Disruptive IT
What does the Oracle-Sun news mean for enterprise CTOs?
OK, sometimes I get emotionally attached to great technology. I need to watch that, I know humans are what is important. But science is cool too, and it gets really really exciting to watch great humans create and field great technologies. That is why I have long been a fan of both Oracle and Sun. I like many other powerhouse IT companies as well… but those are the two names dominating this week’s news and it has been the topic of dozens of conversations with other CTOs since the announcement that Oracle Buys Sun.
Here is some of the significance of the announcement, in my opinion:
– This is a $7.4B purchase. Oracle would only have done this if they realized there is incredible value for IT customers in this transaction.
– The value of Sun is in far more than just intellectual property. It is in incredible thought leadership of Sun’s talented people and terrific, visionary data center experience. It is also because of the tremendous community leadership in the open source world. And of course there is the hardware production, distribution and service. And, as emphasized in the release, Java and Solaris.
– You can believe Larry Ellison when he says” The acquisition of Sun transforms the IT industry, combining
best-in-class enterprise software and mission-critical computing
systems.” He also said “Oracle will be the only
company that can engineer an integrated system – applications to disk –
where all the pieces fit and work together so customers do not have to
do it themselves. Our customers benefit as their systems integration
costs go down while system performance, reliability and security go
up.” All of this rings true.
There are some immediate steps enterprise CIOs and CTOs should do because of this announcement:
– Continue your plans to accelerate open source software into your enterprise. Move faster now. Your risk is lower than ever.
– Understand that market dynamics are going to change. Oracle is a great company that will ensure Java and Solaris and MySQL continue to improve (with backing by and leadership of the great open source software community, of course). But understand the dynamics may change the equation when it comes to software support costs.
– Move now to lock in your service and support plans for open source Solaris, MySQL, Java Composite Applications Platform Suite (CAPS) and Java Enterprise Services (JES). Lock in at today’s rates if you can. And extend today’s rates out for more years if you can.
– The leading operating system for the Oracle database is Solaris. Since Solaris is now open and since its use is growing there are huge numbers of trained administrators with mastery over Solaris. But this is a good time to re-evaluate how many trained masters you have. If you have an enterprise suport agreement with Sun it might have training options on it that you are not using. Now is the time to max out your training. Clearly this is going to pay off for your enterprise long term. And after the aquisition is complete there is a chance that if you have not locked in your training rates that some of this cost may go up.
– With this agreement, enterprises are now faced with easy choices for identity management solutions. Sun Identity Management solutions already form about 60% of the identity management stack in the enterprise-class federal space. Oracle in their fusion middleware account for much of the rest of the enterprise-grade solutions space. Accelerate your Sun Identity Management solutions. I believe, just based on personal experience, that Oracle and their policy management capabilities are best of breed, and they can already be engineered to work with open enterprise class leaders like Sun. I imagine that will be a much smoother integration in the future. Which leads to the next key point:
– While now is the time to lock in, rapidly, your Solaris, JES, MySQL support licenses, and now is the time to take advantage of any Solaris/Java training available to you, you should also agressively review the entire Oracle Fusion Middleware stack. There are some really GREAT capabilities there.
Any thoughts on any of the above?
New Command to Focus on Cybersecurity for DoD and IC
The Wall Street Journal just ran an article titled: “New Military Command to Focus on Cybersecurity.” In it they indicate “current and former officials familiar with the plans” say a new military command will be established to coordinate the defense of Pentagon computer networks and improve US offensive capabilities in cyberwar.
WSJ also reports that Defense Secretary Gates plans to announce the creation of a new military cyber command after the rollout of the White House review.
My opinion: This WSJ article seems more balanced and accurate than the article I discussed in my post “NYT wants cyber security to be a divisive issue.”
The WSJ article is in consonance with what is going on and what should be going on. I believe NSA should be formally given the lead for defending DoD/IC systems, but defense remains a team sport, and DHS should be given the lead for defending the rest of .gov networks (while still leaning on NSA/DoD/DNI as required). And all players need to work well with industry and allies in a coordinated, fast moving way.
