Vault in the Cloud

1 21 march 2011 cto forumThe Chief

TeChnologyoffiCer forum

editorialRahul Neel MaNi | [email protected]

Dataleaks …What’s at stake?

Data leakage Prevention (DlP) come in handy and play a vital role when you are contemplating an enterprise-wide strategy for safety of data. in case of murli, it wasn’t really an easy roll-out, but to believe him, it was the ‘only’ remedy to address the challenges of data theft and leak-age. not only has Drm and DlP prevented the leakage, it has also helped the company with pre-venting customer poaching (e.g. insurance customers).

As custodians of sensitive corporate information, Cios seriously need to look at these successful technologies that are not only saving sensitive data from being stolen or misused, but also safeguarding enter-prises from something that can cause loss of image.

in conversation with a few of india’s top-ranked CiSos

(Chief information Security officers) last week, some very scary and eye-opening facts came to light.

one of india’s premier telecom service providers (name undis-closed) discovered that over 400 of its employees were found mis-using the corporate data – a clear violation of data usage norms. The company issued a caution-ary warning to 49 of them and finally terminated nine employ-ees as they didn’t pay heed to the

security of data is yet to show on the ‘to-do’ list of many.

A lot of you will disagree with me and site examples of firewalls, iDS/iPS, SSl-VPn secure access type of solutions deployed in your organisations. frankly those solutions are related to network security and provide the first line of defence from external threats. When it comes to fighting internal data theft and misuse, the approach, technology and mindset needs to be totally different.

in the same series of discus-sions, murli nambiar, VP and head of information Security at reliance Capital explained how he, after a lot of internal jockeying, overcame the serious threats of data thefts and helped in reducing the number of inci-dents in an organisation that has over 25,000 employees.

Technologies like Digital rights management (Drm) and

repeated warnings. Similarly, a software and e-learning major in india nabbed six of its employees and showed them the door. Ter-rifying, isn’t it?

indeed! While enterprises face a data

deluge and there is tremendous pressure on technology organisa-tions to make the data available to large sections of the workerforce, for better decision-making, the security of stored data remains a huge concern. While storage woes were handled beautifully by the majority of enterprises, the

editor's pick28 Outsourcing Open

Source Mudra group takes the open source route to address its operations and accounting issues. The web-based application is centralised and integrated with all business processes.

2 21 MARCH 2011 cto forum The Chief


mArcH 11

Cover Story

32 | Vault In The Cloud The cloud is forming; Virtualisation adoption is rising; and SSD is steadily gaining. IndianCIOs are at the forefront of technology when it comes to managing the data deluge.

COpyrIghT, All rights reserved: reproduction in whole or in part without written permission from Nine Dot Nine Interactive pvt Ltd. is prohibited. printed and published by Kanak ghosh for Nine Dot Nine Interactive pvt Ltd, C/o Kakson house, plot printed at Silverpoint press pvt. Ltd. D- 107, MIDC, TTC Industrial Area, Nerul, Navi Mumbai- 400706

ColumnS04 | I belIeve: TrusT More IMporTanT Than Technology Active listening helped the iT department at reliance life insurance to regain the trust from its users. By Milind Sawant

56 | vIew poInT: bIg DaTa: I was rIghT agaIn By Steve dupleSSie

FeatureS16 | besT of breeD: how To presenT The IT sTory Cios need to engage the company's top brass in major presentations. By denniS Mccafferty

Please Recycle This Magazine And Remove Inserts Before

Recycling

Co

ve

r D

eSi

ge

n b

y P

c A

No

oP

co Nte Nt s theCtoForum.Com

32

3 07 MARCH 2011 cto forumThe Chief


Managing Director: Dr Pramath Raj SinhaPrinter & Publisher: Kanak Ghosh

Publishing Director: Anuradha Das Mathur

EditorialEditor-in-chief: Rahul Neel Mani

Executive Editor: Yashvendra SinghSenior Editor: Harichandan Arakali

Resident Editor (West): Minu Sirsalewala AgarwalAssistant Editor: Varun Aggarwal

dEsignSr. Creative Director: Jayan K Narayanan

Art Director: Binesh Sreedharan Associate Art Director: Anil VK

Sr. Visualiser: PC Anoop Sr. Designers: Prasanth TR, Anil T, Joffy Jose

Anoop Verma, NV Baiju, Vinod Shinde & Chander Dange Designers: Sristi Maurya, Suneesh K, Shigil N & Charu Dwivedi

Chief Photographer: Subhojit Paul Photographer: Jiten Gandhi

advisory PanElAnil Garg, CIO, Dabur

David Briskman, CIO, RanbaxyMani Mulki, CIO, Pidilite

Manish Gupta, Director, Enterprise Solutions AMEA, PepsiCo India Foods & Beverages, PepsiCo

Raghu Raman, CEO, National Intelligence Grid, Govt. of IndiaS R Mallela, Former CTO, AFL

Santrupt Misra, Director, Aditya Birla GroupSushil Prakash, Country Head, Emerging Technology-Business

Innovation Group, Tata TeleServicesVijay Sethi, VP-IS, Hero Honda Vishal Salvi, CSO, HDFC Bank

Deepak B Phatak, Subharao M Nilekani Chair Professor and Head, KReSIT, IIT - Bombay

Vijay Mehra, CIO, Cairns Energy

salEs & MarkEtingVP Sales & Marketing: Naveen Chand Singh

National Manager-Events and Special Projects: Mahantesh Godi (09880436623)

Product Manager: Rachit Kinger (9818860797)GM South: Vinodh K (09740714817)

Senior Manager Sales (South): Ashish Kumar Singh

GM North: Lalit Arun (09582262959)GM West: Sachin Mhashilkar (09920348755)

Kolkata: Jayanta Bhattacharya (09331829284)

Production & logisticsSr. GM. Operations: Shivshankar M Hiremath

Production Executive: Vilas MhatreLogistics: MP Singh, Mohd. Ansari,

Shashi Shekhar Singh

oFFicE addrEssPublished, Printed and Owned by Nine Dot Nine Interactive Pvt

Ltd. Published and printed on their behalf by Kanak Ghosh. Published at Bunglow No. 725, Sector - 1, Shirvane, Nerul

Navi Mumbai - 400706. Printed at Silver Point Press Pvt Ltd., A-403, TTC Ind. Area, Near Anthony Motors, Mahape,

Navi Mumbai-400701, District Thane.Editor: Anuradha Das Mathur

For any customer queries and assistance please contact [email protected]

This issue of CTO FORUM includes 12 pages of CSO Forum free with the magazine

www.thectoforum.com

46 | nexT horIzons:sTuxneT anD The fuTure of Malware malware in future would be web-based worms By Jeff vance

regularS

01 | eDITorIal10 | enTerprIse

rounD-up

advertisers’ index

BHARTI AIRTEL IFC SCHNEIDER 05IBM 07VODAFONE 08-09CISCO 13ACE DATA 15RIVERBED IBCMICROSOFT BC

This index is provided as an additional service.The publisher does not assume

any liabilities for errors or omissions.

50 | no holDs barreD: Dhruv sInghal, oracle InDIa’s senIor DIrecTor, sales consulTIng, shares his company’s plans around cloud computing.

50

beSt oF breeD CaSe StuDy

28 | Outsourcing Open Source Mudra group takes the open source route to address its operations and accounting functionalities.

46

28

I BelIeve

4 21 march 2011 cto forum The Chief


THe auTHor has over 15 years of rich overseas and domestic experience managing

technology infrastructure for large corporate organisations.

By MIlInd SawanT Head - IT Infra, Reliance Life Insurance Company Ltd.

currentchallenge

unavailability of communication in-frastructure made people lose faith in it services

THe one principle that i believe very strongly in, and always try to live by, is that one must always be open to listening to people and trusting them to have the best intentions. This might sound naive in the cut-throat corporate world, but when a person knows that he or she is trust-

ed and that others are depending on him, it will take a very hard heart to deliberately do something wrong.

When we learn to intelligently, not blindly, live by this principle, it gives us a chance to positively affect many people's lives by creating a sort of a chain reaction. The principle is appli-cable equally in our personal and professional lives. Since we are in the services industry, we should always be in the listening mode to deliver the desired output. my strong belief is that when you listen carefully you can deliver effectively and efficiently. By virtue of our experience we trans-form/address these dynamic needs using different technology solutions.

here’s one example: We used to have lots of complaints from our branches about the unavailability of commu-nication infrastructure, and people had lost faith in iT services. When we analysed the incident database through a series of interviews with the branch ops people, we found a pattern, and the solution was quite simple, really.

An alert mechanism that pro-actively informed branches about the outages would go a long way in winning our users’ trust again, we realised. We also added regular status updates that gave people a clear idea, in the case of an outage, of when they could expect the services back and what was being done about it.

using people and technology we have started our noC operations, which send alerts to affected branches either pro-actively or on an immediate basis. We follow up on it till the closure of the incident. Currently our noC ops has handled more than 1,000 links suc-cessfully, with many ‘customer delight’ features including billing, commis-sioning and capacity planning. The point i’m making is, people are the real assets, and technology is merely a tool to enable them to do their best. Winning their trust goes a long way in getting them to perform well.

Trust More Important Than Technology active listening helped the It department at reliance life Insurance to regain the trust from its users.

ph

ot

o B

Y j

ite

n g

an

dh

i

LETTERS

WRITE TO US: The CTOForum values your feedback. We want to know what you think about the magazine and how

to make it a better read for you. Our endeavour continues to be work in progress and your comments will go a long way in making it the preferred publication of the CIO Community.

Send your comments, compliments, complaints or questions about the magazine to [email protected]

WhaT aRE ThE aTTRIbUTES Of a gOOd CTO? WhaT aRE ThE pREREqUISITES fOR a CTO ROLE ?

I see the CTO role as that of a technology leader bridging the gap between the commercial requirements of the enterprise and the technology support of those requirements. An effective CTO should be able to guide the efficient implementation of IT strategy of the business.RichaRd WaRd, Head of Technical, WIN Plc

‘Win-Win’ is not a CliChe

“The power of this idea isn’t often as obvious to people as it should be. Just consider the following: who would like to lose? Got it?”

To read the full story go to: http://www.thectoforum.com/content/'win-win'-not-a-cliche

CTOf Connect Hubert Yoshida, Vice President & CTO, Hitachi Data Systems, provides insights into how Hitachi is transforming their data centres to stay in sync with changing business needs in a conversation with Rahul Neel Mani.http://www.thectoforum.com/content/transforming-data-centre

OpiniOn

AiyAppAn pillAi, Vice president, tAtA communicAtions

CTOforum LinkedIn groupJoin close to 700 CIOs on the CTO Forum LinkedIn group

for latest news and hot enterprise technology discussions.

Share your thoughts, participate in discussions and win

prizes for the most valuable contribution. You can join The

CTOForum group at:

www.linkedin.com/

groups?mostpopular=&gid=2580450

Some of the hot discussions on the group are:The Cloud is all air and no substance

Do you think cloud is going to die a quick death of SOA

or is it going to make big headway into the enterprise? Is

it old wine in a new bottle? What does it lack in making a

convincing case?

Its real and all about today and tomorrow.

However, you have to bring it back to a realistic service

that gives tangible benefits.

There are a great deal of 'cowboy' stories and not many

who really understand it.

—Ronald Kunneman, Director at Digitra

If you think, ‘win-win’ is a cliche, think again.

6 21 MARCH 2011 cto forum The Chief


advts.indd 54 12/22/2009 2:54:15 PMadvts.indd 54 12/22/2009 2:54:15 PMadvts.indd 54 12/22/2009 2:54:15 PM



Enterprise

Round-up

FEATURE InsIdE

Four Risks CIOs should Address

When Contracting for Cloud services Pg 12

million LinkedIn users world-wide

Tablets to Shave Off Third of PC Growth this Year Gartner has cut its forecast for the growth of PC due to competition from tablets.ThE gRowIng popularity of devices like the iPad, which recently saw its second iteration, will bring down growth of the PC industry from 15.9 percent to 10.5 percent in 2011, gartner said. The impact will be the greatest on laptops, which have been driving the growth of the PC industry by growing at 40 percent growth every year.

Consumer mobile PCs have been the dynamic growth engine of the PC market over the past five years, averag-ing annual rates of growth approaching 40 percent. for much of this period, mobile PCs remained consumers' platform of choice for bringing the internet into their

daily lives. internet access is now available through a multitude of mobile devices that allow consumers to engage in virtually all their favorite online activities with-out the need of a mobile PC.

george Shiffler, research director, gartner said, "We once thought that mobile PC growth would continue to be sustained by consumers buying second and third mobile PCs as personal devices. however, we now believe that consumers are not only likely to forgo addi-tional mobile PC buys but are also likely to extend the lifetimes of the mobile PCs they retain as they adopt mobile PC alternatives as their primary mobile device."

100dATA BRIEFInG

Illu

st

ra

tIo

n B

Y s

un

ee

sh

K

E nt E r pr i s E ro u n d - u p



According to a comScore report, by the fourth quarter of 2010, the average In-ternet user (worldwide) spent 23.1 hours per month online. While Indians surf-ers spend an average of 11.9 hours on the Internet per month, Canadians spend as high as 43.5 hours per month surfing.

QUICk ByTE On InTERnET

HP Integrates 3PAR Utility Stor-age for Cloud Computing new storage offerings optimise cloud service delivery and simplify data managementhp has announced the integration of 3PAr utility Storage across the hP Con-verged infrastructure portfolio to simplify scalable cloud computing, and intro-duced new storage solutions for virtualisation and data deduplication.

This integration enables clients to optimise cloud delivery with features like automated storage tiering to improve performance, and thin storage offerings to eliminate over-provisioning.

The combination also helps clients seeking to consolidate storage hardware and respond to explosive data growth to address both of these challenges with converged block-and-file storage on a single storage array. hP also has simplified data manage-ment with solutions built on converged storage, server and networking platforms to provide clients with unified management and a lower total cost of ownership.

“our clients tell us their journey to the cloud will be one of the most critical transitions for them this decade,” said Prakash Krishnamoorthy, Country manager, StorageWorks, hP india. “hP 3PAr utility Storage meets their demand for a new storage architecture specifically designed for iT as a Service.”

Warren Buffett, American investor, industrialist and philanthropist, who is on his maiden visit to India, said that Ajit Jain has made more money for Berkshire Hathaway than he himself has. He said that he owes the people of India an enormous amount for sending him a person like Ajit Jain.

"He (Jain) could have made a lot more money working for someone else than working for Berkshire, but he is unbe-lievably loyal and hardworking and unbelievably smart.”

THey SAId IT

WARRen BUffeTT

ph

ot

os

BY

ph

ot

os

.co

m

-Warren Buffett,

American investor,

industrialist and

philanthropist




Four Risks CIOs Should Address When Contracting for Cloud Services Cloud sourcing contracts often favour the provider.aLThough cloud offerings are rapidly maturing, the immaturity of cloud service contracting means that many contracts have structural deficits, according to gartner. gart-ner has identified four risky issues that Cios and sourcing executives should be aware of when contracting for cloud services.

"Cloud service providers will need to address these structural shortcomings to achieve wider acceptance of their standard contracts and to benefit from the economies of scale that come with that acceptance," said frank ridder, research vice president

at gartner. "Cios and sourcing executives have a duty to understand key areas of risk for their organisations."

The four risky issues for Cios, when con-tracting for cloud services include:

Cloud sourcing Contracts are not Mature for all MarketsWhen analysing cloud sourcing contracts, it is often obvious whether the cloud service provider wrote the contract with larger, more mature corporations, or the consumer side of the market, in mind. gartner also sees many

cloud-sourcing contracts that lack descriptions of cloud service providers' responsibilities and do not meet the general legal, regulatory and commercial contracting requirements of most enterprise organisations.

