The Open Group Trusted Technology Forum is Leading the Way to Securing Global IT Supply Chains

Transcript of a BriefingsDirect podcast focusing on the upcoming Open Group Conference and the effort to develop standards to make IT supply chains secure, verified, and trusted.

Listen to the podcast. Find it on iTunes/iPod. Download the transcript. Sponsor: The Open Group.

Register for The Open Group Conference
July 16-18 in Washington, D.C. Watch the live stream.

Dana Gardner: Hello, and welcome to a special BriefingsDirect thought leadership interview series coming to you in conjunction with the Open Group Conference this month in Washington, D.C. I'm Dana Gardner, Principal Analyst at Interarbor Solutions, and I'll be your host throughout these discussions.

The conference focuses on enterprise architecture (EA), enterprise transformation, and securing global supply chains. We're here now to focus on the latest effort to make global supply chains for technology providers more secure, verified, and therefore trusted. We'll examine the advancement of The Open Group Trusted Technology Forum (OTTF), which was established in late 2010.

We’ve assembled a panel of experts, including some of the major speakers at The Open Group Conference, to provide an update on the achievements at OTTF, and to learn more about how technology suppliers and buyers can expect to benefit. [Disclosure: The Open Group is a sponsor of BriefingsDirect podcasts.]

Please join me now in welcoming our panel. We're here with Dave Lounsbury, Chief Technical Officer at The Open Group. Welcome, Dave.

Dave Lounsbury: Hello, Dana.

Gardner: We're also here with Dan Reddy, Senior Consultant Product Manager in the Product Security Office at EMC Corp. Welcome, Dan.

Dan Reddy: Hi, Dana.

Gardner: We're also joined by Andras Szakal, Vice President and Chief Technology Officer at IBM's U.S. Federal Group, and also the Chair of the OTTF. He also leads the development of The Open Trusted Technology Provider Standard. Welcome back, Andras.

Andras Szakal: Thank you very much, Dana.

Gardner: And lastly, we're here with Edna Conway, Chief Security Strategist for Global Supply Chain at Cisco. Welcome, Edna.

Edna Conway: Delighted to be here, Dana.

Gardner: Dave Lounsbury, first to you. OTTF was created about 18 months ago, but I suspect that the urgency for these types of supply chain trust measures has only grown. We’ve seen some congressional testimony and we’ve seen some developments in the market that make this a bit more pressing.

Why this is an important issue, and why is there a sense of urgency in the markets?

Boundaryless information

Lounsbury: You framed it very nicely at the beginning, Dana. The Open Group has a vision of boundaryless information flow, and that necessarily involves interoperability. But interoperability doesn't have the effect that you want, unless you can also trust the information that you're getting, as it flows through the system.

Therefore, it’s necessary that you be able to trust all of the links in the chain that you use to deliver your information. One thing that everybody who watches the news would acknowledge is that the threat landscape has changed. As systems become more and more interoperable, we get more and more attacks on the system.

As the value that flows through the system increases, there’s a lot more interest in cyber crime. Unfortunately, in our world, there's now the issue of state-sponsored incursions in cyberspace, whether officially state-sponsored or not, but politically motivated ones certainly.

So there is an increasing awareness on the part of government and industry that we must protect the supply chain, both through increasing technical security measures, which are handled in lots of places, and in making sure that the vendors and consumers of components in the supply chain are using proper methodologies to make sure that there are no vulnerabilities in their components.

I'm sure that Andras, Edna, and Dan will give us a lot more detail on what those vulnerabilities are, but from an Open Group perspective, I'll note that the demand we're hearing is increasingly for work on standards in security, whether it's the technical security aspects or these global supply-chain aspects. That’s top of everybody's mind these days.

Gardner: Let’s go through our panel and try to get a bit more detail about what it is that we are trying to solve or prevent. Dan Reddy, what do you view as some of the critical issues that need to be addressed, and why the OTTF has been created in the first place?

Reddy: One of the things that we're addressing, Dana, is the supply chain item that was part of the Comprehensive National Cybersecurity Initiative (CNCI), which spans the work of two presidents. Initiative 11 was to develop a multi-pronged approach to global supply chain risk management. That really started the conversation, especially in the federal government as to how private industry and government should work together to address the risks there.

In the OTTF, we've tried create a clear measurable way to address supply-chain risk. It’s been really hard to even talk about supply chain risk, because you have to start with getting a common agreement about what the supply chain is, and then talk about how to deal with risk by following best practices.

Gardner: Andras, the same question. It seems like a vexing issue. How can one possibly develop the ability to verify deep into the supply chains, in many cases coming across international boundaries, and then bring into some play a standard to allow this to continue with a sense of security and trust? It sounds pretty daunting.

Szakal: In many ways, it is. One of the observations that I've made over the last couple of years is that this group of individuals, who are now part of this standards forum, have grown in their ability to collaborate, define, and rise to the challenges, and work together to solve the problem.

Standards process

Technology supply chain security and integrity are not necessarily a set of requirements or an initiative that has been taken on by the standards committee or standards groups up to this point. The people who are participating in this aren't your traditional IT standards gurus. They had to learn the standards process. They had to understand how to approach the standardization of best practices, which is how we approach solving this problem.

It’s sharing information. It’s opening up across the industry to share best practices on how to secure the supply chain and how to ensure its overall integrity. Our goal has been to develop a framework of best practices and then ultimately take those codified best practices and instantiate them into a standard, which we can then assess providers against. It’s a big effort, but I think we’re making tremendous progress.

Gardner: Because The Open Group Conference is taking place in Washington, D.C., what’s the current perception in the U.S. Government about this in terms of its role? Is this a "stand by and watch?" Is this "get involved?" Is there the thought of adding some teeth to this at some point that the government can display in terms of effective roles?

Szakal: Well, the whole forum arose out of the work that Dan just discussed with the CNCI. The government has always taken a prominent role, at least to help focus the attention of the industry.

The government has always taken a prominent role, at least to help focus the attention of the industry.

Now that they’ve corralled the industry and they’ve got us moving in the right direction, in many ways, we’ve fought through many of the intricate complex technology supply chain issues and we’re ahead of some of the thinking of folks outside of this group because the industry lives these challenges and understands the state of the art. Some of the best minds in the industry are focused on this, and we’ve applied some significant internal resources across our membership to work on this challenge.

So the government is very interested in it. We’ve had collaborations all the way from the White House across the Department of Defense (DoD) and within the Department of Homeland Security (DHS), and we have members from the government space in NASA and DoD.

It’s very much a collaborative effort, and I'm hoping that it can continue to be so and be utilized as a standard that the government can point to, instead of coming up with their own policies and practices that may actually not work as well as those defined by the industry.

Gardner: Edna Conway, have we missed anything in terms of being well-versed in understanding the challenge here?

Conway: The challenge is moving a little bit, and our colleagues on the public side of the public-private partnership addressing supply-chain integrity have recognized that we need to do it together.

More importantly, you need only to listen to a statement, which I know has often been quoted, but it’s worth noting again from EU Commissioner Algirdas Semeta. He recently said that in a globalized world, no country can secure the supply chain in isolation. He recognized that, again quoting, national supply chains are ineffective and too costly unless they’re supported by enhanced international cooperation.

