endorse the work HP is doing with Cloud 28+ – such initiatives had an important role to play in supporting the EC’s cloud goals.

“This is indeed a promising and enriching initiative that has the potential to substantially contribute to the development of the European cloud services market and will provide opportunities for small and large cloud service providers,” Medeiros said.

"Of course, we – as the commission – are not in a position to endorse specific market initiatives but, in general terms, I can tell you initiatives like Cloud 28+ and others are key, in our view, for the establishment of a competitive market for cloud services.”

Read More »

Evolving ITSM to support agile IT and BYOD

The corporate IT department is just a service function for the business, ensuring those bright minds and red hot sales folk – using an increasing number of personal technology devices in the workplace – make the products and rake in the cash that keeps the corporation going. Corralling all these devices and applications is a never-ending task that only grabs headline attention when something goes wrong.

IT service management (ITSM) must address a broad range of data and application responsibilities, both on-premise and in the cloud (private, public and hybrid). This typically includes patch management, vulnerability management, maintenance contracts, quality assurance and control, project management and so on. Service management requires forward thinking to support DevOps, address developments in business areas – such as the enterprise internet of things (IoT) and intelligent building management – and support human resources (HR) functions.

For example, BMC's Remedy 9 service management platform offers native support for bring-your-own-device (BYOD) schemes. With better overview and control, the IT department can engage critical business operations.

The IoT is another area service management tools are starting to support. Axios Systems' Assyst ITSM platform, for instance, handles “smart objects” by centralising service management and drawing all of the service domains (and smart assets) together under one service desk, one helpline number and one self-service portal. Smart objects provide self-diagnosis, automated alerting, self-healing/run-book automation and remote control without expanding the service desk or field engineer workforce.

Another area of current interest lies in linking building and facilities management to IT service management such as IBM's ITSM platform, which interfaces with the supplier’s Tririga intelligent buildings management application.

This software combines real-time monitoring with event management and analytics to help building managers optimise their energy consumption, and enhance operations and reliability. It integrates with the ITSM platform and monitoring equipment to capture data, which can be used for improved energy analytics and performance.

An example of HR support is in ServiceNow’s ITSM platform, which comes with additional HR capabilities. The human resources management application uses the same format as the incident management application to allow users to create HR requests, which can then be handled by an HR management team using the same tools as the IT infrastructure library (ITIL) best-practice processes.

Checklist of considerations before buying ITSM software

When choosing the ITSM software for your organisation, there are a number of issues to consider at the outset:

  • Is the software scalable?
  • Is the software user interface role-based and easily configured to support different user groups?
  • Is the software extensible to integrate with other core third-party applications?
  • If so, does this include the use of public cloud platforms – software as a service, infrastructure as a service etc?
  • Can the software be customised, or must the suppliers come in every time a small tweak is required?
  • Does the software include business process automation that has drag-and-drop tools, wizards, debugging tools and re-usable process libraries?
  • Does the supplier have a robust portfolio of ITIL-compliant modules and include systems that extend beyond core helpdesk functions – such as software asset management, client lifecycle management and web self-service?

The supplier landscape

ITSM applications are today available from over 400 suppliers – most of them focused on specific functions, while ITSM platforms are available for on-premise implementation typically for the larger enterprise, or as cloud-based software as a service (SaaS) for the SME market.

Modern ITSM platforms enable process automation at a high level. They come with intuitive user interfaces based on a flexible web design and provide access to a common database. There are also predefined, customisable ITIL processes allowing users to build to their own specifications using integrated workflow editors with self-service portals, such as the one provided by the RES Software Service Desk. Ideally, ITSM tools should operate with the user-friendliness of modern web applications and social media platforms. In this way, ITSM is an important technological step for the internal IT operation, which allows the IT department to keep tabs on the current operating environment, while concurrently supporting business initiatives.

What are you looking for?

Buyers risk paying a lot of money for functionality they won’t use in the lifespan of the tool. A rational buying decision must be based on detailed requirement studies.

There has been little progress toward maturity in infrastructure and operations organisations in the ITSM market, so buyers must structure and codify their needs. Suppliers such as Splunk Enterprise offer a platform for real-time operational intelligence to search, analyse and visualise the large streams of machine data generated by corporate IT systems and the corresponding technology infrastructure – physical, virtual and cloud.

One commonly used structuring tool is the IT infrastructure library (ITIL) touched on earlier, a set of practices for ITSM that focuses on aligning IT services with the business. Companies with limited in-house ITIL expertise, or that lack the resources to develop best-practice processes, should find a supplier that will become a business partner and help customers design and build best-practice processes based on ITIL.

To develop a consistent view of service management the ITIL framework can be applied to cloud computing to identify gaps. But ITIL and cloud are not a direct fit. ITIL must be reframed in the context of cloud, not simply extended. Service vision, design, migration under a set of defined processes, efficiently operating and managing those services and continuously improving them in a DevOps environment, are all useful and applicable to cloud computing. ITIL and ISO/IEC 20000 compliance is relevant for organisations that face governance, regulatory and legal requirements.

Define the business goals (for example, a strong service culture and management of business-critical apps) before embarking on ITSM; identify the sought-after effects; identify the right processes and assess the company’s competence and maturity levels. Finally, buyers need to assess the system providers and their ability to provide ongoing development support.

ITSM in the longer term

The future of ITSM is shifting focus from the static reviews of machine data to dynamic, big-data operational intelligence analytics, and the ability to create completely new product capabilities based on data insight that can respond in real time. A leading-edge company such as Volkswagen in Germany is using its ITSM platform with Splunk to help manage its connected and self-driving cars programme together with Vodafone SIM cards and Apple Car-Play. Data is fed into iPhone and smartwatch apps, and then passed on to Volkswagen datacentres and ITSM platforms for real-time data analytics.

The next step in the world of the IoT could be collecting and analysing data from “smart dust” – tiny microelectromechanical systems including sensors, robots and other devices used to detect light, temperature, vibration or chemicals. Other long-range areas that will influence the future of ITSM include software-defined security, the connected home and quantum computing – which are all approaching the innovation trigger stage.

What to look for in IT service management tools

  • Make sure your IT service management (ITSM) tools include these core components:
  • Real-time dashboards providing information on configuration and services availability.
  • Change management for standards, procedures and supporting customers.
  • Cloud platform management to ensure integration, with internal IT support. This will often require a third-party tool such as RightScale’s multi-cloud management platform, which integrates with ServiceNow’s ITSM.
  • Configuration management to identify requests for change with the status of IT assets and their relationship to incidents updated in real time.
  • Incident management addresses helpdesk best practice to categorise issues and automate workflow. A real-time, customisable dashboard capability is very useful here.
  • Knowledge management provides support staff with systems to solve issues and allows users to search for systems over the web to reduce the pressure on the service desk.
  • Problem management able to analyse root causes.
  • Release management to design and implement procedures to distribute releases and communicate changes to IT staff and customers.
  • Service level management to maintain and improve IT services through service level agreements with service providers and line-of-business customers. This is also important when defining and managing service catalogues.
  • Self-service management allows users to view the status of their issues and submit issues over the web.
  • IT service support management tools manage how services are used, the infrastructure that supports them and the organisation’s responsibility in supporting them.

Bernt Ostergaard is service director at analyst company Quocirca.

Read More »

Mobile strategies increase the need for data loss prevention technology in Europe

Mobile has entered business strategy from two directions. The business wants to grab the opportunity to better serve the mobile masses, while employees want to mobile devices as part of their work

This has created an environment that security teams have had to come to terms with quickly.

Roman Foecki, CEO at security supplier CoSoSys, says the increasing number of mobile devices in the enterprise, and new versions of an operating system, is forcing organisations to rethink ways of securing corporate data.

It is not just about mobile the applications, he says, but also how employees interact with other organisations and people. Mobile provides low-cost computing power that is available to everyone and enables staff to collaborate with others, but this is a recipe for security breaches in businesses.

Foecki says traditional security is irrelevant in many cases. For example, he says the shift from open file systems (Windows 7) to application sandboxes (Android, iOS, Windows Phone/Pro/RT), is making traditional antimalware, especially antivirus, less relevant.

For example, on iOS, there is little need for antimalware or antivirus products because neither they, nor any other app on the device, can access another app’s storage or memory.

According to Foecki, when planning a mobile security strategy there is no one size fits all: “Every company has to choose a cross-platform solution that works on Apple iOS, Android mobile devices, Windows, Mac OS X and Linux computers to cover the entire fleet of workstations.”

Sufficient resources for data loss protection

But what are companies doing to incorporate endpoint and mobile security tools in applications to make sure they are secure?

“This can be achieved by implementing data loss prevention (DLP) features into applications and more,” says Foecki. “However, the administrators have to be sure that IT resources under their control are ready to co-operate with advanced features like file tracing and file shadowing.”

Read more about data loss prevention

With DLP, he says, the amount of data being monitored and the number of copies stored could quickly absorb a sizeable chunk of the available IT resources.