Contract Terms generally Favour the Vendororganisations that successfully outsource, evolve more partnership-style relationships with their vendors. Cloud service contracts do not lend themselves to such partnerships — mainly because of the high degree of con-tract standardisation — where terms are con-sistent for every customer, and service is typi-cally delivered remotely rather than locally.

An organisation needs to understand that it is one of many customers and that customisation breaks the model of indus-trialised service delivery. Cloud service contracts are currently written in very stan-dardised terms, and buying organisations need to be clear about what they can accept and what is negotiable. To manage cloud services contracts successfully, organisa-tions need to manage user expectations.

Contracts are opaque and Easily ChangedContracts from cloud service providers are not long documents. Certain clauses are not very detailed, as url links to Web pages detail additional terms and conditions. These details are often critical to the quality of service and the price (such as SlAs) for uptime or perfor-mance, service and support terms, and even the description of the core functionality of the offering. Clauses that are only fully document-ed on these Web pages can change over time; often without any prior notice.

organisations need to ensure that they understand the complete structure of their cloud sourcing contract, including the terms that are detailed outside of the main contract.

Contracts do not have Clear service CommitmentsAs the cloud services market matures, increasing numbers of cloud service provid-ers include SlAs in url documents refer-enced in their contracts and, in fewer cases, in the contract itself. usually, the cloud ser-vice providers limit their area of responsibil-ity to what is in their own network as they cannot control the public network.

GlOBAl TRACkER

14%while 14 percent of Indian organisations are currently us-ing cloud computing, 76 per-cent plan to use cloud comput-ing at least after six months.

Cloud adoption in India

so

ur

ce

: eEye 20

11 Vu

lne

ra

BIlIt

Ym

an

aG

em

en

t t

re

nD

s r

ep

or

t

Illu

st

ra

tIo

n B

Y s

un

ee

sh

K




Worlds of IT and Operational Technology Are Converging Key issues for alignment examined.

yeAR Of PaaS

all the leading enterprise software

vendors, as well as large cloud

specialists, will introduce new

platform-as-a-service (paas) offer-

ings this year, making 2011 the

year of paas, according to Gartner.

these vendors are expected to

deliver new or strongly expanded

paas service offerings and cloud-

enabled application infrastructure

products.

"By the end of 2011, the battle

for leadership in paas and the

key paas segments will engulf

the software industry," said Yefim

natis, vice president and distin-

guished analyst at Gartner. "early

consolidation of specialised paas

offerings into paas suites will also

be evident. new vendors will enter

the market through acquisitions

or in-house development. users

can expect a wave of innovation

and hype. It will be harder to find a

consistent message, standards or

clear winning vendors."

During the next five years, the

now-fragmented and uncertain

space of cloud application infra-

structure will experience rapid

growth through technical and

business innovation. large ven-

dors will grow through in-house

development, partnerships and

acquisitions, while small vendors

will grow through partnerships and

specialisation. users will be driven

into cloud computing as business

application services and advanced

platform services reach acceptable

levels of maturity.

ThE woRLds of It and operational

technology (ot) are converging, and

It leaders must manage their tran-

sition to converging, aligning and

integrating It and ot environments,

according to Gartner. analysts say the

benefits that come from managing

It and ot convergence, alignment

and integration include optimised

business processes, enhanced infor-

punjab national Bank (PnB), india's second largest public sector bank, has become the world's largest site for infosys's finacle universal Bank-ing Solution running on oracle real Application Clusters, oracle's Sun SPArC enterprise Servers and oracle Solaris.

Catering to over 60 million accounts, over 5000 branches and extension counters and managing nearly 14 terabytes of data, finacle on oracle real Application Clusters and Sun SPArC enterprise servers have helped PnB to run its bank operations

Punjab national Bank Standardises IT InfrastructureHelped improve avail-ability of PnB’s core banking solution.

FACT TICkER

mation for better decisions, reduced

costs, lower risks and shortened proj-

ect timelines.

an independent world of physical-

equipment-oriented technology is

developed, implemented and sup-

ported separately from the It groups.

For simplicity, Gartner refers to physi-

cal-equipment-oriented technology as

"operational technology" (ot).

"the relationship between the It and

ot groups needs to be managed bet-

ter, but more importantly, the nature

of the ot systems is changing, so that

the underlying technology — such as

platforms, software, security and com-

munications — is becoming more like

It systems," said Kristian steenstrup,

research vice president and Gartner fel-

low. "this gives a stronger justification

for It groups to contribute to ot soft-

ware management, creating an It and

ot alignment that could be in the form

of standards, enterprise architecture

(ea), security models, and information

and process integration."

more efficiently, securely and with zero downtime."i can proudly say that among the nationalised

banks in india, we have taken iT deployment to new heights," said Ajay misra, gm, iT, PnB. "The finacle solution on oracle real Application Clus-ters and oracle's Sun Servers has provided us with reliable technology that helps us serve our custom-ers much more efficiently. our customer satisfac-tion rate has improved drastically in the last year."

PnB reaped the following performance improvements:

- 30% increase in daily business transactions.- 100% increase in number of transactions

from delivery channels (nefT, rTgS, ATm etc.) - increased from 5 lakhs a day to 10 lakhs per day.

- growth in the number of concurrent users accessing finacleTm across branches with the ability to scale up to 35000 concurrent users

- iT optimisation resulted in a reduction of 1.5 hours daily to process day end activities (eg. inter-est run from the day's sales of fixed deposits, sav-ings account, loans etc. at a branch)

- Automation of the bank's statistics gathering mechanism, which can now be completed within 12 hours, compared to 28 hours previously.

- reduction in query response time from 30 minutes to a few minutes due to high availability of the solution

PnB's enhanced transaction processing efficien-cy enables the bank to provide its customers with on-line and real-time banking, across its urban and rural branch network across india.

This platform empowers the bank with highly scalable architecture for quick ramp-up capabili-ties to handle growing volumes for future busi-ness growth and provides flexibility for creating innovative banking products.



Best of

Breed

you've been called upon to make a major presentation to your organisation. your job is to "sell" the audience on your latest iT initiative. now what? use these

eight tips to tell your iT story in a way that engages and motivates your audience.

We feel your pain. you need to make a major presentation to your organisation – which includes everyone from your Ceo to the Cfo to the rank-and-file in all departments – to “sell” the audience on an iT initiative. or, perhaps you've been called to present to your board of directors for the first time.

you realise a long, dreary speech from the “tech boss” isn't going to get the crowd “pumped up” from the get-go. The solu-tion? Don't give a long, dreary speech, according to Peter guber.

With a proven track record in the enter-

tainment, sports, and new media industries, guber's successes are often directly tied to his command of “telling to win” during his presen-tations. in the book, Tell to Win: Connect, Per-suade, and Triumph with the hidden Power of Story (Crown Business/Available now), guber reveals that you don't have to be a hollywood hotshot to dazzle audiences with your speeches.

There are many, highly transferable qualities of winning presentations that Cios and other senior leaders can adapt for their own engage-ments. in the end, it's all about connecting by

How to Present the It storyIt is challenging for a CIO to engage his company's top brass in a major presentation. By Dennis Mccafferty

Illu

st

ra

tIo

n B

Y s

hIg

Il n

Stories emotionally transport the audiencePeter GuberCEO, Mandalay Entertainment Group

Is it Time For Bringing Your Own Technology? Pg 18

Business Analytics: Numbers and Nuance Pg 21

Have You Tested Your Strategy Lately? Pg 23 More

FeATureS INSIde



m a n ag e m e n t B E S t o f Br E E D

telling a purposeful story. “Stories emotion-ally transport the audience,” says guber, “so they don't even realise they're receiving a hidden message.”

After an extensive history of leader-ship with Columbia Pictures, Casablanca records and filmworks, Sony Pictures and other high-profile entertainment organisations, guber is now chairman/Ceo of mandalay entertainment group. films he produced or executive produced have been nominated for more than 50 oscars. (including mandalay’s The Kids Are All right, which was nominated for four oscars, including Best Picture.) guber is also owner and co-executive chairman of the nBA franchise, the golden State Warriors.

here are eight tips drawn from the book that you can use for your next big presentation:

introduce “me-to-we” techniques that transform your story into a shared experi-ence. in your “tell,” you connect to your listeners through shared frustration or pain, turning your audience into viral advocates.

All stories have a challenge, struggle and resolution. The beginning sheds light on the

challenge. The middle explains what it takes to meet the challenge. The end is a call-to-action.

humanise the numbers. When you tell the story of the people behind any “suc-cess stats” presented, you put “real” faces on the data.

Past failures can demonstrate authority/authenticity as well. if you apply lessons learned to failure through the story you tell, you convey admirable qualities of vulner-ability, humility and resilience.

listen with your ears – and eyes. listen and look to see if the audience is engaged. Are they nodding, laughing and taking notes? or are they yawning, pulling out smart phones and slumping in their chairs?

Be prepared to drop your script. Telling

purposeful stories is as much about impro-visational ability as it is about a good script. Take verbal/visual clues from the audience and remain nimble enough to shift direc-tion as needed.

Change passive listeners into active par-ticipants. Surrender control of your presen-tation to them. Allow them to “own” your topic with their input on action steps.

use “state of the heart” technology online – and offline. in doing so, you will make your story resonant, memorable, actionable and more likely to be paid for-ward by your listeners.

—This opinion was first published in CIO Insight. For

more such stories please visit www.cioinsight.com

Be prepared to drop your script. Telling purposeful stories is as much about improvisational ability as it is about a good script.

Is it time for Bringing Your own technology?Three forces are colliding that will make the 'Bring your own technology' workplace a reality. By John Parkinson

it’s time to get over the control paradigm we’ve all gotten used to and start thinking outside the box. What would it take to allow any device to connect safely and securely to our corporate networks?

most of the organisations i have worked with for the past 40 years had rules about what technology could be used at work. They spent a good deal of time and money creating or acquiring standard technologies that were supposed to be easy to secure and manage because they were: standardised; and recognisable.

Some places even went so far as to “lock down” user technolo-gies, preventing or overwriting changes made by users.With all the well-known challenges related to combating viruses and other malware—as well as the need to secure business data and make

sure that business technology wasn’t being diverted to unauthorised personal use—all this effort seemed to make sense.

occasionally, you would come across someone who didn’t want all the procurement and asset management hassle. These iT renegades would hand out cash to staff to “go and buy what you want.” But they remained in the minority, and generally still had rules about what could connect to the network and what software could run on user endpoints.

Talk to infrastructure managers (and even some security man-agers) and they’ll tell you that keeping track of all this has become a real pain. users don’t like it, and with some justification: no single configuration can be optimised for everyone. Asset manag-ers don’t like it. even vendors don’t like it -- especially in single-



B E S t o f Br E E D m a n ag e m e n t

vendor environments in which procurement is a winner-takes-all event over a period of years.

now, three forces are colliding that will make the “Bring your own Technology” workplace a reality.

The first is mobility. innovation today is focused around mobile devices, and it’s becoming hard to have, or even enforce, standards. When a phone costs as much as a laptop and only lasts about half as long, businesses aren’t going to want to give everyone their own. Also, you can’t, yet, lock down a phone, the way you can a laptop, because it has to be able to connect to open public networks. There are things that a business can do to secure and manage mobile devices, but these are, at best, stopgaps.

The second force is virtualisation. once you have separated the user’s software environment from the underlying hardware, it’s less important what that hardware is or who owns it. user technology becomes an access point to a virtualised information and application space. i still have to be able to identify and authenticate the user, but i’m now much less concerned about the device.

The final force is the rising use of contract and outsourced resources -- and of multi-business collaborative networks. it may

not be economically, or even legally, possible to dictate which technology contractors use, especially if they’re not working for you full time. Contractors won’t want to have different devices for different customers. And if they are working for an outsourcer in a different geography, you are unlikely to have much control over what technology they use.

how can we assure ourselves that nothing bad will happen when a new device shows up? how can we ensure that when information leaves one of these devices, it will remain secure?

Answer these questions -- and workable answers do exist -- and you can get out of the user-technology provisioning business, simplify asset management and let your users have the technology they really want.

—John Parkinson is the head of the Global Program Management Office

at AXIS Capital. He has been a technology executive, strategist, consultant

and author for 25 years. Send your comments to [email protected].

—This opinion was first published in CIO Insight. For more such stories

please visit www.cioinsight.com.

A new CIO has to define the present and future state of IT and strengthen governance. By Peter hiGh

the New CIo’s first steps

Duane Anderson took on his first Cio role in mid-2009 when he joined ad agency marquette group and its sister agency uSmotivation. his first steps?

focus on defining the present and future state of iT and strengthen governance in his organisation.

marquette group in Peoria, ill., is an advertis-ing agency that delivers qualified, local customers to national brands by designing integrated media strategies. its sister company, uSmotivation, focuses on incentive strategies, group travel, and creative communications.

When Duane Anderson came on board in mid-2009 as Cio serving both entities, he clearly needed to be sure to work with his new colleagues to define the present and future state. This was Anderson's first foray into the Cio role, and he was new to the industry. As a former lieutenant to Tim Stanley at harrah's entertainment, he had Il

lus

tr

at

Ion

BY

PC

an

oo

P



been exposed to a high-octane iT depart-ment, but now he was in iT's biggest chair.

Since he was new to the role and to his company, Anderson focused on steps relat-ed to defining the present and future state of iT, as well as strengthening governance.

The first step was to develop an infra-structure roadmap. As Anderson began to evaluate the iT infrastructure, he realised that the server infrastructure had grown on a need-by-need basis, rather than with the company's strategic goals and total cost of ownership in mind. This led to a very out-dated footprint that could not easily scale or be supported at a reasonable cost.

"To break this cycle, we focused an inter-nal and external team to define our server infrastructure roadmap," says Anderson. "We are now executing on key components of this plan, which includes moving tacti-cal needs [such as] email and file servers to public cloud options, and strategic needs [such as] customer applications and high availability to a blend of private cloud and on-demand utility computing."

next, Anderson focused on the needs of his colleagues outside of iT. he had joined the company after the economic malaise was in full swing, and he pushed to ensure that he was gaining strategic traction with his new business colleagues, as opposed to being viewed simply as a cost center.

"our iT-business communica-tion plan is designed to ensure alignment at the strategic, project, and day-to-day support levels, with forums that allow escalation or decision-making to happen closer to real-time when an issue is identified," says Anderson. This includes:

frequent strategic meetings with company ownership and business unit leaders to review the iT portfolio;

Project meetings that include everyone from the executive sponsor to the ultimate end-user;

Status for all iT projects communicated via weekly email and an internal portal for anyone to review.

After that, Anderson made sure that the appropriate governance was in place to manage the growing portfolio of initiatives under his purview. When he dug into the iT portfolio of projects, he found that there were too many small projects that did not align well with the company's strategy. he turned this on its head, focusing instead on fewer projects that were directly aligned with the business plans. "This has allowed us to really move the dial on strategic efforts, such as growing our revenues non-linearly with costs and greatly increasing

our customer-facing iT efforts," Anderson says.

lastly, Anderson says that prior to his arrival (and before the last economic downturn), marquette group and u.S. motivation did not manage its spend on infrastructure as well as it should have, leading to ever-increasing costs just to "keep the lights on." Anderson responded by creating a business opera-

tions function within iT. This group is responsible for tracking every external iT cost, benchmarking these costs externally, and re-bidding these costs at defined inter-vals to ensure the company is not paying too much for services. "As a fringe benefit, our business leadership has allowed us to re-invest a portion of these savings into new iT development," says Anderson.

