Captain's Blog

Virtualization Updates

I was in San Francisco at the VMworld conference this week.  Lots of activity, good sessions, and many vendor announcements being made.    SF has a great downtown, and we had great weather there making it very enjoyable.

VMworld reminded me of the energy people using VMware products have, it was a great show this year as it was last year.  When I compare it to the 2009 RSA show, held at the same location, VMworld just felt much more active with people there to learn and create new solutions.  The VMworld show floor was always busy, even the last hour of the last day which is rare for a trade show.  

Check out the new video showcasing VMware Go, the new web-based service from VMware. VMware Go enables first-time virtualization users to fly through the ESXi setup process with just a few mouse clicks.  VMware Go was developed in partnership with VMware and Shavlik Technologies. http://www.youtube.com/watch?v=HQd6PM5TMDA  this is a new area for us as we extend our simplification models to new areas.  Go of course contains our patching technologies, for both ESXi itself and VMs running on it. Thank you to the VMware and Shavlik teams for working so hard on this release. It was a busy summer. This our 2nd partnership with VMware, the other one is with the UpdateManager with also uses our patching technology.

(infomercial)

The team at Shavlik has announced this week that we have added asset management capabilities in the Shavlik Security Suite, making it the only solution available that manages IT operations for both physical and virtual worlds, including offline virtual patches.   The Shavlik Security Suite allows organizations to apply a single process to ensure machines – physical or virtual -- are identified, secured, and managed across their lifecycle from a single viewpoint.  From patching, to AV, to VMware asset inventory to agent-less inventory scanning for physical computers.

The significant benefit of the new asset management capabilities in the Shavlik Security Suite is to leverage our agent less approach to thoroughly and dynamically discover and catalog IT assets including software assets, hardware assets, and virtual machine assets. Now organizations will be able to discover physical and virtual machines they didn’t know they had and uncover software applications they didn’t know were installed.  By consolidating this information in one Shavlik console, the organization has all the relevant information about its IT assets at its finger tips so they can make informed decisions with confidence and accuracy.  They can then take the information and filter their view in machine centric view and filter their reports using any of the collected inventory data, AV state, patch state, Compliance state and configuration state. the Suite also provide end-point security protection. All at great integrated prices. 

 The Shavlik Security Suite is in public beta today.   We encourage you to sign up for our beta program, give the products a test drive, and let us know what you think.  To join the beta program, sign up on our web site at www.shavlik.com/netchk-beta.aspx.    We look forward to your feedback. 

 The Security Suite will be generally available for public download and customer upgrades on September 29th.

Private vs Public Cloud Computing

 

Larger companies and government departments are likely to consider going to the Cloud but in a more controlled and secure fashion via a Private Cloud.  A Private Cloud has all the benefits of the Public Clouds but it is hosted inside the firewall of the company or department it is supporting.  Full control of who has access to data is maintained while all the benefits of the Cloud are realized. End-users simply buy their Cloud services from the Private Cloud and the Private Cloud treats the end-users in the same way a Cloud vendor treats its customers. An institution would need to be fairly large to get benefits from this model, however, and smaller groups that do not want to or cannot have their data leave their network can host virtualized environments that have many of the features of the Cloud without the benefits of sharing the expertise and access to scalable resources that a Cloud provider has.

 

This article features a great example of a hotel group that wants to receive the benefits of cloud computing but is not yet ready to commit to public cloud computing:

http://searchcio.techtarget.com/news/article/0,289142,sid182_gci1364027,00.html

 

Here is a link around private clounds and AWS, a likely trend.

 

The Cloud Equalizes New Product Development

Another example of how the Cloud creates greater efficiency is a software development group that wants to create a new software application for either internal or external customers.  By leveraging a Cloud provider they immediately have access to a complete server development environment with no need for IT and with modern cloud database technologies the data is stored in efficient, redundant locations. Servers are tuned and kept up to date by the Cloud provider so no further resources need to be allocated.  During the load testing phase the group can use the Cloud to run hundreds of clients, and after  the testing is completed these servers are freed up to be used in other capacities. This model is financially efficient as servers are set up instantly without the need for the business to provide space, cooling and capital equipment.  Small start ups get all the benefits of the large software providers in an instant and for a low cost, creating a game changing equalizer.

 

As the newly developed software application is rolled out to end users the Cloud provider automatically scales out the backend databases, web servers, reporting and analysis tools based on customer demand.  Without access to a cloud based environment, the development team would have to work with IT to estimate and purchase the equipment needed to scale for demand increases whereas in a Cloud model the initial backend can remain small and grow automatically when demand creates a need.  Therefore the business only spends on what is needed at any given time and does not have to foot a bill up front for equipment in anticipation of how customer demand will scale.