“In European countries, sometimes we are faced with the situation that a CIO or administrator evaluates resources as insufficient for DLP use,” says Foecki. “In such cases it is recommended to look at cloud-managed DLP and mobile device management [MDM] that offer easy evaluation, implementation and scalability. It’s also a good way to safely reap the benefits of the cloud protecting data.”

In central and eastern European countries, one obstacle is the fact that many companies still prefer their own datacentres or computing power over cloud services, says Foecki.

Authorisation and security awareness

The software being used in enterprises is changing, so security teams must understand different security features and their limitations.

Foecki says CoSoSys increasingly supports Macs and iOS devices. It has experience with preventing data breaches that could happen with the use of Google Drive, One Drive, Dropbox, on Windows and Mac OS X computers, for example.

“When it comes to Android, in the next versions we expect to see more security features added directly from Google,” he says.

Google’s Android lock functionality should help relieve at least some of the concerns that IT administrators might have in allowing employees to use Android devices to access and store business applications and data.

“One of the main tasks of administrators is to set authorisation levels for employees according to departmental and task requirements. They also have to ensure that security does not limit accessibility,” according to Foecki. “For example, two users on the same device will mean two completely different levels of authorisation for transferring data. This flexibility marries convenience with security.”

Foecki advises that the implementation of DLP involves testing a variety of risk scenarios, such as content sharing and portable device threats, and admits that one of the main challenges for CoSoSys in Europe lies in a need to lead constant education about DLP.

Read More »

Salesforce Thunder, Lightning and Wave show new app economy at work

Salesforce’s Internet of Things Cloud service and an upgrade to its Wave Analytics service are significant developments because they take part in a broader trend of action-orientated apps, according to two of its leading spokespeople.

Chief operating officer Andrew Gross runs the supplier’s platform as a service, Heroku. He was the co-founder and CEO of Cloudconnect.com, which was acquired by Salesforce in 2013.

At Salesforces 2015 Dreamforce event in San Francisco, Gross explained the import of Salesforce’s most recent technical developments with respect to the trend, exemplified by car ride hiring company Uber, of “refashioning the customer experience” through apps that are event driven – pushed out rather than pulled.

He invoked a near-future scenario of checking into a hotel, whereby rather than having to check in at a desk, a beacon will detect your arrival and send a digital key to your smartphone. You won’t have to telephone for room service. Instead you’ll press an app button, and food will be delivered within 15 minutes from the hotel or, more likely, its environs.

The technology to make this sort of customer interaction work takes the form, in Salesforce’s world, of Thunder and Lightning. Thunder is, according to Gross, the underlying real-time event processing engine behind Lightning, which is an app development console used by business professionals among the supplier’s customers.

“We provide tools for developers, under the hood. Some of that is based on open-source software, like Kafka and Redis, and some of our own proprietary technology. And it all runs on Heroku,” he said.

“The next phase [of customer relationship management] is to think not of what CRM [customer relationship management] used to mean – you call the support centre or send an email. The next phase turns on the phenomenon of you as a consumer generating a torrent of data. This means we need a new data architecture, a new programming model and new applications to support what connecting to your customers means now.

Read more about cloud apps

“It’s moving from a pull model to a push model – sensing and acting proactively. The IoT cloud infrastructure is about enabling this new computing model, which is event based to operate, and about more proactive and intelligent customer interactions,” said Gross.

He maintains the future is already here in the form of sophisticated companies such as Uber and Lift which are dynamically changing pricing based on demand. Think about all the data being ingested in real time to enable that”.

Much of the technology behind what he sees as the new wave of CRM comes from LinkedIn and Twitter, said Gross, but he cited the IT team at the Financial Times as another example of a Salesforce customer that gets digital in the way that a downtown San Franciscan company would.

The idea that technology interest ends at the IT person’s door is no longer the case Andrew Gross, Salesforce

But he also argued that a key player for companies implementing newer ways of engaging customers is the chief marketing officer (CMO): “More and more we are talking to the CMO. The idea that technology interest ends at the IT persons door is no longer the case. And these CMOs are amazingly sophisticated.

“Technology has never been more strategic or important to the organisation, no question. Either the CIO will evolve to serve that critical function or it will emerge in other places. IT leadership needs to focus on what adds value to the business, be more risk-taking and accept the cloud. It’s hard to see how you can be an IT organisation that satisfies the needs of the business if you are still debating the cloud.

“IT has an essential role in understanding the risk profile of technologies but they cannot do that in an unsophisticated way,” said Gross.

The analytics wave

Stephanie Buscemi, chief operating officer, analytics, at Salesforce, joined the company in 2014 to head up its Wave Analytics business, launched at Dreamforce 2014. She is a business intelligence (BI) veteran of 18 years, with two stints at Business Objects, both as a standalone company and as part of SAP, and one at Hyperion, before and after its acquisition by Oracle.

Speaking at Dreamforce, Buscemi said BI and, more sophisticatedly, analytics, needed to be systematically embedded in workflows that issue actions for sales, service and marketing staff.

“There is a new type of [action-orientated] BI emerging here,” she said. “Our sweet spot is getting analytics to sales and service staff – not analysts, not IT. [Sales people] have historically used [in Salesforce] the operational reporting they get in the sales and service clouds. But they needed a more intuitive UI [user interface] – with the Wave visualisations they’ll now get that through the Lightning dashboards.

There is a new type of [action-orientated] BI emerging Stephanie Buscemi, Salesforce

Wave Analytics can bring third-party and other data, such as enterprise resource planning (ERP) data, to bear on business decisions for salespeople and service staff, said Buscemi. It can be embedded in desktop and mobile apps, she added.

“The other piece is delivering Wave actions. This makes a sales person more productive because they are working within Salesforce, not having to go into email, and it is integrated with Chatter [Salesforce’s collaboration tool].”

But what’s the benefit to companies that already have a lot of BI tools, including some sold by Buscemi herself at Business Objects? “Yes, Wave is a co-exist. But we are seeing customers getting away from selling using PowerPoint, but directly from dashboards,” she said.

She gave the example of Verizon, where global sales senior vice-president George Fischer has implemented Wave for his salespeople to get a complete view of their products.

In the mid-market, she said, Wave is more apt to be a replacement technology for companies that are already using Salesforce strategically.

Wave is not focused on data mining as such, though Salesforce plans to put native predictive capability on the product in the near future to support and measure sales reps. “It’ll be about predictive analytic apps for sales, service and marketing people,” said Buscemi.

Wave also has connecters out to the big data world, in the likes of Hadoop, Splunk and Google, she added, but that is in its infancy. It is also early days for Wave in the Europe, Middle East and Africa region, she said, but confirmed Barclays is an early customer.

“Personally, I’m having a blast. It’s great that there are hundreds of predictive analytics startups out there, but this is like being on a rocket ship,” Buscemi concluded.

Read More »

Australian organisations need to catch up in identity and access management

Australian enterprises are lagging behind the world in securing and managing user identities, leaving them vulnerable to attack as almost half of all cyber breaches are caused by weak or stolen credentials.

Trey Gannon, the Australian lead for Deloitte’s identity and access management team, recently moved to Australia from the US. Gannon said he believed the continued lack of mandated data breach notifications in Australia was one reason why the nation “is a step behind in identity and access management”.

Citing recent Verizon research, which defined user credentials as “the keys to the digital kingdom”, Deloitte is growing its capability in Australia. The advisory firm is set to bring on board a team of 22 identity specialists – who previously made up Qubit Consulting – from October 2015, swelling Gannon’s team to a total of 60 locally based identity and access management specialists.

According to Gannon, although Australia is currently lagging, there is the opportunity to leapfrog other countries by learning from their successes and failures with identity management. He said this was critical for those companies that want to harness technology to digitally disrupt themselves by offering flexibility to employees to work remotely from any device, and to launch a raft of services to customers which rely on being able to properly identify and authenticate them.

“Identity and access management is becoming the foundation to enable digital transformation,” said Gannon.

Granular identity and access management systems that identify users, their location, what context they are operating in, what device they are using and determine what access rights are appropriate are increasingly critical, he said.

However, technology alone won’t crack the nut. Education programmes will be needed to remind users to properly protect their identities and credentials.

A recent survey of US IT managers conducted by identity security specialist Centrify found 59% had shared their credentials with employees, and 52% with contractors – essentially handing over the keys to the kingdom.

While Centrify has not asked whether Australian IT managers have shared their credentials, it did survey attendees at an AusCERT conference earlier in 2015 about systems breaches, and found 46% said they had experienced an attempted breach in the previous week, highlighting the extent of the problem.

According to Centrify’s senior director for sales in Asia-Pacific, Niall King, cloud computing and mobile access are creating security headaches for IT where “identity is the new perimeter”.

“The challenge is that today’s corporate perimeter has nothing to do with physical headquarters. As employees reach for the cloud or their mobiles to get their jobs done, it opens up greater security vulnerabilities. As a result, there is a greater need than ever for unified identity security across multiple devices and platforms,” said King.

This is music to the ears of Infoblox, a company that focuses on security systems to protect internet domains and IP addresses, and which recently unveiled its identity mapping system in Australia. This links network security systems with user identities managed through Microsoft Active Directory logs, which tie user identity to an IP address.