Mindful focus

The one thing that we bring to bear here is a mindful focus on the fact that we need a public-private partnership to address comprehensively in our information and communications technology industry supply chain integrity internationally. That has been very important in our focus. We want to be a one-stop shop of best practices that the world can look at, so that we continue to benefit from commercial technology which sells globally and frequently builds once or on a limited basis.

Combining that international focus and the public-private partnership is something that's really coming home to roost in everyone’s minds right now, as we see security value migrating away from an end point and looking comprehensively at the product lifecycle or the global supply chain.

Gardner: We obviously have an important activity. We have now more collaboration among and between public and private sectors as well as the wider inclusion of more countries and more regions.

Dave Lounsbury, perhaps you could bring us up to speed on where we are in terms of this as a standard. Eighteen months isn’t necessarily a long time in the standards business, but there is, as we said, some emergency here. Perhaps you could set us up in understanding where we are in the progression and then we’ll look at some of the ways in which these issues are being addressed.

Lounsbury: I’d be glad to, Dana, but before I do that, I want to amplify on the point that Edna and Andras made. I had the honor of testifying before the House Energy and Commerce Committee on Oversight Investigations, on the view from within the U.S. Government on IT security.

It was even more gratifying to see that the concerns that were raised in the hearings were exactly the ones that the OTTF is pursuing.

It was very gratifying to see that the government does recognize this problem. We had witnesses in from the DoD and Department of Energy (DoE). I was there, because I was one of the two voices on industry that the government wants to tap into to get the industry’s best practices into the government.

It was even more gratifying to see that the concerns that were raised in the hearings were exactly the ones that the OTTF is pursuing. How do you validate a long and complex global supply chain in the face of a very wide threat environment, recognizing that it can’t be any single country? Also, it really does need to be not a process that you apply to a point, but something where you have a standard that raises the bar for our security for all the participants in your supply chain.

So it was really good to know that we were on track and that the government, and certainly the U.S. Government, as we’ve heard from Edna, the European governments, and I suspect all world governments are looking at exactly how to tap into this industry activity.

Now to answer your question directly -- in the last 18 months, there has been a tremendous amount of progress. The thing that I'll highlight is that early in 2012, the OTTF published a snapshot of the standard. A snapshot is what The Open Group uses to give a preview of what we expect the standards will apply. It has fleshed out two areas, one on tainted products and one on counterfeit products, the standards and best practices needed to secure a supply chain against those two vulnerabilities.

So that’s out there. People can take a look at that document. Of course, we would welcome their feedback on it. We think other people have good answers too. Also, if they want to start using that as guidance for how they should shape their own practices, then that would be available to them.

Normative guidance

Of course, with Andras as the Chair, Edna as the Vice-Chair, and Dan as a key contributor, I'm probably the least qualified one on the call to talk about the current state, but what they've been focusing on is how you would go from having the normative guidance of the standard to having some sort of a process by which a vendor could indicate their conformance to those best practices and standards.

That’s the top development topic inside the OTTF itself. Of course, in parallel with that, we're continuing to engage in an outreach process and talking to government agencies that have a stake in securing the supply chain, whether it's part of government policy or other forms of steering the government to making sure they are making the right decisions. In terms of exactly where we are, I'll defer to Edna and Andras on the top priority in the group.

Gardner: Let’s do that. Edna, can you perhaps fill us in on what the prioritization, some of the activities, a recap if you will of what’s been going on at OTTF and where things stand?

Conway: We decided that this was, in fact, a comprehensive effort that was going to grow over time and change as the challenges change. We began by looking at two primary areas, which were counterfeit and taint in that communications technology arena. In doing so, we first identified a set of best practices, which you referenced briefly inside of that snapshot.

Where we are today is adding the diligence, and extracting the knowledge and experience from the broad spectrum of participants in the OTTF to establish a set of rigorous conformance criteria that allow a balance between flexibility and how one goes about showing compliance to those best practices, while also assuring the end customer that there is rigor sufficient to ensure that certain requirements are met meticulously, but most importantly comprehensively.

Register for The Open Group Conference
July 16-18 in Washington, D.C. Watch the live stream.

We have a practice right now where we're going through each and every requirement or best practice and thinking through the broad spectrum of the development stage of the lifecycle, as well as the end-to-end nodes of the supply chain itself.

This is to ensure that there are requirements that would establish conformance that could be pointed to, by both those who would seek accreditation to this international standard, as well as those who would rely on that accreditation as the imprimatur of some higher degree of trustworthiness in the products and solutions that are being afforded to them, when they select an OTTF accredited provider.

Gardner: Andras, when we think about the private sector having developed a means for doing this on its own, that now needs to be brought into a standard and towards an accreditation process. I'm curious where in an organization like IBM, that these issues are most enforceable.

Is this an act of the procurement group? Is it the act of the engineering and the specifying? Is it a separate office, like Dan is, with the product security office? I know this is a big subject. I don’t want to go down too deeply, but I'm curious as to where within the private sector the knowledge and the expertise for these sorts of things seem to reside?

Szakal: That’s a great question, and the answer is both. Speaking for IBM, we recently celebrated our 100th anniversary in 2011. We’ve had a little more time than some folks to come up with a robust engineering and development process, which harkens back to the IBM 701 and the beginning of the modern computing era.

Integrated process

We have what we call the integrated product development process (IPD), which all products follow and that includes hardware and software. And we have a very robust quality assurance team, the QSE team, which ensures that the folks are following those practices that are called out. Within each of line of business there exist specific requirements that apply more directly to the architecture of a particular product offering.

For example, the hardware group obviously has additional standards that they have to follow during the course of development that is specific to hardware development and the associated supply chain, and that is true with the software team as well.

The product development teams are integrated with the supply chain folks, and we have what we call the Secure Engineering Framework, of which I was an author and the Secure Engineering Initiative which we have continued to evolve for quite some time now, to ensure that we are effectively engineering and sourcing components and that we're following these Open Trusted Technology Provider Standard (O-TTPS) best practices.

In fact, the work that we've done here in the OTTF has helped to ensure that we're focused in all of the same areas that Edna’s team is with Cisco, because we’ve shared our best practices across all of the members here in the OTTF, and it gives us a great view into what others are doing, and helps us ensure that we're following the most effective industry best practices.

Gardner: It makes sense, certainly, if you want to have a secure data center, you need to have the various suppliers that contribute to the creation of that data center operating under some similar processes.

We want to be able to encourage suppliers, which may be small suppliers, to conform to a standard, as we go and select who will be our authorized suppliers.

Dan Reddy at EMC, is the Product Security Office something similar to what Andras explained for how IBM operates? Perhaps you could just give us a sense of how it’s done there in terms of who is responsible for this, and then how those processes might migrate out to the standard?

Reddy: At EMC in our Product Security Office, we house the enabling expertise to define how to build their products securely. We're interested in building that in as soon as possible throughout the entire lifecycle. We work with all of our product teams to measure where they are, to help them define their path forward, as they look at each of the releases of their other products. And we’ve done a lot of work in sharing our practices within the industry.

One of the things this standard does for us, especially in the area of dealing with the supply chain, is it gives us a way to communicate what our practices are with our customers. Customers are looking for that kind of assurance and rather than having a one-by-one conversation with customers about what our practices are for a particular organization. This would allow us to have a way of demonstrating the measurement and the conformance against a standard to our own customers.

Also, as we flip it around and take a look at our own suppliers, we want to be able to encourage suppliers, which may be small suppliers, to conform to a standard, as we go and select who will be our authorized suppliers.

