Cloud Security is Top of Mind

According to the Boston Globe newspaper, a data breach in 2007 cost TJX Companies $256 million. It also compromised 45 million customer credit and debit card numbers.   Things have not improved much in the years following this high profile incident.  During 2012, almost every industry sustained hacking attacks and a vast amount of data was stolen.  eHarmony acknowledged that about 1.5 million user passwords were compromised last year.  Networking giant, Linkedin, was stripped of 6.5 million hashed passwords in July of 2012.   Zappos, the online shoe retailer, was tapped for the personal information on about 24 million customers.   Even presidential candidate, Mitt Romney, had his email account hacked into by someone who got his email address in the Wall Street Journal.

Despite significant savings in infrastructure costs and improved operational flexibility, security is the single biggest barrier for companies wanting to implement a cloud-based solution.   However, security methods are improving and the confidence in cloud providers to protect their customers’ data is rising.

Before we tackle the question – what is cloud security, let’s discuss what cloud security is not.

What Cloud Security Is Not

First, cloud security is not a one-size-fits-all program or procedure that protects every asset running in a cloud.  Second, cloud security is not protecting a single point of attack with a firewall. Computing systems have expanded to incorporate the entire perimeter of a computing landscape; it is critical that all endpoints accessing the cloud as well as edge computing systems are secure.  Lastly, cloud security is not a universal and structured service provided by all companies offering cloud solutions.  Because cloud computing typically involves third party hosting providers, it would be a mistake to think that all third party providers have the right security processes and procedures to protect your corporate data and systems.

While there are many things cloud security is not, the main point is that protecting your computing assets in a cloud environment, with so many access points, is far more complex than it was just a few years ago.  Less than 5 years ago a solid datacenter, a good firewall and trusted employees were considered sufficient tools to protect most computing assets.   This is not the case anymore.

What Cloud Security Is

While everyone has a different approach to defining cloud security, for our purposes, we’re going to discuss this topic from the standpoint of a third party provider hosting enterprise systems such as SAP ECC or Oracle’s eBusiness Suite in a private cloud. Perhaps the best place to start is by stating that cloud security is a coordinated set of policies, technologies, and other controls designed to protect the data, infrastructure, and applications from a breach.  It is also a system that enables and supports regulatory compliance.   This same definition would have applied 5 years ago, but what separates our computing systems today from 5 years ago is that now the policies must be different, the technology is different and the controls are different.  Attackers are fully aware of these differences, and security systems must constantly evolve as technology advances.

Security starts with protecting the physical environment.  That being said, authorized people inside the physical environment (e.g. technicians, engineers, programmers, administrators, etc.) tasked with the responsibility of maintaining the environment must be competent as well as trustworthy.  A breach can happen due to an internal attack, or it can happen as a result of an honest mistake.  Either way, security can be breached and the system compromised from within a secure physical building.

The focus of this post is more on the technical aspects of protecting an organization’s sensitive data and systems, and what third party hosting providers must do to guarantee a secure environment.

Today, the most advanced datacenters hosting private clouds rely on layered technologies to create a durable and flexible net or grid.  This layering of security components and software allows components or pieces of software to be inserted at each level of the technology stack, creating multiple points of protection or barriers. The barriers increase the chances that a hacker will be deterred or possibly identified before they get to the data.  It also protects the good guys (the system administrators), because even if they make a mistake or overlook something that leaves one layer unprotected, there are still other layers that remain armed and secure.

In a private cloud, the security concerns of multiple clients sharing services and even equipment (called a multi-tenant environment) is typically minimized.  Private clouds usually handle the entire computing environment of any single company as a single closed system, including the network, edge computing, and mobile access points.  This security could go so far as housing the servers and racks in a separate and secure building.  However, a private cloud can still be exceptionally private and secure even if it is housed in a multitenant system…if it is physically impossible for any part of the private cloud to touch or integrate with any parts of the other clouds being hosted in the same datacenter.   The main point is that any organization looking at potential hosting services to manage their private cloud should examine how the private cloud is kept private.

In some cases, there is debate as to whether a hosting environment can be considered a private cloud. When evaluating vendors for private cloud computing, it’s important to ask if more than one company’s data is running on the same server.

Traditionally, application components and services that are consolidated onto a single server platform should all be from the same company to maintain the integrity of a private cloud.   However, recently there are companies who have created virtualized environments running on a single box that are reported to be as secure as the stand alone physical server.  Intel is one of the companies leading the way in the endeavor.   Regardless, if you are considering a hosted private cloud, it is recommended that you find out how the virtualized environments are maintained by any providers under consideration.

If you are looking for a third party private hosting provider with a strong security posture, one of the main capabilities you will find is their ability to provide data sovereignty.  This means you will have complete control (sovereignty) over your data, almost as if the information was hosted in a data center within the physical boundaries of your organization.

You will also have complete functional control of your systems; although you may utilize the technical expertise of your hosting provider to support the daily ‘care and feeding’ of your landscape.
In addition to data sovereignty, there are some other security-related questions you should ask your prospective vendors:

1. Does the vendor have any suggestions about how best to utilize your existing technology investments?
2. Can the vendor help with architectural design issues as well as system deployment guidance and other best practices for your cloud?
3. Is the vendor’s infrastructure scalable and flexible enough to accommodate your needs now and in the future?  What happens if you need to ramp up or down?
4. Does the provider have 24/7/365 technical support?
5. How does the vendor handle disaster recovery planning?