This more granular representation of identity allows IT managers much better identity insights, such as revealing who had access to a particular IP address at a particular time, creating rich audit trails and insight, for example.

Read more about IT security in Australia

Read More »

Talent shortage drives IT salary rise in Singapore

IT salaries in Singapore are increasing at up to 15%, fuelled by a shortage of workers in the IT industry.

The IT sector is considered one of the most competitive recruitment markets in Singapore. This is largely because it is seen as the gateway to businesses in south-east Asia with its sound infrastructure making it attractive to multinational corporations. 

There is a shortage of workers in the IT industry who have both technical and business skills, according to ZW HR Consulting’s Singapore IT Salary Guide for 2015/16.

“The year 2015 is likely to be a reasonably good period for IT professionals,” said Mervin Chui, managing director of ZW HR Consulting Singapore.

“The average salary ranges for professionals are up by 10-15% for 2015/16 as compared to the 2014/15 figures. Hiring is still strong in many areas such as mobile applications, data analytics, business intelligence and cloud computing. Cyber security professionals and application developers are in demand due to increasing regulations and customers concern for data protection,” said Chui.

Experienced skilled IT professionals can expect to see salary hikes, said Chui.

Serge Shine, managing director Asia at recruitment firm Spring Professional - Adecco Group, said salaries are increasing at 5-10% across a number of industries. But IT professionals can expect higher increases than other industries, he said.

“With the economic turmoil, it is difficult to estimate salary increases for next year but, with technology driving so many aspects of businesses, IT professionals are likely to remain in demand,” said Shine.

“A premium is needed for professionals to change jobs, but those that stay at the same job are likely to get 5-10% salary increases.”

ZW HR said the IT professionals likely to be in demand in 2015/16 are: software developers, mobile application developers, database administrators, cloud computing, information security/ cyber security, network engineers, helpdesk/technical support, project managers, web designers/developers and big data.

The demand for IT skills varies across the Association of Southeast Asian Nations (Asean) region, said Shine.

The significant business process industry in the Philippines means a strong demand for IT professionals, while organisations in Vietnam are seeking software and applications skills, he said.

Malaysia is seeking to strengthen its network infrastructure in the financial services industry, while both Singapore and Thailand are seeing a demand for mid to senior level positions, with Singapore having the greatest demand for senior positions in Asean.

Read More »

IT services procurement: Could G-Cloud be the answer Europe is looking for?

Anyone reading the British press would be left with the impression the UK is, at best, a half-hearted member of the European community and, at worst, positively at odds with its continental neighbours.

While it’s true to say there are some areas of disagreement, there are commercial areas where the UK is not only fully engaged, but actively leading the field.

Cloud computing is one area where British expertise is really showing the way. Take the UK government’s G-Cloud project, which is currently attracting a good deal of interest across Europe, as an example of how public sector procurement can be done differently and more efficiently.

Public sector procurement is a key component of the European Cloud Computing Strategy, launched by former European Union (EU) commissioner Neelie Kroes in 2012.

Speaking at the time of the launch, she said: “Public IT procurement is about 20% of the market, but today it is fragmented with limited impact.

“We can harness this buying power through more harmonisation and integration and through joint public procurement across borders. It is a true win-win: The cloud market will grow, bringing opportunities for existing suppliers and new entrants; and cloud buyers, including the public sector, will buy more with less and become more efficient,” she added.

Lack of enthusiasm for cross-border cloud strategy

It’s fair to say there hasn’t been much movement in establishing a common procurement policy across Europe to date.

There’s been no effort to establish a continent-wide cloud-first approach, for example, as the US and UK governments have done, and there’s still much resistance to the idea of European cloud services crossing borders. Some countries, notably Germany, maintain the attitude that IT services should be acquired nationally – and that philosophy remains a barrier.

However, the UK G-Cloud approach remains a model that demonstrates how public cloud procurement could be enabled in the future, and some organisations are already looking to it for inspiration.

Bob Jones is head of Helix Nebula – the European Science Cloud initiative which aims to establish a Europe-wide cloud infrastructure – and is grateful for guidance from G-Cloud about how the organisation should approach procurement.

“The G-Cloud has helped. We were keen to learn from G-Cloud as it’s difficult to find something that’s so well developed in other EU member states,” says Jones.

The EU has also set up the Procurement Innovation for Cloud Services in Europe (PICSE) to advise public sector bodies. According to Strategic Blue CEO James Mitchell, a PICSE consultant, the organisation is also looking to advise small to medium-sized enterprises (SMEs).

Jones says PICSE was set up to look at how cloud is procured, particularly by public bodies and research organisations, as there is an issue with the procurement processes organisations are legally obliged to go through.

“Research institutes have to go through request for proposal [RFP] processes, which are not designed for buying utility services,” he says.

He points out some problems faced by procurement bodies: “Contracts will have items such as computing services, so instead of writing ‘computing services’, you’re going to write ‘cloud’ – that doesn’t work very well.”

There are accounting issues too. “A server is an asset, with the cost spread over the lifetime of that server – pay as you go doesn’t fit well into this model,” he adds.

Looking ahead

Procurement managers have to look beyond these difficulties and explore new areas. The three partners of PICSE – Cern; the Cloud Security Alliance and Trust-IT Services – want to build on the work carried out by Helix Nebula to help the process along.

Sara Garavelli, project lifecycle strategist and project manager at Trust-IT Services, describes how Helix Nebula demonstrated the suitability of cloud services for public sector organisations, but there were stark differences according to size.

“We observed two different trends. The big EU research organisations are quite aware of what procuring cloud means, but when it comes to small to mid-sized research organisations, many of them have no clue about cloud. They are attracted by the cloud benefits, but they don’t know how to approach the procurement,” she says.

There are many reasons for this reluctance to adopt cloud. “They are put off by interoperability issues with existing systems and by lock-in issues. They don’t have any idea how to run a cloud business case and they don’t know what legal and financial implications cloud brings,” she says.

To aid the procurement process, PICSE has introduced a self-assessment tool, called the Wizard, to help public research organisations better understand the issues with their procurement processes.

According to Garavelli, the Wizard should help research institutes procure services, even if it does have limitations. “Of course, it cannot replace the legal and procurement advice provided by experts, but it could give them with warnings and suggestions on how to deal with the full cloud procurement cycle,” she says.

The tool is designed for IT managers from public research organisations willing to procure significant amounts of cloud services.

Garavelli says there are considerable difficulties faced by these bodies. “Writing cloud tenders is quite a challenging and expensive task for public sector organisations. Cloud skills – technical, legal and financial – must be there to run successful cloud procurement,” she says.

However, organisations can get some financial assistance with this, thanks to two instruments launched by the European Commission (EC): The pre-commercial procurement (PCP) and the public procurement of innovation (PPI) instruments.

“Buyers can receive some funds from the EC to procure innovative cloud services. This is quite clever as the EC is not allowed to fund any commercial procurement, so in this case it’s a good opportunity for these public sector organisations,” says Garavelli, explaining that these financial initiatives are not widely known.

The challenge ahead

There are serious challenges in trying to procure services across Europe, as the multiplicity of different rules and regulations hinder the take-up of cloud. As Garavelli says: “Different EU countries have different regulations and laws. Managing a procurement of this type is really challenging and expensive.”

The UK’s G-Cloud initiative, with its ease of use, offers a good model, but PICSE’s Mitchell admits it has its limitations.

“If you want to deploy infrastructure as a service [IaaS], platform as a service [PaaS] and Salesforce, and try to do that on one RFP, you’ll need someone to put it all together – it’s going to be expensive,” he says.

Nevertheless, there’s a new awareness across Europe that things have to change and cloud services are on the agenda. The EU has put plenty of initiatives in place to help the process along, recognising the barriers in place.

As yet, the UK’s G-Cloud initiative is in a class of its own, but there’s plenty of time for the rest of the continent to catch up.

Read more about public cloud procurement

Read More »

Asean businesses fall behind in cloud business agility

Asian organisations show strong signs of agility in terms of technology adoption, but those in Association of Southeast Asian Nations (Asean) countries are slower to harness cloud computing, according to research.

Despite lagging behind, Asean organisations are ina position to leapfrog their Asian neighbours because they do not have the same levels of legacy systems to deal with.

Respondents in the Oracle Cloud Agility study are clear about the benefits of using technology to achieve business agility. The study surveyed 759 employees working for large enterprises in the Asia-Pacific (Apac) region to understand business agility in the age of cloud.

Some 85% said the ability to rapidly develop, test and launch business applications is either important or critically important to the success of their business. Nearly a third of respondents (29%) believe the effective mobilisation of applications and services is the most important factor for business success today when it comes to IT infrastructure.

A significant number demonstrate agility, with 52% of respondents businesses saying they had an IT infrastructure capable of responding to competitive threats. In addition, 60% of respondents said they could develop, test, and deploy business applications for use on mobile devices in six months – and nearly half (46%) felt that they could achieve this in one month.