Gardner: Dave Lounsbury at The Open Group, it seems that those smaller suppliers that want to continue to develop and sell goods to such organizations as EMC, IBM, and Cisco would be wise to be aware of this standard and begin to take steps, so that they can be in compliance ahead of time or even seek accreditation means.

What would you suggest for those various suppliers around the globe to begin the process, so that when the time comes, they're in an advantageous position to continue to be vigorous participants in these commerce networks?

Publications catalog

Lounsbury: Obviously, the thing I would recommend right off is to go to The Open Group website, go to the publications catalog, and download the snapshot of the OTTF standard. That gives a good overview of the two areas of best practices for protection from tainted and counterfeit products we’ve mentioned on the call here.

That’s the starting point, but of course, the reason it’s very important for the commercial world to lead this is that commercial vendors face the commercial market pressures and have to respond to threats quickly. So the other part of this is how to stay involved and how to stay up to date?

And of course the two ways that The Open Group offers to let people do that is that you can come to our quarterly conferences, where we do regular presentations on this topic. In fact, the Washington meeting is themed on the supply chain security.

Of course, the best way to do it is to actually be in the room as these standards are evolved to meet the current and the changing threat environment. So, joining The Open Group and joining the OTTF is absolutely the best way to be on the cutting edge of what's happening, and to take advantage of the great information you get from the companies represented on this call, who have invested years-and-years, as Andras said, in making their own best practices and learning from them.

Gardner: Edna Conway, we’ve mentioned a couple of the early pillars of this effort -- taint and counterfeit. Do we have a sense of what might be the next areas that would be targeted. I don’t mean for you all to set in stone your agenda, but I'm curious as to what's possible next areas would be on the short list of priorities?

It's from that kind of information sharing, as we think in a more comprehensive way, that we begin to gather the expertise.

Conway: You’ve heard us talk about CNCI, and the fact that cybersecurity is on everyone’s minds today. So while taint embodies that to some degree, we probably need to think about partnering in a more comprehensive way under the resiliency and risk umbrella that you heard Dan talk about and really think about embedding security into a resilient supply chain or a resilient enterprise approach.

In fact, to give that some forethought, we actually have invited at the upcoming conference, a colleague who I've worked with for a number of years who is a leading expert in enterprise resiliency and supply chain resiliency to join us and share his thoughts.

He is a professor at MIT, and his name is Yossi Sheffi. Dr. Sheffi will be with us. It's from that kind of information sharing, as we think in a more comprehensive way, that we begin to gather the expertise that not only resides today globally in different pockets, whether it be academia, government, or private enterprise, but also to think about what the next generation is going to look like.

Resiliency, as it was known five years ago, is nothing like supply chain resiliency today, and where we want to take it into the future. You need only look at the US national strategy for global supply chain security to understand that. When it was announced in January of this year at Davos by Secretary Napolitano of the DHS, she made it quite clear that we're now putting security at the forefront, and resiliency is a part of that security endeavor.

So that mindset is a change, given the reliance ubiquitously on communications, for everything, everywhere, at all times -- not only critical infrastructure, but private enterprise, as well as all of us on a daily basis today. Our communications infrastructure is essential to us.

Thinking about resiliency

Given that security has taken top ranking, we’re probably at the beginning of this stage of thinking about resiliency. It's not just about continuity of supply, not just about prevention from the kinds of cyber incidents that we’re worried about, but also to be cognizant of those nation-state concerns or personal concerns that would arise from those parties who are engaging in malicious activity, either for political, religious or reasons.

Or, as you know, some of them are just interested in seeing whether or not they can challenge the system, and that causes loss of productivity and a loss of time. In some cases, there are devastating negative impacts to infrastructure.

Gardner: Andras at IBM, any thoughts on where the next priorities are? We heard resiliency and security. Any other inputs from your perspective?

Szakal: I am highly focused right now on trying to establish an effective and credible accreditation program, and working to test the program with the vendors.

From an IBM perspective, we're certainly going to try to be part of the initial testing of the program. When we get some good quality data with respect to challenges or areas that the OTTF thinks need refinement, then the members will make some updates to the standard.

We'll then be able to take that level of confidence and assurance that we get from knowing that and translate it to the people who are acquiring our technology as well.

There's another area too that I am highly focused on, but have kind of set aside, and that's the continued development and formalization of the framework itself that is to continue the collective best practices from the industry and provide some sort of methods by which vendors can submit and externalize those best practices. So those are a couple of areas that I think that would keep me busy for the next 12 months easily.

Gardner: Before we wrap up, I want to try to develop some practical examples of where and how this is being used successfully, and I’d like to start with you, Dan. Do you have any sense of where, in a supply chain environment, the focus on trust and verification has come to play and has been successful?

I don’t know if you can mention names, but at least give our listeners and readers a sense of how this might work by an example of what’s already taken place?

Reddy: I'm going to build on what I said a little bit earlier in terms of working with our own suppliers. What we're envisioning here is an ecosystem, where as any provider of technology goes and sources the components that go into our products, we can turn around and have an expectation that those suppliers will have gone through this process. We'll then be able to take that level of confidence and assurance that we get from knowing that and translate it to the people who are acquiring our technology as well.

As Andras is saying, this is going to take a while to roll out and get everyone to take advantage of this, but ultimately, our success is going to be measured by if we have a fully functioning ecosystem, where this is the way that we measure conformance against the standard, whether you are a large or a small company.

Further along

We think that this initiative is further along than most anything else in the landscape today. When people take a look at it, they'll realize that all of the public and private members that have created this have done it through a very rigorous conformance and consensus process. We spend a lot of time weighing and debating every single practice that goes into the standard and how it’s expressed.

You may be able to read 50 pages quickly, but there is a lot behind it. As people figure out how those practices match up with their own practices and get measured against them, they're going to see a lot of the value.

Conway: It’s being used in a number of companies that are part of OTTF in a variety of ways. You’ve heard Dan talk about what we would expect of our suppliers, and obviously, for me, the supply chain is near and dear to my heart, as I develop that strategy. But, what I think you will see is a set of practices that companies are already embracing.

For example, at Cisco, we think about establishing trustworthy networks. Dan’s company may have a slightly different view given the depth and breadth of the portfolio of what EMC delivers to its many customers with integrity. Embedding this kind of supply chain security as a foundational element of what you're delivering to the customer requires that you actually have a go-to-market strategy that allows you to address integrity and security within it.

Then to flip back to what Dan said, you need areas of discipline, where there are best practices with regard to things like logistics security and electronic fabrication practices, obviously, looking uniquely in our industry which is what the OTTF is focusing on.

You need areas of discipline, where there are best practices with regard to things like logistics security and electronic fabrication practices.

If you look deeply, you'll find that there is a way to take a best practice and actually follow it. I just came from Florida, where I was stuck in a tropical storm so I have those storm "spaghetti models" that the media show on the television to predict the path of storm action. If you looked at O-TTPS as a spaghetti model, so to speak, you would have the hub being the actual best practice, but there are already pockets of best practices being used.

You heard Andras talk about the fact that IBM has a robust methodology with regard to secure engineering. You heard Dan mention it as well. We too at Cisco have a secure development lifecycle with practices that need to be engaged in. So it’s embracing the whole, and then bringing it down into the various nodes of the supply chain and practices.