If you are interested in reading more about public and private clouds, download our whitepaper:  Cloud Computing: a deeper look into the technology, design and opportunities.

However, even smaller companies that are experiencing major changes in their market or are in need of a structural overhaul can divest themselves of non-core/non-strategic business segments.

This blog post is about what happens when the parent company decides to divest itself of a business unit. Particularly, what happens to the Information Technology assets and systems when a company is divested?

Find the Right Buyer

During a divestiture, companies pay a great deal of attention to operations, finance, and the human resource functions of the unit being divested, sometimes putting IT on the back burner. However, at some point during the process there is a sudden realization that IT is equally important and needs to be handled properly too.

As part of this realization, it is common for the company to see the divestiture process as a window of opportunity to improve the efficiency and portability of the divested company’s computing environment. The selling company realizes that many potential buyers of a divested unit may be interested in re-selling that same unit down the road.

If that is the case, having an IT function that is portable or able to stand alone no matter who owns the company, makes the asset being divested much more attractive to potential buyers.

Even if the acquiring company doesn’t plan to sell the divested unit, they will place a high value on gaining an IT unit that is already optimized and cost effective. That said, IT functions are usually shared among all business units within the parent company and peeling off the piece of the parent’s IT capabilities that ‘belong to’ the divested organization, can be a messy and painful process.

Shorten the Transition Service Agreement Timeline

Overall, the divestiture process is very complex and expensive for both the parent company and the buyer. Most divestitures have post-closing Transition Service Agreements (TSA) between the buyer and seller where the seller commits for a period of time – and for a fee – to provide certain services to the new buyer. This fee is typically extremely high, making speed of migration to a new solution critical to saving large sums of money.

TSAs usually occur in divestiture situations where it will take a period of time to replace corporate functions (IT, legal, accounting, etc.) that had previously been provided by the parent company, but did not come with sale of business. Anything that can reduce the complexity and the cost of the TSA during the transition and shorten the length of time required to complete the changeover will be very appealing to potential buyers.

Leverage a Capable IT Hosting Service

This is where a capable IT hosting partner can be a significant resource in advising and guiding the parent company’s leadership on ways to improve the service levels of the divested company’s IT functions. A third party can also help to preserve the integrity and functionality of the IT functions staying with the parent. Also, by using a capable infrastructure outsourcing service with the ability to host the divested company’s IT platform, it makes the IT function much more portable.

During the divestiture process, having all or part of the divested company’s IT landscape hosted in a datacenter with the technical ability to maintain essential applications is of benefit to both the selling organization and the buyer. This approach essentially removes the problem of extracting the IT function from the parent and integrating it into the IT environment of the new owners. Essentially this method makes the IT function ‘plug-and-play’ right from the beginning.

It also enables the buying company to focus their attention on operations, finance and human resources, rather than IT. Of course, if the buyer chooses, they can absorb the IT functions into their own in-house IT department at a later, more convenient time.

By turning a critical function like Information Technology into a Service Level Agreement with a single monthly fee, the divestiture process is simplified. This strategy benefits both the seller and buyer and can significantly shorten the transition time required to stand up the new company or to integrate into another parent organization.

Almost everywhere we look we see ‘real-time’ this and ‘real-time’ that. There are a lot of real-time information sources out there and many of them are readily available to anyone with the technology to tap into the source. For example, we can get real-time traffic reports on something as common as a car radio or as high-tech as smartphones. There is real-time weather information depicted on our television screens and computers.

But, this begs the question – how much real-time information do we actually need?

Well, the answer to that question depends on how you define ‘we’. Some people need real-time information sources to do their jobs; for example a pilot flying an airplane needs up to the second details on such things as the weather, the planes altitude and attitude, the status of the engines, and even the air pressure in the tires. Obviously, a pilot needs to know if there is a potential problem well before the plane and all of its occupants fly into a disastrous situation.

The Need for Real-Time Information

To bump this example up a notch, consider the pilot of an F-18 Super Hornet engaged in a mid-air dog fight with a Soviet MIG-35. Both of these pilots’ need for real-time information is an order of magnitude greater than the pilot of the commercial jetliner.

What’s the difference?

The commercial pilot is not under attack by a human being desiring to and capable of destroying his aircraft. As a result, the fighter pilots are usually wearing heads-up displays that are essentially instrumentation dashboards right in front of their eyes. All key performance indicators are visible and accessible instantly – fuel supply, speed, location of enemy, speed of enemy, ammunition, missile lock-on radar, altitude, etc. Since surviving a dog-fight at the speed of sound is dependent on split second decision-making and lightning fast reactions, there isn’t even time to glance down at the planes instrument panel. In this life or death scenario, the need for real-time information is without question.

Technology and real-time information go hand in hand. Unless a person is willing to sit and watch something every second of every minute all day long, we need technology to help us ‘watch’ or monitor key events or situations that are meaningful to our lives. Interestingly enough, as technology evolves we become more aware of situations or events that we should be monitoring, simply because we can monitor them.