—Peter High is president of Metis Strategy, a

boutique IT-strategy consultancy based in Wash-

ington, DC. A contributor to CIO Insight, Peter is

also the author of World Class IT: Why Businesses

Succeed When IT Triumphs, and the moderator of

the podcast, The Forum on World Class IT. He can

be reached [email protected].

—This opinion was first published in CIO Insight. For

more such stories please visit www.cioinsight.com.

53%of the adults

in india have

been victims of

mobile phone

loss or theft

10 sure fire Ways to Avoid success

in business as in life, bad ideas are ubiquitous. in life, we often get a chance to grow up, be forgiven, and learn from our mistakes, but bad ideas in business can be devastating and unrecoverable. So, when they begin to take root and start damaging morale, blocking innovation, and destroy-

ing value, you must recognize the warning signs before it’s too late and take steps to avoid the damage.

you say that you don’t have that many bad ideas; that they come from "others." Then perhaps you should review some of the follow-ing common bad ideas and attitudes that can destroy your business:

Bad ideas can be very damaging for a business. Such ideas should be nipped in the bud. Donn Dinunno





1 delegate upward: What is needed is more support from upper management. This attitude is a not so subtle way of delegating

upward. management is about planning and supporting core sys-tems and processes. it does set priorities and maintains order but what is needed is more leadership at all levels. leadership is about proactive alignment, vision, establishing ways of getting things done -- usually within the direction of upper management -- sometimes in spite of that direction.

2 Hold onto the past: great companies are built to last. Just like in investing “past performance is noT a predictor of future

success.” Companies that aren’t growing and changing are dying, maybe slowly, but dying for sure. This doesn’t mean that all change is good, but regular re-examination of values and strategies is neces-sary to keep companies alive.

3 tough love is best: Training, quality management, advertising, research and other optional budget areas should be temporarily

suspended in tough times. A company is defined by how it deals with tough situations. Almost anyone can manage the good times, but quickly eliminating the feeding mechanisms show that some company values aren’t held that strongly. in reality, it’s during tough times when “in-reaching” through training and quality programs and out-reach-ing through advertising and research become most valuable in turning those tough times around.

4 Compromise values: There are exceptions to every rule. So it’s okay if a few high-performing indi-

viduals are not held to the same level of scrutiny as the rest of the employees. Company values are not “rules” to live by. The rules are based on those values. rules can be broken, but within the culture and according to the values of the company. everyone has their own set of values, and maintaining respect for individuality is important. But, when individual values clash with company values, then individuals may have to be separated from the company to maintain corporate integrity.

5 throw money at problems: People just need to be “incentiv-ised.” instead of treating people as animals to be coaxed into

doing good work, get to know and work with people as individuals, and discover what they value. Build jobs around their core com-mitments, and pay them for the value they create. good people are more likely to stick around if you respect their values.

6 Avoid confrontation: issues with your boss (or peers) should be minimised. Confrontation doesn’t have to be, well, confron-

tational. make others aware of your concerns by calmly describing your issues and explaining the consequences of ignoring them. This is a great way of building a reputation for avoiding confrontations. face it: other people don’t see the world as you do. engaging others in a discussion of viewpoints and initiating joint problem solving can be a way of getting others to come up with your ideas as if they were their own. you just might see a little better where their values have shaped their viewpoints too to avoid bad idea no. 4.

7 rely on the experts: follow the consultant’s recommenda-tions, or worse, what the current magazine article outlines. most

consultants, books, and articles provide solutions that don’t account for any specifics of your situation or your company. Theory is a good place to start but it’s not practical or tactical. you need help getting from where you are to where you need to go, and both are most probably unique to your circumstances. it’s good to ask the experts, just don’t rely solely on their advice.

8 Insert technology: Technology is the solution to streamlining processes, cost-cutting, creating competitive advantage, auto-

mating production, avoiding waste, etc. Technology is a means to a end, not the end itself. Streamlining is something that most com-panies can do much more of, but streamlining won’t help if what you are currently doing isn’t the right thing to be doing. Technology insertion for competitive advantage first requires market research, price benchmarking, and establishing a value proposition that’s good for customers and for the company. Then technology may help deliver that value.

9 try, try, Again: if we just try harder, it will work this time.redoubling your efforts, now that you

have learned your lessons is usually a formula for failure. Working harder and expecting a reward can set you up for false expectations. however, sometimes when you’re faced with a “no way” response, the best approach is to take the thing to a higher level to find “the way.” But, usually, this success involves changing the equation. Just trying the same thing isn’t insanity, but it can waste a lot of emotions and resources. When it’s those sunk costs that keep you holding on, trying to reach that return on your investment, ask yourself what you’d do if you didn’t have those sunk costs? if

your answer is different, then the difference is an indication of a bet-ter approach. Working smarter is a better idea.

10 return to your roots: focus on what made us successful in the first place. like bad idea no. 2, returning to the past isn’t

much better than holding onto it. you’ve heard that, “you can’t go home again.” Without reinventing itself every few years a company will commit to a roadmap that leads to a dead end (just ask Block-buster). The customer has experienced that value and wants some-thing more. either you provide it or someone else will!

These ten bad ideas (and more) are probably running rampant in your company and must be identified, evaluated, and replaced with better ideas or the eventual consequences will be the destruction of your business. Better ideas come from values, assessments, indi-viduals, empowerment, research, scenario planning, partnerships, and a willingness to change. if what you are doing hasn’t led you to success then change what you are doing -- before you destroy some-thing good. —Donn DiNunno is Quality director at EM&I, whose consultants specialize

in the areas of strategy, governance and engineering,

—This article appears courtesy www.cioupdate.com. To see more articles

regarding IT management best practices, please visit CIOUpdate.com.

21.2%growth of

storage revenue

in apac in the

year 2010



b u s i n e s s a n a ly t i c s B E S t o f Br E E D

Business Analytics: Numbers and NuanceBA tools have moved from being used for specific campaigns to being incorporated into the day-to-day operations of an organisation. Dennis Mccafferty

A car-rental giant seeks solu-tions to get fast, accurate information about customer comments. A health care benefits provider is using iT

tools to obtain a complete picture of patient medical histories. And a global nonprofit is deploying the same technologies to ensure that donor contributions are well-spent.

like many companies, these three organisa-tions are discovering new ways to deploy busi-ness intelligence and business analytics tools. By now, using Bi/BA is nothing new. What is new, however, is the eagerness of Cios to seek out an ever-expanding list of capabilities and applications for this kind of technology, and to use them across the enterprise.

This interest is fueling considerable demand: Worldwide Bi software sales are expected to reach more than $11.3 billion by 2012, up from just over $9.7 billion this year, according to research firm gartner.

new solutions are emerging that allow for improved change-data capture, manage-ment and cleansing. And there are more self-service tools to make it easier than ever to access and use the data throughout the enterprise. for Cios, however, a frequent and possibly more perplexing challenge goes beyond finding the right technology. The real challenge is in finding and retain-ing top Bi/BA talent.

leveraging Bi/BA, after all, doesn’t simply require high-end aptitude for data analysis, reporting and management. it demands a deep understanding of the intended business process, says Steve Cranford, a

director in the advisory practice of Price-waterhouseCoopers, a global professional services firm. “These ‘hybrid’ qualities are usually found in individuals with several years of business knowledge who have emerged from either the business or the technology organisation,” he says. “They also have experience with the Bi processes, methodologies and tools that are driving the decision processes of the organisation. given the drought of top Bi talent, these qualities become a ‘perfect storm’ retention challenge as adoption of Bi increases in the overall marketplace.”

Traditionally, Bi/BA tools have been used to target a specific campaign, market seg-ment or other niche. But the current push

is to incorporate Bi/BA into the day-to-day operations of an organisation so that it’s routinely applied at all levels. This means that the Bi/BA process must be collabora-tive across the enterprise, says John lucker, principal at Deloitte Consulting.

“Cios should look for ways to actively par-ticipate in the process,” he says. “They must team with business groups to find new ways to do things and new approaches for analysis. They should look for new tools to make things easier or possible, and new external data sets to augment institutional data." This collabora-tive approach is already delivering roi for the Cincinnati Zoo, which implemented a busi-ness analytics system tied to its PoS.

What Cios really need are Bi/BA solu-

Illu

st

ra

tIo

n B

Ys

hIg

Il n



B E S t o f Br E E D b u s i n e s s a n a ly t i c s

tions that can bring their companies to “next-level” business performance. it’s about more than simply gathering and analysing data. it’s about maximising the value of data through-out the enterprise. Cio insight recently spoke to three top technology executives at high-profile organisations—hertz, Capital District Physicians’ health Plan and the elizabeth glaser Pediatric AiDS foundation—to learn more about what “next-level” Bi/BA solutions mean to them. here are their stories.

like many car-rental companies, hertz seeks as much feedback from customers as it can. it wants to know if its vehicles ran well, and whether the fleet was clean and appealing. it encourages customers to indicate whether there were any mechanical problems, and how the sound system fared. And, if a service-counter employee was extra accommodating, the company is interested in these details as well.

Accessing such information in a timely fashion has always been troublesome. There have been thousands of paper sur-veys mailed to customers, toll-free phone conversations and comments posted on the company’s Web site. “it could take three weeks to gather all the information and have someone aggregate it and try to see if there was a trend there,” says Joe eckroth, Cio for hertz, which is based in Park ridge, n.J. “Then, there was the question of, ‘What the heck do you do with this information?’ By the time you figured it out, the customers had moved on to other things.”

By using mindshare Technologies and other tools from iBm, hertz has shifted its Bi/BA capabilities into the fast lane. The resulting solution package is mobile-focused, collecting and aggregating massive streams of comment data delivered to the company by customers using smartphones. The solution can distinguish and provide special analytical focus according to specific topic points—Clean or dirty car? helpful or unhelpful staff? long or short wait at the counter line?—as well as geographic region.

local managers now get daily perfor-mance feedback. if a customer has a particu-larly negative experience, managers must address and resolve the problem within the day—no later than a 24-hour period. “That makes a huge impression, when a manager indicates that he wants to help you resolve a situation so quickly,” eckroth says. “it

makes a great deal of difference when it comes to customer retention.”

Available tools also help hertz get a sense of whether features such as satellite radio and iPod-friendly sound systems deliver added (and salable) value to the customer. Sentiments being expressed “out there” in the social media universe, such as Twitter feeds, can also be monitored and analyzed.

The efforts are paying off: hertz’s per-formance on the net Promoter Score—the industry standard of customer-satisfaction assessment tools—has risen steadily since the company made significant investments in Bi/BA. every monthly score in 2010 has seen a notable improvement over the same period in 2009, and hertz has approached what amounts to industry best-in-class scores in four out of nine months.

"in our business, it’s all about the custom-er experience,” eckroth says. “This technol-ogy is allowing us to get a clear and immedi-ate picture. With customers being as fickle as they are with the choices they have, you

need to be ahead of the data, not behind it.for patients in upstate new york, the path

to improved health care may have been inspired by … Pop-Tarts?

long before Bi/BA emerged as an iT industry buzz phrase, linda navarra had a “eureka!” moment that involved the popular snack. “it was 15 years ago,” she recalls. “i was getting targeted ads from Walmart promoting strawberry Pop-Tarts before snowstorms. And i thought, ‘Walmart must know that its cus-tomers are going to want to load up on Pop-Tarts before a winter storm. Why are they able to come up with this kind of useful knowledge and, in health care, we don’t?’ What we’re doing is about life and death, after all.”

now the Cio of the Capital District Physi-cians’ health Plan (CDPhP) in Albany, n.y., navarra has taken the initiative to deploy Bi tools for this very purpose. CDPhP uses Bi solutions from hP to take data from finan-cial, claims, clinical and third-party systems to come up with a “total patient picture,” with the intention of providing the best health care possible for its 340,000 mem-bers. “We can build this picture around years of medical services, lab results, pre-scriptions and other information,” navarra says. “it allows for faster and more accurate assessments on the part of our physicians [than was previously possible].”

When navarra arrived at the 800-employ-ee CDPhP four years ago, there was no way of tracking a patient’s entire medical history, given how often each patient switched cov-erage through the years, and how disparate various hospital record-keeping systems could be. hP’s solution allowed CDPhP to build a model that essentially “connects the dots” with respect to the far-flung data. This is far from a completed effort.

“We want to see the day when a system will know, for example, when a patient was given a prescription but never went to the pharmacy to pick it up,” says navarra. “or when a system will know whether a patient is taking medication as prescribed and, if not, send us an alert so we can let the doc-tor know. This would allow us to make the appropriate intervention.”

The Washington, D.C.-based elizabeth glaser Pediatric AiDS foundation raises more than $119 million a year from diverse sources, including the Centers for Disease Control and Prevention, Disney, CBS, the

By using Mindshare

Technologies and other tools from IBM, Hertz has shifted its BI/BA capabilities into

the fast lane. The resulting solution

package is mobile focused, collecting and aggregating

massive streams of comment

data delivered to the company by customers using

smartphones.




Bill and melinda gates foundation, the u.S. Agency for international Development, the nBA, actor harrison ford, iBm and mem-bers of the public.

Carrying on the work started by gla-ser—who passed away from the disease in 1994—the foundation provides health care services for more than 2 million women at 3,700 locations around the world. As with other nonprofits, glaser employees must provide detailed reports to donors about how funds are used, such as how many people have been tested for hiV and how many are being treated successfully.

Traditionally, the process of gathering such massive data on a global scale was a cumbersome, manual one. Workers—some

in remote locations—typed reports into excel spreadsheets and attempted to e-mail or fax them to centralised locations.

Data integrity was often poor. Slow inter-net connections, frequent power losses and limited technical know-how further hindered the process. Sometimes, workers resorted to phoning in the latest numbers, which could increase the likelihood of inaccuracy.

“The data wasn’t readily available,” says mark reilley, director of iT for the founda-tion. “We didn’t have the policies we needed to designate proper access. We couldn’t be assured of its accuracy. We needed a solu-tion that addressed all of these concerns.”

reilley and his team went with a .net appli-cation from Acumen Solutions to consolidate

and make use of the data. it allows each inter-national site to automate reporting on a Web-based platform. At the headquarters level, the Bi/BA solution provides a previously unavail-able and valuable perspective on the intricacies of the funding impact. it can cross-track sites and their funding levels with the number of patients being treated. it can tap into the foundation’s travel database and pinpoint which areas have been visited most often, and whether they have made a large impression on the quality of local health care.

“it lets us see where the dollars are going,” reilley says, “and what kind of value we’re getting.” —This opinion was first published in CIO Insight. For

more such stories please visit www.cioinsight.com

Have You tested Your strategy Lately?A few timeless tests can help you kick the tires on your strategy, and kick up the level of strategic dialogue throughout your company. By chris BraDley, Martin hirt, anD sven sMit

What’s the next new thing in strategy?” a senior executive recently asked Phil rosenzweig, a pro-fessor at imD, in Swit-

zerland. his response was surprising for someone whose career is devoted to advanc-ing the state of the art of strategy:

“With all respect, i think that’s the wrong question. There’s always new stuff out there, and most of it’s not very good. rather than looking for the next musing, it’s probably better to be thorough about what we know is true and make sure we do that well.”

let’s face it: the basic principles that make for good strategy often get obscured. Sometimes the explanation is a quest for the next new thing—natural in a field that

Illu

st

ra

tIo

n B

Ys

hIg

Il n



4-6

7-83 or fewer


emerged through the steady accumulation of frameworks promising to unlock the secret of competitive advantage.

in other cases, the culprit is torrents of data, reams of analysis, and piles of documents that can be more distracting than enlighten-ing. ultimately, strategy is a way of thinking, not a procedural exer-cise or a set of frameworks.