Whether you are a Human Resources team or a software development group, after the product has been in its market for a while low use periods have automated server count reductions and during peak load server demand is increased, providing simplified cost saving optimizations in which costs scale only with demand.  In this way the Cloud reduces the total cost of IT expenses needed to get a product in the hands of an end-user. Also, if the business decides to move to a new cloud vendor or partner offering lower costs and better support levels, migration is simple with low initiation costs.  

These are big changes and they are creating new oppurtunities at a time when technology sales are slow.

What is the future of Cloud Computing?

As the “End-User Computing Revolution” enters its 25^th year of empowering users, the next phase will be dominated by Cloud Computing (http://www.newsweek.com/id/166738/page/1) together with the “always available” clients such as the Netbook (http://www.wired.com/gadgetlab/2008/09/netbooks-evolvi/ )  and SmartPhones (http://www.informationweek.com/news/mobility/showArticle.jhtml?articleID=206800816) that are providing a world in which the end-user has complete control over their client-server, web based, and computing solutions - allowing them to choose what they use, where they use it, and where they get solutions from. Each phase of the end-user revolution has created terrific efficiency gains and cost reductions for businesses in rapid fashion, moving from the mainframe to the PC, from the PC to Client/Server, to the Web and now to the Cloud.  With this phase we are seeing the many year battle between the end-user and IT nearing an end and IT will either evolve by becoming a strategic partner with its customers or be relegated to the occasional helpdesk call.   As a professional life long IT peson this is a good wake up call for me.

 

The power and business benefits of Cloud Computing are very clear to me after observing the early days of the PC revolution during my stint at Microsoft® and running a business focused on operational simplification since then. The Cloud is the next natural step for the industry because it enables the end user to simplifiy the typically complex nature of working with IT.  The ability of the Cloud to solve the challenge of allowing end users to fully leverage the benefits of technology while lowering costs to the business is a game changer and one that all of IT needs to be aware of in order to not only prosper but to survive.

 

A Break From Dependence On IT To Solve a Business Problem

The biggest change the Cloud provides is that the end-user or the consumer can now simply select the type of IT service they want much in the same way you might purchase a book from Amazon.com.  Whether it is a wiki, e-mail, or custom program, the end-user does not have to worry about involving IT to scope the hardware and maintenance needs allowing for focus on the business problem being solved. 

 

The innovation of the Cloud opens a market where neither the end-user nor the business needs to be dependent on a specialized and trained IT department or a specific vendor.  Cloud services are easily outsourced to a Cloud provider reducing the business costs associated with maintenance, data centers, servers, compliance, backup and recovery, security, patching, virus protection, configuration management, bandwidth, and onsite support. Now instead of a business locally hosting servers in a controlled server room where their capacity is often not fully used, the Cloud provider can reduce the total server count, end users are always running the latest configuration and if something does break or the business wants to roll out a new version, the Cloud provider updates a desktop image for the end-users who need it.

 

By choosing a Cloud provider, the end-user no longer has to worry about lining up IT to scope the hardware needs, buy servers, set up a web server and database, and provide the on-going maintenance including patching, security, backup and recovery, and product upgrades.  In minutes the business can have their software running on all devices at the company without the need for a large capital expense. The business takes on a services contract but no longer has to worry about keeping IT staff expertise current or keeping multiple IT expertise in house for different systems, less is needed for budgeting for energy and hardware costs, and productivity is shorten when months are no longer needed spent scoping, purchasing and setting up equipment.

 

The Cloud can simplify legacy client server systems in stable production by consolidating the use of servers not operating to full capacity. It can help internal departments, like Human Resources (HR); roll out software tools such as employee review software, without the need for internal IT involvement and allows an HR team to own the entire process.  The only consideration for the business is to assure that the selected vendor has valid security processes and to keep an on-going watch to assure that the security is managed.

 

See Christina Torode’s latest article on this topic, Latest cloud computing trend: End users buying IT as a Service, at

 http://searchcio.techtarget.com/news/article/0,289142,sid182_gci1363151,00.html?track=NL-981&ad=717499&asrc=EM_USC_8855174&uid=5982925#

Blackhat

Microsoft and Cisco are Platinum sponsers of Blackhat.