Twenty years ago, who would have thought to use a satellite, looking at Earth from a geostationary orbit, to tell us how to drive to friend’s house or find a good pizza in strange city? Twenty years ago we had satellites in orbit around the Earth that matched the rotation of our planet and held their exact position in the sky relative to a fixed spot on Earth, but it took a while for scientists and engineers to figure out how to build a GPS navigation system for smartphones.

SAP HANA

SAP HANA and in-memory computing is the next leap forward in high speed data processing. In fact, this leap forward goes beyond anything we’ve every experienced because HANA actually provides us with real-time data processing.

SAP HANA technology is transformational technology because its emergence impacted hardware manufacturers, database systems, software developers, mobile device applications, reporting processes, networking topology and even business strategies. SAP HANA isn’t just going to influence the future of computing, it is going to alter the trajectory of computing and where it is going. Businesses must embrace the new and improved capabilities of in-memory computing now or, very quickly, many will be left far behind.

Business leaders and management want real-time information so they can analyze market situations and react to rapidly changing customer needs. This isn’t just marketing spin either, it is a reality that is taking hold more every day and will eventually touch each person on the planet. Real-time information, once just a dream, is fast becoming a reality and soon we won’t be able to live without it.

Consider the National Basketball Association’s need for analytics. InformationWeek recently reported that the NBA’s statistical website (www.NBA.com/stats) will use SAP HANA technology to enable its millions of fans to analyze stats from the league’s founding in 1946. According to Michael Gliedman, NBA CIO, “The main reason the NBA selected SAP HANA is because we wanted to support fast, flexible querying. With the entire stat dataset held in memory on HANA, fans will be able to split, filter and query data as they see fit.”

What is driving the demand for real-time information for businesses?

The short answer is consumers demand faster response times, better services, and more flexibility. And, competitors are actively seeking to build up their customer-bases anyway they can, and stealing your customers by provider faster service is one way to do that.

Let’s consider two companies in the manufacturing industry, one working with real-time analytics running on HANA and another with a traditional system. Company A (with HANA) needs to know which one of their more than 15,000 resellers world-wide brought in the most sales in 2011 compared to the previous year.

Within 30 seconds, Company A is able to make an informed decision on which reseller is most profitable. Company B on the other hand, needs to go through their legacy system, to compile all the sales information over the past two years, and eventually arrive at the same conclusion Company A did, only it took Company B several hours to prepare the report and make the decision.

While these hours may not seem like much, the important thing to note is that when data takes so much more effort to process – most companies don’t bother running reports for every small decision. And these small decisions are now made by gut feelings rather than intelligence, which can add up to big mistakes in the long run. SAP HANA allows businesses to make critical day-to-day decisions – on the fly.

Business Suite Powered by SAP HANA

SAP recently introduced their Business Suite powered by HANA. This is ‘real-time’ ERP technology that brings together analytics and transactions into a single platform. Business is moving fast and changes happen in real-time so decisions have to be made within very small windows of time. There is also an ever expanding ocean of data that is available within the entire ERP system if you can capitalize on it. SAP is now enabling senior leadership to unit managers control their entire environment from end-to-end in real-time, no matter how much data they have to process.

Hosting HANA in an SAP Cloud

The advantages of bringing SAP HANA into your environment are compelling, but the advantages of bringing it into your company without all the upfront cost is even more compelling. Having your HANA environment hosted by Secure-24 on a state-of-the-art SAP cloud platform makes great economic sense. First you will only have one flat, predictable monthly fee. Second, hosting and application management services are provided by Secure-24, an SAP-certified hosting provider with full technical support and system monitoring. Third, you will receive a comprehensive Service Level Agreement that offers Basis support, Disaster Recovery, High Availability Uptime and many other service commitments. This approach allows you to turn what could be a large and often unbudgeted Capital expense into a very manageable monthly Operational expense.

Take cloud computing for example. Early in the summer of 2010 I was asked by a customer if Secure-24 did cloud computing.  Before I answered him I asked a few questions and found out that he was interested in something called a ‘private cloud’ for his own needs, but he also wanted someone to come out to his office and explain to a group of his employees exactly what this concept called cloud-computing meant.  He didn’t want any spin or sales jargon, just the bare-bone facts and then they would figure out the rest.    So we obliged and trouped out to his office, PowerPoint in hand, to lay bare the essence of cloud computing.  

Today, in the early spring of 2013, no one is calling to have us explain cloud-computing.  It is now old news and, for the most part, quite well understood.  It also lived up to its early billing as a game-changer, disruptive technology and revolutionary.   But, in the 3 years or so since I first heard about ‘the cloud’, it has become a commodity, now with all the fanfare and hoopla of a bag of wet sand.   Cloud computing has taken its place as just another wave that rolled in from the ocean of technology.

So what comes after cloud computing?

Well, asking what comes after cloud computing is a little bit like asking what comes after television, or the Internet, or even the flush toilet.  Some items establish themselves as real breakthroughs, turning points that essentially nothing comes after.   Sure, through innovation and refinement most breakthrough items get better, more user-friendly and even help to break new ground, like a doctor who uses a HD television, a robotic arm and the Internet to operate on a patient from one-thousand miles away.   But breakthrough items eventually become a commodity and are woven into the fabric of our society.  They are used by almost everyone, and evolve from nice-to-have items to essentials.