What does this mean for enterprise technologists? For the most part it is good news. But for day to day security operations in most enterprises, the relationships you have with other organizations will remain the same as before– for now. And the current body of best practices remains in place. You still need to understand and implement and follow the Common Audit Guidelines, for example. Doing that is going to help you and will help others too.
A CTO’s views on the new Fed CTO
I’m very pleased with the pick of Aneesh Chopra as the Federal Government’s CTO. I wish I could add more context than that, and was thinking of a quick biographical sketch of Aneesh and some ideas on why this is great news. Then I read Tim O’Reilly’s post at OReilly Radar, and frankly I just totally agree with everything Tim said. Please check out his post at:
http://radar.oreilly.com/2009/04/aneesh-chopra-great-federal-cto.html
Here is an excerpt that particullarly resonated with me:
“Chopra has been focused for the past three years on the specific technology challenges of government. Industry experience does little to prepare you for the additional complexities of working within the bounds of government policy, competing constituencies, budgets that
often contain legislative mandates, regulations that may no longer be relevant but are still in force, and many other unique constraints. In his three year tenure as Secretary for Technology for the Commonwealth of Virginia, Chopra has demonstrated that he has these skills. In fact, last year, the National Association of State Chief Information Officers ranked Virginia #1 in technology management. ” Read the rest of this entry »
May I have your views on the future of IT?
If all goes well I’ll get a speaking part at the next DoDIIS Worldwide Conference at Orlando 17-21 May 2009. I love this conference. It is attended by great folks, many of whom are technologists with a deep background in a favorite mission area. The greatest systems integrators come to the conference. And the technology companies that exhibit at the conference are also great, with many demonstrating cutting edge, disruptive technologies that make for an intellectually stimulating time.
I submitted a proposal to deliver a presentation at a breakout session on megatrends in the IT world and some assessments on the future of IT. Read the rest of this entry »
You Really Have to See This: From MIT Media Lab
Words can hardly describe how neat this technology is. I’m excited and enthused for many reasons, including the potential power of this technology to help us all make better decisions and of course to bring even more fun to our lives. Watch and let your imagine go… Think of the wonderful ways we can interact with data to do good things in the world.
Other thoughts: Look for the dynamic, moving newspaper. Yet again there is more evidence that Hollywood is driving enterprise technology.
Vivek Kundra: Still the Alpha CTO and now the First Fed CIO
Today’s news on Vivek Kundra’s role in the federal space made me think of another CTO, Yuvi Kochar. Yuvi, the CTO of the Washington Post, is a great connector of CTOs who leads the informal collective of the Washington Area CTO Roundtable. Although I had heard Vivek speak a time or two, the first really deep interactions I had with
Vivek were through Yuvi’s work in service to the tech community and I much appreciate that.
For a quick update on Vivek from a CTO perspective see: Read the rest of this entry »
Open Source Databases
All indications are the next significant growth segment for open source software will be in databases. This follows the trend of open source operating systems (Open Solaris and Linux).
Additionally, MySQL can result in better reliability and more uptime, which should also be factored into your TCO calculations.
So, those are cost reasons to move to MySQL. Other, perhaps more important reasons include:
- It is easy to learn and easy to administrate
- It helps prevent vendor lock-in and companies that will try to place you over the barrel
- Security is built in and in my opinion there will continue to be fewer vulnerabilities in MySQL because of its open source model
- There are very large numbers of developers supporting MySQL, so it is easy to find highly qualified developers and administrators.
Enhancing Security and Functionality At The Same Time
Have you ever been sucked into the false debate over how much IT spending should be spent on security? I used to all the time. Some folks point to a rule of thumb that goes something like “ten percent of the IT budget should be applied to security.” That old school formula may well be part of the reason we got into the mess we are currently in. It contributes to thoughts that lead you to think security can be separated. By my way of thinking, 100% of the budget goes to security and functionality and that is the calculus.