There are pockets right now in development, in logistics, and in fabrication already well under way that we are going to both capitalize on, and hopefully raise the bar for the industry overall. Because if we do this properly, in the electronics industry we all use the vast majority of a similar set of supply-chain partners.

What that will do is raise the bar for the customers and allow those of us who are innovators to differentiate on our innovation and on how we might achieve the best practices, rather than worrying about are you trustworthy or not. If we do it right, trust will be an automatic given.

Gardner: I have to imagine that going out to the market with the ability to assert that level of trust is a very good position in terms of marketing and competitive analysis. So this isn’t really something that goes on without a lot of commercial benefits associated with it, when it’s done properly. Any reaction to that Andras in terms of companies that do this well? I guess they should feel that they have an advantage in the market.

Secure by Design

Szakal: Especially now in this day and age, any time that you actually approach security as part of the lifecycle -- what we call an IBM Secure by Design -- you're going to be ahead of the market in some ways. You're going to be in a better place. All of these best practices that we’ve defined are additive in effect. However, the very nature of technology as it exists today is that it will be probably another 50 or so years, before we see a perfect security paradigm in the way that we all think about it.

So the researchers are going to be ahead of all of the providers in many ways in identifying security flaws and helping us to remediate those practices. That’s part of what we're doing here, trying to make sure that we continue to keep these practices up to date and relevant to the entire lifecycle of commercial off-the-shelf technology (COTS) development.

So that’s important, but you also have to be realistic about the best practices as they exist today. The bar is going to move as we address future challenges.

Gardner: I'm afraid we have to leave it there. We’ve been talking about making global supply chains for technology providers more secure, verified, and therefore, trusted. We’ve been learning about the achievements of OTTF and how technology suppliers and buyers will expect to benefit from that moving forward.

You also have to be realistic about the best practices as they exist today. The bar is going to move as we address future challenges.

This special BriefingsDirect discussion comes to you in conjunction with The Open Group Conference from July 16 - 20 in Washington, D.C. You’ll hear more from these and other experts on the ways that IT and enterprise architecture support any enterprise transformation as well as how global supply chains are being better secured.

I’d like to thank our panel for this very interesting discussion. We’ve been here with Dave Lounsbury, Chief Technical Officer at The Open Group. Thanks, Dave.

Lounsbury: Thank you, Dana.

Gardner: We’ve also been here with Dan Reddy, Senior Consultant Product Manager in the Product Security Office at EMC. Thanks, Dan.

Reddy: Thanks, Dana.

Gardner: We’ve been joined by Andras Szakal, Vice President and Chief Technology Officer at IBM’s US Federal Group as well as the Chairman of the OTTF. Thank you, Andras.

Szakal: My pleasure, Dana.

Gardner: And lastly, Edna Conway, Chief Security Strategist for Global Supply Chain at Cisco. Thanks so much for your input.

Conway: My pleasure. I’ll look forward to seeing everyone in Washington.

Gardner: Yes, and I’ll look forward to all of your presentations and discussions in Washington as well. I encourage our readers and listeners to attend the conference and learn even more. Some of the proceedings will be online and available for streaming, and you could take advantage of that as well.

This is Dana Gardner, Principal Analyst at Interarbor Solutions, your host and moderator through these thought leadership interviews. Thanks again for listening, and come back next time.

Register for The Open Group Conference
July 16-18 in Washington, D.C. Watch the live stream.

Listen to the podcast. Find it on iTunes/iPod. Download the transcript. Sponsor: The Open Group.

Transcript of a BriefingsDirect podcast focusing on the upcoming Open Group Conference and the effort to develop standards to make IT supply chains secure, verified, and trusted. Copyright The Open Group and Interarbor Solutions, LLC, 2005-2012. All rights reserved.

You may also be interested in:

• Corporate Data, Supply Chains Remain Vulnerable to Cyber Crime Attacks Says Open Group Conference Speaker
• Open Group Conference Speakers Discuss the Cloud: Higher Risk or Better Security?
• Capgemini's CTO on Why Cloud Computing Exposes the Duality Between IT and Business
• San Francisco Conference observations: Enterprise transformation, enterprise architecture, SOA and a splash of cloud computing
  
• MIT's Ross on how enterprise architecture and IT more than ever lead to business transformation
• Overlapping criminal and state threats pose growing cyber security threat to global Internet commerce, says Open Group speaker
• Enterprise architects play key role in transformation, data analytics value -- but they need to act fast, say Open Group speakers

The Open Group and MIT Experts Detail New Advances in Identity Management to Help Reduce Cyber Risk

Transcript of a BriefingsDirect podcast in conjunction with the upcoming Open Group Conference on the current state and future outlook for identity management.

Listen to the podcast. Find it on iTunes/iPod. Download the transcript. Sponsor: The Open Group.

Register for The Open Group Conference
July 16-18 in Washington, D.C. Watch the live stream.

Dana Gardner: Hello, and welcome to a special BriefingsDirect thought leadership interview series coming to you in conjunction with The Open Group Conference this July in Washington, D.C. I'm Dana Gardner, Principal Analyst at Interarbor Solutions, and I'll be your host throughout these discussions.

The conference will focus on enterprise architecture (EA), enterprise transformation, and securing global supply chains. Today, we're here to focus on cyber security, and the burgeoning role that identity (ID) management plays in overall better securing digital assets and systems.

We’ll examine the relationship between controlled digital identities in cyber risk management, and explore how the technical and legal support of ID management best practices have been advancing rapidly. We’ll also see how individuals and organizations can better protect themselves through better understanding and managing of their online identities.

Joining us now to delve into this fast-evolving area are few of the main speakers at the July 16 conference. We are here with Jim Hietala, the Vice President of Security at The Open Group. Welcome, Jim. [Disclosure: The Open Group is a sponsor of BriefingsDirect podcasts.]

Jim Hietala: Thanks Dana, good to be with you.

Gardner: We are also here with Thomas Hardjono, Technical Lead and Executive Director of the MIT Kerberos Consortium. Welcome, Thomas.

Thomas Hardjono: Hello, Dana.

Gardner: And we are joined by Dazza Greenwood, President of the CIVICS.com consultancy, and lecturer at the MIT Media Lab. Welcome, Dazza.

Dazza Greenwood: Hi. Good to be here.

Gardner: Jim, first question to you. Let’s describe the lay of the land for our listeners. What is ID management generally and how does it form a fundamental component of cyber security?

Hietala: ID management is really the process of identifying folks who are logging onto computing services, assessing their identity, looking at authenticating them, and authorizing them to access various services within a system. It’s something that’s been around in IT since the dawn of computing, and it’s something that keeps evolving in terms of new requirements and new issues for the industry to solve.

Particularly as we look at the emergence of cloud and software-as-a-service (SaaS) services, you have new issues for users in terms of identity, because we all have to create multiple identities for every service we access.

You have issues for the providers of cloud and SaaS services, in terms of how they provision, where they get authoritative identity information for the users, and even for enterprises who have to look at federating identity across networks of partners. There are a lot of challenges there for them as well.

Gardner: Is it fair to say, Jim, that as we expand the boundaries of process and commerce beyond the four walls of the enterprise, that this becomes even more urgent, more of an issue?

Key theme

Hietala: I do think it’s fair to say that. Figuring out who is at the other end of that connection is fundamental to all of cyber security. As we look at the conference that we're putting on this month in Washington, D.C., a key theme is cyber security -- and identity is a fundamental piece of that. So, yeah, I think that’s a fair characterization.

