WANspeak Musings - Volume III

WAN Speak Musings Volume III
Over the last months, Quocirca has been blogging for Silver Peak System s independent blog site, http://www.WANSpeak.com. Here, the blog pieces are brought together as a single report.
July 2013
Further to WAN Speak musings - Volumes I and II, more aggregated blog articles from the Quocirca team covering a range of topics.
Clive Longbottom Quocirca Ltd Tel : +44 118 948 3360 Email: Clive.Longbottom@Quocirca.com
Bob Tarzey Quocirca Ltd Tel: +44 1753 855794 Email: Bob.Tarzey@Quocirca.com
Copyright Quocirca 2013

Over the last months, Quocirca has been blogging for Silver Peak Systems independent blog site, http://www.WANSpeak.com. Here, the blog pieces are brought together as a single report. Is the role of the geek in the workplace like watching the final days of the dinosaur? And if so, 11 places for geeks
just where can this poor, threatened species go to find a conservation park suitable for them?
Broadband a game of leap frog, or just a squashed toad? Mobility How shall I love thee? Let me count the ways Dealing with your organisations near certain malware problem A Magical Trinity ask and you shall receive. Ill give you something to do thats new stop using the word innovate Core concerns about SDN The ultimate Venndor choice guide Worried about the Patriot Act? Why? Showing red RAGs to headless chickens Silicon v. Carbon: my money is on Silicon Faster financial networks need big data analysis for compliance
Letting politicians make major decisions around technology may not be a good way to do things. However, allowing vendors to squabble around what the politicians are doing just makes things several times worse. The UK is running the risk of becoming a broadband alsoran and it has no-one to blame but itself. Your mobile workforce need to be controlled but it has to be as seamless as possible. WAN speeds are becoming more important as VPN and enterprise application access needs are stressed as more employees hit the road with BYOD. You have all the protection you need in place to avoid viruses, worms, Trojans and hackers? Its highly doubtful, and different approaches are needed to avoid falling into a position of a perception of information security.
A technologists worst nightmare having to go to the business to ask for yet more money. How can this be made less of an onerous task can the business be brought on board by slight changes to how the request is messaged to them? Are you fed up of vendors stating that they will help you in your quest for innovation? Has any vendor ever defined what they mean by innovation or asked you what you mean by it? A more balanced view of mixing improvement, innovation and invention may make you a far better organisation SDN is great honestly. However, it has its downsides and for it to deliver on its promise, SDN may need to face up to some unwelcome truths, and end up as a hybrid solution somewhere along the continuum of todays intelligent, managed switches and the long-term target of a completely dumb box. Are you finding it increasingly difficult to find the right vendor for a specific technology product as part of a business solution? Maybe this approach of using a Venn diagram can help you. The US Patriot Act seems to send shivers down the spines of non-US companies, fearing that they could have the US authorities poring over their data without them having any say about it. Maybe this is just a slight over-reaction? It is a common approach now to use traffic-light systems to show the overall health of a system to people green being everything is fine, amber watch out and red major problem. Doing this without adequate additional information may work against you, though.
Automation is wonderful. A computer is quite happy doing the same thing, day in, day out without suddenly losing focus and making the sort of mistakes a human tends to do. So why do we still include humans in so many steps of a process?
The speed of dealing with large financial transactions can lead to errors that cannot be easily called back. Systems are needed to help identify any issues in real time and allow for rectification and big data could be the light at the end of the tunnel.
Quocirca 2013
-2-
11 places for geeks

Weve all seen the headlines over the last year or so. The end of IT. No software. The move to cloud. It looks as if the days of the geek are numbered. The capability to dig into the bowels of technology through the use of CLIs (if you need to be told what a CLI is, you are not a geek) is disappearing as technology commoditises and dumbs down so that anyone even a <shudder>business person </shudder> can set things up and be off and running through such nannying approaches as self-service. Businesses seem to be looking for people who can understand exactly what the business does for example, being a retailer, operating in the service industries or manufacturing stuff. This is not where a geek fits such grubby commercial aspects are outside of their area of interest. No self-respecting geek would ever be found doing anything business related, or stooping to do things through an easy-to-use graphical portal. At the heart of geekdom is the striving for a more difficult way of doing things; for example, cracking an iPhone so that apps can be loaded on from the geeks own Linux -based, Raspberry Pi system running off sea water and platinum electrodes for power. Surely there is somewhere for poor geeks to live out their lives? Some form of a protected environment a reserve, say where this endangered species can stay and do useful work? Lets look at the options for geek reserves. 1. In the commercial private organisation. This can only be a short-term place for geeks. The long-term strategy is for such organisations to move to the cloud and minimise the use of in-house data centres and self-run applications. The geek will suffer a slow and agonising death here. 2. The service provider. A much better place for the geek. Service providers (along with telephony operators and many independent software vendors (ISVs)) will require techie geeks who are capable of knowing their ASCII from their ALBOW. Although technology may well continue to commoditise, these companies require people who can tweak this here, change that there and come up with something that is a few tenths of a percentage faster than it was before; something that is a cent or two cheaper than it was previously; a system that is a micron ahead of the black hat ninjas trying to break down the door. Possibly the equivalent to Valhalla for the geek: a tech fest where they can be the successful warriors. 3. Open Source land. This could well be the ultimate for geeks. Not only does open source demand technical wizardry, it also is a way of railing against the status quo. Pure open source is not Microsoft, Oracle or IBM; nor is it Verizon, SAVVIS or Salesforce.com. Open source is (slightly) subversive no up-front payments, no end-user tax, just freely available software that anyone (OK, anyone who can understand how to build a working version of the software from the various bits that are required in the open source jigsaw box) can put together. There are some small problems here, though such as earning a living to pay for the roof over your head and for food unless you are still living at home and can leave all that unnecessary capitalist stuff to the bank of mum and dad. In all seriousness, the roll for the hyper-techie is changing. Businesses need people who understand the business and can advise accordingly. Those who cannot adapt need to look outside of the business environment to those organisations that still need technical wizards there will still be places where your skills are accepted. And as for the title of this piece? If you understand it, you are probably a geek.
Quocirca 2013
-3-
Broadband a game of leap frog, or just a squashed toad?