To stimulate that thinking and the dialogue that goes along with it, we developed a set of tests aimed at helping executives assess the strength of their strategies. We focused on testing the strategy itself (in other words, the output of the strategy-development process), rather than the frameworks, tools, and approaches that generate strategies, for two reasons. first, companies develop strategy in many different ways, often idiosyncratic to their organisations, peo-ple, and markets. Second, many strategies emerge over time rather than from a process of deliberate formulation.

There are some tests on our list, and not all are created equal. The first—“will it beat the market?”—is comprehensive. The remaining disaggregate the picture of a market-beating strategy, though it’s certainly possible for a strategy to succeed without “passing” all of them. This list may sound more complicated than the three Cs or the five forces of strategy. But detailed pressure testing, in our expe-rience, helps pinpoint more precisely where the strategy needs work, while generating a deeper and more fruitful strategic dialogue.

Those conversations matter, but they often are loose and dis-jointed. We heard that, loud and clear, over the past two years in workshops where we explored our tests with more than 700 senior strategists around the world. furthermore, a recent mcKinsey Quar-terly survey of 2,135 executives indicates that few strategies pass more than three of the tests. in contrast, the reflections of a range of current and former strategy practitioners suggest that the tests described here help formalise something that the best strategists do quite intuitively.

The tests of a good strategy are timeless in nature. But the ability to pressure-test a strategy is especially timely now. The financial crisis of 2008 and the recession that followed made some strate-

Number of tests rated as fully consistent with company strategy, percentage of respondents

25

1065

Have you tested your strategy lately?

gies obsolete, revealed weaknesses in others, and forced many companies to confront choices and trade-offs they put off in boom years. At the same time, a shift toward shorter planning cycles and decentralised strategic decision making are increasing the utility of a common set of tests. All this makes today an ideal time to kick the tires on your strategy.

test 1 Will your strategy beat the market?All companies operate in markets surrounded by customers, suppli-ers, competitors, substitutes, and potential entrants, all seeking to advance their own positions. That process, unimpeded, inexorably drives economic surplus—the gap between the return a company earns and its cost of capital—toward zero.

for a company to beat the market by capturing and retaining an economic surplus, there must be an imperfection that stops or at least slows the working of the market. An imperfection controlled by a company is a competitive advantage. These are by definition scarce and fleeting because markets drive reversion to mean performance (exhibit 2). The best companies are emulated by those in the middle of the pack, and the worst exit or undergo significant reform. As each player responds to and learns from the actions of others, best practice becomes commonplace rather than a market-beating strat-egy. good strategies emphasise difference—versus your direct com-petitors, versus potential substitutes, and versus potential entrants.

market participants play out the drama of competition on a stage beset by randomness. Because the evolution of markets is path dependent—that is, its current state at any one time is the sum product of all previous events, including a great many random ones—the winners of today are often the accidents of history. Con-sider the development of the u.S. tire industry. At its peak in the mid-1920s, a frenzy of entry had created almost 300 competitors. yet by the 1940s, four producers controlled more than 70 percent of the market. Those winners happened to make retrospectively lucky choices about location and technology, but at the time it was difficult to tell which companies were truly fit for the evolving environment. The histories of many other industries, from aerospace to informa-tion technology, show remarkably similar patterns.

To beat the market, therefore, advantages have to be robust and responsive in the face of onrushing market forces. few companies, in our experience, ask themselves if they are beating the market—the pressures of “just playing along” seem intense enough. But playing along can feel safer than it is. Weaker contenders win sur-prisingly often in war when they deploy a divergent strategy, and the same is true in business.

test 2 does your strategy tap a true source of advantage?Know your competitive advantage, and you’ve answered the ques-tion of why you make money (and vice versa). Competitive advan-tage stems from two sources of scarcity: positional advantages and special capabilities.

Positional advantages are rooted in structurally attractive markets. By definition, such advantages favor incumbents: they create an asymmetry between those inside and those outside high walls.

for example, in Australia, two beer makers control 95 percent of




mance is a critical part of the quest for positional advantage. Special capabilities, the second source of competitive advantage, are scarce resources whose possession confers unique benefits.

The most obvious resources, such as drug patents or leases on min-eral deposits, we call “privileged, tradable assets”: they can be bought and sold. A second category of special capabilities, “distinctive compe-tencies,” consists of things a company does particularly well, such as innovating or managing stakeholders. These capabilities can be just as powerful in creating advantage but cannot be easily traded.

Too often, companies are cavalier about claiming special capabili-ties. Such a capability must be critical to a company’s profits and exist in abundance within it while being scarce outside. As such, special capabilities tend to be specific in nature and few in number. Companies often err here by mistaking size for scale advantage or overestimating their ability to leverage capabilities across markets. They infer special capabilities from observed performance, often without considering other explanations (such as luck or positional advantage). Companies should test any claimed capability advantage vigorously before pinning their hopes on it.

When companies bundle together activities that collectively create advantage, it becomes more difficult for competitors to identify and replicate its exact source.

Consider Aldi, the highly successful discount grocery retailer. To deliver its value proposition of lower prices, Aldi has completely redesigned the typical business system of a supermarket: only 1,500 or so products rather than 30,000, the stocking of one own-brand or private label rather than hundreds of national brands, and super-lean replenishment on pallets and trolleys, thus avoiding the expensive task of hand stacking shelves. given the enormous changes neces-sary for any supermarket that wishes to copy the total system, it is extremely difficult to mimic Aldi’s value proposition.

finally, don’t forget to take a dynamic view. What can erode positional advantage? Which special capabili-ties are becoming vulnerable? There is every reason to believe that competitors will exploit points of vulner-ability. Assume, like lewis Carroll’s red Queen, that you have to run just to stay in the same place.

test 3 Is your strategy granular about where to compete?The need to beat the market begs the question of which market. research shows that the unit of analysis used

in determining strategy (essentially, the degree to which a market is segmented) significantly influences resource allocation and thus the likelihood of success: dividing the same businesses in different ways leads to strikingly different capital allocations.

What is the right level of granularity? Push within reason for the finest possible objective segmentation of the market: think 30 to 50 segments rather than the more typical 5 or so. Too often, by contrast, the business unit as defined by the organisational chart becomes the default for defining markets, reducing from the start the potential scope of strategic thinking.

Defining and understanding these segments correctly is one of the most practical things a company can do to improve its strategy. man-agement at one large bank attributed fast growth and share gains to measurably superior customer perceptions and satisfaction.

examining the bank’s markets at a more granular level suggested that 90 percent of its outperformance could be attributed to a rela-tively high exposure to one fast-growing city and to a presence in a fast-growing product segment. This insight helped the bank avoid building its strategy on false assumptions about what was and wasn’t working for the operation as a whole.

in fact, 80 percent of the variance in revenue growth is explained by choices about where to compete, according to research sum-marised in The granularity of growth, leaving only 20 percent explained by choices about how to compete. unfortunately, this is the exact opposite of the allocation of time and effort in a typical strategy-development process. Companies should be shifting their attention greatly toward the “where” and should strive to outposition competitors by regularly reallocating resources as opportunities shift within and between segments.

test 4 does your strategy put you ahead of trends?The emergence of new trends is the norm. But many strategies place too much weight on the continuation of the status quo because they extrapolate from the past three to five years, a time frame too brief to capture the true violence of market forces.

A major innovation or an external shock in regula-tion, demand, or technology, for example, can drive a rapid, full-scale industry transition. But most trends emerge fairly slowly—so slowly that companies gen-erally fail to respond until a trend hits profits. At this

Too often, companies are cavalier about claiming special capabilities. Such a capability must be critical to a com-pany’s profits and exist in abundance within it while being scarce outside. As such, spe-cial capabilities tend to be specific in nature and few in number.

the market and enjoy triple the mar-gins of uS brewers. This situation has sustained itself for two decades, but it wasn’t always so. Beginning in the 1980s, the Australian industry experi-enced consolidation. That change in structure was associated with a change in industry conduct (price growth began outstripping general inflation) and a change in industry performance (higher profitability).

understanding the relationship among structure, conduct, and perfor-

30%of indian

telecom

subscribers to be

on 3g by 2015




ranging from technology to distribu-tion and to tailor their strategies to the new environment.

To do so, strategists must take trend analysis seriously. Always look to the edges. how are early adopters and that small cadre of consumers who seem to be ahead of the curve acting? What are small, innovative entrants doing? What technologies under development could change the game? To see which trends really matter, assess their potential impact on the financial position of your company and articulate the decisions you would make differently if that outcome were certain. for example, don’t just stop at an aging population as a trend—work it through to its conclusion. Which consumer behaviors would change? Which particular product lines would be affected? What would be the precise effect on the P&l? And how does that picture line up with today’s investment priorities?

test 5 does your strategy rest on privileged insights?Data today can be cheap, accessible, and easily assembled into detailed analyses that leave executives with the comfortable feeling of possessing an informed strategy. But much of this is noise and most of it is widely available to rivals. furthermore, routinely analys-ing readily available data diverts attention from where insight-creat-ing advantage lies: in the weak signals buried in the noise.

in the 1990s, when the ability to burn music onto CDs emerged, no one knew how digitisation would play out; mP3s, peer-to-peer file sharing, and streaming Web-based media were not on the hori-zon. But one corporation with a large record label recognised more rapidly than others that the practical advantage of copyright pro-tection could quickly become diluted if consumers began copying

material. early recognition of that possibility allowed the Ceo to sell the business at a multiple based on everyone else’s assumption that the status quo was unthreatened.

Developing proprietary insights isn’t easy. in fact, this is the ele-ment of good strategy where most companies stumble. A search for problems can help you get started. Create a short list of questions whose answers would have major implica-tions for the company’s strategy—for example, “What will we regret doing if the development of india hic-cups or stalls, and what will we not regret?” in doing so, don’t forget to examine the assumptions, explicit and implicit, behind an established business model. Do they still fit the current environment?

Another key is to collect new data through field observations or research rather than to recycle the same indus-try reports everyone else uses. Simi-larly, seeking novel ways to analyse the data can generate powerful new insights. for example, one supermar-ket chain we know recently rethought its store network strategy on the basis of surprising results from a new clus-tering algorithm.

finally, many strategic break-throughs have their root in a simple but profound customer insight (usu-ally solving an old problem for the customer in a new way). in our expe-rience, companies that go out of their way to experience the world from the

customer’s perspective routinely develop better strategies.

test 6 does your strategy embrace uncertainty?A central challenge of strategy is that we have to make choices now, but the payoffs occur in a future environment we cannot fully know or control. A critical step in embracing uncertainty is to try to char-acterise exactly what variety of it you face—a surprisingly rare activ-ity at many companies.

our work over the years has emphasised four levels of uncertainty. level one offers a reasonably clear view of the future: a range of outcomes tight enough to support a firm decision. At level two, there are a number of identifiable outcomes for which a company should prepare. At level three, the possible outcomes are represented not by a set of points but by a range that can be understood as a probability distribution. level four features total ambiguity, where even the dis-tribution of outcomes is unknown.

point, it is too late to mount a strate-gically effective response, let alone shape the change to your advantage. managers typically delay action, held back by sunk costs, an unwillingness to cannibalise a legacy business, or an attachment to yesterday’s for-mula for success. The cost of delay is steep: consider the plight of major travel agency chains slow to under-stand the power of online intermedi-aries. Conversely, for companies that get ahead of the curve, major market transitions are an opportunity to rethink their commitments in areas

3.5

3.0

2.5

2.0

1.5

1.0

0.5

0

-0.5

-1.0

-1.52001 2003 2005 2007 2009

Ratio of enterprise value to invested capital (EV/IC)

20

15

0

5

0

-5

-10

-152001 2003 2005 2007 2009

Return on invested capital (ROIC),%

Top quintileMiddle quintileBottom quintile

Performance cohorts based on position in 2001 relative to mean, n = 743

Markets drive a reversion to mean performance.

sourCe: standard & Poor’s ComPustat; mCKInseY



in our experience, companies oscillate between assuming, sim-plistically, that they are operating at level one (and making bold but unjustified point forecasts) and succumbing to an unnecessarily pessimistic level-four paralysis. in each case, careful analysis of the situation usually redistributes the variables into the middle ground of levels two and three.

rigorously understanding the uncertainty you face starts with listing the variables that would influence a strategic decision and prioritising them according to their impact. focus early analysis on removing as much uncertainty as you can—by, for example, ruling out impossible outcomes and using the underlying economics at work to highlight outcomes that are either mutually reinforcing or unlikely because they would undermine one another in the market. Then apply tools such as scenario analysis to the remaining, irreduc-ible uncertainty, which should be at the heart of your strategy.

test 7 does your strategy balance commitment and flexibility?Commitment and flexibility exist in inverse proportion to each other: the greater the commitment you make, the less flexibility remains. This tension is one of the core challenges of strategy. indeed, strategy can be expressed as making the right trade-offs over time between commitment and flexibility.

making such trade-offs effectively requires an understanding of which decisions involve commitment. inside any large company, hundreds of people make thousands of decisions each year. only a few are strategic: those that involve commitment through hard-to-reverse investments in long-lasting, company-specific assets. Com-mitment is the only path to sustainable competitive advantage.

in a world of uncertainty, strategy is about not just where and how to compete but also when. Committing too early can be a leap in the dark. Being too late is also dangerous, either because opportunities are perishable or rivals can seize advantage while your company stands on the sidelines. flexibility is the essential ingredient that allows companies to make commitments when the risk/return trade-off seems most advantageous.

A market-beating strategy will focus on just a few crucial, high-commitment choices to be made now, while leaving flexibility for other such choices to be made over time. in practice, this approach means building your strategy as a portfolio comprising three things: big bets, or committed positions aimed at gaining significant com-petitive advantage; no-regrets moves, which will pay off whatever happens; and real options, or actions that involve relatively low costs now but can be elevated to a higher level of commitment as chang-ing conditions warrant. you can build underpriced options into

a strategy by, for example, modularising major capital projects or maintaining the flexibility to switch between different inputs.

test 8 Have you translated your strategy into an action plan?in implementing any new strategy, it’s imperative to define clearly what you are moving from and where you are moving to with respect to your company’s business model, organisation, and capa-bilities.

Develop a detailed view of the shifts required to make the move, and ensure that processes and mechanisms, for which individual executives must be accountable, are in place to effect the changes. Quite simply, this is an action plan. everyone needs to know what to do. Be sure that each major “from–to shift” is matched with the energy to make it happen. And since the totality of the change often represents a major organisational transformation, make sure you and your senior team are drawing on the large body of research and experience offering solid advice on change management—a topic beyond the scope of this article!

finally, don’t forget to make sure your ongoing resource alloca-tion processes are aligned with your strategy. if you want to know what it actually is, look where the best people and the most gener-ous budgets are—and be prepared to change these things signifi-cantly. effort spent aligning the budget with the strategy will pay off many times over.

As we’ve discussed the tests with hundreds of senior executives at many of the world’s largest companies, we’ve come away convinced that a lot of these topics are part of the strategic dialogue in organi-sations. But we’ve also heard time and again that discussion of such issues is often, as one executive in Japan recently told us, “random, simultaneous, and extremely confusing.” our hope is that the tests will prove a simple and effective antidote: a means of quickly iden-tifying gaps in executives’ strategic thinking, opening their minds toward new ways of using strategy to create value, and improving the quality of the strategy-development process itself.