Gardner: Let’s go to you, Thomas. How have you been viewing this in terms of an evolution? Are we at a plateau that we're now starting to advance from? Has this been a continuous progression over the past decade? How has ID management been an active topic?

Hardjono: So it’s been at least a decade since the industry began addressing identity and identity federation. Someone in the audience might recall Liberty Alliance, the Project Liberty in its early days.

One notable thing about the industry is that the efforts have been sort of piecemeal, and the industry, as a whole, is now reaching the point where a true correct identity is absolutely needed now in transactions in a time of so many so-called Internet scams.

The number attacks have increased, including attacks from state-sponsored co-terrorists, all the way to so-called Nigerian scammers. This brings to the forefront the fact that we need two things right now, yesterday even, namely, identity under federation and also a scalable authorization mechanism that’s linked to this strong identity.

Gardner: Dazza, is there a casual approach to this, or a professional need? By that, I mean that we see a lot of social media activities, Facebook for example, where people can have an identity and may or may not be verified. That’s sort of the casual side, but it sounds like what we’re really talking about is more for professional business or eCommerce transactions, where verification is important. In other words, is there a division between these two areas that we should consider before we get into it more deeply?

Greenwood: Rather than thinking of it as a division, a spectrum would be a more useful way to look at it. On one side, you have, as you mentioned, a very casual use of identity online, where it may be self-asserted. It may be that you've signed a posting or an email.

On the other side, of course, the Internet and other online services are being used to conduct very high value, highly sensitive, or mission-critical interactions and transactions all the time. When you get toward that spectrum, a lot more information is needed about the identity authenticating, that it really is that person, as Thomas was starting to foreshadow. The authorization, workflow permissions, and accesses are also incredibly important.

In the middle, you have a lot of gradations, based partly on the sensitivity of what’s happening, based partly on culture and context as well. When you have people who are operating within organizations or within contexts that are well-known and well-understood -- or where there is already a lot of not just technical, but business, legal, and cultural understanding of what happens -- if something goes wrong, there are the right kind of supports and risk management processes.

There are different ways that this can play out. It’s not always just a matter of higher security. It’s really higher confidence, and more trust based on a variety of factors. But the way you phrased it is a good way to enter this topic, which is, we have a spectrum of identity that occurs online, and much of it is more than sufficient for the very casual or some of the social activities that are happening.

Higher risk

But as the economy in our society moves into a digital age, ever more fully and at ever-higher speeds, much more important, higher risk, higher value interactions are occurring. So we have to revisit how it is that we have been addressing identity -- and give it more attention and a more careful design, instead of architectures and rules around it. Then we’ll be able to make that transition more gracefully and with less collateral damage, and really get to the benefits of going online.

Gardner: Jim Hietala, before we go into what’s been happening in the field around ID management, I just wanted to get a better sense of the urgency here. We hear quite a bit about consumerization of IT trends in the enterprise, driven in many respects by mobile use. But it seems to me that there is a need here to move rapidly away from de facto single sign-on through some of the social networks and get more of a mission-critical approach to this.

Do you agree that people have been falling into a consumer’s sense of security for single sign-on, but that it really needs to be better, and therefore we need to ramp up the urgency around it?

Hietala: I do agree with that. It’s not just mobile. You can look at things that are happening right now in terms of trojans, bank fraud, scammers, and attackers, wire transferring money out of company’s bank accounts and other things you can point to.

There are failures in their client security and the customer’s security mechanisms on the client devices, but I think there are also identity failures. They need new approaches for financial institutions to adopt to prevent some of those sorts of things from happening. I don’t know if I’d use the word "rampant," but they are clearly happening all over the place right now. So I think there is a high need to move quickly on some of these issues.

They need new approaches for financial institutions to adopt to prevent some of those sorts of things from happening.

Gardner: I sense that the legacy or historical approach was piecemeal, somewhat slow to react to the marketplace. Then, there is this other side, where the social mechanisms have crept in, and in the middle of this big hole you could drive a truck through.

So let’s talk about what’s going to be happening to shore this up and pull it together? Let’s look at some of the big news. What are some of the large milestones? We’ll start with you Jim for ID management leading up to the present.

Hietala: Well, so I think the biggest recent news is the US National Strategy for Trusted Identities in Cyber Space (NSTIC) initiative. We’ll probably talk about that as we go through this discussion, but that clearly shows that a large government, the United States government, is focused on the issue and is willing to devote resources to furthering an ID management ecosystem and construct for the future.

To me that’s the biggest recent news. You can look on the threat and attack side, and see all sorts of instances, where even the LinkedIn attacks from the last week or so, demonstrate that identity and the loss of identity information is a big deal. You don’t have to look far in the news headlines these days to see identity taking front and center as a big issue that needs to be addressed.

Gardner: Let’s go to you Dazza. What do you see as the big news or milestones of the day. Then, maybe a secondary question on what Jim just mentioned -- that it’s not just about protecting ID, that the bad guys are often trying to take IDs away from others?

At a crossroads

Greenwood: I think that’s right. Where we are just now is at a crossroads where finally industry, government, and increasingly the populations in general, are understanding that there is a different playing field. In the way that we interact, the way we work, the way we do healthcare, the way we do education, the way our social groups cohere and communicate, big parts are happening online.

In some cases, it happens online through the entire lifecycle. What that means now is that a deeper approach is needed. Jim mentioned NSTIC as one of those examples. There are a number of those to touch on that are occurring because of the profound transition that requires a deeper treatment.

NSTIC is the US government’s roadmap to go from its piecemeal approach to a coherent architecture and infrastructure for identity within the United States. It could provide a great model for other countries as well.

People can reuse their identity, and we can start to address what you're talking about with identity and other people taking your ID, and more to the point, how to prove you are who you said you were to get that ID back. That’s not always so easy after identity theft, because we don’t have an underlying effective identity structure in the United States yet.

I just came back from the United Kingdom at a World Economic Forum meeting. I was very impressed by what their cabinet officers are doing with an identity-assurance scheme in large scale procurement. It's very consistent with the NSTIC approach in the United States. They can get tens of millions of their citizens using secure well-authenticated identities across a number of transactions, while always keeping privacy, security, and also individual autonomy at the forefront.

Practically everywhere you look, you see news and signs of this transition that’s occurring, an exciting time for people interested in identity.

There are a number of technology and business milestones that are occurring as well. Open Identity Exchange (OIX) is a great group that’s beginning to bring industry and other sectors together to look at their approaches and technology. We’ve had Security Assertion Markup Language (SAML). Thomas is co-chair of the PC, and that’s getting a facelift.

That approach was being brought to match scale with OpenID Connect, which is OpenID and OAuth. There are a great number of technology innovations that are coming online.

Legally, there are also some very interesting newsworthy harbingers. Some of it is really just a deeper usage of statutes that have been passed a few years ago -- the Uniform Electronic Transactions Act, the Electronic Signatures in Global and National Commerce Act, among others, in the US.

There is eSignature Directive and others in Europe and in the rest of the world that have enabled the use of interactions online and dealt with identity and signatures, but have left to the private sector and to culture which technologies, approaches, and solutions we’ll use.

Now, we're not only getting one-off solutions, but architectures for a number of different solutions, so that whole sectors of the economy and segments of society can more fully go online. Practically everywhere you look, you see news and signs of this transition that’s occurring, an exciting time for people interested in identity.