Being old and gnarly, I remember the way that I, as a Brit, could look down my nose at the Yanks during the late 1990s as our fully integrated mobile telephone system, stretching across the whole of the European continent was so modern. It made the US approach of having to tell a provider that you were going to San Francisco from New York for a few days, and would it be OK if you could possibly use your phone while you were down there look so ancient. OK so the US has caught up now, but there do seem to be problems in both our cases of providing an internet that supports our commercial needs that may slightly echo what went before. The UK was pretty good when it came to putting in WiFi but then went all expensive on it and has been passed when it comes to how cheap it is to gain effective WiFi access in hotels or out on the streets. In the UK, expect to pay in the US, expect it to be free (and complain like mad if a hotel tries to charge). At the basic broadband level, the UK was an early adopter of fibre, rolling out mile upon mile down streets for future use. The future didnt seem to come; much of the fibre remained unused an d for more than a while, we struggled along with ageing copper from the exchange to the cabinet and from there to the home. Speeds of above 2Mb/s were pretty much unheard of, but providers tried to call it superfast broadband. Meanwhile, the likes of t he Netherlands were putting fibre in and using it and getting speeds of above 10Mb/s. Now, as the UK finally figures out the value of fibre, if only fibre to the cabinet, we are getting speeds of up to 40Mb/s and that up to is a bone of contentio n. More accurately, it is contention that is the problem. Providers are sharing data lines, and at peak periods, users are getting only a fraction of their up to speeds. Where does this leave us? Well, those countries that had little infrastructure in the past and have recently joined the European Union have been using the inward investment to improve their speeds. According to Akamai, real-world figures show that the UK has managed to climb to the dizzy heights of 6.3Mb/s, while Romania was marginally ahead on 6.4Mb/s. Other countries have chosen to carry out wholesale upgrades to their systems and are ahead even if only slightly of the UK. Ireland and Belgium are on 6.7Mb/s; Sweden on 6.8Mb/s and the Netherlands on 8.5Mb/s. The US is on 7.2Mb/s, but it is the eastern countries that are truly leaving us behind. Japan is on 10.5Mb/s, South Korea on 14.7Mb/s and Hong Kong on 54Mb/s or over 8 times as fast as the UK. Can the UK play leapfrog and be a world leader? Current activity points to a no on this 4G licences have only just been auctioned, leaving the UK in the slow lane for high-speed wireless adoption. The current roll-out of truly fast wired broadband looks like the UK will remain behind the pack and way off from the front runners for wired speeds. In a global economy, internet access and the effectiveness of it is not a local thing the UK has to be able to play with the big boys and show that it is a place to come and be at least as good as the rest of the world for connectivity and overall performance. Sure, business-to-business connectivity is relatively good, but it is the distributed workforce that provides the engine for the organisations, and the consumers that put the money into the businesses through their purchasing activities. Where the experience is poor, both will start to look elsewhere, to companies and retail outlets in other countries. We need better connectivity. The worry is that on the connectivity superhighway, the UK could be the toad hopping across the road, getting squashed by those leapfrogging along it.
Quocirca 2013
-4-
Mobility How shall I love thee? Let me count the ways