Really, security is about ensuring information confidentiality, availability and integrity. And those constructs are totally connected to functionality of IT. I try whenever possible to use the term security and functionality in the same context just to underscore that point.
For example, the goal I continually push regarding security in the federal space is not just one dealing with security. I put it this way: “Security and functionality of all federal IT will be increased by two orders of magnitude in the next 24 months.” Putting the goal this ways also underscores that it is not security vs. functionality. Both need to increase.
This goal also cries out for the need for metrics in security and functionality. For functionality there are many customer focused survey methods that can help collect the right metrics. For security, I think one metric stands out above all others: Detected unauthorized intrusions. There are many other important metrics for other dimensions of the security problem, but that one is key. So, a goal that expects both security and functionality of federal enterprise IT to improve by two orders of magnitude will expect customer survey satisfaction to go through the roof, and will expect detected intrusions to drop significantly. If there were 50,000 detected intrusions in 2008, there should be less than 5000 in 2010.
That is a dramatic goal. What makes me think it is achievable? In part the dramatic action being put in place today in the federal space. And in part by dramatic new technologies and approaches like private clouds and thin client computing and enhanced identity management and authorization methods. But of more importance and more relevance than all of that, in my opinion, is the coordinated action and leadership underway by CIOs and CISOs and the security experts in the federal space today.
As evidence of this incredible positive action I’d like to bring your attention to a release by a Consortium of US Federal Cybersecurity Experts on Consensus Audit Guidelines. Details of this effort are at http://www.sans.org/cag/
The Consensus Audit Guidelines provide the twenty most important controls and metrics for effective cyber defense and continuous FISMA compliance. These controls and metrics include:
Critical Controls Subject to Automated Measurement and Validation:
-
Inventory of Authorized and Unauthorized Hardware.
-
Inventory of Authorized and Unauthorized Software.
-
Secure Configurations for Hardware and Software on Laptops, Workstations, and Servers.
-
Secure Configurations of Network Devices Such as Firewalls and Routers.
-
Boundary Defense
-
Maintenance and Analysis of Complete Security Audit Logs
-
Application Software Security
-
Controlled Use of Administrative Privileges
-
Controlled Access Based On Need to Know
-
Continuous Vulnerability Testing and Remediation
-
Dormant Account Monitoring and Control
-
Anti-Malware Defenses
-
Limitation and Control of Ports, Protocols and Services
-
Wireless Device Control
-
Data Leakage Protection
Additional Critical Controls (not directly supported by automated measurement and validation):
-
Secure Network Engineering
-
Red Team Exercises
-
Incident Response Capability
-
Data Recovery Capability
-
Security Skills Assessment and Training to Fill Gaps
The site at http://www.sans.org/cag provides more details on each, including detailed descriptions of the controls, how to implement them, how to measure them, and how to continuously improve them. The site also spells out the fact that this is a work in progress and processes are in place to ensure this great effort remains relevant and maximizes our ability to protect ourselves.
What should CTOs think about this guidance? As for me, I most strongly endorse it. In my mind the appropriate implementation of these controls will reduce unauthorized intrusions in any enterprise.
The deeply respected community leader Alan Paller said it this way:
“This is the best example of risk-based security I have ever seen,” said
Alan Paller, director of research at the SANS Institute. “The team that was
brought together represents the nation’s most complete understanding of
the risk faced by our systems. In the past cybersecurity was driven by
people who had no clue of how the attacks are carried out. They created an
illusion of security. The CAG will turn that illusion to reality.”
Please give these controls a read, and please help get them into the hands of the security and functionality professionals in your enterprise.
A Blog I Like: Haft of the Spear
Michael Tanji brings a perspective forged in years of intelligence work and a successful stint protecting information in the financial sector. He is a well published author who focuses on national security issues and is also a thought leader in the computer security domain.
At Haft of the Spear he writes primarily about technology related/enabled national security issues, which includes a heavy dose of information warfare.
Read HOTS at: http://haftofthespear.com/
Next week I write about Nicholas Carr and his Rough Type blog.
CTOvision Blog 