Even though cloud computing is an offshoot of the Internet, much as television is an offshoot of the electric power grid, the cloud created its own ecosystem and forward momentum.  This constant forward thrust pushes cloud computing and all of its associated technologies to the horizon and beyond.

But…there are things on the horizon and many are worth paying attention to.

1. Edge Computing

The cloud facilitates ‘edge computing’.   With the plethora of mobile devices that leverage the Internet, the only factor that limits what we can do is our own imagination.  From smart phone to smart toys, or device-to-device communications to remote sensors, the types of devices that live and work on the edge is nothing short of amazing.  Add to this edge network an ability to converge content from multiple data sources, and we essentially have the whole world in the palm of our hands, anywhere, anytime, on any device.

2. Growth of Complexity

Another thing that is just beginning to show its face on our horizon is not a thing at all, it is complexity.  The growth of complexity in the world of technology is at an all time high and it will do nothing but get more complex in the coming months and years.   Further, we will have to deal with two kinds of complexity, first is technical complexity, and the second is management complexity.

Technical complexity is actually more familiar to us now that we have 20 plus years of experience dealing with personal computers, cell phones, iPads and even elaborate in-home entertainment systems.  Over the years many people gravitated toward technical fields that rewarded them if they had the aptitude to learn how technology works and, more importantly, how to fix it when it breaks.   Fortunately we are surrounded by knowledgeable technicians that can help us when our computers go down.

However, the management of complexity is relatively new to many businesses as they transform themselves from supporting their own technical environment, to managing companies that support it for them.  Application outsourcing, for instance, is growing in popularity and requires a specific set of skills to manage the outsourcing partner that is supporting the application and ensure that they are maintaining the environment properly.

There are also a whole host of management issues to consider when so many different kinds of mobile devices, some owned by the company, but most owned by individual employees, can attached to the company’s network and utilize company resources.  This explosion of devices that people use to connect to and leverage company information opens up serious concerns with security.  The question of how to manage the complex array of people and devices that are plugging into a company’s computing assets is now top-of-mind with most CIOs.

3. Specialized Clouds

Beyond the public and private clouds is a huge variety of ‘specialty clouds’ that perform specific tasks for specific audiences.  Specialized clouds, like magazines, will appeal to a certain audiences with known demographic characteristics.  There will be interactive clouds for transactional systems with ‘get and pull’ computational capabilities.  There will also be analytic clouds that can process vast amounts of disparate data and reduce that data down to measurable statistics in mere seconds.  Collaborative clouds will help people communicate, work and play together in ways that until recently were simply impossible.   Lastly, there will be clouds that are a combination of the clouds just mentioned, creating ‘future’ hybrid clouds that we cannot imagine at this point in time.

Innovation is also one of the most popular buzzwords in boardrooms throughout the world, and it has been for many years. Buzzword or not, there is no denying that innovation is real and can differentiate one competitor from the next. Companies large and small have been searching for a magic formula that causes innovation to happen, but the illusiveness of innovation defies management. However, innovation or the ability to innovate does not defy logic.

An environment that encourages business innovation can be nurtured and cultivated. Considering that innovation is not an invention, but an improvement on an existing product or service, it is entirely realistic to expect innovation to happen on a regular basis. Of course this assumes that the people closest to the product or service are inclined to innovate.

Let’s look at the example of Apple Computers. In 1997 Apple was near collapse as a company, but was resurrected by its co-founder, Steven Jobs. Jobs, once exiled from Apple, reinvented the company as a consumer-electronics juggernaut and set it on course to reach a level of success that no one could have imagined. Today the company’s stock is trading at more than $450 per share; this is an 8500% increase over 1997.

Where did this incredible burst of commercial success come from? In polls of the world’s most inventive and innovative firms, Apple consistently ranks first.  From its first computer in 1997, to the mouse-driven Macintosh in 1984, to the IPod music player in 2001, and now to the IPhone and IPad, Apple has dominated its market by keeping ahead of the times. Most people would say they led the drive towards ubiquitous consumer gadgets.

According to an article in the Economist magazine back in 2007, Apple uncovered four key characteristics of firms that are consistently innovative.

1. Innovative ideas can come from anywhere, inside the company or out
2. Focus on the needs of the user, not the limitations of technology
3. Sometimes, ignore what the market says it wants and listen to your own gut
4. The fourth lesson is perhaps the most important, ‘fail wisely’.  Don’t stigmatize failure but tolerate it as an inevitable part of innovation

If these four characteristics fuel innovation, what inhibits innovation within a successful company? Is it possible that managing the complex yet mundane tasks required to run a data center are draining the company’s talented human resources of their creative energy. Innovation is a process that discloses its rewards little by little as the people driving the innovation uncover hidden assets within a product or service.

Since innovation is a process that never completely stops, it requires the people who are innovating to possess a considerable amount of patience as well as a strong imagination to expose the veiled properties they know exist. But, nothing nullifies patience and dims the imagination quicker than performing mundane and routine tasks day in and day out.

If innovative people are responsible for managing a complex technical environment filled with applications, hardware, networking, security, building facilities, employees, and contractors as with an application like ERP systems, can they squeeze in the time to improve and modernize? This tamping down of innovation could be a matter of people being stretched so thin that they have precious little time or desire to innovate. For many in the Information Technology business today, enduring is what matters most at the end of the day, not innovation!