However, the study revealed that businesses are less aware of how technology such as Platform-as-a-Service (PaaS) can address business challenges. These challenges include flexibly managing workloads or rapidly developing new applications.

“Businesses clearly know agility holds the key to their success, but there is an awareness gap around exactly how this agility can be realised through the right technology investments,” said Robert Shimp, group vice-president Asia at Oracle.

The study found agility had a strong impact on business competitiveness. For instance, the ability of competitors to launch customer services more rapidly was identified as the top threat by 29% of the respondents.

“The speed with which many Asian countries are adapting to digital technologies like mobile is clearly acknowledged… [However,] what this research shows is that many companies are not yet harnessing the power of PaaS solutions to further boost agility levels, and so stay ahead of the digital curve,” said Chris Chelliah, chief architect, core technology and cloud, Apac at Oracle.

Most Asean countries are still behind other Apac countries average in terms of adopting cloud technologies, said Naveen Chhabra, senior analyst, Forrester.

“In terms of cloud adoption, Asean countries fall behind Australia, China, Japan and India, due to factors such as network connectivity, services availability in the local market, business and customer maturity,” said Chhabra.

However local services providers in Asean countries are introducing services for local consumption and are bringing new cloud services in their geography,” said Chhabra. “Asean countries can leapfrog using cloud services since they have less legacy technology to content with, compared to other countries in Asia,” said Chhabra.

Steve Bingham, Advisory Leader at Ernst & Young Solutions’ Asia-Pacific, said Asean businesses are still developing their understanding and adoption of cloud computing to boost business agility.

“Many businesses recognise the benefits of cloud, including greater flexibility, performance and cost savings – but need further investment before they can use cloud services effectively.”

He said some businesses have started using a hybrid approach and experimenting with cloud offerings in their existing environments. This is occurring in the areas of “systems of engagement” such as online and CRM systems, rather than core system information, he said.

Bingham said Asean businesses need to shift their focus toward building a secure cloud environment.

“A secure cloud environment has the appropriate controls to protect the confidentiality, availability and integrity of the systems and data that resides in the cloud.”

He said an audit-ready cloud environment, which has continuous compliance and is certified to meet specific industry regulations and legislation, is essential.  “Appropriate procedural and technical protection is in place, documented and can be verified for compliance purposes.”

Read More »

HP reinforces commitment to open, hybrid cloud vision as business split looms

The move is part of the hardware giant’s much-discussed, multi-year turnaround strategy and will see responsibility for the firm’s infrastructure, software, services and cloud activities fall under the remit of new company, HP Enterprise.

The company’s consumer-focused computing and printing interests, meanwhile, will be catered for by HP Inc, once the split occurs at the start of November.

Ahead of that, Meg Whitman, who is set to become the president and CEO of HP Enterprise, has outlined the soon-to-be created company’s continued support for its parent’s hybrid cloud vision, which is covered off by the contents of its Helion product portfolio.

“Hewlett-Packard Enterprise will be smaller and more focused than HP is today, and we will have a broad and deep portfolio of businesses that will help enterprises transition to the new style of business,” she said, in HP’s 2016 financial statement.

“As a separate company, we are better positioned than ever to meet the evolving needs of our customers around the world.”

HP Helion and the hybrid cloud hype

Whitmans hybrid cloud declaration of commitment coincides with the news from HP about the general release of HP Helion CloudSystem 9.0, following its initial launch in June 2015.

The private cloud-enabling software package is geared towards helping users manage legacy, off- and on-premise workloads, and features the latest version of the HP Helion OpenStack infrastructure-as-a-service (IaaS) offering.

Users also have the added benefit of being able to tap into the platform-as-a-service (PaaS) HP Helion Development Platform, which is aimed at firms that want to develop their own cloud-native apps in-house.

Speaking to Computer Weekly about the release, Paul Morgan, Europe, Middle-East and Africa director for HP CloudSystem, said the latest iteration should help the firm capitalise on the success it’s already had with the product during its five years on the market.

“Five-and-a-half years ago we launched the cloud business unit and really recognised the value of having a dedicated unit for cloud. That’s when we launched CloudSystem and since then we’ve got 3,000 clients worldwide and the number one leadership position in private cloud,” he said.

The company’s commitment to helping users avoid supplier lock-in through its partnership with OpenStack has been a factor in this success, he added.

“What we heard from day one from customers is their concerns around vendor lock-in and the use of proprietary systems, and that’s what we’ve focused on addressing,” he added.

“Spending huge amount of time, resource and funding on something only to find it doesn’t work, and then having to write off that investment, is a huge concern for customers. So we’ve gone all-in on protecting them against that.”

Read More »

Surrey University opens 5G Innovation Centre with pioneering demos

Surrey University, alongside its technology partners and mobile operators, has opened its 5G Innovation Centre (5GIC) at its Guildford campus.

Three years in the making and backed by more than £70m of investment, 5GIC has attracted support from suppliers Fujitsu, Huawei and Samsung among others, and all four UK mobile network operators.

The centre’s objective, said director Rahim Tafazolli, is to bring together academic expertise and industry partners to define and develop the future 5G network.

Tafazolli’s team has developed technology capable of delivering speed of one terabit per second (Tbps) – more than 1,000 times faster than current 4G network speeds – and filed more than 15 patents.

“The true impact of 5G will come from the innovative applications the network will enable, some of which are yet to be realised,” said Tafazolli.

“The opening of the centre marks an important step in allowing those from across the globe to work with us in developing the network and for partners, other universities and industry to test their applications in a real-world setting before they are brought to market.

“The ethos of the centre is not built on competition, but co-operation. 5G will be achieved through global collaboration so that everyone will benefit from working to a single standard,” he added.

The 5GIC has already created a fully-functioning test-bed 4G network to further explore future networking technology. This network stretches across the university’s campus and will be open to other departments and students, as well as the 5GIC teams.

This network will be upgraded to deliver 10Gbps per cell – 10 times faster than the highest 4G speed – by 2018, and will ultimately evolve into a fully fledged 5G network.

To give an idea of its potential, Huawei demonstrated ultra-high definition (4K) video streaming to a mobile device over a mobile network enhanced with 5G radio computing architecture-based cloud radio access network (RAN) technology.

It also showed off the potential of a new radio waveform called 5G Sparse Coding Multiple Access (SCMA) to support treble the number of connected internet of things (IoT) sensors than currently possible with 4G.

Tong Wen, Huawei principal scientist and wireless chief technology officer, said: “We are committed to researching and developing future technologies that help build better connected societies, businesses and economies, and ensuring 5G is a success is essential in achieving this. The 5GIC will play an important role by helping us start testing foundational 5G technologies as early as possible.”

Read more about 5G research and development

Read More »

Organisations in Asean countries adopt hybrid cloud approach

Asia-Pacific (Apac) organisations are increasingly moving applications to the cloud, adopting a hybrid cloud approach, with no sign of the trend abating. The same trend is prevalent among Association of Southeast Asian Nations (Asean) countries – although their adoption of cloud deployment lags behind that of Asian countries as a whole.

Enterprises in Asia are increasingly embracing a cloud-first approach, according to F5’s The State of Application Delivery in Apac 2015, which surveyed 3,200 IT decision-makers across the Apac region.

About half (45%) currently deploy 1-200 applications in the cloud, while almost 10% of organisations deploy more than 3,000 applications. The study showed that at least 41% of IT decision-makers are open to moving up to 24% of their applications to the cloud by 2016, while almost 24% are keen to move between 25-50%.

“As applications continue to be a critical part of the business strategy, organisations are seeking the same confidence level in cloud deployments that they’ve seen in the data centre,” said Emmanuel Bonnassie, senior vice-president, Asia Pacific, at F5 Networks.

Sandeep Bazaz, industry analyst for ICT at Frost & Sullivan Asia Pacific, agreed that organisations in Asean countries are going through a similar cloud adoption trends, albeit at a lower level.

“Cloud computing adoption in Asean is low, when compared to mature economies in Asia, but adoption levels are almost similar with other developing economies in Asia,” said Bazaz. “However, cloud adoption is quite fast in more mature markets like Singapore.”

"These findings suggest a growing hybrid environment across the region, with a mix of on premise and off premises solutions increasingly being adopted by enterprises,” said Bonnassie.

Some 29% of organisations in the survey attributed slow adoption to a failure to identify a comprehensive identity and access management policy. A total of 35% admitted the lack of internal knowledge as an impediment to adoption.

Bazaz agreed Asian organisations are adopting a hybrid approach to cloud adoption, using a mix of on-premise and off-premise systems, with most large enterprises in the Asean area going with private cloud deployments.

“Most of the enterprises are concerned about the security and privacy of their critical data. Hybrid cloud gives the option to use private cloud for critical applications and use public cloud for less critical applications. Hybrid cloud also allows enterprise applications to burst into public cloud, when the demand for computing spikes,” said Bazaz.

The survey also revealed that security is top priority for Asia-Pacific organisations, outranking the importance of availability and performance when it comes to applications, where 42% of survey respondents believe that application services cannot be deployed without security. Yet, a further quarter had no plans to deploy DDoS protection.