Lets do a quick calculation. How many employees do you have, rounded up to the nearest 100? What percentage of them are mobile? Have they sourced their own devices through BYOD? Do you use VPN access through to a private data centre? Hang on what has the last question got to do with all this? Lets assume that you are a middling size company with 1,000 employees. Lets also assume that f or the sake of argument, 40% of these are mobile as in they use a device to carry out work activities while outside of the office. Thats 400 people who are making demands on the corporate ITC platform at some point. Lets assume that there is a 20% concurrency therefore, 80 people are all working against your resources at the same time. What is the WAN speed in and out of your data centre? Again, lets assume that you have a decent bank balance as a company and that you have gone for a pair of load balanced, 100Mb/s leased lines, so giving a total maximum capability where both lines are working of 200Mb/s. For those 80 people, they have the capability to access 2.5Mb/s if it were to be dedicated to them alone via that VPN. Sounds great, doesnt i t? Not quite what you are likely to be getting at home (in many cases, probably around a tenth), but good enough, surely? Unfortunately, though, apart from the fact that the last mile for many of these mobile workers will be over a highly contended public link of WiFi, ADSL or 3G, there are 600 desk-bound people who will also be using those lines from inside the organisation and if you are using VoIP as well, then a whole raft of phone systems. Some of these services may be using virtual connections with dedicated bandwidth so taking that resource away from any real use even when the service the link is there for is not in use. As you can see, the amount of bandwidth available per employee or per task starts to fade away quite rapidly. Taking a 10,000 employee organisation with a single datacentre, maybe using a degree of video conferencing alongside everything else, starts to bring the available bandwidth per workload down to what an individual would have expected back in the 20th century and yet they believe that they are receiving 21st century, superfast speeds. You could just throw more money at the problem: use 1Gb/s lines or build more data centres to share the load. You could use external, co-location data centres and ensure that the owners have enough bandwidth plugged in. And yet, as the inexorable march of growth in IP traffic grows, youll still run up against a brick wall of bandwidth constraints at some point. WAN acceleration can really help instead of every packet transferring from the access device to the service platform, static content (i.e. that which doesnt change much) can be cached either at a server closer to the access device or on the access device itself. The inherent chattiness of certain traffic can be curtailed, with only the real IP needs traversing the WAN. Packets can be re-shaped to be more efficient in how data fills the pipe. Data can be deduplicated to remove the transport of the same information down the same line more than once. A modern organisation needs good WAN connectivity and its mobile workforce will be increasingly demanding that this is in place. Unmanaged use of what can be seen as very fast connections will lead to a poor end-user experience and lots of complaints through to the help desk. Get to grips with the problem as early as you can monitor usage, manage bandwidth using acceleration and ensure that everyone gets the best that your connections can truly offer.
Quocirca 2013
-5-
Dealing with your organisations near certain malware problem

The networks of Europes organisations and by extrapolation, those elsewhere are riddled with malware and the majority have been the victims of a targeted attack at some point in the recent past. That is the startling conclusion of a recent Quocirca research report titled The trouble heading for your business which is freely available here. As grim as this might sound, what it actually means is that reality is simply being accepted. In the past, security vendors pretended there was a Utopian position that could be reached, where all malware could be recognised and blocked. This was never true in the first place and it is less true today than ever. More and more zero day malware (that which has never been seen before) is being specially prepared to target individual organisations, often using polymorphism (making every instance appear as unique) and hiding malware either using encryption or by embedding it in other files (for example spreadsheets and PDFs). The European organisations Quocirca spoke to in its survey are not alone. They are in the company of some the most eminent organisations in the IT industry. Facebook, Twitter, Apple and Microsoft: have all been the focus of targeted attacks, just during February 2013. Microsoft recently admitted that During [an] investigation, we found a small number of computers, including some in our Mac business unit, [which] were infected by malicious software see here for source. Microsoft appears not to have been seriously impacted; at least if the aim of the attackers was to steal data, as it goes on to say We have no evidence of customer data being affected and our investigation is on-going. Even though Microsofts defences were penetrated, it was prepared to acknowledge this and make a statement that its customers data remained safe something many others could learn from. The story at Facebook was alike; malware did get on to its devices, but it was confident data was not stolen see here for more information. Reports about the incident at Apple are similar. Twitter had to admit to 250,000 user account details being compromised. All organisations must accept that if they become a target, it is very hard to stop determined cybercriminals or hacktivists getting malware on to their systems. What is essential is to ensure that such attacks are identified as soon as possible and that it is hard for the perpetrators to extend their attacks within the impacted networks. Security vendors are accepting this reality too. One Quocirca spoke to last week was talking about its new capability for retrospective detection. In short, when the vendor detects some deviance at one of its customers it will come and check its other customers networks for something similar. This is nothing short of an IT security vendor saying, we cannot keep your networks free of malware but we can aim to minimise the time in which new attacks are identified. Quocircas report goes on to identify a problem that many Europe organisations still have to face up to. There is an over-reliance on traditional security technology and not enough use being made of more advanced techniques. Whilst Quocirca cannot be sure of how Microsoft, Apple and Facebook are defending themselves it seems that their security posture is predicated on the fact that attacks will penetrate their defences but timely detection and multiple layers of security means the aim of these attacks can be foiled. With their high level of interaction with consumers and the need to store personal financial data, retailers and financial services organisations are some of the most concerned about the potential impacts of targeted attacks. However, no business can afford to be complacent. With the rise of hacktivism any organisation could unexpectedly become an overnight target.
Quocirca 2013
-6-

All must be prepared to invest in security measures that prepare them to respond to these increasingly sophisticated and well-targeted attacks on their employees, networks, applications and data. Those that do not face data losses, regulatory fines, damaged competiveness and, in the worst case, the collapse of their businesses.
A Magical Trinity ask and you shall receive.