Of course it is impossible to outsource all the mundane and thankless tasks within an enterprise, but it is possible and desirable for many repetitive IT functions to be handed off to a third-party hosting service.  And in most cases, the third party hosting provider will do a better job, at a lower cost, while freeing up internal resources to focus on solving real business problems.

The ideas of cloud computing or infrastructure outsourcing are no longer innovative concepts.  In fact, they are becoming commodities like electricity, the Internet, or cable television. There was a time when all of these technologies were considered innovative and cutting-edge, but as they became common place and readily available the price dropped and usage sky-rocketed. This is not to say that innovation no longer takes place in these industries, it does. But these industries now provide commodities that are widely used by other companies so they can focus their resources on business issues.

The impact of infrastructure outsourcing, cloud computing and application outsourcing becoming commodities is very important in the competitive landscape. Since many organizations are beginning to leverage cloud computing or other types of system outsourcing, these commodities truly help companies lower cost, become more efficient, and more competitive. If a firm is moving forward without leveraging technology outsourcing, they are probably falling behind.

It seems ironic that innovations like cloud computing evolved into a commodity. Then, following a period of mass adoption, the commodity itself spurs on new forms of innovation by freeing up the talent and creativity in companies that utilize outsourcing services.

Innovation is a mysterious component of any business, but it is vitally important and worth nurturing and cultivating. However, nothing guarantees that innovation will happen.  You can be open to new ideas inside and outside your company, pursue simplicity, focus on the users, ignore the market, and fail wisely – and still innovation eludes you. If there is any lesson to be learned about innovation, it is that innovation is more of an art than a science. But innovation drives success and people drive innovation.

The refreshing news is that as technology evolves, and as the notion of ‘outsourcing’ your IT systems becomes the norm, upgrades, transitions and migrations are becoming more streamlined and less of a headache – as long as you’re working alongside the right vendor.

 

Join Secure-24 on February 26th at 3:00 PM ET, for a webinar to discuss some of the secrets to our upgrade strategy.

Given that extended maintenance for companies running 5.0 or earlier versions of ECC will end in March 2013, we’ll be diving into some specifics around upgrading to SAP ECC 6.0. Presenting along with Secure-24′s Chief Strategy Officer, Joe Szmadzinski, is Multiquip’s VP of IT, Michael Hanken. Joe will address some of the key challenges, lessons learned, and best practices for reducing risks and eliminating downtime in the upgrade process. Michael will discuss the challenges Multiquip faced such as their small SAP team, limited budget, and outdated hardware, and how choosing the right SAP hosting provider proved to be a great success.

Click here to learn more about this webinar or register by clicking the button above.  If you’re unable to attend the webinar, but you’d like us to send you a recording, e-mail webinars@secure-24.com.

Given the tragic results following Super Storm Sandy on the East coast, the focus on disaster recovery and business continuity is at an all time high. The stakes for businesses are much too high to ignore and if someone mistakes DR for BC, they are running the risk of calamity and misfortune that could possibly have been avoided.

To emphasize the importance of disaster recovery plans and business continuity plans, a few sobering statistics from a report published by Continuity Central about the impact of disasters on businesses:

• 70% of businesses involved in a major fire fail within 3 years (Chubb)
• One out of two businesses never return to the marketplace following a major disaster (AXA)
• Within two years after Hurricane Andrew in Florida (1992), 80% of affected companies that lacked a business continuity plan went out of business (FEMA)

Before we delve into the difference between DR and BC, it might be worth defining what constitutes a disaster. Although there is not a universally accepted definition of a disaster, the following observation by US disaster relief specialist Fredrick Curry should suffice, “A situation resulting from an environmental phenomenon or armed conflict that can produce stress, personal injury, physical damage, and economic disruption of great magnitude.”

This definition applies to all forms of disasters, but it also works for significant IT outages that cause significant disruption in the operation of a business entity. It is usually up to the company experiencing the disruption to declare a disaster, based on their own particular situation.

Types of IT Disasters

Information technology disasters can be either major or minor. Determining if a disaster is major or minor does not necessarily mean how far reaching the impact on employees or how much data was put at risk. For example a small amount of the very important data could compromise an organization just as much as the loss of a large amount of data. What if a disaster caused The Coca Cola Company to lose the recipe/formula to make Coke!

Another thing to consider when determining if a disaster has caused a major or minor loss of data is how long it will take to recover the data. It is entirely possible that a small data loss would necessitate a complete restoration of the entire company database, a Herculean undertaking for most companies. So, for purposes of this article, all significant loss of data or systems will be considered a major disaster.

Some typical life-events that can lead to an IT disaster being declared include:

• Flood
• Fire
• Weather event (hurricane, tornado, etc.)
• Widespread and long term power outage
• Internal sabotage
• Medical emergency (e.g. widespread epidemic)
• Equipment or software malfunction on a large scale
• Communication networks disabled
• Accident that closes down a large geographic area
• Earthquake, tsunami or volcanic eruption
• Multiple events at one time (e.g. flood, weather event, and communication network down)

In a disaster recovery survey conducted by Applied Research in 2009 (1650 companies surveyed, with at least 5000 employees) they found that nearly all organizations (93 percent) suffered some type of significant IT outages in the previous year. However, most reported that they could get back up and running within about four hours and did not declare a disaster. This large percentage of impacted organizations points to the fact that all companies, no matter how large or small, are vulnerable to a disaster scenario. Additionally, IT is becoming a more critical part of an organization’s ability to function because 60 percent of all applications were deemed mission critical in 2009. This percentage is most certainly higher now as we enter 2013.