Read More »

School kids would rather study coding than a foreign language, says Ocado

More than 70% of children would rather learn to program a robot than to speak a foreign language, according to research by Ocado.

The online supermarket found most parents would also prefer their primary school children to learn coding than French.

“Writing software is an amazingly exciting and creative discipline. You start with a blank canvas and then, step by step, you create something that can solve a problem, play a game, or control a robot,” said Ocado director of technology Paul Clarke.

“Seeing what you have created actually do something, and knowing that it came out of your head, is incredibly satisfying.”

In part, Clarke thinks this is due to an increase in affordable computing technologies such as the Raspberry Pi, as well as the new curriculum.

Every firm is a technology firm

But like many firms with an online offering, Ocado considers itself in equal parts a retailer and a technology company, making the IT industry skills gap an important issue.

The retailer’s IT arm, Ocado Technology, recently developed a platform for running end-to-end commerce, fulfilment and logistics, which will run in the public cloud to build Ocado’s automated warehouses.

As the firm looks to grow Ocado Technology’s pool of engineers from 650 to 1,000, it is finding the IT skills gap an obstacle to recruiting the best people for the job.

“Recruiting the quality and quantity of software engineering talent continues to be a key organisation constraint for us,” said Clarke.

“Computer science needs to be treated as the serious engineering discipline it undoubtedly is, as it is also the language of the digital economy. We need all our children to not just be competent in it, but fluent.”

Computing viewed as the “easy option”

Younger children may be keen to learn to code, but once they reach secondary school more than half of students think a computer science GCSE is the “easy option”.

To combat the skills gap, Ocado proposes that computer science is made mandatory at GCSE level, just as English and maths are.

“This educational deficit, and the misconceptions regarding computer science that it reinforces, means there is a serious shortfall in the number of UK-grown quality software engineers entering industry, especially women,” said Clarke.

“So whilst we will continue to recruit in the UK as fast as we can, the seemingly inevitable recruitment shortfall is leading us to open four more nearshore development centres in mainland Europe.”

Supplementary to this campaign, the online retailer has developed Rapid Router, a free application for teaching coding, and Python, which is already used by more than 30,500 pupils and teachers.

Ocado Technology is also releasing videos to assist teachers with the delivery of the new computer science curriculum.

“Learning to code is important for children as a tool in their wider education, in their careers and as parents of the future. Mandating computer science at GSCE level would send a vital message about the importance of teaching children to code.” said Clarke.

Read more about IT skills

  • Microsoft-endorsed firm Azzure IT launches IT skills academy to teach development, customer support and consultancy in a bid to close the skills gap.
  • Despite optimism, UK businesses are still feeling effects of IT skills gap, finds CompTIA report.
Read More »

Case study: How Ebury took a cloud-first approach to delivering financial services

The financial services industry is often cited as an example of a sector that – for regulatory compliance and data protection reasons – has been slow to adopt cloud computing.

But for every rule there is an exception, and in this case it is Ebury. The London-based firm specialises in the provision of financial services to small and medium-sized enterprises and third-sector organisations, and its operations are underpinned by cloud-based apps and technologies at almost every turn.

Speaking to Computer Weekly, Ebury chief technology officer Toby Young says the company and its operations are run almost exclusively in the cloud, with the exception of a single on-premise server, which is squirrelled away in a datacentre that backs up its in-office connection to the Society for Worldwide InterBank Financial Telecommunications (Swift) payments network.

“We’re very aggressive in terms of adding value as fast as possible to our customers, and we would experience friction with them if we weren’t able to quickly make the decisions we need to or we would fail fast in terms of trying things out if we were slowed down by having to provision additional servers and on-premise hardware,” he says.

It is this kind of attitude to business agility that has shaped the firm’s cloud-first approach to IT, which has markedly accelerated since Young joined the firm a year ago.

“When I joined, we had most of our kit running in Rackspace, but there was no cloud approach at all regarding the desktop or other applications that don’t necessarily sit in the datacentre,” he says.

But it has been all change since then, with Ebury opting to leave Rackspace behind in favour of Amazon Web Services’ (AWS) vast tranche of infrastructure-as-a-service (IaaS) offerings, while making a concerted effort to use more software-as-a-service (SaaS) tools throughout its business.  

This has seen it adopt a swath of business-focused cloud apps, such as Saleforce’s customer relationship management tools, NewVoiceMedia’s telephony kit and other finance-related offerings, which its 160-strong sales team can now access through a web browser on their Chromebooks.

Read more about financial services and cloud

The latter hardware was introduced as part of an “aggressive” PC replacement campaign in the organisation, which has resulted in fewer IT support requests and helped the firm’s sales team become more upwardly mobile.

“We will move our sales around regularly, so if all they need to do their job is accessible in the browser, it makes it extremely cheap for those moves to take place,” says Young.

“We don’t have to climb under any desks and unplug anything, move phones or PCs around because we’ve focused on ensuring everything our users need, both externally and internally, are serviced through the browser.”

Countering the cloud security threat

While security concerns are often cited as a reason not to move to the cloud, Young says this setup has actually helped to simplify its data protection procedures and made it easier to keep track of where the organisation’s business information is, thanks in part to Google’s productivity tools.

“We’ve achieved huge productivity gains by not using Microsoft Word and Office. While they’re catching up with allowing users to share documents, that ability to collaborate didn’t really exist a year ago,” says Young.

“Google certainly helped us do that to a huge extent. It also means we have tight control over the information that is shared and it means it doesn’t exist on people’s hard disks any more, which is important from a security perspective.”

As previously stated, Ebury has adopted a number of SaaS applications to support the work of its sales team, and the data these generate can now be fed into Birst’s cloud-based business intelligence (BI) platform to create self-service reports for its senior executive team.

We’re acting as a partner to our customers by providing them with an instance of our systems. Its our SaaS, but delivered to them in their own separate instance Toby Young, Ebury

It also provides the Ebury team with greater data analytics capabilities, which allow it to get a more thorough view of what is going on within its customer base and business as a whole.

“There wasn’t really anything at Ebury like this a year ago, in terms of having a single place to pull all that data together. Being able to bring in all the data we have and track its progress from being an initial lead through to revenue [generation] is hugely important for our continuous improvement,” says Young.

“We’re using it to build out our capabilities in generating leads, nurturing them and retaining customers to make sure we’re addressing them to the best of their needs.”

Various other BI tools were evaluated by the company before signing the contract with Birst in November 2014, but the software’s data modelling capabilities ensured the other runners and riders were quickly discounted, says Young.

“We can do some fun stuff, such as operational and design work. It’s more than just bringing in the data and displaying it, we’re also able to do some proper modelling of it. And, against Salesforce, we can do some real cohort analysis,” he continues. “You can’t really do things like that if you just look at a flat dataset.”

Making better use of customer information was one of the drivers behind the firm’s decision to make the move over to AWS, says Young, as it meant his team would be able to make almost immediate use of the cloud giant’s range of data warehousing and management tools.

Passing on the cloud advantage

Cloud technologies have made a big difference to the way Ebury operates, and – as a result – the company is keen to help its own customers feel the benefit too, adds Young.

“We’re acting as a partner to our customers by providing them with an instance of our systems. Its our SaaS, but delivered to them in their own separate instance,” he says.

One of the key benefits of this arrangement is that it makes it easier for Ebury to do business overseas, which is important as one of the company’s major aims is to help make it easier for its own customers to expand internationally.

“It helps us because if we move into other jurisdictions that may have different data or security requirements from other regulators we can – at the flick of a switch – spin up new instances where their data is kept completely separate and secure,” Young says.

“That’s really important for us and is the backbone of where Ebury is looking to grow, as we expand in Europe and follow our supply chain into places such as China and India.”

Read More »

US State Department plans cyber security playbook

The US State Department is asking for input from information security industry experts on putting together a set of cyber security guides for a playbook to support its information security programme.

The move comes less than a year after the department’s unclassified email system was reportedly breached by state-backed hackers.

The department said the aim of the request for information (RFI) is to determine the capabilities of commercial industry to provide and maintain a cyber security playbook.

Contributions have been invited from cyber security experts, including AT&T, CenturyLink, Planet Technology, Booz Allen Hamilton and Deloitte.

“This RFI is issued solely for information and planning purposes and does not constitute a solicitation,” the department said, but added that there will eventually be a paid 1-year contract for a set of detailed playbooks.

A key element of the responses to the RFI will be information about the respondent’s capabilities that will assist the department with making a decision about how best to contract for the required products and services.

The cyber threat to critical infrastructure continues to grow and represents one of the most serious national security challenges, the RFI said.

It said the national and economic security of the US depends on the reliable functioning of the critical infrastructure in the face of such threats.

The RFI said the department is seeking to work closely with specialised cyber security experts to put in place robust policy frameworks and doctrines to clearly guide both offensive cyber operations and responses to cyber attacks.

The how-to guides are required to provide clear direction and guidance for actionable information security operation activities and will eventually be made available for use by private companies.

Deliverables must include a set of standards, methodologies, procedures and processes that align policy, business and technological approaches and “industry best practices” to address cyber risks.