Gardner: Before we define a few of these approaches, Thomas, a similar question to you, but through a technical lens. What’s most new and interesting from your perspective on what’s being brought to bear on this problem, particularly from a technology perspective?

Two dimensions

Hardjono: It's along two dimensions. The first one is within the Kerberos Consortium. We have a number of people coming from the financial industry. They all have the same desire, and that is to scale their services to the global market, basically sign up new customers abroad, outside United States. In wanting to do so, they're facing a question of identity. How do we assert that somebody in a country is truly who they say they are.

The second, introduces a number of difficult technical problems. Closer to home and maybe at a smaller scale, the next big thing is user consent. The OpenID exchange and the OpenID Connect specifications have been completed, and people can do single sign-on using technology such as OAuth 2.0.

The next big thing is how can an attribute provider, banks, telcos and so on, who have data about me, share data with other partners in the industry and across the sectors of the industry with my expressed consent in a digital manner.

Gardner: Let’s drill down a little bit. Dazza, tell us a bit about the MIT Core ID approach and how this relates to the Jericho Forum approach. I suppose you'd have to just do a quick explanation of what Jericho is in the process of explaining it.

Greenwood: I would defer to Jim of The Open Group to speak more authoritatively on Jericho Forum, which is a part of Open Group. But, in general, Jericho Forum is a group of experts in the security field from industry and, more broadly, who have done some great work in the past on deperimeterized security and some other foundational work.

With a lot of the solutions in the market, your different aspects of life, unintentionally sometimes or even counter-intentionally, will merge.

In the last few years, they've been really focused on identity, coming to realize that identity is at the center of what one would have to solve in order to have a workable approach to security. It's necessary, but not sufficient, for security. We have to get that right.

To their credit, they've come up with a remarkably good list of simple understandable principles, that they call the Jericho Forum Identity Commandments, which I strongly commend to everybody to read.

It puts forward a vision of an approach to identity, which is very constant with an approach that I've been exploring here at MIT for some years. A person would have a core ID identity, a core ID, and could from that create more than one persona. You may have a work persona, an eCommerce persona, maybe a social and social networking persona and so on. Some people may want a separate political persona.

You could cluster all of the accounts, interactions, services, attributes, and so forth, directly related to each of those to those individual personas, but not be in a situation where we're almost blindly backing into right now. With a lot of the solutions in the market, your different aspects of life, unintentionally sometimes or even counter-intentionally, will merge.

Good architecture

Sometimes, that’s okay. Sometimes, in fact, we need to be able to have an inability to separate different parts of life. That’s part of privacy and can be part of security. It's also just part of autonomy. It's a good architecture. So Jericho Forum has got the commandments.

Many years ago, at MIT, we had a project called the Identity Embassy here in the Media Lab, where we put forward some simple prototypes and ideas, ways you could do that. Now, with all the recent activity we mentioned earlier toward full-scale usage of architectures for identity in US with NSTIC and around the world, we're taking a stronger, deeper run at this problem.

Thomas and I have been collaborating across different parts of MIT. I'm putting out what we think is a very exciting and workable way that you can in a high security manner, but also quite usably, have these core identifiers or individuals and inextricably link them to personas, but escape that link back to the core ID, and from across the different personas, so that you can get the benefits when you want them, keeping the personas separate.

Also it allows for many flexible business models and other personalization and privacy services as well, but we can get into that more in the fullness of time. But, in general, that’s what’s happening right now and we couldn’t be more excited about it.

Gardner: Of course, you'll be discussing this in greater detail at The Open Group Conference coming up on July 16, so we look forward to that. When it comes to this notion of a core ID, where might that be implemented and instantiated? Where would I keep my core ID, so that I could develop these other personas, have a form of federation as a result, but managed through my own core? Where would that core reside?

It's important to recognize that people are not computer scientists and hardware manufacturers, and don't run data centers in their basements.

Greenwood: I'll say a couple of words on that and I think Thomas has a few words as well. The Jericho Forum is pretty definite that they favor having the individual human being have a hardware device of some kind, a cryptographically hardened module of some kind, within which the data that comprises the core identifier.

Also some wrapping data that Thomas and I are putting forward in the proposed architecture would reside on it, and that would be literally owned and under control of, in the pocket of, the person, so they can treat it almost like their wallet. It maybe would become part of the future wallet, or what we come to think of this as a wallet, with digital walletized services on phones and other devices people have with them.

So there is that high dimension, a very basic answer where the data would reside. It's important to recognize that people are not computer scientists and hardware manufacturers, and don't run data centers in their basements. There is always a critical role for service providers to make this easy for people, so there would be simple products and simple services that people can use to have the issuance and management of each of layers of their identity.

Part of what we have done is come up with an architecture with the right types of institutions. Mixes of governments and other highly-trusted institutions that for hundreds or more years have already been the authoritative source for identity, as opposed to new startups, would have their appropriate role. Then, layers of service providers that provide personalization, eCommerce, and other services, whatever their appropriate roles within the ecosystem we’re looking toward to help support and enable within the architecture we’re putting up. Thomas may have some more on that.

Hardjono: I agree with Dazza. For a global infrastructure for core identities to be able to develop, we definitely need collaboration between the governments of the world and the private sector. Looking at this problem, we were searching back in history to find an analogy, and the best analogy we could find was the rollout of a DNS infrastructure and the IP address assignment.

Register for The Open Group Conference
July 16-18 in Washington, D.C. Watch the live stream.

Here today

It's not perfect and it's got its critics, but the idea is that you could split blocks of IP addresses and get it sold and resold by private industry, really has allowed the Internet to scale, hitting limitations, but of course IPv6 is on the horizon. It's here today.

So we were thinking along the same philosophy, where core identifiers could be arranged in blocks and handed out to the private sector, so that they can assign, sell it, or manage it on behalf of people who are Internet savvy, and perhaps not, such as my mom. So we have a number of challenges in that phase.

Gardner: Very interesting. Does this relate to the MIT Model Trust Framework System Rules project? If so, please explain how and how this notion of a directory -- either private, public or in some combination -- would help to move this core ID concept forward.

Greenwood: The Model Trust Framework System Rules project that we are pursuing in MIT is a very important aspect of what we're talking about. Thomas and I talked somewhat about the technical and practical aspects of core identifiers and core identities. There is a very important business and legal layer within there as well.

So these trust framework system rules are ways to begin to approach the complete interconnected set of dimensions necessary to roll out these kinds of schemes at the legal, business, and technical layers.

What’s really missing is the business models, business cases, and of course the legal side.

They come from very successful examples in the past, where organizations have federated ID with more traditional approaches such as SAML and other approaches. There are some examples of those trust framework system rules at the business, legal, and technical level available.

Right now it’s CIVICS.com, and soon, when we have our model MIT under Creative Commons approach, we'll take a lot of the best of what’s come before codified in a rational way. Business, legal, and technical rules can really be aligned in a more granular way to fit well, and put out a model that we think will be very helpful for the identity solutions of today that are looking at federate according to NSTIC and similar models. It absolutely would be applicable to how at the core identity persona underlying architecture and infrastructure that Thomas, I, and Jericho Forum are postulating could occur.

Gardner: Thomas, anything to add to what Dazza just said?

Hardjono: No. I'm looking back 10-15 years. We engineers came up with all sorts of solutions and standardized them. What’s really missing is the business models, business cases, and of course the legal side.