What is the difference between Business Continuity (BC) and Disaster Recovery (DR)?

As mentioned in the beginning of this blog, BC and DR are not the same. However, DR plans are part of a BC plan or strategy. Jarrett Potts, Director of Strategic Marketing for STORServer, said, ‘Disaster recovery is a subset of business continuity. It is the process of saving data with the sole purpose of being able to recover it in the event of a disaster.’ Potts went on to say, ‘The root of disaster recovery is that data is kept in a secondary site, and plans are made to insure that the data will be recovered and the business can access it in a timely fashion.’

Business continuity is all about maintaining business operations following a declared disaster. The Disaster Recovery Institute International provides the following definition of business continuity: ‘The ability of an organization to provide service and support for its customers and to maintain its viability before, during and after a business threatening continuity event.’ Certainly, recovering vital computing systems and assets is a part of business continuity. But, the elements necessary for business continuity also include the physical location of the place or places of business, staffing and equipment, inventory, and transportation/distribution channels.

Continuity represents a much larger scope of planning and maintenance than recovery. However, given the dependency most businesses have on technology, disaster recovery is usually a top priority because it supports all the other elements of the business continuity plan.
Time is of the essence following a disaster. Whether the focus is on data, systems, physical locations, staff or customers, time is the biggest enemy of business continuity. The issue of time-to-recover highlights several critical business continuity questions:

• What do we need recovered first to conduct business?
• What do our customers need to be assured of our stability?
• What do our business partners require to continue their normal operations?
• What do our vendors need to continue to work with us?

In a report form Continuity Center, the biggest impediment to Business Continuity and Disaster Recovery planning is resistance on the part of executive management to provide adequate support and funding. Other challenges facing IT staff interested in implementing BC and DR activities are: high levels of change taking place within their organization, lack of support from business units, and lack of time for business continuity efforts.

In conclusion, although disasters are few and far between, and we all believe that a disaster will never happen to us, the fact is they do happen and they can happen to anyone. Responsible organizations recognize this and take the proper steps to protect all of its assets in the event of a declared disaster.

Alternatives to DIY Upgrades

Performing a Hyperion Upgrade is definitely not for amateurs; it is not even for experienced IT professionals if they don’t have substantial technical experience with Hyperion. Most Hyperion upgrades are more like a complete reinstallation of the software, but with more complexities to consider since you will be dealing with a live, production system. So what alternatives does one have to perform an upgrade? Three come to mind immediately. First, you can call a certified Oracle Hyperion consulting organization. Second, you can, if you are brave, attempt the upgrade yourself. Third, you can hand your Hyperion application over to a qualified third-party hosting service and let them take care of all that for you. This post is about the benefits and advantages of working with a qualified hosting partner that will oversee your Hyperion environment, including – help, guidance and support with upgrades. To handle the complexities of Hyperion, you need a partner that provides an enterprise-class infrastructure along with the services necessary to manage the entire landscape. The daily services needed to maintain a healthy Hyperion environment include: • scheduled backups, • patching, • monitoring, • alarming, • disaster recovery, • high availability systems, • and access to experts. You may not need every service your hosting partner has to offer, but if they provide an ‘a-la-carte’ portfolio of services from which to choose, you can select the ones that meet your needs at a predictable and reasonable cost.

Hyperion Hosting in a Private Cloud

Additionally, with cloud computing established now as a reliable, secure, and affordable medium for Hyperion, the future is bright for those companies wanting to take advantage of this growing service. Oracle recently released a major upgrade of its Hyperion suite – the second major release since being acquired by Oracle in 2007. Oracle’s latest release is Hyperion 11.1.2.1. Although this is a multiple dot release, which typically means that it is a minor upgrade; this new Enterprise Performance version has a lot of new functionality, features and modules that make it a major release. The decision to upgrade often rests on the analysis of three significant categories: infrastructure, support and functionality. Of course support, or the lack thereof, is also a major consideration and motivation pushing companies to upgrade. Some organizations believe that sticking with an older version saves time and money because they believe ‘if it ain’t broke don’t fix-it’. However, with software the opposite is often the case. Since older software has fewer and fewer fixes or enhancements coming out from the manufacturer, the older version are usually underperforming and lacking needed features. Not to mention they are often very delicate and can crash at any time.

Improved Functionality

This brings us to the last category, and that is functionality. This category offers the most compelling reasons to upgrade. The promise of new capabilities, more flexibility, and better reliability makes it easier to develop a business case, especially if the company thinks the upgraded system will help them outperform the competition. According to Juan Porter, President of TopDown Consulting, the most noteworthy features in Hyperion 11.1.2.2 are as follows: • Greater detail with custom or configurable dimensions • User interface updates which offer a richer, Web 2.1 experience • Automated account reconciliations with the new Account Reconciliation Manager • Cohesive and flexible planning that includes Predictive Planning and Project Planning Module. • Packaged Dashboard add dynamic reporting capabilities and on-the-go access to data

Hosting Hyperion with a Capable Partner

This newest release of Hyperion is a major step beyond earlier version, but upgrading to this version will be complex.  If you are currently supporting Hyperion yourself with internal resources, perhaps it is time to consider the tremendous benefits that are available through qualified managed hosting partners. If you have been running Hyperion in-house, upgrading to release 11 may be an opportune time to outsource Hyperion into a managed hosting environment. Adopting a managed hosting model enables your in-house IT department to focus on strategy rather than infrastructure and address pressing business challenges rather than jumping over technical roadblocks.