The department said the topics for the cyber security playbooks should include, but are not limited to the following:

  • Physical and logical network segmentation
  • Two-factor authentication
  • Network configuration and monitoring
  • Zero client architecture
  • Cloud computing security
  • Security operations centre
  • Mobile device security
  • Dynamic system defences
  • Data encryption
  • Data-centric security
  • Micro hypervisor technology
  • Application whitelisting

The closing data for submissions in response to the RFI is 11 September 2015.

Read more about critical infrastructure cyber security

Read More »

Security Thank Tank: Business resilience should be proactive, not reactive

The rapid pace of technological change is changing the way companies do business. Technology developments such as cloud computing and the internet of things (IoT) are affecting the way organisations function for the better, but they have also had an effect on the way we, as a profession, approach security.

Business resilience – both in an IT security and a non-security context – is ultimately about keeping the business running, no matter what. By nature, it is a proactive measure, whereby plans are set to prevent things from going wrong or plans are to keep the lights on if the worst happens.

We need to understand what the critical systems and critical processes are and how they relate to each other, ensuring that if something does go wrong, we have alternative systems that can be brought in quickly. 

Business and IT are so tightly intertwined that a lack of attention to one severely affects the other. It is imperative, therefore, that IT, security and business continuity teams work together to create and test holistic plans. 

The basis for this is, of course, risk assessment to identify business-critical assets and the threats and incidents that can impair their operation. Coupled with risk assessment is incident management, encompassing identification, response, recovery and learning.

Measurements of resilience are difficult – if it breaks, then it is not resilient, but how resilient do you need to be? But there are common metrics which can be used to infer resilience. Many of these are common to both business continuity and information security – such as risk assessment process measurement, business impact analyses performed, incident management plans in place, service continuity and reconstitution, and awareness and training performed – and can be used to indicate how prepared a business is for an incident that will test its resilience.

Read more from the Computer Weekly Security Think Tank about resiliency to reduce the impact of cyber attacks

Importantly, resilience is not a one-off process or an annual task. It’s a living concept that requires updating with the business as it changes, along with testing and learning. This is where information security professionals can take the lead and engage with the business in a positive way. It presents an opportunity for information security professionals to break out of the reactive position highlighted in our most recent study from the Global Information Security Workforce.

Resilience is a proactive and forward-looking concept, and it provides a platform for information security to be seen by the business as a valued partner, rather than one that just fixes the next crisis.


Adrian Davis is managing director for Europe at (ISC)2.

Read More »

Why Pegasystems' CEO, Alan Trefler, has learned to think smaller

“When you play ping pong, you don’t really strike the ball. You’re sort of asking the ball to do something for you. What you are really trying to do is use the subtlety of spin,” says the CEO and founder of software company Pegasystems.

Spin is not something that comes naturally to Alan Trefler, who is almost as well known for his skills in table tennis and chess as he is for being a software entrepreneur.

Since he founded the software company in 1983, Pegasystems has kept a low public profile, preferring to make deals by word of mouth and personal contacts than to spend money on marketing and publicity.

Even so, the company has grown rapidly, with a turnover north of £570m, and is delivering software to some of the world’s biggest companies, including Cisco, General Motors, Barclays, Pfizer, and General Electric.

The company supplies sophisticated case management tools, which combine analytics technology with business process management (BPM) and customer relationship management (CRM) functions. It is also moving heavily into mobile and social media technology.

Organisations use Pega’s technology in a wide range of applications, from recommending the best handset upgrade for a mobile phone company customer, to controlling the refuelling of planes at Heathrow Airport, and for managing transport systems in Australian cities.

Pegasystems’ closest competitors include IBM, Software AG, Salesforce.com, Oracle, SAP and Microsoft. But US-based Appian Software is probably Pega’s nearest equivalent, according to Forrester analyst Clay Richardson. “Appian is smaller, but I  would say it competes on the same level with Pega,” he says. 

Reliant on sales expertise

To date, Pega has spent its time and energy working directly with the Fortune 500 companies that can afford its – often expensive – products.

Its strategy until now has been to hire skilled sales teams to build direct relationships with senior executives in companies with turnovers of $40m to $1bn.

“We’ve taken all of our target accounts and mapped all the products that we have ever sold them, and what’s left over is white space to us

Robert Tas, Pegasystems

“It did not do any marketing. Pretty much zero. It hired experienced sales people in specialist areas, with big contact books, and said go off and sell, and that has been very successful,” says analyst Neil Ward-Dutton at WMD Advisors.

Once inside a company, Pega’s sales teams work hard to convince other parts of the organisation that they also need Pega’s technology. 

The company has started a project, codenamed “white space”, to identify the areas where its existing customers could use Pega’s technology but don’t, says Robert Tas, Pega’s newly appointed chief marketing officer (CMO).

“We’ve taken all of our target accounts and mapped all the products that we have ever sold them, and what’s left over – say Merrill Lynch doesn't use our customer service tools – that's white space to us,” he tells Computer Weekly.

A game of two halves

But ping pong, like football, is a game of two halves. Pegasystems has now reached the point where it needs to radically rethink its business if it is to continue to grow its revenues.  

And that means developing services that will appeal to smaller companies and, in turn, making Pega tools simpler to use for companies that cannot afford large teams of Pega specialists.

In an exclusive interview with Computer Weekly, Trefler talks about his plans to “open the aperture” to smaller companies.

He is setting his sights on the world’s top 3,000 companies. They may not be as wealthy as the Fortune 500, but they are still companies with billions of dollars in turnover and complicated problems to solve.

Pegasystems founder Alan Trefler is almost as well known for his skills in table tennis and chess as he is for being a software entrepreneur

“By simplifying our user experience, by building out applications that are much richer, we can now bring that power to companies that are smaller,” he says.

Marketing boost

Tas, who joined Pega from JP Morgan Chase last year, is the driving force behind Trefler’s plan to raise Pega’s profile among smaller companies.

The CMO is making some big changes. He has overseen a redesign of Pega’s website, which has made it more business focused rather than technology focused. The site features case study videos with Pega’s customers and thought leadership pieces. 

Tas has also overseen Pega’s first print advertising and social media campaign, “Pega Can”, starting in North America, with Europe to follow this year. And the company is experimenting with live video streaming service Periscope and other social media.

“Our web traffic has more than tripled since we introduced those campaigns, and the number of people registering on our site downloading content has gone up by a similar amount,” says Trefler.

He concedes the push on marketing is long overdue: “We made a very conscious decision that we wanted to really uplift our energy on the marketing front.”

  • Ford Motor Company is using Pega to build a warranty management system for its network of 12,000 dealers worldwide, which promises to save tens of millions of dollars a year in repair costs.
  • The Royal bank of Scotland is spending over £100m in data analytics technology, from Pega and other suppliers, as it seeks to recreate levels of personal service last seen in the 1970s.
  • Mobile phone operator Everything Everywhere has claimed a 400% increase in mobile phone deals after rolling out Pega’s customer relationship management software.
  • Cisco is turning to business rules software to help it respond in a more agile way to new market opportunities, changing regulations and business practices.

Moving away from BPM

Part of Pega’s rebranding it to position itself as a digital transformation company – distancing itself from its roots as a business process management specialist.

Its competitors are following a similar strategy, according to analyst Ward-Dutton, who says businesses have been left disappointed after the early hype around BPM failed to live up to its promises.

“We are finding that while companies want BPM capability, they have become disillusioned with the whole idea because it was oversold in the past. Many organisations bought into it, but it did not deliver what was promised,” he says.

These days, Trefler talks disparagingly about BPM. Look up BPM on Google, and the first definition you get is “beats per minute”, he says. And that just about sums it up for him.

“I never really liked the BPM term because it meant too many different things to too many different people, and we’re quite happy to trade in that lexicon for really talking about working to make companies digital,” he says.

Simplifying Pega to expand its appeal

Building a wider base of customers could be a real challenge for Pega. For over 30 years the company has lived off the reputation of its brand, and its high-level contacts in banking, financial services and the retail industry.

Forrester’s Richardson says it will take some effort to educate the next tier of organisations just what Pega is all about. It isn’t, after all, an easy technology to understand.

“It is going to have a heavy lift to educate the rest of the market, where this product is coming from, and why it’s important,” he says.

Pegasystems’ three approaches to analytics

Predictive analytics: Maps historical data to predict future trends. Typical business applications include predicting what products might be of most interest to each customer, what sort of advertising might be most effective and which customers might be in danger of moving to a rival supplier.

Adaptive analytics: This approach continually tests the hypotheses used in predictive analytics, and changes the model based on the outcomes. The system will test whether the best customer offer is really better than the second best offer, by regularly substituting each offer and comparing the outcome. Adaptive analytics can also spot new trends in customer behaviour and change the prediction model automatically.

Event-driven analytics: This type of analytics monitors and responds to the behaviour of customers. For example, the technology can issue an alert if a customer types “termination fees” into a search box or posts a negative comment on social media.

Just over four years ago, the company made a strategic decision to make its software easier to use, as part of its strategy to make the technology more accessible to a wider range of companies.