How can a business make revenue out of the management of identity-related aspects, management of attributes, and so on and how can they do so in such a manner that it doesn’t violate the user’s privacy. But it’s still user-centric in the sense that the user needs to give consent and can withdraw consent and so on. And trying to develop an infrastructure where everybody is protected.

Gardner: So it sounds as if you are proposing a chartered or regulated industry, perhaps modeled somewhat on ICANN and the way that DNS has been managed to be the facilitator of these core IDs and then further into federation. Is that fair?

Almost an afterthought

Hardjono: It's only an analogy. Unfortunately if you look at history, people say that ICANN is an organization that was put together quickly, slapped together quickly, because the Internet was growing so fast. It's almost an afterthought for how to regulate the management of IP addresses.

I am hoping that this time around, for identity, we have a more planned and thought-out process that would allow an infrastructure to remain for the next 50 years or 100 years and scale for the needs of technology 50 years from now and 100 years from now.

Greenwood: I’ll just pick up on that a little bit. What you described there was like be a regulated industry. Perhaps one day, but that’s not today and that’s not tomorrow. What we have today is just reality, as it exists, and so what we're coming up with is something that works in a few levels. One of them is a vision in line with the Jericho Forum’s vision. It's a future state vision. It's a very good vision to work towards to help organize our thinking and to get out for discussion and dialogue on ideal amendments or consensus.

Meanwhile, from this trust framework system rules approach and some of the skunkworks project that we'll be able to share at The Open Group Conference in D.C. out of MIT, we're showing in a stepwise way how can we get there from here, what constructive things can we do that are in alignment with this vision today.

The system rules at the business, legal, and technical level in this model trust framework system rules approach are great because they are very flexible. There are lots of examples in payment systems, supply chains, identity federations, and other places, where they use multilateral contractual approaches, can allow multiple stakeholders to get together right now to define their liability, choose the technologies, establish the business processes, and so forth and get rolling.

I am hoping that this time around, for identity, we have a more planned and thought-out process that would allow an infrastructure to remain for the next 50 years or 100 years.

So we are attempting to offer something that can work today. One day perhaps there may be an industry or industries that may be regulated without really presuming how exactly that will come out. Those are decisions, as Thomas said, that are best made, because they are infrastructural really, by a number of different parties over time.

Gardner: Jim Hietala, at The Open Group, being a global organization focused on the collaboration process behind the establishment of standards, it sounds like these are some important aspects that you can bring out to your audience, and start to create that collaboration and discussion that could lead to more fuller implementation. Is that the plan, and is that what we're expecting to hear more of at the conference next month?

Hietala: It is a plan, and we do get a good mix at our conferences and events of folks from all over the world, from government organizations and large enterprises as well. So it tends to be a good mixing of thoughts and ideas from around the globe on whatever topic we're talking about -- in this case identity and cyber security.

At the Washington Conference, we have a mix of discussions. The kick-off one is a fellow by the name Joel Brenner who has written a book, America the Vulnerable, which I would recommend. He was inside the National Security Agency (NSA) and he's been involved in fighting a lot of the cyber attacks. He has a really good insight into what's actually happening on the threat and defending against the threat side. So that will be a very interesting discussion. [Read an interview with Joel Brenner.]

Then, on Monday, we have conference presentations in the afternoon looking at cyber security and identity, including Thomas and Dazza presenting on some of the projects that they’ve mentioned.

Cartoon videos

Then, we're also bringing to that event for the first time, a series of cartoon videos that were produced for the Jericho Forum. They describe a lot of the commandments that Dazza mentioned in a more approachable way. So they're hopefully understandable to laymen, and folks with not as much understanding about all the identity mechanisms that are out there. So, yeah, that’s what we are hoping to do.

Gardner: Do you sense that what MIT has been working on, and what Dazza and Thomas have been describing, are some important foundational blocks to where you see this going. Are they filling a need that you can bring to bear on the discussions and some of the standardization work at The Open Group?

Hietala: Absolutely. They fill a void in the market in terms of organizations that are willing to do that sort of work. The Jericho Forum tends to do forward-looking, thought-leadership kinds of work, looking at problems at the highest level and providing some guidance. Doing model trust frameworks and those sorts of things is that next layer of detail down that’s really critical to the industry. So we encourage it and are happy it's happening.

Gardner: We’re coming up on our time limit, but I did want to dive a little bit deeper into NSTIC. We mentioned that earlier on as an important aspect. Now that we’ve talked a bit more about what's going on with Core ID concepts and trust framework activities, perhaps we could now better explain what NSTIC is and does, but in the context of what we’ve already understood. Who would like to take a step at that?

Greenwood: The best person to speak about NSTIC in the United States right now is probably President Barrack Obama, because he is the person that signed the policy. Our president and the administration has taken a needed, and I think a very well-conceived approach, to getting industry involved with other stakeholders in creating the architecture that’s going to be needed for identity for the United States and as a model for the world, and also how to interact with other models.

In general, NSTIC is a strategy document and a roadmap for how a national ecosystem can emerge.

Jeremy Grant is in charge of the program office and he is very accessible. So if people want more information, they can find Jeremy online easily in at nist.gov/nstic. And nstic.us also has more information.

In general, NSTIC is a strategy document and a roadmap for how a national ecosystem can emerge, which is comprised of a governing body. They're beginning to put that together this very summer, with 13 different stakeholders groups, each of which would self-organize and elect or appoint a person -- industry, government, state and local government, academia, privacy groups, individuals -- which is terrific -- and so forth.

That governance group will come up with more of the details in terms of what the accreditation and trust marks look like, the types of technologies and approaches that would be favored according to the general principles I hope everyone reads within the NSTIC document.

At a lower level, Congress has appropriated more than $10 million to work with the White House for a number of pilots that will be under a million half dollars each for a year or two, where individual proof of concept, technologies, or approaches to trust frameworks will be piloted and put out into where they can be used in the market.

In general, by this time two months from now, we’ll know a lot more about the governing body, once it’s been convened and about the pilots once those contracts have been awarded and grants have been concluded. What we can say right now is that the way it’s going to come together is with trust framework system rules, the same exact type of entity that we are doing a model of, to help facilitate people's understanding and having templates and well-thought through structures that they can pull down and, in turn, use as a starting point.

Circle of trust

So industry-by-industry, sector-by-sector, but also what we call circle of trust by circle of trust. Folks will come up with their own specific rules to define exactly how they will meet these requirements. They can get a trust mark, be interoperable with other trust framework consistent rules, and eventually you'll get a clustering of those, which will lead to an ecosystem.

The ecosystem is not one size fits all. It’s a lot of systems that interoperate in a healthy way and can adapt and involve over time. A lot more, as I said, is available on nstic.us and nist.gov/nstic, and it's exciting times. It’s certainly the best government document I have ever read. I'll be so very excited to see how it comes out.

Gardner: A good read for the summer, no doubt. Before we close out, let's affirm for our audience how important this is. Clearly, we are at a crossroads, as you mentioned, Dazza. It seems to me that the steam, the pressure, for having a better means of ID management is building rapidly from things like the use of multiple mobile devices, location-based commerce, the fact that more of our personal business and economic lives are moving to the cyber realm.

Being able to continue to gain productivity from that really falls back to this issue about maintaining a core and verifiable identity, and being able to use that effectively in more-and-more types of activities.