But that was then, now thirteen years later, managed hosting services are viewed in a much more favorable light. There are still trust issues and technical hurdles abound, but the economies of scale outweigh the potential problems. Further, the trust issues have been mitigated by the emergence of high quality security methods and tools that were not available 10 years ago. The term ‘outsourcing’ is even less intimidating now.

The cost advantages that third party hosting providers offer are driving much of the interest in managed hosting services. Hosting providers can spread out their fixed costs across all customers for things such as the datacenter building, HVAC, electric power consumption, the racks, the hardware and even the technical services.

This allows an enterprise hosting provider to fractionalize their fixed costs and charge only a portion of the full costs to each of their customers. This approach typically yields a lower cost to each customer than if they were to bear the entire fixed costs of supporting their own data center.

Cost savings would be irrelevant though if customers could not trust hosting providers to reliably support and maintain their enterprise systems. Trust is where the rubber meets the road. For organizations that utilize SAP outsourcing services, the mission-critical nature of SAP would certainly compromise the entire enterprise if their outsourcing partner could not meet their service level agreements.

Adding momentum to the resistance to ‘outsourcing’ back in the early 2000’s was the cultural notion that outsourcing meant sending U.S. jobs overseas, which is bad for U.S. workers. In 2004, economist Paul Samuelson (a Nobel Prize winner) wrote a paper that claimed the economic impact of outsourcing is similar to opening up the flood gates and allowing mass immigration of workers willing to work at extremely low wages. Obviously, the effect would be to drive down wages for everyone in the middle class, even if it did benefit certain employers.

Given this economic backdrop for outsourcing business in the early 2000’s, who would seriously consider starting a managed hosting company; even it was entirely based in the U.S.? Enter two immigrants and entrepreneurs from Germany.

In 2000, Volker Straub and Matthias Horch were sent to the U.S. by TDS AG (a large SAP outsourcing firm based in Neckarsulm, Germany). Their mission was to launch a new operating division for TDS AG here in the United States that would offer IT and SAP hosting and integration services.

However, things were about to change for TDS AG before the mission could be completed. The first was the dot-com implosion that happened right after the new millennium began. The ‘dot-bomb’ as it was called, caused TDS AG to reverse its decision about starting a new division. The second was that Straub and Horch decided that, rather than return to their old jobs with TDS AG back in Germany, they’d rather stay in the United States. Their short time in the U.S. ignited their entrepreneurial spirit and they made a big decision.

“We thought, ‘why not start our own business?’” said Straub.

So, instead of launching a new TDS AG division, Matthias Horch and Volker Straub launched Secure-24 in 2001. The fledgling company was focused on IT security in the beginning; enterprise hosting was just a part of their overall services. But as luck would have it, 2001 was not the best of times to start any kind of business, especially here in the U.S. September 11, 2001 was a day that will never be forgotten and a day that changed the country and the world.

Fortunately for Horch and Straub, they were able to win several clients before that fateful day, not enough work to show a profit, but enough work to show that starting a successful business was possible. As a result of those small successes, they hung on to their dream.

“Looking back, it was probably the worst time (to launch a business),” said Straub. “We couldn’t pay ourselves a salary. We were working on computers all night and meeting with clients all day.”

But this blog is not just about Secure-24, it is about how the environment for enterprise hosting services emerged and shook off the negative impressions that were wrapped around the entire hosting industry. As the opinions of hosting providers improved, Secure-24 like many other managed hosting companies began to grow. However, business growth is not a steady, predictable or assured thing.

On September 16, 2008, the New York Times headline read: “Fearing Worse to Come, Investors Drive Dow to Biggest Loss Since ’01”. The crisis in the financial industry was beginning to shock the broader economy as investors drove down the Dow Jones Industrial Average a whopping 504.48 points; the biggest one-day drop since September 17, 2001.

Obviously, this drop in the DJIA was a profound shock to all businesses everywhere and, as a result, any unnecessary spending stopped while everyone waited to see what was going to happen next. What happened was a huge shortage of available capital to fund business growth and improvements. However, in 2008, with some creative financing, Secure-24 was able to build a state-of-the-art datacenter; their third facility in the Detroit metro area.

The 2008-2009 recession was a game-changer for the enterprise hosting business. “CIOs couldn’t get $20 million to purchase much needed computing infrastructure, but they could amortize it over time,” said Joe Szmadzinski, Chief Strategy Office at Secure-24, “and that was beneficial to both the CIOs and the hosting industry.”
In many respects, the recession accelerated the plans of thousands of CIOs to consider third-party hosting providers. Because of their shortage of cash as well as the problems caused by end-of-life computer equipment, CIOs were looking for quick relief and they found it in managed hosting services.