In discussions with end users, Im often asked how they should put together a case for getting funding for a particular project. For example, in networking, it may be put to me in words along the lines of Hey, Id love to get a chance to try out multi-lambda fibre with MPLS to carry H.264 video traffic prioritised over data how can I get the business to stump up the money for it?. Biting back the urge to play back a recording of what has been said to me and just say Theres your problem, I would proffer the following advice: The business should have no real interest in technology. If it can get where it needs to using baked bean cans and pieces of string, it should do so. A business is not there to support or embrace technology; it is there to make money and this applies even if the organisation is a not-for-profit or a charity. No there are only three things an organisation should worry about. If you can create messages supporting your project that encompass these, then you should be closer to getting to the money. 1) Risk organisations want to lower the risks to the business (and to the board members at a personal level). If you can show how your technology can lower risk at a business level, particularly with regard to governance, regulatory and compliance (GRC), the board will listen. 2) Cost the big issue as far as many at board level are concerned. If something has an overall cost, then you are already on the losing end of the discussions. Therefore, dont use terminology such as total cost of ownership (TCO) this has connotations of an ongoing cost against the organisations bottom line. Any technology should be capable of demonstrably removing cost from the processes that it impacts this is what the business is interested in, as this adds to the bottom line. 3) Value slightly more ephemeral, but just as important. What is it the business wants to do? Your technology should help this happen, whether it is selling more of what the organisation already sells at the same or greater margin, or if it is bringing a new product or service to market at a good enough margin. So what would this mean for the project mooted in the first paragraph? Risk: By utilising quality and prioritisation of service, existing applications will not be impacted and so business services such as cyclical reporting and application availability will be maintained. Cost: The capability to carry video streams at a high level of fidelity without the video or sound going out of sync or juddering would allow more of the organisations meetings to be carried out over video conferencing, so lowering the costs of these meetings due to travel and loss of working time. Value: By using prioritisation, the technology will be more flexible to respond to the business needs as it changes its strategy to reflect what is happening in the markets, so ensuring that new business campaigns will not require lengthy planning, developing and testing at the technology level. Obviously, there will be a need to quantify some of these areas and Im not in a position to help you here. However, concentrating on these three simple areas should give anyone the needed foundation for creating a business-focused proposal as to why a technology project should be funded by the business.
Quocirca 2013
-7-

For those old enough to remember radio terminology, the three areas can be easily remembered. Just ask, and you shall RCV.
Ill give you something to do thats new stop using the word innovate
Definition of innovate verb [no object] make changes in something established, especially by introducing new methods, ideas, or products: the companys failure to diversify and innovate competitively [with object] introduce (something new, especially a product): we continue to innovate new products Ive just been at yet another event where everything seemed to hinge on innovation. Now forgive me, but this seems to be one of the most overused words (along with its variations), and Im not sure that it truly gets anyone anywhere, as the human brain gets to the point of sticking fin gers in its metaphorical ears and going blah, blah when it hears the word.. Many years back, a very large, three-letter IT vendor carried out extensive research interviews with CEOs of Global 2000 organisations. No mean feat getting any time from these people requires them to be sure that theres something at the end of it for them. The report that came out from the research showed that innovation was the thing that the majority felt was going to be the life blood of their businesses going forward; indeed, without it, they were all going to fail horrendously. My first question? Was the word innovation defined for the purposes of the research? No and it was accepted that maybe it should have been. The problem is that innovation is pretty easy to do if you just use a simple dictionary definition. Is an incremental improvement innovation? According to the definition above, it could well be, as something has changed to something already established. How about bringing something absolutely brand new to market? Maybe not, unless the innovative change here is seen as something that wasnt there now is. In marketing, is changing the colour or font of a text innovative (any marketing people reading this, please do not even think of answering ). To my mind, it is far better to provide more granularity, so that an organisation can better gauge what it should be doing, rather than aiming for this amorphous target of being innovative. So, here goes Quocircas patented guide to being better. The first stage is to evaluate existing tasks and processes and compare these to where you want the organisation to be a pretty classical gap analysis. Then break down what is required to get you where you want to be into the following areas: 1 Improve. Identify where things are not being done in the best way, and optimise so that things are being done better. Incremental changes at this level can reap huge rewards. 2 Innovate. I cant escape from the need to use innovation in the guide, but it is only one of the aspects. What is it that you are already doing that needs wholesale change? 3 Invent. What is it that you are not doing that you should be doing?
Quocirca 2013
-8-