—About the Authors: Chris Bradley is a principal in McKinsey’s Sydney

office, Martin Hirt is a director in the Taipei office, and Sven Smit is a direc-

tor in the Amsterdam office.The authors wish to acknowledge the many

contributions of McKinsey alumnus Nick Percy, now the head of strategy

for BBC Worldwide, to the thinking behind this article

—This article was originally published in January 2011 in McKinsey Quar-

terly, www.mckinseyquarterly.com. Copyright (c) 2011 McKinsey & Com-

pany. All rights reserved. Reprinted by permission."

Rigorously understanding the uncertainty you face starts with listing the variables that would influence a strategic decision and prioritising them according to their impact. Focus early analysis on removing as much uncertainty as you can.




ship product of the group has been at the core of this.

mBoss is the operations and accounting business applica-tion of the group that has been developed in-house and con-tinues to be supported by the in-house team.

According to Sebastian Joseph, President Technol-ogy & fm, mudra group, “mBoss is a comprehensive web-based integrated accounting and operations system covering all the branding and communications offer-ings—mainline advertising (press & TV), digital media, out-of-home solutions, strategy & design consulting, local-isation & pre-media services, content creation, interactive & new media, data driven marketing services, health & lifestyle communication, retail designing & visual mer-chandising, navigation solutions, promotional marketing, field force management, trade marketing, bottom of the

Case study | Mudra Group

OutsourcingChallenGe: Mudra group takes the open source route to address its operations and accounting functionalities. The web based application is centralised and integrated with all the business processes.By Minu SirSalewala agarwal

Open Source

The advertising vertical is a niche industry and one does not see much in terms of product and solution offerings for this space. As a result leading players in this space are left to dabble in technology for

themselves and take the home-grown route on most occasions. There are several examples where advertis-ing agencies have developed their own solutions to cater to their needs. one such example is the mudra group, which embarked on this journey in 2001 and is now reaping the benefits.

With a new brand identity and diversified business units, the group has successfully completed over 30 years in the industry. Technology continues to play a key role at any organisation in realising its goals. The mudra group too resorted to technology to achieve increased efficiency, streamline its processes and align its business goals with the delivery systems. mBoss (mudra Branch operations Support System), the flag-

ca s e s t u dy B E S t o f Br E E D



COMPANY DASHBOARD

Company:The mudra Group

headquarTers:

mumbai, india

employees: 1,100 employees across 26 offices

ClienTs: airCel, Amrutanjan, Amway,

Bank of Baroda,Bajaj

Allianz Insurance,

Castrol, Dabur, Disney,

Emirates, Electrolux,

Femina, Future Group,

Godrej, HBO, Henkel,

HP, HPCL, Hindustan

Unilever, ITC, Jet

Airways to name a few.

respective locations and merged with the Corporate system. in short, all the systems were running in silos,” expressed Sebastian.

a web-based solutionin 2001 management decided to take a re-look at the existing iT infrastructure. The entire iT landscape was re-drawn keeping in view the future growth agenda. This is when the company decided to go in for an inte-grated product that could address the business needs. After considerable evaluation of various off the shelf products it was decided to take the build route rather than the buy route. Sebastian shared, “The primary reason was lack of product fitment and high level of customisation (around 65%) required for the existing products. The next step was to decide on the overall architecture to be adopted. The first selection was the rDBmS. ingres was the obvious choice since we were already an ingres shop. After numerous discussions with the vendor, industry feedback and our own study we were not confident about their roadmap. hence we zeroed in on oracle.”

next was the operating System (oS) selection. The users were all sworn uniX fans. riSC architecture was vanishing. After a lot of deliberation, the choice was nar-rowed down to linuX. having achieved this the devel-opment architecture was narrowed down to Java (J2ee). Crysal report was the default choice for report develop-ment. “however, at that point of time, Crystal did not sup-port linuX. We found a third party software that allows rendering of crystal reports on the linuX platform, “ added Sebastian.

The development journey began in mid 2001. The sys-tem initially addressed Accounts receivable, Accounts Payable, general ledger and miS on the accounting front. Client Servicing, Press, TV, outdoor, Studio were covered on the operations front. With the business growth, newer modules such as radio, internet, Trade marketing, Direct marketing, etc. were added. Sebastian shares, “This is a completely web-based model – anytime any where access. Whenever we look at adding any additional physical loca-tion to the business, all we need to take care of is only the basic physical infrastructure. There is nothing on the technology front that needs to be additionally set up as one just needs an internet connection to have the new location up and running in a jiffy.

Challenges facedChange is a way of life but change is not always welcome. Sebastian opined, “Challenges were plenty, users knew about 40 percent of what they required. The user require-ments received were half baked. iT team had to burn the midnight oil debating on the user inputs and stretch them to create possible scenarios. Since they were not exposed to other systems their thinking was single track. Best

pyramid marketing, sports marketing, integrated events management, youth marketing —making it one of its kind in the advertising vertical. The system is deployed across multiple companies and Strategic Business units (SBus) spread across multiple locations.”

The group earlier had an accounting and operation system in uniX and ingres for major locations and Clip-per based system for smaller branches. The corporate office had a separate accounting system in uniX. none of these systems could talk to each other. “on a monthly basis, only the header information was brought in from

SebaStian JoSeph, President technology & FM, Mudra Group Ltd implemented an Mudra Branch Opera-tions support system for 20 percent of the cost of saP.

B E S t o f Br E E D ca s e s t u dy



practices being followed in the industry ver-tical was not known.”

in 2001, Java resource was a scarce commodity. So was the case with open source. on the implementation front, the team faced immense mind-set issues. user acceptance thus became a challenge. one thing that did work in the company's favour was the ui. The earlier system was in character mode whereas the new system had a graphical user interface. Then came the huge task of migration that was an even bigger challenge. Sebastian expresses, “We had to do extensive hands-on support to the users. The business logic also under-went changes at the time of implementa-tion. We came across business cases that differed from location to location for the same activity.”

The system was developed in-house and proved to be extremely cost effective as the investment was well within 20 percent of a SAP or any other similar implementation for a like to like enterprise.

Sebastian opined, “The maintenance cost is also negligible as compared to what a similar enterprise would end up paying as ATS or AmC charges to SAP or other simi-lar solution annually.”

Key benefitsThe web-based feature of the solution was the one which truly gave the solution its due credit. According to Sebastian, other benefits included implementation of uni-fied accounting practices, integration of all transactions, effective control, and the flexi-bility to take care of different business cases,

change. There was an effecient utilisation of manpower and computing resources.

Constant upgradesSince the start of this initiative in 2001, there have been constant feature upgrades. "Apart from tight integration with other business applications, our business has gone through major growth. from a few companies/SBus it has grown into mul-tiple companies, multiple SBus, multiple locations, multiple business verticals," Sebastian opines. mBoss caters to both the accounting and operations requirements for the entire mudra group across all compa-nies, SBus, locations and business verticals.

road aheadAccording to Sebastian, “The intention behind implementing a virtual office infra-structure is that employees can work from any geography. The base application plat-forms that address end-to-end business pro-cesses are already in place. The organisation is now constantly building new features and applications on this framework. in terms of management, innovation and support, Sebastian has done things differently. The core team that supports the business appli-cation is a five member team. The entire project management – Design, implementa-tion, support and infrastructure manage-ment is done by the core team. The develop-ment and testing are carried out through a cost effective staffing model. 23 outsourced consultants operate out of company premis-es, managed by the five member team, thus ensuring effective project management.

General Features

Multi-company support

Multi-division support

Multi-location support

Multi-currency support

Supports all types of clients- full agency, fee

based,AOR (Agency on Record)

Multiple media support - print, electronic,

digital, studio, production, out-of-home, event

management, retail

Facility to import plans in excel

Facility to create bulk ro / contracts

Supports different formats of contracts

Facility of post changes in contracts

Statutory compliance-tds, service tax, input,

vat, stampduty, central sales tax etc.

In-built checking of duplicate supplier invoice

In-built e-payment facility

Adjustment of bills within group clients

Inter-branch transactions

Commission sharing – internal/external

Facility to reverse a wrongly entered document

Push reports - on given intervals

Integration - e-hrms and time-sheet

User friendly accounting functionalities

Data retrievals and huge mis reports

On-line user help

Issue tracking tool

“In 2001, Java resource was a scarce commodity. So was the case with Open source. On the implementation front, the team faced immense mind-set issues. User acceptance thus became a challenge.”—Sebastian Joseph

etc. Due to a centralised web based infra-structure anywhere anytime access became a reality and security could now be centrally controlled. in terms of resource utilisa-tion also the group witnessed a significant

COVE R S TORY E n t E r pr i s E s to r ag E

32 21 MARCH 2011 CTO fORum The Chief


33 21 MARCH 2011 CTO fORumThe Chief


E n t E r pr i s E s to r ag E COVE R S TORY

It was not too long back when a couple of terabytes were considered big data. not anymore. Today, information in enterprises runs into tens and hundreds of terabytes.

managing this ever increasing data flow is a tough challenge, more so because of the critical nature of the information. The Cio of an enterprise, thus, has his job cut out. he has to formulate a storage strategy that aligns with his company's growth plans, is flexible and possesses scalability. read on to know how indian Cios are dealing with this data deluge.

INsIde34 | Cloud of Data

36 | Moving Your Data to the Cloud – Sense and Sensibility

38 | Whats Hot in Storage

40 | CaSe StuDY: enhancing Operational efficiency

42 | Making the Right Choice

43 | InteRvIeW: “automated tiering is the future of storage”

44 | taking a Behind the Scenes Look at Storage tCO

The cloud is forming; Virtualisation adoption is rising;

and SSD is steadily gaining. IndianCIOs are at the forefront of technology when it

comes to managing the data deluge.



ILLU

ST

RA

TIO

NS

BY

PC

AN

OO

P




Over the last couple of years, cloud storage has come to be one of the most widely used terms in enterprises. however, it is only now

that Cios have started putting their money where their mouths are. There are enter-prises that now allocated separate budgets for cloud storage. max new york life insur-ance, for instance, has set aside a budget just for cloud storage.

“We are exploring the various possibilities around cloud storage and have a budget also around it,” says Parvinder Singh, Corporate Vice President & head iT Services, max new york life insurance.

“i am all for it (cloud storage). you may call it by any definition, but we are already running a private cloud in my enterprise that has fast provisioning. We have hosted more than 100 applications on the cloud infrastructure and they are performing per-fectly. We are slowly maturing the model, and are not far away from moving to public cloud storage,” he says.

Cloud storage could get a big boost in the

near future, if a recent report from research firm ovum is to be believed. According to the report, Clouds open for enterprise Storage, a new breed of specialised cloud storage services is emerging that would be able to take care of live data being generated from a customer’s applications.

Nandkishor dhomneCIO, Manipal Hospitals

These storage services would be able to work independent of other cloud services, and claim to be more cost effective compared to the traditional on-premise storage solutions.

As Timothy Stammers, Senior Analyst at ovum, had said in a statement, “not only do they relieve the burden of storing

Cloud of data

“Cloud storage is going to go main stream in 2011. Enterprises are migrating their non critical applications such as email and back office onto the cloud”

enterprises are increasingly including cloud in their overall

strategy of managing the data flow. CIOs across verticals have already taken baby steps towards cloud storage, and it won’t be late before they

leapfrog into it. By Yashvendra Singh




data on customers' premises, but they also have the multiplying effect of transferring to the cloud provider the responsibility of backing up that data.”

nanadkishor Dhomne, Cio, manipal hospitals, believes 2011 would be the year when cloud storage would go mainstream in the enterprise segment.

“Cloud storage is going to go main stream in 2011. enterprises are migrating their non criti-cal applications such as email and back office onto the cloud,” says Dhomne, who himself is moving his non-critical data onto the cloud.

scalability and efficiencyThe move towards cloud is logical as it offers elastically scalable storage resources in a metered manner, thereby delivering signifi-cant value in efficiency, agility and speed.

Proponents of cloud storage can gain encouragement from yet another study, ‘Cloud Computing in india 2010 - end-user Adoption Trends,’ by Springboard research. According to the report, awareness around cloud computing has shot up significantly among enterprises in india during the last 12 months with an increasing number of enterprises finding it appropriate for their iT infrastructure.

The report also found out that those enterprises in india that had adopted cloud, storage ranked amongst the top applications that were moved onto it.

“Cloud adoption and awareness have increased rapidly in india, but a large pro-portion of non-users still have no concrete plans to adopt cloud-based solutions. While this is currently a consistent trend across the Asia Pacific excluding Japan (APeJ) region, it is also changing rapidly and the percentage of indian organisations plan-ning cloud initiatives is set to increase dramatically”, michael Barnes, VP, Software research at Springboard research has said in the report.

“While a focus on reducing hardware infrastructure costs is the most important driver of cloud adoption in india and across APeJ region, the strong focus on scalabil-ity on-demand is unique to india-based respondents”, Sanchit Vir gogia, Associ-ate research manager, Software research at Springboard research further said.

The benefits of freeing up of capital, which can then be deployed in other busi-

Parvinder singhCorporate vice-President & Head It Services

Max new York LIfe Insurance

s C MittalGroup CtO, IFFCO.

ness units is creating a strong pull for enter-prises towards cloud storage. With an eye on optimising its resources, multi-product electric engineering and electrical goods manufacturing company, havells, is moving its primary data to the cloud.

“i feel cloud is the future. The benefits are huge as we are able to get expert services at minimum price. if used intelligently, it is very beneficial for an enterprise as it helps in optimising resources,” says Vivek Khan-na, Vice President, finance & iT, havells.

“Cloud storage model is moving towards maturity with every passing day. We are going in for oracle’s salesforce automa-tion tool, oracle on Demand. We are also moving our primary data outside, and transforming the in-house data center into disaster recovery site,” he adds.

indian farmers fertiliser Co-operative lim-ited (iffCo) too is aiming to make the most of the opportunity arising from cloud storage.

"for starters, we are moving our workflow and email access to the cloud," reveals S C mittal, group CTo, iffCo.

for others like Dhomne, migrating to the cloud has several other benefits.

“By moving to the cloud, i would do away with the need to have skilled manpower. There would be no hassles of updating patches, and since our company would not be hosting servers, there won’t be issues of manageability,” says Dhomne.

While there are Cios showing faith in cloud storage, there are others who are treading cautiously on account of issues associated with the model.

Some bottlenecks that exist in the present cloud storage model include -- relationship problems cropping up between the service provider and the enterprise; what would be the legal contract between an enterprise and the service provider; lack of firm SlA (ser-vice level agreement) between the parties; and fool-proof security and confidentiality of the customer data.

These are, however, teething troubles common with any new technology. At the end of the day, an enterprise has to focus on a technology that adds to its top line and bottom line.

from a wait-and-watch mode, large com-panies have already starting moving their storage onto the cloud. A few more proofs of concepts would have a domino effect.

“We are exploring various possibilities

around cloud storage.”

“For starters, we are moving our workflow and email access to

the cloud.”




Before building an effective data governance strategy for the cloud, a CIO needs to ask and answer 10 crucial questions.

Contributed By: Danny Lieberman

MOvINg YOur data tO the ClOud-

SenSe andSenSibility




data governance is a sine qua non to protect your data in the cloud. Data governance is of particular importance for the cloud service delivery model

which is philosophically different from the traditional iT product delivery model.

With increasing numbers of low-priced, high-performance SaaS, PaaS and iaaS cloud service offerings, it is vital that organ-isations start formalising their approach to data governance.

Data governance means defining the data ownership, data access controls, data traceability and regulatory compliance, for example Phi (protected health information as defined for hiPAA compliance).