Considering the incredible mixture of problems, tragedies, and uncertainty that plagued first 10 years of this century, the seed of opportunity for managed hosting and outsourcing was able to survive and grow. Today, nearing the end of 2012 and looking ahead into 2013, managed hosting is being transformed into something called cloud computing, which again puts the enterprise hosting providers at the center of a new trend.

A Different Kind of Cliff

This cliff can be described as businesses finding new ways to cut costs and streamline IT operations. Consider the following analogy. If every manufacturing company in the world decided to build their own power generation plant to support each production facility instead of buying electricity off the grid from the local utility company, how many people would it take to support that business model? The answer is probably in the millions… and a large waste of resources that could be used for R&D and growth.

But beyond the financial costs, imagine how much more we’d have to pay for the products that are manufactured in those facilities. Not to mention the tons of pollutants that would be pumped into the atmosphere. This analogy extends to SAP management and hosting. If organizations host their environments independently versus outsourcing SAP to the cloud, they could be missing out on valuable efficiencies and economies of scale.

Evolution of Cloud Computing

In the past few years, cloud computing has evolved from just an interesting idea to a crucial reality with increasing demand for physical data center space in multi-tenant facilities. According to 451 Research (an emerging technology research firm) the amount of data center space is growing about 9% a year in the U.S. Given that the top twenty markets in the US had a total of 22.1 million square feet of revenue producing data center space in 2012, the 9% increase will add approximately 2,000,000 square feet in 2013. And, in most areas the demand is growing faster than supply.

One 451 Research piece reported, ‘there is an unstoppable move to the cloud to host production workloads as well as to outsource services.’

Building an SAP Army

The SAP cloud tipping-point is rapidly approaching as more organizations are starting to adopt cloud solutions of all kinds, which necessitates a reduction or repurposing of their existing IT workforce. Currently, an army of IT professionals work together to support and maintain each production instance of SAP. To give you an idea of the size of the SAP army, consider these numbers:

• SAP is the third largest software company in the world
• Employees over 60,000 people worldwide
• Over 5000 programmers
• Revenue in excess of $20 Billion dollars
• More than 125,000 SAP installations
• Estimated over 15,000,000 users of SAP
• More than 30,000 companies run SAP

Given these amazing statistics, we still don’t know how many people are directly and indirectly required to support the thousands of instances and millions of people using SAP. We do know the number of support staff is in the millions.

For the coming SAP Cloud tipping-point the reverse of the power plant analogy is true. We already have thousands of individual ‘SAP power plants’ in thousands of business locations worldwide with thousands of people and other resources in support of this business model. What happens when the SAP Cloud adoption increases and organizations scramble to ‘plug in’ to the cloud?

Better, Faster, Cheaper Business Model

Just like typewriter repairmen, television antenna installers, milkmen delivering dairy products door to door, or digital cameras replacing photographic film cameras; life changes as better business models come along. And so it will be with the SAP Cloud. In this case, as companies streamline their SAP instances to a cloud hosting model, greater resources will be put into other areas to be more competitive in a changing marketplace. Job markets will also evolve to fulfill increasing demand for new types of IT positions in strategic growth and management within organizations.

The SAP Cloud tipping-point can be quantified as the difference between the number of people currently supporting SAP and the number required to support it when SAP transforms into a primarily cloud based platform. This transformation is occurring within SAP, but has been a gradual change due to the variety of modules and key SAP divisions. However, it is important that CIOs and other IT professionals keep a close eye on SAP and begin to develop their own cloud strategy to gain competitiveness.

Economies of Scale With Cloud-Based Solutions

Consider the economies of scale that will be working in favor of those organizations that move to a cloud based business model for their mission critical systems. The cost advantages that cloud providers offer are driving much of the interest in SAP Cloud solutions. Cloud providers can spread out their fixed costs across all customers for things such as the datacenter building, HVAC, electric power consumption, the racks, the hardware and even the technical services. This allows an enterprise hosting provider to fractionalize their fixed costs and charge only a portion of the full costs to each of their customers. This approach typically yields a lower cost to each customer than if they were to bear the entire fixed costs of supporting their own data center.

To compare SAP to a very successful cloud-based software company, consider Salesforce.com:

• Employees over 7,500 people worldwide
• Revenue in excess of $2.5 Billion dollars
• More than 104,300 customers (as of 2011)

The telling statistic is that Salesforce.com is able to service three times as many customers as SAP with one-eight as many employees. Also, Salesforce.com has well over 300,000 independent consultants and developers that do much of the custom programming and support work; saving many Salesforce.com customers the expense of employing these resources themselves. The comparison is not exactly apples to apples because SAP performs so many more functions as an ERP application than does Salesforce.com which is a CRM application. However, the compelling message of cloud computing is emphasized in Salesforce.com’s company slogan – No hardware. No Software. No headaches.

Secure-24 is an SAP Partner and recognized leader in providing SAP Cloud hosting and other services. With a large percentage of our global clients running SAP – we have an extensive portfolio that offers guidance and expertise in managing SAP in a private cloud. We have highly experienced SAP staff to handle all the daily care-and-feeding needs of SAP, including Basis, operating system management, risk mitigation, system monitoring, disaster recovery, storage and backup systems, and a flexible and scalable infrastructure.