For many, the main focus will be in area 1 improvement costs less that innovation or invention, and the immediate returns can be a lot higher. For others such as automotive, say innovation may be more of a focus. For markets such as pharmaceuticals, invention will be far more important. Such a granular approach helps in setting budgets and in helping to measure the impact of any changes. It also allows organisations to benchmark themselves as to where they are currently are they laggards having to drag themselves up to the mark through concentrating on improvements or are they leaders where they have the luxury of investing heavily in invention? Whatever, I believe that such a modified way of looking at how changes need to be made in a business is truly innovative unless, of course, it is just an improvement on what you are already doing.
Core concerns about SDN

Software defined networking (SDN) is in theory a great idea. By abstracting the control and management functions of a network from the physical boxes, the intelligence that is generally carried out through expensive operating systems and firmware held on proprietary silicon in the form of ASICs and FPGAs in individual network hardware items can be placed on commodity servers. This then ptovides a common means of dealing with network needs and leaving the switches to deal with the grunt work of actually routing the data packets as required. As I say great, in theory. The problems begin to appear when this is done in practice. On the whole SDN should be OK for the average business with an average commercial data centre. Data transmission needs can be dealt with through the virtualisation of the network and aggregated linking of available bandwidth to provide the high speed links that are required for the movement of data packets between the data plane (the part of the network still being managed by the switches) and the management and control planes (carried out by the more commodity-based servers). However put this into a major cloud or other service provider, or a carrier, and the problems start to occur. Now, performance is not only a key consideration, it is close to being THE consideration. If every packet of data has to be moved from the main data plane up to a different level and then back down again, the latency that this will create in the network will be too much for the service providers - and its customers - to bear. What is needed and what seems to be happening is more intelligence in how SDN deals with data packets. As long as a packet of data has been adequately identified, then the data plane should be able to deal with this in a straightthrough manner, without the need for the packet to be brought back into the management and control planes. Simple enough but this brings with it a raft of other possible issues. If a blackhat could spoof a packet, then there would be no intelligence in the switches to identify that the packet is bad: once designated as safe, the packet would be able to travel at will around a network. There is an obvious way around this: build intelligence into the switch so that packets can be inspected and ensured as being good while they are at the data plane. So therein lies the problem. SDN is a brilliant idea in that it separates out the data plane and the control and management planes. The problem is that the data plane has little to no intelligence. To put back the intelligence means moving some of the functions of the control and management planes down to the switch. And what do you then have? An intelligent switch pretty much like we already have from the likes of Cisco, Juniper and others. Is this an insuperable problem for SDN? No what is more likely to be the end result is a range of systems that range from the fully SDN-compliant (switches with little intelligence suited for general network use); systems that are SDN-
Quocirca 2013
-9-

lite (switches that use SDN as an overarching management and control system, but with a degree of intelligence built-in to the switch used for core networking in general commercial use); and SDN-compatible systems (switches that are fully stand-alone in their capabilities, but that will operate as peers within an overall SDN environment, used in core networks in massively high data throughput environments). Is this totally elegant as a solution? No; but I believe that it is likely to be the best that we can expect.
The ultimate Venn-dor choice guide

A little while back, I wrote a blog that used a Venn diagram to look at how the employee, the IT department and the business needed to be in sync in order for BYOD to work in a n organisation (Venn shall we three meet again?). The use of the Venn diagram seemed to go down well, so I thought Id use it again to demonstrate a different area of concern to an organisation how it chooses its IT suppliers. Having just returned from a trip to listen to a major IT vendor discussing how its research had shown that organisations were now looking for no more than five vendors on any IT procurement list. This can be a problem particularly where an organisation wants to make sure that all bases are covered and that best-of-breed is still an option. However, to avoid finger-pointing between vendors when something does go wrong and the costs associated with managing many multiple different contracts, it is important to minimise the number of vendors used in any IT platform. For example, if we look at procurement in data centre, we now have four major trends in how software may impact hardware purchase decisions: software defined computing, storage and networks, leading to a software defined data centre. In the post Will SDN+SDS+SDDC=SDC?, I looked at the problems of three different approaches to software abstraction possibly leading to software defined chaos a means of optimising the choice of vendors is needed so as to avoid such chaos.
Quocirca 2013
- 10 -

The Venn diagram above should help buyers with this. The three inner circles show the components required to create an IT platform; servers, storage and network, each with their own software abstraction layer. The outer circle brings in the concept of private cloud computing, which if abstracted through the use of software defined data centre concepts should lead to the capability for interoperability across hybrid cloud (private plus public) deployments. The trick then is to position your choice of vendors on the diagram. For example, vendor A may be a pure -play vendor with nothing but storage, so it would go into the Storage circle. Vendor B may be a pure play network vendor so it goes into the Networks circle. Vendor C may have both server and network capability, so it goes into the overlap between Servers and Networks. By laying out the various vendor options in this way, you can then optimise the vendor choice, bringing the number of requirements down through using the overlaps carefully. However, even if a vendor fits into the triple overlap, it does not necessarily mean that you have found the ultimate answer there still may be some point functional solutions required. The diagram can still help here: if the vendor that crosses over all three areas is weaker in its approach to, say networks, position it more to the server and storage side of the central overlap, and then identify a vendor in the networks circle that helps to move the overall solution towards the centre. Provided that the vendor community follows the basic concepts of the software defined world, pushing for a good enough level of standards (see another post on the possible issues here If you wait long enough, the one you want may come along), the optimised choice of vendors will then provide a platform where the three levels of software abstraction software defined computing, storage and networking will all come together to provide a platform that will be flexible, manageable and responsive as a software defined data centre.
Worried about the Patriot Act? Why?