To build an effective data governance strategy for the cloud, start by asking and answering 10 questions – striking the right balance between common sense and data security requirements:1 What is your most valuable data? 2 how is that data currently stored – file

servers, database servers, document man-agement systems?

3 how should that data be maintained and secured?

4 Who should have access to that data?5 Who really has access to that data?6 When was the last time you examined

your data security/encryption polices?7 What do your programmers know about

data security in the cloud?8 Who can manipulate your data (include

business partners and contractors)? 9 if leaked to unauthorised parties what

would the damage cost the business?10 if case of data breach, how long would it

take you to detect the data loss event?A frequent question from clients regard-

ing data governance strategy in the cloud is “what kind of data should be retained in local iT infrastructure?”

A stock response is that obviously sensi-tive data should remain in local storage. But instead, consider the cost/benefit of storing the data in an infrastructure cloud service provider and not disclosing those sensitive

used by facebook and Digg: CouchDB (with 10 million installations) and mongoDB that connect directly to Web applications. These noSQl databases may be vulnerable to some of the traditional injection attacks that involve string catenation.

Developers are well-advised to use native APis for building safe queries and patch fre-quently since the technology is developing rapidly and with large numbers of eyeballs – vulnerabilities are quickly being discovered and patched.

note the proactive approach the the Apache foundation is taking towards CouchDB security and a recent (feb 1, 2011) version release for a CouchDB cross-site scripting vulnerability.

So – consider these issues when building your data governance strategy for the cloud and start by asking and answering the 10 key questions for cloud data security.

—Danny Lieberman is a serial technology innova-

tor and leader. Danny's software security business,

Software Associates provides enterprise informa-

tion protection to clients in Europe and the Middle

East.

—This article is printed with prior permission from

www.infosecisland.com. For more features and

opinions on information security and risk manage-

ment, please refer to Infosec Island.

data assets to trusted insiders, contractors and business partners.

using a cloud service provider for storing sensitive data may actually reduce the threat surface instead of increasing it and give you more control by centralising and stan-dardising data storage as part of your overall data governance strategy.

you can rfP/negotiate robust data security controls in a commercial contract with cloud service providers – something you cannot easily do with employees.

A second frequently asked question regarding data governance in the cloud is “how can we protect our unstructured data from a data breach?”

The answer is that it depends on your business and your application software.

if anything, the database threat surface is growing rapidly. Telecom/cellular service providers have far more data (CDrs, cus-tomer service records etc…) in structured databases than in office and with more smart phones, Android tablets and Chrome oS devices – this will grow even more.

As hospitals move to emr (electronic medical records), this will also soon be the case in the entire health care system where almost all sensitive data is stored in struc-tured databases like oracle, microsoft SQl Server, mySQl or PostgreSQl.

Then. there is the rapidly growing use of mapreduce/JSon database technology

If anything, the database threat surface is growing

rapidly. Telecom service providers have far more data in unstructured databases

than in office.




there has been a phenomenal growth in enterprise data in the last few years. The increase in information is increasingly putting pressure on not just an

enterprises’ storage infrastructure but also on the human capital required to manage it.

According to a recent study by iDC, digital data is clocking a fast year-on-year growth of 60 percent. it is expected to touch 1800 exabytes in 2011, which is a 10-fold increase over the last five years. To keep up with the growing data, there has been a steady growth in external controller based storage. This segment grew by 17.8 percent in 2010, according to industry experts.

The growing data, coupled with the fact that it is considered a strategic asset by an enterprise, is posing a serious challenge for a Cio as he is required to put in place a storage strategy that is flexible, scalable and

secure. Above all, he has to implement all this and cut costs too.

Cios are, therefore, deploying technolo-gies and implementing best practices to manage their data and information in the best possible manner. Virtualisation and Deduplication are some of the technolo-gies that enterprises are increasingly turn-ing towards for simplifying their storage infrastructure.

storage virtualisationVirtualiation of the storage infrastructure is a clear trend that is being carried forward from last year. According to experts, in 2010, enterprises went in for virtualisation but not in a structured way. This year will see them adopting virtualisation in a more structured way.

manipal hospitals, for instance, is one such organisation that has storage virtuali-

CIOs are turning to state-of-the-art technologies and storage best practices to manage the ever increasing flow of

information and data. By Yashvendra Singh

What’S

hotIN stOrage

sation high up on its priority list in 2011. The company is witnessing its data growing at 18-22 percent year-on-year. Currently, manipal hospitals handles about 30 tera-bytes of data, which is expected to increase significantly as it is in the process of imple-menting hiS (hospital information Sys-tem) in 13 other group hospitals.

likewise, iffCo is implementing oracle erP across its five manufacturing plants, and expects its data volumes to grow several folds.

“our primary storage is about 9 terabytes, which is being used by oracle and Dominos database, while our vital storage is about 4 terabytes. once we move from the present legacy operations to oracle erP, there will be an increase in data. The way out would be to go in for virtualisation,” says S C mit-tal, group CTo, iffCo.

muti-national companies with smaller set




ups in india also have virtualisation on their storage roadmap.

As Preet Singh Khanna, Cio of commod-ity trading multinational, glencore india, says, “We deployed iBm 3400 storage about five months back, and are using it for our storage and archival needs.”

glencore india has a storage requirement of 3 terabyte at present, while the solution is capable of handling 15 terabyte.

“however, the pace at which we are grow-ing, it won’t be long before we would need to look at other options. Storage virtualisa-tion helps in optimising resources to the fullest, and we would go for it two years from now,” he says.

automated tiering and deduplication Automated tiering is set to make big waves in many SAns in enterprises. it is becom-

Policy in Place: A CIO needs to make sure he has a policy in place on how to manage the unstructured data. According to an estimate, unstructured data takes up 80 percent of the entire enterprise storage, which is completely uncalled for. He should use technol-ogies such as deduplication and thin provisioning to minimise the unstructured clutter.

Ease of Access: A CIO should be able to categorise the information in such a manner that the most important information is easily and quickly accessible.

Capacity and Regulation: The total capacity requirement within an enterprise should be in sync with the regulatory requirement of the particular sector. A CIO has to deploy a storage solution within that parameter for optimum utilisation.

Go With the Need: A CIO should not buy storage based on the lifecycle of the product. Instead, he should buy according to his need. An ideal situation is to procure for the next six months instead of the next two-three years. Considering the cost of storage declines every quarter, it would not make business sense to buy storage to meet two-three years demand.

ing tedious to store data in a flat storage environment. Through automated tiering, enterprises are able to put information on the tier of discs that it needs – more accessed information on the top tier and less frequently accessed information on the lower tier.

Those organisations that have already implemented automated tiering are reap-ing its benefits.

“for iffCo, implementing tiered stor-age has helped. We have moved vital data to fiber disc, while the archival data has been migrated to the cheaper SATA devices,” says mittal. “We are now able to pull out impor-tant information fast, and data that is not needed has been pushed behind.”

According to analysts, dedpulication is gaining traction, and it is expected to become big in the next two years.

Ajay Shah, Senior Vice President, iT Applications & Security at enam is in the process of implementing dedpuplication. “We are going in for deduplication, and should be able to complete it over the next three months,” he says.

Data deduplication could be in the form of archive storage, virtual tape libraries, disk storage systems, backup systems, and appli-cations like email systems. Deduplication enables more volume of data to be stored on

disc or fast access devices. for an enterprise it makes sense as it improves return on investment on systems.

solid state disc There is also a slow but steady movement towards solid state discs. While they may be expensive at the moment, their benefits offset the costs.

large companies looking at high perfor-mance and lower chances of data disruption could deploy solid state devices for their storage in 2011. As solid state devices don’t have mechanisms such as spindle and magnet, their seek times are extremely low thereby making data available fast.

Says nandkishor Dhomne, Cio, manipal hospitals, “We are certainly looking at solid state discs. i may have 10 percent of the data that i access frequently put on solid state discs. The initial higher cost will be offset by the reduction in the footprint of the storage box and its power consumption.”

As per an iDC outlook report brought out last year, solid state disc drive ship-ments are expected to increase 14 percent a year with a CAgr of 54 percent through 2013.

storage Best Practices

Nandkishor dhomne CIO, Manipal Hospitals.

The initial higher cost will be offset by the reduction in the footprint of the storage

box and its power consumption.”




Incorporated in August 1994, hDfC Bank currently has a nationwide network of 1,780 branches and 5,231 ATm's in 833 indian towns and cities. As the bank expanded and decided

to increase its retail customer base, the storage infrastructure came in under a lot of pressure. in response, hDfC imple-mented a multi-tiered storage solution for its business intelligent applications and data warehouse.

however, the bank kept up its pace of growth, which resulted in further expansion in the volume and complexity of the bank’s storage needs.

The growth in data was stretching the management software and hardware that

were initially deployed. The day-to-day operations of the bank were

slowing down.There were increased

demands on the storage system too with the need to

improve time management pro-

cesses, extend the life of its existing stor-age assets, and shorten timelines.

By 2005 it became clear that hDfC need-ed a more powerful model to handle the multiple terabytes of data being analysed and moved. it decided to go in for hitachi’s universal Storage Platform 1100.

“The important aspect needed to improve operational efficiencies was to shift the architecture from islands of stranded stor-age assets to a virtualised tiered storage infrastructure,” says harish Shetty, Senior Vice President of iT, hDfC Bank.

under a tiered infrastructure, the most important information or data is available for systems that demanded the highest availability, which includes the disaster recovery infrastructure. The least critical data such as nearline data analysis and data for backups, on the other hand, is stored on less expensive storage.

By adopting this multi-tiered approach, hDfC was able to leverage its investment that it had earlier made by deploying the

Improve Operational Efficiencies. HDFC Bank’s growth meant that its storage systems had to grow and scale in terms of physical capacity.Simplify Management of Storage Infra-structure. From 2004 to 2007, HDFC’s storage grew from 10TB to over 400TB to support the exponential growth in the retail banking sector. This massive prolif-eration of data required a new system of management.Lower Costs Efficiently. Allocating stor-age helps increase utilisation and cut stor-age administration costs.Reduce Migration Time and Complexity. Based on previous approaches, the bank’s IT department expected to spend up to 33 days performing a data migration when migrating data from a legacy storage sys-tem to the new platform.

CaSe StuDY | hdFC BaNk

Experiencing an exponential growth in data, HDFC Bank decided to further ramp up its

already virtualised storage infrastructure. The result was an increase in overall operational efficiency.

By Yashvendra Singh

enhanCing operational effiCienCy

the goals




capability with regular monthly processes that require data migrations. This has elimi-nated hours of service disruptions.

hDfC is now planning to implement virtualisation and tiered storage at its retail banking arm.

harish shettySenior vice-President of It, HDFC Bank.

“The aim was to optimise the requirement for production,

testing and archival of the database”

Operational Efficiencies in Change ManagementChange management can be done online without bringing the application down.There is no need for the extensive plan-ning and coordination between the mul-tiple groups.New volumes can be created with required configurations.The application and data can be migrated online.

Simplified Storage Management

Streamlined Migration ProcessHDFC Bank avoided both the complexity and time needed for migration by using virtualization technology and tiered stor-age manager software. The software did the storage mapping and then moved the data nondisruptively to the new storage.

Extended Life of Storage Assets The multitier system has ensured that the life of storage assets is enhanced.

Reduced Capital ExpenditureThe bank is now able to have low cost storage tiers.

Reduced IT RisksThe implementation has ushered in flex-ibility, scalability and improved uptime, easing the stresses that rapid growth has visited upon the bank’s data centers.

the results

universal Storage Platform 600. it made the new universal Storage Platform 1100 the primary Tier 1 platform, with virtualised legacy storage behind it.

The bank also added lower cost Tier 3 stor-age, which is virtualised behind the univer-sal Storage Platform. in addition, the multi-tiered system simplifies data management.

having a tiered storage strategy lets hDfC move large databases quickly to top tier storage for analysis, and then back to lower tier storage when done. These effi-ciencies also allow the bank to analyse data more quickly despite its growth, providing more actionable insight to the bank’s man-agement that can help improve revenues, not just cut costs.

“The aim was to basically optimise the requirement for production, testing, and archival of the database, and integrated it

into a common storage. This data could then be flexibly used as and when we need-ed based on the application,” says Shetty.

The virtualised infrastructure also allowed hDfC to align application data to the appropriate class of storage, reducing the cost of data storage and extending the life of storage assets.

“The advantage accrued was the visibility of the entire storage, and we were able to move from one storage to another based on the need,” says Shetty

“Based on previous approaches, the bank’s iT department expected to spend 33 days to migrate the volumes on the storage systems. With the new technology, the appli-cation was brought down for less than an hour,” avers Shetty.

The bank now uses tiered storage man-ager software’s nondisruptive data mobility




as the amount of data stored on the networks increases, it also takes more time to make backup copies of this data. This presents problems

as the time for these backups lengthens beyond the overnight period.

one solution is to eliminate duplicate data that is backed up. how much can you save? A lot. in some cases, there is a more than a 10-to-1 savings; meaning that 90 percent of your data is duplicates. eliminating these redundant files can go a long way towards speeding up the backup process. As the screen shot of Symantec's PureDisk net-Backup shows, more than 95 percent of the data files have been eliminated as a result of the deduplication process, going from a backup of more than 3gB to about 150mB.

Deduplication seems like a simple con-cept, but picking the right deduplication product isn't. There are dozens of vendors.

There are also all sorts of technical wrin-kles to understand before making the right purchase of a deduplication product. here is a checklist and some suggestions as you navigate these waters:

first off, where is the software agent located that controls the deduplication process? Some products put their agents at the source, meaning on each and every server that will be backed up, and others on the actual backup appliance. you need to put it someplace, and depending on your particu-lar set of servers and circumstanc-

Making the right

ChoiCeWhile Deduplication is an

asset for managing data, choosing the right product is not easy. By David Strom

es, and iT policies, you may prefer one or the other method. Some of the products, like CA's Arcserve Backup, can now work with agents in both locations.

Second, how does the deduplication appli-ance appear to the backupsoftware app? Some deduplication boxes appear like a network-attached storage device, while oth-ers appear like a storage area network drive. Depending on the backup software that you already have, one or these might be more appealing to your situation.

Does the deduplication agent have any granularity with any particular apps or oSs? Some products can examine individual email messages, or database records, or files that have changed on a particular virtual machine instance. As more and more shops make use of virtualisation technology, this factor becomes increasingly important, as the size of the virtual disk images can be enormous, yet they contain mostly the same common files for the operating system and underlying applications. This makes these deduplication products more useful when working with the backup software when the need comes to restore these particular files from inside the virtual images.

Do you need special hardware or does the deduplication function come included

as part of the backup software? A number of the usual

backup software vendors are moving towards inte-

grating deduplication func-tionality in their products. for

example, enabling data deduplication func-tionality on both Symantec's netBackup 7 and Backup exec 2010 needs only a single check mark in a pop-up box in one of their control menus.

is deduplication happening during the live stream of backup data or does some post-processing occur? This means that the backup could be first staged to a hard drive designed for this purpose, and then the duplicates are later removed. if the former, do you have enough storage capacity to hold all of your backup files, and can you add more storage as your needs grow?

finally, how does the deduplication prod-uct fit into your overall storage resource management picture? Can you examine file aging reports, that show which files haven't been accessed by your users for more than 90 days, for example? or understand how your storage area networks are using their disk arrays, and perhaps reconfigure them for more optimal usage? These and other analyses are valuable if you want to effec-tively manage your storage needs.

—Dave Strom is a freelance writer living in St. Louis

and the former editor-in-chief of Network Computing

magazine, DigitialLanding.com, and Tom's Hard-

ware.com. He has written two books and numerous

articles on networking, the Internet, and IT security

topics. He can be reached at [email protected] and

his blog can be found at strominator.com.