That is pretty big corporate sponsership, part of MS' and Cisco's plans to take over the security markets I guess, by going to the heart of those creating the new trends in security software.  Too bad for Blackhat, it sounds like its becoming just another watered down corporate event, which is fine but there are plenty of those already. (RSA, CSI, SANS and other security events).

Microsoft Tech-Ed

I took a quick trip out to Boston for the Microsoft Tech-Ed show, which was at least my 10th time to this show.

Boston is a great town and the weather was nice which made the trip even better. 

I always like going to Tech-Ed because you can spend time with the Microsoft product leadership in very direct and open ways.  They tend to be direct and give straight answers which is very useful because its real data we can use to drive our business both as an ISV or and end-user.

This year the show did not have too much in the way of 3rd party security only vendors. (Our good partners ScriptLogic and Numara had nice, and busy, booths but they sell more than security solutions.)  Tech-Ed is more focused on tools and OS extensions than just security I suppose, but given all the work done for security in the world I would have expected to see more security product dedication.  We did not have a booth there this year for a number of reasons but upon reflection we should have and we will return next year if nothing else to represent the security ISVs.

It was nice to see MBSA still so widely used by Microsoft, with using continuing in MOM, SMS and of course MBSA by itself.  We worked hard with Microsoft to create that product and I wish it a long life.

Microsoft did announce its Forefront product but its not shipping for at least one year so there was not too much to really see.  It did not seem like a disruptive technology by any means and it was not the hot event of the show, in fact I did not see much interest in it for attendees and there was no buzz around it.

The new MOM seems like a good management infrastructure product and it continues to get better and grow.  Vista is Vista, nothing super new there to report on, less users running as admin and I expect many more help desk calls and somewhat better security as a result.  SMS will get a new name in its next release I learned.  Microsoft also has a bunch of other security products now, but nothing new for the show other than Forefront.

Upon reflection it was good to learn the details of the latest Microsoft workings but I did not see any great new technology areas being introduced at the show, which was a similar response I had to the Feb RSA show in SFO. 

I remember seeing the first Blackberrys at Tech-Ed a few shows ago and it was easy to see the changes they brought, or the intro of Microsoft into the Firewall world with Proxy 2.0 a while back - showing Microsoft was going to do something in the security markets.  Or seeing the wide-spread availability of wire-less networks (all completely wide open of course). I have not seen any buzz like that yet this year.

Interesting Security Ruling in Minnesota

News.com reported on an interesting ruling recently for a banking security breach in which consumer data was not misused when it was stolen (only the hardware holding the data was wanted during the crime the article says). This seems like a pretty interesting decision since it could be hard to prove misuse, and it greatly lowers the bank's risk  to exposed consumer data it would seem.  It will be interesting if this ruling changes things in the industry.

"In other words, the plaintiffs' injuries are solely the result of a perceived risk of future harm. Plaintiffs have shown no present injury or reasonably certain future injury to support damages for any alleged increased risk of harm. For these reasons, plaintiffs have failed to establish the essential element of damages. Therefore, summary judgment in favor of defendant on plaintiffs' negligence claim is warranted.

"Plaintiffs also bring a claim for breach of contract against Wells Fargo. To establish their claim, plaintiffs must show that they were damaged by the alleged breach. For all of the reasons discussed above, plaintiffs have failed to establish damages. Therefore, summary judgment in favor of defendant on plaintiffs' breach of contract claim is warranted."

Software Engineer - best job in America

Josie from our marketing team let me know that Money Mag rates s/w engineering as best job in America which is good news for the post 2001 crash tech industry.

Kirby Puckett - a sad note

Being from Minnesota I cannot help but be a Kirby Puckett fan and it is sad to see that he has died at 45  Reggie White died at the age of 43 about one year ago (I am from Green Bay originally) which is also sad.  Kirby gave us two World Series titles and Reggie a Super Bowl.

Both had great Hall of Fame careers and made small market teams great, while they were always thinking of the fans of the sports there played.

Nothing to do with security...

Network Admins are responsible for security in today's world

Computer world has an article out about a major security breach they believed is caused by untrained admins. ComputerWorld Article

The problem may have been caused by a combination of not enough training and not using the right security products and measures.  Such a problem is not unique to universities.

"According to a university source close to the incident who requested anonymity, the server in question was under the control of an individual who was not technically qualified to be a systems administrator. "

“Because we’re a university and fairly open, there are many computing fiefdoms all over the place,” often run by individuals with grant money, the source said in an e-mail. Because the university information system office has not figured out a way to manage these independently run computing environments, there can be gaps in security, he said"