“We hired several dozen people with deep backgrounds in user experience, human factors and design, and we’ve insinuated them deeply into the teams,” says Trefler.

One of the fruits of this investment is an improvement to Pega’s core software, known as Pega Express.

It can do everything that Pega 7 can do, but it is designed to make it easy for business specialists to build simple applications quickly, without the in-depth expertise Pega normally requires.

Pega for dummies, as you might call it, attracted huge interest at Pega’s customer conference this year. There were queues of IT professionals waiting for their turn with one of the 15 demonstration terminals to try the product, says Tefler. He is not exaggerating.

The software has attracted particular interest from companies in regulated industries, including, banking, finance and life sciences, he says. They are coming under pressure from regulators to replace the spreadsheets used throughout their organisations, with more robust applications.

“A lot of these companies have many applications written by the business, and are now part of the way the business runs, but are not really mature, maintained or backed up even,” he says.

For Trefler, Pega Express is a way of tempting companies that might have been wary of the technology into the Pega fold.

“It’s not a separate product, it’s a set of improvements to our development environment that guide users through the building of cases and processes, the types of things you start to need to create an application,” he says.

His hope is that companies will start using the software for simple applications at first, then, as their confidence grows, develop more sophisticated applications.

Cloud computing with a silver lining

Pega’s cloud service will play an important role in attracting new customers.

A year ago Trefler hired John Igoe, a well-known proponent of cloud technology, to develop Pega’s cloud strategy. Igoe was previously vice-president for technology at Rackspace.

The company has also invested in network operations centres in North America and India. These centres will be staffed around the clock to provide businesses with the ability to tap into Pega’s cloud services whenever they need to.

Pega may have some catching up to do, with competitors such as Appian that have been offering cloud services for longer, says Richardson. But there is a definite appetite for the cloud.

“Pega customers we talk to are looking for a model that allows them to consume, over time, what they see as valuable. They are looking to pay as you go, and I think that is what Pega is responding to,” he says.

While Pega’s on-premise business has been growing at 20% a year, revenue from Pegacloud has doubled over the past 12 months, says Trefler.

“The balance [of our business] is definitely going to move increasingly to the cloud, particularly as more and more large companies accept the cloud,” he says.

But Trefler warns that it is a mistake for companies to become dependent on the cloud. It’s only a matter of time before there is a major data breach, he says. The Ashley Madison hack serves as a warning. 

“What are the buyers going to tell their board of directors then? The thought that you would limit yourself in something as fundamental as where you run your software and where you keep your data seems to me to be a pretty big potential limitation,” he says.

Expanding the pool of Pega experts

The third plank of Pega’s strategy is to tackle a shortage of skilled Pega specialists, which has often presented an extra hurdle to organisations investing in Pega software.

Businesses can spent a lot of time training people in Pega, only to have them snapped up by other firms desperate to fill gaps in their IT teams.

Trefler created the Pega Academy in 2014 to provide online resources, classroom training and certification for systems integrators to help them train up new Pega specialists to tackle this problem.

He reels off a long list of consulting firms that have built up teams of Pega specialists through this programme. They include Accenture, Ernst & Young and Cognizant.

Wipro has built a Pega campus in India, and smaller companies, such as Virtusa, have also built up specialist teams.

Read more about Pegasystems

At the same time, Pega has steadily wound down its own consulting operations so that it is not seen to be competing directly against its new partners.

“Our software licence revenues have been growing at well over 20% a year and our services business has been in the mid-single digits, in the 5% sort of range. That’s evidence that we’re looking to support this ecosystem with our partners,” he says.

To date, there are more than 15,000 trained and certified Pega specialists, only 650 of whom work at Pega. But Trefler says this is only the start.

“As the business grows, there’s going to be a continued need and desire to build this ecosystem out many times more. I’d love to see 100,000 in the ecosystem, up from the 15,000 that exist now,” he says.

This strategy is beginning to pay off, with big companies reporting fewer difficulties in finding senior Pega specialists, say industry watchers.

According to analyst group Forrester, Pega has now got one of the best partner networks in business. A Forrester study found that major systems integrators such as Tata, Wipro and Infosys had built larger teams of specialists with Pega than with their other business partners.

“Last year, for example, Pega ran a major training workshop in Hyderabad, where it trained up thousands of their partners and developers in one go,” says Forrester’s Richardson.

Companies outside the Fortune 500, however, may still find it challenging to train and retain their own Pega specialists.

WMD Advisors’ Ward-Dutton says: “What I have been picking up is there is much more in availability of Pega resources. But for big projects, you need really senior experienced Pega people and they are expensive.”

Trefler is “no Richard Branson”

There are signs that too Trefler is loosening the reins on the company. He says he no longer meets every new recruit or every new client in person.

He has recently handed responsibility for Pega’s future direction to the marketing department, rather than Pega’s engineering team, for example.

That is a big step for a man who is hands-on when it comes to technology, and loves nothing better than to discuss the intimate details of software engineering.

Trefler insists he has no desire to be seen as a Richard Branson-type figurehead. “I  have no plans to fly Migs or race boats,” he says.

In fact, Trefler has brought new people in to work alongside him. Alongside Robert Tas, he has hired Raef Brown from Salesforce.com as chief financial officer, and Anne Warner from Alexion Pharmaceuticals as general counsel.

These additions to the board will be welcomed by analysts, who feel that Pega needs to be seen a less of a one-man company if it is reach the next phase in its growth.

Trefler himself says: “We’ve moved a long way past where I could sign off with all the hiring or I could meet every client in person, though I do relish those days in some ways.”

But with the CEO and founder controlling over half the shares of Pega, Trefler will inevitably find it difficult to pull back completely.

“It’s really hard if you are 52% owner. It is hard not to have a loud voice [when] a lot of your value is in the company. Even if you try to have a flatter structure,” says Richardson.

Controlled globalisation

There have been concerns that Pega may be too tightly controlled from the US, at a time when over half of Pega’s customers are in Europe and Asia.

Trefler, for his part, agrees that the company needs to think globally. Yet he warns that there is a greater danger in the company “balkanising” itself into local firms if the countries are given too much autonomy.

“To my mind, it’s not about letting some country go off and do it their way for a year or two – that will make my global customers wonder what’s going on,” he says.

Control, he says, should be centred around the customer. Pega hires business officers to make sure that contracts comply with local laws, while at the same time keeping service consistent, he says.

“Those business officers have a great deal of latitude in terms of how they frame the deals, but they know they have a responsibility to make sure they talk to each other and that there’s a community of them keeping things as if we were one company,” he says.

Strategic acquisitions

It is hard to keep Trefler from talking about one of his pet topics – “Frankenstacks”.

He has never approved of companies, like IBM, which buy IT companies and bolt their technology together to create an IT platform that looks good on the outside but is made up of a patchwork of software underneath. They are the Mary Shelleys of the software world, he suggests.

“You get all these dead software companies, glued and sewn together, and they don't create a very good experience for their customers,” he says.

Trefler is particularly critical of rival BPM specialists that have used acquisitions to grow their revenues. He singles out Tibco, which he says had excellent technical roots, but now seems to have lost its way.

“It didn’t really keep up with building an architecture that would enable it to meet emerging client needs. So it bought a bunch of stuff. Now it is struggling because its technology is not well integrated,” he says.

Wary of Frankenstacks, Trefler was adamant that Pega had no plans buy any more companies when he last spoke to Computer Weekly, a year and a half ago. Then he snapped up MeshLabs, a text analytics and social media company, and Firefly, a specialist in collaboration technology.

“Both Mesh and Firefly were just great opportunities to bring in some excellent technology and a couple of great people. Both of them were relatively small acquisitions – they were what you describe as pre-revenue,” he says.

Pega acquisitions

Chordiant

Pega made its largest acquisition, CRM specialist Chordiant Software, in 2010. Over the past two years, it has re-written the Chordiant software to make it compatible with the Pega Architecture. The deal has helped Pega expand its operations from its traditional markets in financial services to new areas such as medical and telecommunications.

Antenna Software

Bought in October 2013, US-based Antenna Software has given Pega the capability to deploy its technology on mobile devices, including tablets and smartphones. The technology has been renamed Pega Mobile, and plays a key role in Pega’s plans for 2015.

Meshlabs Software

Pega bought India-based Meshlabs in May 2014. Meshlabs’ social media and text analytics technology has given Pega the capability of monitoring and reacting to comments made on social media, using sophisticated data analytics software.

Firefly

Acquired in June 2014, Pega has used Firefly’s collaboration technology to enable businesses to interact with customers on the web and mobile devices.

His plan is to “integrate the DNA” of these companies into Pega, rather than create Frankenstacks. This is the approach Pega took with its biggest acquisition to date, that of CRM specialist Chordiant in 2010.

“We put a tremendous amount of effort in over 18 months to completely rewrite Chordiant in the Pega architecture. So if you go to the Pega technology environment, there’s one environment that encompasses both case management processes, rules, analytics,” he says.