—This article appears courtesy www.cioupdate.

com. To see more articles regarding IT manage-

ment best practices, please visit CIOUpdate.com.



What is the kind of growth you’re seeing in the storage market in India?

What are the key drivers for growth?The external controller-based disc market in india grew at 17.8 percent in 2010 over 2009 and we expect the growth to continue in 2011 at 16 percent over 2010. The gov-ernment vertical would be the biggest driver for growth in the storage market in india in 2011. While the government spending on storage contributes about 8-9 percent of the overall storage spend in india, going for-ward, we expect its contribution to increase to about 18-20 percent.

We also expect to see increased traction in the SmB market that would fuel growth. BfSi and Telecom sectors would continue to drive storage demand, though we expect slight slowdown in demand from the tele-com sector this year.

What would be the key storage technologies for the next two years?

Companies have seriously started looking at technologies that improve efficiency in their storage infrastructure. Therefore, while data deduplication is still at a nascent stage in india, we expect to see good traction for it in the indian market. Storage virtualisation on the other hand would see slower adoption as it is not a one size fit all solution. While it may make sense for some enterprises, it may not be suitable for other enterprises and SmBs.

Automated storage tiering will be the most important technology to forward to in 2011 Though not a new concept, organi-sations are realising the importance of tiering to improve efficiencies and reduce cost. Allowing to free up human resources from operational issues, automated stor-age tiering would help organisations focus on development and innovation. Thus, we expect this technology to have huge adop-tion in 2011.

What could be the other areas of interest for an enterprise?

other areas of focus would include newer technologies like near line SAS, which gives you fibre channel performance at the cost of SATA. Similarly, people would also want to consider automated SSDs to improve the performance of applications. however, the first step is to have a storage plan. We’ve observed that most organisation

don’t even have a storage plan. organisa-tions need to take some time out and try to understand what kind of applications they are running, what is the kind of disc perfor-mance that these applications require, what is the expected growth of the organisation.

What is your view on cloud storage? Do you expect large scale adoption

of the same in the near future?

Storage market in India is set for growth as new technologies promise to make

storage cheaper and apps perform faster. aman Munglani, Research Director, Gartner talks to varun aggarwal about the new developments.

While some organisations are ready to experiment with cloud storage, there are still apprehensions regarding security in the cloud and thus enterprises are taking a cau-tious approach. Cloud storage looks quite appealing for SmBs on paper but we haven’t seen a major vendor endorsing it in order to reach out to the SmB community and resolve their con-cerns around the cloud.

“automated tiering isthe futureof storage”




In today’s economic environment, it’s critically important to make sure that any data storage system an organisation purchases has an optimally low total cost of ownership (TCo) over its lifetime.

many storage buyers today use capital expenditure (Capex) as the sole factor for determining the value of a storage purchase.

in doing so, they overlook multiple sig-nificant operating expenditure (opex) cost variables such as: length of warranty period; Post-warranty hardware and software

maintenance costs; Software licensing fees; Administration costs;

Power and cooling costs; and incremental cost of storage growth and

the cost of lost business value caused by sys-tem downtime.

further complicating the total cost equa-tion is that these variables impact storage systems differently depending on the ven-dor. in the end, as David Vellante points

To ensure the storage system has a low TCO, a CIO should know the key measures to be calculated when evaluating the total lifecycle cost of

the solution. By Rob Peglar

taking a behind the

SCeneS lookat Storage tCo



out in his Wikibon article Storage Capex vs. opex, opex is 64% of TCo, compared to 36% for Capex.

in this article, i will explain several key TCo measures to calculate when evaluat-ing the total lifecycle cost of your storage system. This should remove the complex-ity surrounding true cost of storage, help you purchase the best system for your unique environment, and improve your return on investment.

the Capex equationCapex is the easiest cost to determine since it is essentially the storage system’s sticker price. however, it’s important to not make a purchasing decision based on sticker price alone. A purchasing decision needs to take into account the underlying long-term cost variables. To better estimate the cost and manage the impact of Capex, focus on these four primary strategies:

Purchase Only What You Need Now- Pur-chasing the full amount of capacity needed for the life of a storage system at the point of sale may be simple, but it’s an inefficient use of resources and will decrease the sys-tem’s utilization rate. By deferring hardware purchases, you benefit from declining hardware costs over time. Disk drive prices have historically declined 30% year-over-year according to gordon moore in his April 1965 article “Cramming more Components onto integrated Circuits.” ftp://download.intel.com/research/silicon/moorespaper.pdf As a result, purchasing three or even five years of capacity at the point of sale could cost you up to 150% more over a five-year period than adding the capac-ity each year, only when needed.

The legacy view of purchasing storage capacity upfront is that it will be cheaper than making incremental add-on purchases and does not introduce downtime for subse-quent installation. But with today’s storage technology, this is less of a concern and cer-tainly not enough to justify such a TCo hit.

Reduce TCO with Higher System Utilisation - There is a double benefit to purchasing storage capacity as it is needed.

not only does it reduce upfront and overall system purchase cost, but it also lowers opex by reducing electricity usage and soft-ware licensing fees through higher system utilization. fewer disk drives means less maintenance, reduced licensing fees, and lower power and cooling requirements. however, you must ensure that you also get the i/o performance you need even as sys-tem utilization increases.

few storage systems can provide this ben-efit and an incorrect choice may force you to accept lower system utilization not for capac-ity but for performance. That’s because some systems may only have sufficient i/o capac-ity when writing to or reading from the out-ermost cylinders of disk platters, a practice known in the industry as “short stroking.” make sure you get the capacity and the i/o performance you need at full utilisation. you are paying for the system, after all. Take full advantage of it and do not settle for less than optimal utilisation.

The up-front cost of storage can also be reduced by implementing a tiered storage strategy. By purchasing storage capacity at a variety of price points you’ll have the flex-ibility to tailor the system’s capacity to your

budget, with more expensive, high-performance storage for transac-

tion processing systems, or value storage for disk backup.

Additionally, you may be able to consider systematically turning

off your lowest tier of hard disk drives for added power savings through well-controlled methods such as after a backup to disk or writing data to be archived to disk.

Avoid Forced Obsolescence- every stor-age system has a useful life and a war-ranty length, and as with your car, the two are not the same. many storage vendors encourage you to throw away or turn in a perfectly good system after three years,

“By deferring hardware purchases, you benefit

from declining hardware costs over time”

because they are keen to sell you newer gear even if your current storage system is meeting your needs. Storage vendors move this process along by tilting the annual cost/benefit equation of a new system strongly in their favor after the warranty is up. They do this because, ex-warranty, you are forced to purchase maintenance contracts to keep the system operational. maintenance fees vary from vendor to vendor, and it’s not uncommon for these fees to be greater than the depreciation expense of a new system. This creates what is known as forced obsolescence.

You may be able to avoid added maintenance fees by considering the length of warranty available as you choose your system. A lon-ger warranty brings a system’s sticker price and its useful life into closer alignment.

Control Software Licensing Costs- Soft-ware licensing fees also significantly vary by vendor and may be based on the number of storage systems, performance, capacity and features, or a combination thereof. it’s vital that you have a full and complete understanding of a vendor’s software licensing fees up front, over the useful lifetime of the system. Depending on the licensing model used, there may be a dramatic impact on future system costs when it comes time to upgrade. moreover, software licensing costs may increase whether the system upgrade is designed to boost performance or capacity.

—In part II of this two-part series, Rob will

explore OpEx factors effecting TCO. Until then,

you can use this handy worksheet to uncover

your storage system's TCO.


com. To see more such articles regarding IT

management best practices, please visit CIOUp-

date.com.


NEXTHORIZONS Jeff Vance SaYS

Illu

st

ra

tIo

n B

Y P

Ho

to

s.C

oM



“Some insider attacks are practically proof-of-concept for state sponsored or organised crime sponsored ones.”

Who was responsible for Stuxnet? This was a question i asked a number of security pros at the 2011 rSA secu-

rity conference last month in San francisco. The leading contenders were the obvious ones: the u.S. and israel. however, a very good case was made (off the record, unfortu-nately) for a surprising dark horse: China.

“Sure, China relies on iran for oil, and it is an ally of iran at the u.n., but China doesn’t want a nuclear iran any more than we do,” my source said.

China has proven itself to be proficient at cyber-espionage; most likely responsible for penetrating the u.S. electrical grid, as well as both u.S. defense and intelligence networks usually via thumb-drive launched malware.

Is the private sector next?There’s a case to be made that a fortune 500 company has already been a cyber-espionage victim -- or more, accurately, a fortune 500 company suffered collateral damage when it was caught up in state repression. That company was google. The culprit was almost certainly China. The argument could be made that this is an isolated case but it

Stuxnet is, in part, a sophisticated logic bomb, or a specific type of malware that kicks into higher gear when specified conditions are met. By Jeff Vance

Stuxnet and the Future of Malware



s e cu r i t y N E X t H or I Zo N S



seems the Chinese government’s main tar-get was its own dissidents, and it was just a fortunate side benefit for China that it had also been at odds with google for some time.

Thus, China wasn’t too terribly concerned about covering its tracks, avoiding detection or minimising collateral damage. Warning shots are now a key component of cyber-espionage, it would seem.

Today, the biggest threat to the enterprise is still the insider attack. Those attacks aren’t bankrolled by nations, but how long will it be until a hostile or even shady and opportunis-tic foreign government notices this oppor-tunity? how long until a bad-actor nation-state or a creative organised-crime network decides to start turning unhappy, underpaid or simply greedy insiders into intelligence assets in the same manner that nations have turned locals into spies for centuries?

in fact, some insider attacks are practically proof-of-concept for state sponsored or organ-ised crime sponsored ones. The only missing ingredient is the link between the insider and a larger malicious entity willing to pay.

Logic bombs in everyday lifeStuxnet is, in part, a sophisticated logic bomb, or a specific type of malware that kicks into high-gear when specified condi-tions are met. logic bombs have long been suspected in several high profile cyber-espi-onage attacks, including, but not limited to, the google hack, the penetration into the u.S. electrical grid, some of the attacks that hit georgia and estonia during their con-flicts with russia, and u.S.-backed attacks against the Taliban and Serbia.

even for national defense agencies, cyber-espionage is still far more theory than fact. Skeptics have long argued that the threat from cyber-espionage is overblown. “Show me the actual damage,” they say. or as rob rosenberger writes on the security-hype-debunking site myths:

"Did a story in the Wall Street Journal say 'Thousands of georgians feared dead in russian military cyber-attack?' no. Did The register announce “russian army hack-ers make georgian fuel pipelines flow back-ward”? no. Did the u.S. Air force website proclaim “Airmen deploy to Tbilisi to stop russian military hackers”? no. remember this the next time the computer media gets infatuated with the notion of a cyber-war."

Well, Stuxnet has done lots and lots of real-world damage. There’s no body count, nor were iranian defense systems, say, turn-ing themselves against Tehran Termina-tor style, but rosenberger now has some of the evidence that was previously lacking.

The signs pointing to something like Stuxnet have been around for a while. With security so often an afterthought, i have a hard time dismissing anyone who wants to get out ahead of the evolving threat land-scape for a change. That said, rosenberg, back in 2008, had a very valid point. A few years later, several high profile attacks that hit the enterprise look to have plenty in common with Stuxnet. here are some highlights:

2010, Texas Auto Center - A vengeful employee, who had just been laid off, launched an attack from the company’s Webt-ech Plus software. he used the software, meant to aid with repos-sessions, to disable customer vehicles, flash lights continu-ously and cause horns to blare all day long. The dealership was besieged with angry calls and towing requests.

2008, Fannie Mae - A logic bomb from a contract engineer, who had recently been terminated, attempted to delete data on more than 4,000 servers.

2008, Wand Corp. - A laid off tech support employee at this family-owned restaurant technology and management company launched a semi-successful logic bomb attack that crashed 25 computers and cost the company thousands of dollars to clean up.

2006, UBS - A uBS system administrator, angered over his “meager” annual bonus, launched a virus that, had it been success-

ful, would have driven uBS’s stock price into the ground.

of the incidents listed above, three of them have one thing in common: they were logic bombs. The fourth incident, Texas Auto Center, didn’t even need logic bomb capabilities because the system itself was already pretty much designed to be a logic bomb. The conditions: a disgruntled employee with system access and ill intent. The result: the system does what it was designed to do -- set off car alarms -- but not how or when it was supposed to.

All the Texas Auto Center ex-employee needed for that attack were credentials. his

were suspended, but as a former admin, he just used someone else’s that he happened to remember. Texas Auto Center was sloppy about its access controls and authentication and paid for it.

for a primer in just how potentially dangerous these sorts of attacks are, check out a november 2009 episode of 60 minutes, which showed the world how easily a logic bomb

could damage or destroy physical machin-ery. A test attack (called Aurora) hacked into a SCADA system and caused a power gen-erator to self-destruct.

Logic bombs, insiders, scammers and thievesThe insider attacks above share an impor-tant trait with cyber-warfare: the main intent is to disrupt and damage. more troubling are the ones that actually want to steal clas-sified information (or protected iP), or sim-ply learn enough about the target to cause all sorts of problems.

The google penetration falls into that camp, as do earlier Chinese breaches into the u.S. intelligence and defense systems.

54%second

hand phones

contain

personal data

The insider attacks share an important trait with cyber-warfare: the main intent is to disrupt and damage.

N E X t H or I Zo N S s e cu r i t y

The ZeuSand Bugat Trojans, both of which focus on gaining financial data, seek to gather specific data in order to steal.

now, take those sophisticated malware tools (which anyone can buy online for a few thousand dollars, by the way) mix them with disgruntled workers and an outside entity seeking to steal or do harm, and you have a perfect attack storm.

is there any proof that this sort of thing is happening? no. But it's probably just a mat-ter of time before it does.

There are two even more flammable ingredients: mobility and social networks. “malware used to be binary in nature, tak-ing advantage of a particular vulnerability in a specific system,” said michael Sutton, VP of Security research for Zscaler. now, the software landscape is far more frag-mented, with smartphones, tablets and other non-PC platforms complicating the picture, which is inspiring hackers to create more general-purpose malware.

“The future of malware, i’d argue, is Web-based worms. Then, it doesn’t matter what device you are on,” Sutton said. “malware also used to spread by hopping from device

to device. The devices had to have the same vulnerabilities, or it didn’t work. now, malware is starting to target social networks, where it spreads from profile to profile to profile, growing expo-nentially, in minutes.”

Twitter, facebook and linke-din all have numerous security vulnerabilities. for social net-working sites, the space is still a land grab and the point is to grow as big as you can as fast as you can. Security is considered a minor nuisance that the sites figure they can clean up later.

“As fascinating as it is to study new threats like Stuxnet, the majority of the threats to business are what they’ve always been,” said Chris larsen, head of Blue Coat System’s research lab. “Social engineering attacks, especially for fake security products, are still some of the most common and most successful threats.”

larsen also discussed a particularly devi-ous social engineering attack where the bad guys launched their targeted attack by focusing on a company’s executives. how-

ever, instead of targeting the executives themselves, they went after spouses, the logic apparently being that at least one executive would have a poorly secured PC shared with a non-tech savvy spouse. That PC would then be the beach-head into the company.

hackers tend to be hackers, conventional wisdom goes, because they’re greedy and

lazy. emphasis on lazy. Patient, determined, high-achieving hackers who have even greedier backers? now that’s really scary.