In my discussions with end-user organisations around the world, the USA Patriot act often comes up as a worry for organisations when it comes to data security in a cloud world. The act, initially signed off by George W Bush in 2001, is better looked at as its full name the Uniting and Strengthening of America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act. Quit a mouthful. However, note what the Act is there for. It is not to go out and wilfully get business information: it is there as part of the reaction to the 9/11 terrorist attacks on the US. The Act, however, has got some sections that worries many in the data security space. For example, it enables certain security forces to enter business premises and search through records physical or electronic without the agreement or even knowledge of the business owner. This has then been extrapolated to it being the case that data that is held on storage systems held within a data centre that is owned by a US incorporated company could fall under these rules. So, even though the data centre is physically in the UK, as the organisation owning it is a US company, then the FBI can demand access to all the data in that facility and the owning company will have to provide that access. Firstly, this is not what the Act says and as yet, there is no precedence to show that such access would be allowed on another sovereign countrys soil. Secondly, the Act is there for situations where there is distinct suspicions of terrorist links it is not there for fishing expeditions against commercial organisations and their activities. Thirdly and herein lies the statement that will always be the bone of contention what have you got to hide anyway? If all that your organisation is doing is going along on a day-by-day basis carrying out its business, does it make much
Quocirca 2013
- 11 -

difference if the FBI, the CIA or the NSA get hold of your company data? Is it likely that they will sell your strategy plans on to the competition? Are they going to take your customer details and place ads in the papers along the lines of The FBI your one-stop-shop for email contact lists? Yes, I can hear the rumblings of the comments already its alright saying that you have nothing to hide until the Powers That Be descend on you having had access to information about you that you were unaware was in the cloud, or that was incorrectly entered by someone. OK its a possibility. But as an organisation, should I be losing sleep over the Patriot Act? I doubt it. If you are reading this while wearing a tin-foil hat sitting under a reinforced table with the windows blocked out, then external data centre facilities cloud or co-locational are probably not for you. If you have deep data security worries, then it may be that you need to choose a facility that is outside of the Patriot Acts reach completely non-US owned in a non-US location. There could be one other solution Embassy storage. Here, the physical storage is placed within a specific cage in the data centre facility. Preferably, the customer owns the physical storage not the facility owner. The cage is nominated as being part of whatever country the customer is headquartered in so the storage can be deemed to be under the laws of Germany, France, the UK or whatever. The Patriot Act then doesnt reach the storage device itself unless they want to get into the sort of issues that would be involved with entering anothers sovereign terri tory of an Embassy on US soil.. This needs agreement at a governmental level. It can be done, as Quocirca is aware of a couple of companies that have managed to take this approach but it is not easy. It may just be easier to be pragmatic and not worry unless your business is a bit on the shady side?
Showing red RAGs to headless chickens

I recently met with NetEvidence, a company that provides insights into network and application performance. It provides the service through a cloud offering, and allows areas such as root cause of poor performance to be rapidly identified, and can then integrate into help desk systems such as Remedy to kick off remedial action. NetEvidence provides a role-based dashboard view that can be tuned to the requirements of different people in an organisation for example, a network engineer can focus in on what is happening at the network level, whereas a data centre person can look more at the servers. Business people can also be included, having views that are more targeted at them maybe showing how the ecommerce site is performing, or the ERP system. The dashboard works on a traffic light system green when things are OK, amber when there may be a problem and red is oops, better do something here. This red/amber/gr een (or RAG) is used by many vendors in different areas and gives a quick and easy visual means to see how things are going. But lets take an example where it may not be the best way to do things. The monitoring service is cloud -based. The main data centre is connected to the business managers office via a leased line. The leased line goes down, but the general access to the internet from the business persons office is still there. Therefore, the monitoring service is still active, but the data centre is not available. The business persons dashboard is a sea of red no ecommerce availability, no ERP, no SFA, no CRM all of these are provided via the data centre and they are not accessible. Picture for yourself what the considered response fro m said business person will be. A case of Oh, never mind. Im sure it will all get sorted? More like a very close imitation of a headless chicken as panic sets in, as pictures of money going down drains flits through that oft-unused brain.
Quocirca 2013
- 12 -