This time, Trefler is careful not to rule out any more acquisitions. Pega has 1,000 engineering staff, out of a total of 3,000 employees. They are focused, but they can’t cover everything. “It would be foolish to not always be looking at both the open-source community and the technical community in general for places to blend in or purchase other technology,” he says.

Ideas rock the Pega world

It has been said that Pega is not as strong at innovation as Google and other silicon valley companies because of its “don’t rock the boat” culture. But Trefler claims “there is a lot of rocking” going on in Pega.

The Google model of innovation is not all it is cracked up to be, he suggests: “I think the myth that Google staff spend 20% of their time on innovative projects has actually been punctured of late.”

A key element of our culture is that your opinions are not just respected, theyre expected

Alan Trefler, Pegasystems

Trefler says that good ideas mater more than job titles and hierarchy at Pega. “A key element of our culture is that your opinions are not just respected, they’re expected. We expect people to have strong opinions about things,” he says.

He admits to some “dynamic disagreements” with his employees. “Then it turns out they’re right. And I think that’s a good sign.”

The company encourages innovation through what Trefler describes as “an aggressive programme” of hackathons – mass gatherings of programmers and business specialists.

“We get some of the best ideas for product direction from the weird things. One of the teams in the hackathon got our Pega system running on a Raspberry Pi,” he says.

Pegasystems runs hackathons to develop product ideas

Plans for this year

Mobile will be a big part of Pega’s strategy this year, as Pega completes the integration of Antenna’s mobile software, now branded Pega Mobile.

Mobile technology is key to giving customers the ability to write Pega software that will work on any platform, from desktop computers to tablets and mobile phones.

“We’ve invested a lot and are continuing to invest to bring the Antenna technology completely into the mainstream, so Pega will be able to show the initial versions of that,” he says.

The latest Pega 7 release has a user interface which automatically scales to fit whatever device a person has. It’s a real breakthrough, says Trefler, offering a better look and feel, and, for employers, the ability to get people up to speed without as much investment in training.

Pega will build on these capabilities to offer businesses case management, customer relationship and analytics technology that will operate through any sales channel, from high street outlets to web commerce sites and mobile phone applications.

“It is very exciting and really quite unique that we have been able to take a leader in the mobile development space and integrated it so well in Pega technology,” he says.

Having this sort of mobile capability is essential if Pega wants to remain credible, says Ward-Dutton. Businesses now expect mobile capabilities, as a matter of course.

“Very often customers ask for it, and want it. They don’t always know how to use it, but they want to know it’s there and they want to know it’s possible. Many have not figured out how to use mobile yet, and are using in simple ways,” he says.

Tapping into the internet of things

Trefler believes the internet of things (IoT) offers another key opportunity for Pega.

The IoT is expected to bring significant benefits to areas such as healthcare, energy, transport and buildings. Analyst group Gartner estimates that 26 billion devices will be connected to the internet by 2020 – one for every person then on the planet.

The internet of things is a little bit like mobility in that it’s going to become seamlessly integrated into every aspect of life, says Trefler. “It’s going to become part of everything.”

As the IoT takes off, organisations will need some way of managing their internet-connected devices, and Pega’s software can act as an intelligent hub to manage and analyse data from online devices.

For example, Pega is working with GM OnStar in China and North America on a safety system that will automatically call for help if a car is involved in an accident.

If an airbag activates, for example, the car will report the incident into a Pega case management system, which will automatically phone the driver to check they are okay. The system can also alert the police and arrange for a rental car, if necessary.

Pega also sees opportunities in healthcare, from remote monitoring of patients with serious medical conditions to sending people reminders to take their medication.

“We do a lot of work around making sure that the care for people with chronic illnesses like diabetes or heart disease is properly managed and monitored,” says Trefler.

On an industrial scale, Pega is working on a project to use drones to remotely inspect pipelines. Product maintenance is another application, offering the potential for devices that alert the manufacturer or an engineer when they develop a fault.

And then there will be real-time selling – delivering advertising and offers to people’s mobile phones based on their location and interests.

“I don’t think the internet of things is a separate thing. It’s just the next step in the evolution of what digital needs to be,” says Trefler.

Industry watchers are in no doubt that Pega has a strong opportunity to benefit as the internet of things takes off, but Pega’s technology is not quite there yet, says Ward-Dutton. “I don’t think it has a product that lends itself to that in an elegant way. It is probably doing some work behind the scenes,” he says.

Taking simplicity further

Pega has taken a clever approach with Pega Express by making its software more user friendly without losing any of the sophistication of the technology.

Ultimately, however, Pega may have to grasp the nettle, and make simpler versions of its products. And that means removing features, rather than adding them, particularly in Pega Cloud – a difficult challenge for an engineering company.

“They need to combine the shift to cloud with offering more of a service model, and simplify it, so it’s cheap to get started, easy to get started and can demonstrate value very quickly,” says Ward-Dutton.

For an engineering company, taking functions out of a product will not come easily. “The temptation for a technology-driven company is that, if you want to release a new version, you create new features and new whizz-bang stuff. If Pega wants to broaden out, it will have to take stuff out of the box,” says Ward-Dutton. “It can be done, but it will have to be brutal.”

In the future, Pega may well develop a simplified version of its technology, but chief marketing officer Tas says that is not on the agenda right now.

“I don’t say no to that in the long run, but today our goal is to deliver that high end, where we think we stand alone with our product differentiation. There are a lot of players in that small field. It’s very competitive,” he says.

Forrester’s Richardson argues that creating a “Pega-lite” will be crucial if Pega is to really appeal to smaller companies, with smaller IT teams.

There may be pressure too for Pega to simplify the way it prices its software. The company looks at multiple factors when considering what to charge its customers, but that can make it difficult to predict costs from one year to the next.

Striking a balance between technology and business

As Pega grows in scale, it is becoming clear that the company will need to become less geeky and more business focused.

Trefler, who loves to talk in great technical depth about the capabilities of Pega, faces the same challenge personally. He has been known, on more than one occasion, to draw diagrams of a “situational layer cake” on napkins over dinner with clients, as he seeks to explain the inner workings of Pega’s rules engine.

“When Trefler gets on stage he is very techie, and talks in very technical terms. That scares the hell out of people. It’s certainly not a business pitch,” says Ward-Dutton.

Pega’s chief marketing officer agrees the company needs to become better at communicating with non-technical business people. He says, only half joking, that Trefler didn’t mention cakes once in his speech at Pega’s annual customer conference this year.

“I don’t think I can ever take ‘situational layer cake’ out of Pega, nor would I want to, but I do want to put the business into Pega,” says Tas.

That means talking more to chief marketing officers, chief risk officers, chief sales officers and customer experience people in a language they can understand.

Trefler’s plan of action

For Trefler, there are three priorities over the next year.

The first is to focus on delivering the next generation of customer relationship management technology – dubbed CRM Evolved – which uses sophisticated analytics technology to predict customer needs.

The technology will allow businesses to interact with customers through call centres, in stores, through the web, tables and mobile phones – an “omni-channel experience”, says Trefler.

Next on his list is the task of raising Pega’s profile through better marketing, a process that the CMO has already set about in earnest.

Trefler’s final priority is to for Pega to open up its technology to a much wider range of companies through the Pega Cloud. This should see Pega expanding its reach from the Fortune 500 companies, to the top 3,000.

“By this time next year, I hope you will tell me more people know of Pega and that when you look at our website it’s not just big companies that are using us for important things, but smaller and mid-sized companies,” he says.

Nearly half of Pega’s business now comes from outside the US and Canada.

Europe and the UK, represents the lions share of  Pega’s business, accounting for  between 35% and 40% of its sales, with the rest coming from Asia-Pacific.

With the Eurozone still struggling with stagnant growth, Pega is positioning its technology here as a way for businesses to simplify and cut costs quickly.

“We're really talking a lot about ‘Hey look, we can help you simplify operations. We can help you as we did during the 2008, 2009 downturn,’” says Trefler.

This approach has helped the company win contracts with two of the country’s largest mutual insurers, MGEN and MACIF.

“We are also seeing an interest number of the large global banks which are stressed from the need to respond to regulation, the need to do a better job of know your customer and onboarding customers,” says Trefler.

This year, Pega plans to use the Pega Cloud, to expand its services to several thousand, large and medium sized companies in Europe.

The company began its Asia operations in Australian and Singapore. It is expanding in Japan, after winning an initial contract with AIG,  and has supplied technology to some of the Japan’s leading banks and insurers.

“In Asia, I think we just scratched the surface there, and we think there's lots of opportunities in China, and in other places. But we want to be thoughtful and we want to focus our resources,” says Robert Tas, Chief Marketing Officer.  

In South America, the company has won its biggest contract in its history to date with the Brazilian insurance company Bradesco Seguros.

Eastern Europe is another growing market, but Pega plans to take it slowly and focus on specific markets, says Tas.

Most of the companies Pega works with operate across borders. There are local teams in Germany, France, Spain and Italy, and Russian speakers on the company’s payroll.

“When I think of a company like Deutsche Bank, for example, we actually actively work with them in four venues in Germany, in the UK, in North America, and Singapore,” says Trefler.

 

Read More »