—Based in Santa Monica, California, Jeff Vance is

the founder of www.sandstormmedia.net, a copy-

writing and content marketing firm. He regularly

contributes stories about emerging technologies to

this publication and many others. If you have ideas

for future stories, contact him atjeff@sandstorm-

media.net or visit.


com. To see more articles regarding IT

management best practices, please visit CIOUp-

date.com.

advts.indd 56 12/22/2009 3:02:47 PM

46%rise in malware

targeting

mobile devices in

2010

advts.indd 54 12/22/2009 2:54:15 PMadvts.indd 54 12/22/2009 2:54:15 PMadvts.indd 54 12/22/2009 2:54:15 PM

N O H O LDS BARR E D D h ruv S i n g h a l

50 21 march 2011 ctO fORum The Chief


the CloudSeeding

With cloud emerging as a viable comput-ing model, Oracle wants to make the most

of this opportunity. In an Interview with Rahul Neel Mani, Oracle India’s Senior

Director, Sales Consulting, Dhruv Singhal talks about his company’s plans around

cloud computing.

What is your definition of cloud computing?Cloud computing provides on-demand access to a shared pool

of computing resources in a self-service, elastically scalable and metered manner, delivering significant advantages in speed, agility and efficiency.

Cloud computing has evolved from several trends that have been driving enterprise data centers and service providers over the last several years. These trends include grid computing, virtualisation, SoA shared services and large-scale management automation.

DoSSier

Company:Oracle

EstablishEd:

1977

foundErs:

Larry Ellison, Bob

Miner, Ed Oates

produCts: Oracle Database,

Oracle Fusion,

Middleware, Oracle

Applications,Oracle

Enterprise Manager,

Oracle Financials

EmployEEs:

105,000

D h ruv S i n g h a l N O H O LDS BARR E D

51 21 march 2011 ctO fORumThe Chief


Cloud computing builds off these by add-ing new capabilities such as self-service, dynamic scaling and pay-per-use.

What are the factors fueling growth of cloud computing and what trends

can we expect in this space? recent surveys show that the top two ben-efits of cloud computing are speed and cost. Through self-service access to an available pool of computing resources, users can be up and running in minutes instead of weeks or months. making adjustments to comput-ing capacity is also fast, thanks to an elastic and scalable grid architecture. Since cloud computing is a pay-per-use model, operates at a high scale and is highly automated, the cost and efficiency of cloud computing is very compelling as well.

SmBs are expected to adopt public cloud services owing to lower costs involved, while private cloud computing is anticipated to see stronger traction with larger companies, which is not surprising, since many of these organisations already have extensive invest-ments in expansive iT infrastructures.

According to the survey conducted by unisphere research among iT and data managers and professionals with the independent oracle users group (ioug), private cloud formations are growing in many companies, often outpacing adoption of public cloud services. As per the same survey, companies are packaging and virtu-alising their own iT assets into cloud-like services to offer across various departments and divisions, and even to outside partners. These ‘private clouds’ offer the same flex-ibility and incremental cost advantages to end users as public clouds, but with less perceived risk and greater assurances of security and accountability.

furthermore, security issues continue to be a concern with use of public cloud and online application services, making private clouds a more attractive option to enterpris-es. The survey also highlighted adoption of private cloud solutions for iT workload pro-cessing or infrastructure clearly outpaced the use of public platform service providers.

As you said, security is an issue and so is performance. How is Oracle

addressing these challenges related to cloud computing?

oracle is committed to improving cloud security and has been building innovative security solutions which bring industry-leading security functionality and ensure that the cloud environment remains secure for enterprises. oracle Database provides advanced security products like Database Vault, Audit Vault, Advanced Security options to ensure security of data. oracle identity and Access management Suite sim-plifies the management of user identities and security in an enterprise infrastructure that spans a mixture of private and public cloud services.

on the performance side, oracle remains poised to address the needs for extreme per-formance and mission-critical computing, so that companies can reap the greatest roi out of their iT investments. We recently announced two models of oracle exalogic

oracle is a cloud computing leader that can boost of a number of customer success stories. oracle helps customers realise the speed, agility and efficiency benefits of cloud computing through an evolutionary approach. oracle clients can accelerate deployment by leveraging oracle exadata Database machine and oracle exalogic elastic Cloud.

Credit Suisse, an international financial services group, built a private, self-service, Java Platform-as-a-Service using oracle Weblogic, consolidated over 200 applica-tions onto the platform, saved 35 percent in operating costs, reduced 85 percent of their servers, and avoided 44 percent power increase while doubling capacity.

Can you share details on Oracle’s ‘Cloud in a box’ theory?

Today enterprises have an option to choose from various cloud models that have a number of compelling business benefits. however, issues pertaining to security, per-formance and associated costs overpower

"Oracle helps customers realise the speed, agility and efficiency benefits of cloud computing through an evolutionary approach."

elastic Cloud - oracle exalogic elastic Cloud X2-2 with 64-bit x86 processors and a choice of oracle Solaris or oracle linux, as well as oracle exalogic elastic Cloud T3-1B with SPArC servers running oracle Solaris. engineered for large-scale, mission-critical deployments, oracle exalogic elastic Cloud provides the foundation for enterprise-class multi-tenancy or cloud applications and can support thousands of applications with dif-fering security, reliability, and performance requirements. All oracle exalogic elastic Cloud models are engineered hardware and software systems that leverage an infiniBand-based i/o fabric and solid-state storage with the market-leading oracle Weblogic Server and other enterprise Java oracle middleware products, which are assembled, tested and tuned to reduce the time from machine delivery to fully opera-tional for application deployment.

oracle provides complete, integrated and optimised systems which greatly reduce the TCo for the customer. As oracle provides

hardware and software technologies, cus-tomers can expect clean and elegant solu-tions which are more tightly engineered to reduce costs and boost performance.

What is Oracle’s play in the cloud computing space?

oracle has a comprehensive set of cloud computing offerings that are complete, open and integrated – spanning applica-tions, middleware, database, operating systems, virtualisation, servers, storage, networking and management of the entire stack. These include building and manag-ing private PaaS and iaaS clouds, customer options for running oracle technology in public clouds or on-premise, and enterprise applications that are deployed on a shared services private cloud as well as a public cloud model via oracle on Demand.

N O H O LDS BARR E D D h ruv S i n g h a l

52 21 march 2011 ctO fORum The Chief


these benefits, making the decision for orga-nizations uncertain.

oracle specifically designed exalogic elas-tic Cloud to provide enterprises with a foun-dation for secure, mission-critical private cloud capable of virtually unlimited scale, unbeatable performance, and previously unimagined management simplicity. exalog-ic is the ideal platform for applications of all types, from small-scale departmental appli-cations to the largest and most demanding erP and mainframe applications.

oracle exalogic's extreme performance, massive scale, and hardware-based applica-tion isolation make it the ideal platform for consolidating many existing applications on a single platform. it is the world's first and only integrated cloud machine—hardware and software engineered together to provide a "cloud in a box". exalogic is designed to revolutionize data center consolidation, enabling enterprises to bring together tens, hundreds, or even thousands of disparate, mission-critical, performance-sensitive workloads with maximum reliability, avail-ability, and security.

What is Oracle’s strategy to increase its cloud computing footprint?

Cloud computing is driving a significant part of oracle’s product development plans – from enterprise applications to middle-ware, databases, servers and ! storage devic-es, as well as cloud management systems. Taken together, these developments are building off oracle’s grid computing archi-tecture to create an out-of-the-box solution for cloud computing- oracle PaaS Platform.

oracle’s overall corporate strategy is to provide the industry’s most complete, open and integrated set of products from applica-tions to disk. for cloud computing, oracle’s strategy is to:Ensure that cloud computing is fully enter-prise grade – oracle provides enterprise grade technology for high performance, reliability, scalability, availability, security and portability/interoperability (based on standards). enterprises demand these char-acteristics before moving important worklo! ads to a public or private cloud. Support both public and private clouds to give customer choice –organisations are adopting different deployment models for cloud computing for different applications

at different rates of speed, so oracle sup-ports customers on premise or regardless of the type of cloud they choose. Develop and enable rich SaaS offering – oracle offers a very broad portfolio of hori-zontal and industry applications that are deployed in either a private shared services environment or in a public SaaS model.

What kind of traction has Oracle experienced in the cloud comput-

ing space?Wipro chose oracle (oracle Database, oracle Weblogic Application Server and oracle Virtual machine) as the deployment platform for w-SaaS enabled applications. The oracle Database is used as the backend data store for the platform. The w-SaaS platform leverages the high performance capabilities of the oracle Vm by integrating well with the oracle Vm Server powered private cloud.

Amazon collaborated with oracle to offer their customers options and convenience when deploying enterprise applications on the cloud. not only can customers build enterprise-grade solutions hosted by Amazon Web Services (AWS) using oracle fusion middleware and Database by oracle, they can also launch entire enterprise soft-ware stacks from oracle on eC2. in both cases, customers can benefit from the scal-ability, reliability, and cost-effectiveness of deploying on Amazon’s cloud.

in addition, other Public Cloud providers

like Savvis are also offering services based on oracle products.

What is Oracle’s future road map? oracle remains poised in the position to

address needs for extreme performance and mission-critical computing, so that companies can reap the greatest roi out of their iT invest-ments. We believe that enterprises will evolve their current iT infrastructure (from stand-alone, consolidated and optimised) to become more “cloud-like” or “iT-as-a-Service”.

“iT-as-a-Service” will see iT departments become better internal service providers to business units and departments.

The first step for many customers will be to consolidate onto a shared pool of resourc-es, which could be at the PaaS (middle tier, database tier) or iaaS (Vm/Compute tier). We believe that Private PaaS is the natu-ral evolution for enterprise data centers. oracle’s engineered systems, exalogic and exadata, provide the foundation blocks for Private PaaS and are great target platforms for consolidation. This evolution will take time, and will take shape in different ways for each company. oracle can evolve with the company’s iT infrastructure using compute, storage, network, and software building blocks for flexible, optimised data-centers. Similarly, the same building blocks can be tightly integrated and engineered to work on purpose-built systems like the oracle exadata Database machine X2-8 and exalogic elastic Cloud.

“We believe that Private PaaS is the natural evolution for

enterprise data centres.”

Hide time | BOOK REVIEW

ABOUT THE REVIEWER



Author of Prey By

The Ganges (Wis-

dom Tree, 2011),

Hemant Kumar is

a veteran of wire

service and televi-

sion journalism.

Auth

or: T

arun

Kha

nna

tHe world’s large, rapidly-growing emerging markets represent the collective ambitions and aspirations of the people who populate them. in a sense, these markets are not much different in character from the mighty American corporations of the late 19th and early 20th centuries.

The markets are lucrative, but doing business in emerging markets isn’t at all easy for multinational companies. Key market-support insti-tutions, that are taken for granted in the Western world, are either weak, still evolving or entirely missing in most such markets. When these institutions of regulation, gover-nance, facilitation and transaction, are missing, there exists, what is known as an "institutional void".

in their new book ‘Winning in emerging markets: A roadmap for Strategy and execution,’ harvard veterans Tarun Khanna and Krishna Palepu work through the global maze of institutional voids, design-ing strategies to respond to them. By pinpointing these voids in product, labour, and capital markets, inves-

every such company’s leadership has to eventually ask itself, are: whether it should replicate or adapt an exist-ing business model in that market; collaborate with domestic partners or go it alone; navigate around that market’s voids or actively try to fill them; enter the market now or look for opportunities elsewhere, and; stay in or exit the market if current strate-gies are not working.

Peppered with examples from real companies in the real world, the book has ‘field-tested’ advice and knowledge of the emerging markets.

So, whether you are an armchair globetrotter or jetsetting Ceo, the book is a treasure house of knowl-edge and wisdom. And even if you are not some master strategist mull-ing over how to penetrate the indian sweet-meat market, you should read it. Two exceptionally bright and gifted teachers have spent their entire working lives munching on a book of this calibre.

tors and entrepreneurs can succeed by harnessing private sector niches in the institutional infrastructure. These niches come in the form of information analysers and advisors, aggregators and distributors, transac-tion facilitators, and more.

in their book, Khanna and Palepu identify and plug the institutional voids by asking a few key questions. if a company is planning to enter an emerging market, it must ask itself questions like which institutions in the market are working and which missing; how the void can affect its business model; how it can compete by navigating the voids, and; where profit lies in finding opportunities to fill these voids.

According to Khanna and Palepu, emerging market institutional voids are a global phenomenon. They, therefore, focus their research world-wide, not just on the BriC countries of Brazil, russia, india and China.

for companies that want to enter emerging markets, the book can serve as a sort of rough guide or sur-vival kit. Some of the questions that

emerging market survival Kit two indian-American Harvard professors pen the entrepreneur’s ‘rough guide’ to the world’s promising markets

“Firms should create value

where they are”

VIEWPOINT



AbOuT ThE AuThOr: Steve Duplessie

is the founder of

and Senior Analyst

at the Enterprise

Strategy Group.

Recognised

worldwide as

the leading

independent

authority on

enterprise storage,

Steve has also

consistently been

ranked as one of

the most influential

IT analysts. You

can track Steve’s

blog at http://www.

thebiggertruth.com

FIrsT, allow me to roll around in self-love for a few minutes. Aster just got acquired by Teradata, and yet again, i told you so. i called Vertica and Aster–way before it was in vogue. i have many posts on said subjects that back up my bravado. good for me.

The first lesson you should learn is that if you are a VC, or a startup, you should pay more attention, you dumb asses. i appear to be in the groove, as it were.

So, greenplum, Vertica, and Aster are gone. informatica (public) is still a prime acquisition (big money) candidate (Dell isn’t in the game yet, but will be). And as we speak, any VC with any money left at all–post the great Armageddon of the past decade–is desperately looking to dump it into anyone who can spell “Big”–being able to spell Data is just gravy at this point. most of these investments will be “lemming” investments with zero chance of any significant outcome, but that’s a dif-ferent story.

now the fun starts, at least for

So, what’s critical for any of this big data business to make the leap from “geek to chic” (i want credit for that, that’s a good one), is mAr-KeTing. These companies have to establish their broad market appeal (hint: it ain’t about your super spiffy algorithm)–to business buyers, with broad business application. Talk about the overall value of what hap-pens when you find that nugget of gold out of the piles of dung–not how you found it. little guys–and some big guys–love to talk about algo-rithms. Algorithms won’t impress the ladies, or ultimately the money players. Algorithms impress fellow geeks–which (sorry again, people) represent a SmAll niChe mAr-KeT oPPorTuniTy.

if you wanna play against oracle, you bring forth your best-looking assassin, not your smartest scientist.

now, let’s get out there and do some bad ass marketing, so that i can tell one of you from the other. otherwise, i’ll get bored and write the whole lot of you off.

me. The reason these companies have been acquired is twofold: first, there is a legitimate need for better tools to be able to help owners of said big data sift through said big data to find stuff that they can make money on. Totally legit. Second, because the other guys made a move first.

So, what we have is the classic follow the leader, keeping up with the Jone-ses mentality at play, and then we will try to sort out the details post facto.

The issue: now that big dogs have acquired the small dogs in this space, the real work must begin. The small dogs all sounded a lot like total geek, niche market plays. Those are not appealing to big dogs. Selling to the “analytics” guy is arguably more niche/geeky than selling to the “stor-age” guy. At least the storage guy has had ten years or more of being “visible” in the iT organization. The analytics guy is the modern pocket protector-wearing iT dude. (Take no offense–as always, i’m just telling you what those uneducated bastards on the 57th floor think).

Big Data: I Was Right Again

What’s Next: Marketing

Steve DupleSSie | [email protected]

Documents

Vault in the Cloud