Without feedback loops, what else can be expected from a person faced with a red mist? How about if there was a capability for the techie people to input comments against what the real problem is and what is being done? So, against the red indicators would be a single textual box (maybe yellow to make it stand out, but this is possibly just a little bit too much detail for here) with This is due to a fault with connectivity to the data centre. Expected time to resolution 15 minutes. Entered by Engineer X, extension 123. End of flap. Head back in place. The business person can now toddle off and get a cup of coffee and a quick doughnut knowing that everything is under control well, at least it is in the process of being fixed. The problem is that many of these RAG systems assume too much. They expect the person looking at the system to be able to drill down through multiple levels until they get to the actual problem and then understand it. This just wont happen if the business person drilled down here and got to something that said Problem with Leased Line. No response to Ping. Packet loss 100%, it is unlikely that they would have any greater understanding than when they first looked at the dashboard, and may well be even more confused than they were before. Systems that are meant to be multi-faceted in dealing with different roles within an organisation have to be able to talk consistently to the people in their own language. This may mean that they should be actively stopped from drilling down too far.
Silicon v. Carbon: my money is on Silicon

How many headlines have you seen blaming computers for a range of problems? Bank ATMs giving out the wrong amount of money. Utility statements with a few extra zeros on the total. Finding that you are double booked on a flight. It's all the computer's fault. Except it isn't. For anyone in the UK who has watched Little Britain (or those in the US who have seen it on PBS), the problem is best shown through David Walliams' creation of the woman tapping at a keyboard for a while before saying "computer says no". A computer is a pretty unfailingly logical piece of equipment. No deus ex machina here - everything is hard wired or programmed in the way a computer operates. No amount of AI in commercial computer systems has allowed a computer to single-handedly decide that this time around, 1 + 1 will equal 3. No - computers do as they are told. Yes - they will give the "wrong" answer if they are told to do things wrongly. This can be a case of errors introduced at coding time, which means that the "wrong" answer has been hard-wired in, or it can be that it is more a case of "operator error: please replace operator". Coding errors should be picked up during testing - if an application is so complex that exhaustive testing cannot be carried out, then is there probably something wrong with the application's design. Of course, meaningful error messages could also help clarify, rather than further cloud, things. Operator error is a little bit more difficult to deal with. You could try and make sure that the operator is so completely well trained and trusted that they never make mistakes. You could weed out those who cannot realise that a result they receive has to be wrong, during job interviews. Or - and here's a different idea - you could automate things. If the main cause of errors comes from carbon based entities (I.e. the humans), then it makes sense to transfer the power to the silicon-based entities (I.e. the computers). As computers do as they are told, then as long as the code is correct, they will not make errors. Not only that, but as computer can do millions of things every second, they will do these tasks faster than a human. The end result? Happier customers; more sales; a better bottom line.
Quocirca 2013
- 13 -

OK: yes, I do remember the "fatal flaw" found in a certain CPU some years back, and the problems in some commercial off the shelf software (COSS) systems leading to erroneous calculations. Hopefully, these are now in the past - COSS worth its salt will have been tested for code quality and will have been extensively tested; on the hardware side, I haven't seen a repetition of such design errors for some time. In a battle between silicon and carbon as to lack of making process errors, my money is on silicon winning every time. This still leaves a fairly major place for humans, though. Ask a computer to make a decision based on a limited set of information assets, and it will still struggle. Get it to identify the odd one out from a series of pictures, and you'll be looking at pretty expensive software that will still make errors on a regular basis. For humans, surely this is where our skills lie? And not only the skills, but the interest. I'd certainly be far more attracted to a job where I am making informed decisions based on using my brain to weigh information in a way computers can't. There's hope for the humans as yet - just remove them from the low-end tasks and use them for dealing with the more complex issues.
Faster financial networks need big data analysis for compliance

It only takes four seconds to invest thousands of million of pounds", said Jrme Kerviel, the now -imprisoned rogue trader. While it makes me wonder whether Im in the right business, or on the right network, his and other similar stories do emphasize the very thin red line between huge success and ruinous behaviour in the financial trading world, where ultra-low latency financial networks operating at the speed of light create huge repercussions from even a single error intentional or not. A Japanese trader, who wanted to sell one share for 650,000 yen, but got the key-in sequence wrong, offered 650,000 shares for 1 yen apiece! The Tokyo Stock Exchange had to close down for several hours to unwind all the millions of purchase placements that followed. Similarly, a Lehman Brothers dealer in London 12 years ago wiped 30bn off the FTSE when he inadvertently ordered sales of shares in blue-chip companies such as BP and AstraZeneca that were 100 times larger than intended. The reaction to these and similar events has been more network controls, stricter regulation, not only in the forensics department finding out what actually happened after the catastrophic event - but also better proactive capabilities to spot and stop a disastrous deal from closing at all. Millions of high-volume trading deals are being transacted every minute across the global financial networks like BTs Radianz and Orange Business Services Flexible Trading Service. With faster speeds and more channels of electronic communication, regulators are feverishly trying to reign in trading transgressions and create more transparency. The most important acts are the US DoddFrank Wall Street Reform and Consumer Protection Act (D-F), which applies to any financial institution with operations in the USA; and EU MiFID (The Markets in Financial Instruments Directive 2004/39/EC). D-F is in on-going implementation mode (despite some delays), second generation MiFID II is a work-inprogress. Most importantly, D-F requires swap trading companies to document thoroughly any deal within 24-hours if so requested by a regulator. That documentation must include all voice, mail and chat data relating to a specific deal. Enter big data and a 3-step implementation process. The ability of big data products to handle large volumes of unstructured data is clearly the first step towards a highly scalable, near real-time monitoring of high-speed networks. The second step is developing applications that can rapidly synthesize the data and generate reports in the formats required by D-F.
Quocirca 2013
- 14 -

Compliance applications are now becoming available to investment banks, institutional investors, hedge funds etc., from companies like Headstrong, Traiana and Fonetic. However, given that the fast-approaching drop-dead D-F compliance date is set to Q1 2014, the general state of market progress in the financial institutions, and in the regulators in major markets like the UK, France and Germany is too slow. The third step is to develop applications that can spot non-compliant deals e.g. when a trader suggests on the phone or in an email that a deal is finalized over lunch i.e. outside the range of deal -monitoring systems, and the monitoring system then alerts a compliance manager. This final step is still under development and is not yet a D-F requirement, but follows logically from investments in the first two steps. Overall, there are improvements in transparency and critical analysis of trading activities on financial networks, but threats are still faced from other fast (but erroneous or malicious) information flows. On April 23rd, $130bn was temporarily wiped off the value of stocks in the S&P 500 after the Associated Press Twitter account was hacked and a false message stated that Two explosions hit the White House. Obama injured. The Dow Jones dropped 100 points in less than a minute. So today, the financial networks move 1000s of millions of pounds in few seconds; but it is misinformation and lack of real-time compliance tools that can cost investors huge sums of money.
Quocirca 2013
- 15 -
About Silver Peak Systems

Silver Peak software accelerates data between data centres, branch offices and the cloud. The companys software defined acceleration solves network quality, capacity and distance challenges to provide fast and reliable access to data anywhere in the world. Leveraging its leadership in data centre class wide area network (WAN) optimisation, Silver Peak is a key enabler for strategic IT projects like virtualisation, disaster recovery and cloud computing. Download Silver Peak software today at http://marketplace.silver-peak.com.
REPORT NOTE: This report has been written independently by Quocirca Ltd to provide an overview of the issues facing organisations seeking to maximise the effectiveness of todays dynamic workforce. The report draws on Quocircas extensive knowledge of the technology and business arenas, and provides advice on the approach that organisations should take to create a more effective and efficient environment for future growth.
About Quocirca
Quocirca is a primary research and analysis company specialising in the business impact of information technology and communications (ITC). With world-wide, native language reach, Quocirca provides in-depth insights into the views of buyers and influencers in large, mid-sized and small organisations. Its analyst team is made up of real-world practitioners with first-hand experience of ITC delivery who continuously research and track the industry and its real usage in the markets. Through researching perceptions, Quocirca uncovers the real hurdles to technology adoption the personal and political aspects of an organisations environment and the pressures of the need for demonstrable business value in any implementation. This capability to uncover and report back on the end-user perceptions in the market enables Quocirca to provide advice on the realities of technology adoption, not the promises.
Quocirca research is always pragmatic, business orientated and conducted in the context of the bigger picture. ITC has the ability to transform businesses and the processes that drive them, but often fails to do so. Quocircas mission is to help organisations improve their success rate in process enablement through better levels of understanding and the adoption of the correct technologies at the correct time. Quocirca has a pro-active primary research programme, regularly surveying users, purchasers and resellers of ITC products and services on emerging, evolving and maturing technologies. Over time, Quocirca has built a picture of long term investment trends, providing invaluable information for the whole of the ITC community. Quocirca works with global and local providers of ITC products and services to help them deliver on the promise that ITC holds for business. Quocircas clients include Oracle, IBM, CA, O2, T -Mobile, HP, Xerox, Ricoh and Symantec, along with other large and medium sized vendors, service providers and more specialist firms. Details of Quocircas work and the services it offers can be found at http://www.quocirca.com Disclaimer: This report has been written independently by Quocirca Ltd. During the preparation of this report, Quocirca may have used a number of sources for the information and views provided. Although Quocirca has attempted wherever possible to validate the information received from each vendor, Quocirca cannot be held responsible for any errors in information received in this manner. Although Quocirca has taken what steps it can to ensure that the information provided in this report is true and reflects real market conditions, Quocirca cannot take any responsibility for the ultimate reliability of the details presented. Therefore, Quocirca expressly disclaims all warranties and claims as to the validity of the data presented here, including any and all consequential losses incurred by any organisation or individual taking any action based on such data and advice. All brand and product names are recognised and acknowledged as trademarks or service marks of their respective holders.

WANspeak Musings - Volume III

Transféré par

Informations du document

Description originale:

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

WANspeak Musings - Volume III

Transféré par

Droits d'auteur :

Formats disponibles

WAN Speak Musings Volume III

Copyright Quocirca 2013