Being able to continue to gain productivity from that really falls back to this issue about maintaining a core and verifiable identity.

Do you agree? What would be some of the future trends that are going to drive even more demand to solve this problem? Let’s start with you, Jim, and go through our panel. What’s coming down the pike that’s going to make this yet more important?

Hietala: I would turn to the threat and attacks side of the discussion and say that, unfortunately, we're likely to see more headlines of organizations being breached, of identities being lost, stolen, and compromised. I think it’s going to be more bad news that's going to drive this discussion forward. That’s my take based on working in the industry and where it’s at right now.

Gardner: Thomas, same question.

Hardjono: I mentioned the user consent going forward. I think this is increasingly becoming an important sort of small step to address and to resolve in the industry and efforts like the User Managed Access (UMA) working group within the Kantara Initiative.

Folks are trying to solve the problem of how to share resources. How can I legitimately not only share my photos on Flickr with data, but how can I allow my bank to share some of my attributes with partners of the bank with my consent. It’s a small step, but it’s a pretty important step.

Gardner: Dazza, what future events or trends are going to drive this more rapidly to the public consciousness and perhaps even spur the movement towards some resolution?

Greenwood: I completely agree with Thomas, keep your eyes on UMA out of Kantara. Keep looking at OASIS, as well, and the work that’s coming with SAML and some of the Model Trust Framework System Rules.

Most important thing

In my mind the most strategically important thing that will happen is OpenID Connect. They're just finalizing the standard now, and there are some reference implementations. I'm very excited to work with MIT, with our friends and partners at MITRE Corporation and elsewhere.

That’s going to allow mass scales of individuals to have more ready access to identities that they can reuse in a great number of places. Right now, it's a little bit catch-as-catch-can. You’ve got your Google ID or Facebook, and a few others. It’s not something that a lot of industries or others are really quite willing to accept to understand yet.

They've done a complete rethink of that, and use the best lessons learned from SAML and a bunch of other federated technology approaches. I believe this one is going to change how identity is done and what’s possible.

They’ve done such a great job on it, I might add It fits hand in glove with the types of Model Trust Framework System Rules approaches, a layer of UMA on top, and is completely consistent with the architecture rights, with a future infrastructure where people would have a Core ID and more than one persona, which could be expressed as OpenID Connect credentials that are reusable by design across great numbers of relying parties getting where we want to be with single sign-on.

I believe this one is going to change how identity is done and what’s possible.

So it's exciting times. If it's one thing you have to look at, I’d say do a Google search and get updates on OpenID Connect and watch how that evolves.

Gardner: Very good. We've been talking about cyber security and the burgeoning role that identification management plays in the overall securing of assets and systems. We've learned quite a bit about how individuals in organizations could begin to better protect themselves through better understanding and managing of their online identities.

This special BriefingsDirect discussion comes to you in conjunction with The Open Group Conference from July 16 to 20 in Washington, D.C. You’ll hear more from these and other experts on the ways that IT and enterprise architecture support enterprise transformation.

I’d like to thank our panel for this fascinating discussion, Jim Hietala, the Vice President of Security at The Open Group. Thank you, Jim.

Hietala: Thank you, Dana.

Gardner: We are also here with Thomas Hardjono, Technical Lead and Executive Director of the MIT Kerberos Consortium. Thank you so much, Thomas.

Hardjono: Thank you, Dana.

Gardner: And also Dazza Greenwood, President of the CIVICS.com consultancy and a lecturer at the MIT Media Lab. Thanks very much, Dazza.

Greenwood: Thanks. It's been a pleasure.

Gardner: I look forward to your presentations in Washington and I encourage our readers and listeners to look at this conference, register if you can, go to learn more about what’s going to be happening there and some of the activities will be streamed live for you to consume regardless of where you are.

Thank you all too, the audience, for listening. This is Dana Gardner, Principal Analyst at Interarbor Solutions. Don’t forget to come back next time.

Listen to the podcast. Find it on iTunes/iPod. Download the transcript. Sponsor: The Open Group.

Register for The Open Group Conference
July 16-18 in Washington, D.C. Watch the live stream.

Transcript of a BriefingsDirect podcast in conjunction with the upcoming Open Group Conference on the current state and future outlook for identity management. Copyright The Open Group and Interarbor Solutions, LLC, 2005-2012. All rights reserved.

You may also be interested in:

• Corporate Data, Supply Chains Remain Vulnerable to Cyber Crime Attacks Says Open Group Conference Speaker
• Open Group Conference Speakers Discuss the Cloud: Higher Risk or Better Security?
• Capgemini's CTO on Why Cloud Computing Exposes the Duality Between IT and Business
• San Francisco Conference observations: Enterprise transformation, enterprise architecture, SOA and a splash of cloud computing
  
• MIT's Ross on how enterprise architecture and IT more than ever lead to business transformation
• Overlapping criminal and state threats pose growing cyber security threat to global Internet commerce, says Open Group speaker
• Enterprise architects play key role in transformation, data analytics value -- but they need to act fast, say Open Group speakers

Roundtable: Revlon, SAP and VMware Describe Accretive Benefits from Aggressive Adoption of Cloud Computing

Transcript of a sponsored podcast on how cloud and virtualization deliver benefits in cost, efficiency, and agility.

Listen to the podcast. Find it on iTunes/iPod. Download the transcript. Sponsor: VMware.

Dana Gardner: Hi, this is Dana Gardner, Principal Analyst at Interarbor Solutions, and you're listening to BriefingsDirect.

Today we present a sponsored podcast discussion focused on two prime examples of organizations that have gleaned huge benefits from high degrees of virtualization and aggressive cloud computing adoption.

We're joined by executives from Revlon and SAP, who recently participated in a VMware-organized media roundtable event in San Francisco. The event, attended by industry analysts and journalists, demonstrated how mission-critical applications supported by advanced virtualization strategies are transforming businesses. [Disclosure: VMware is a sponsor of BriefingsDirect podcasts.]

We're going to learn more about the full implications of IT virtualization, and how they're being realized -- from bringing speed to business requests, to enhancing security, to strategic disaster recovery (DR), and to unprecedented agility in creating and exploiting applications and data delivery value.

With that, please join me now in welcoming our guests, David Giambruno, Senior Vice President and CIO of Revlon. Welcome back, David.

David Giambruno: Thanks a lot, Dana.

Gardner: We're also here with Heinz Roggenkemper, Executive Vice President of Development at SAP Labs. Welcome Heinz.

Heinz Roggenkemper: Welcome, Dana.

Gardner: Heinz, let me begin with you, if you don’t mind. Describe for our listeners your internal cloud approach that you've been using to make training and development applications readily available. What's going on with that internal cloud, and why is the speed and agility so important for you?

Roggenkemper: If you look at SAP, you find literally thousands of development systems. You find a lot of training systems. You find systems that support sales activities for pre-sales. You find systems that support our consulting organization in developing customer solutions.

From a developer's perspective, the first order of business is to get access to a system fast. Developers, by themselves, don’t care that much about cost. They want the system and they want it now. For development managers and management in general, it’s a different story.

For training, it's important that the systems are reliable and available. Of course again for management, it's the cost perspective. For people in custom development, they need the right system quickly to build up the correct environment for the particular project that they're working on.

Better supported

Also these requirements are much better supported in the virtualized environment than they were before. We can give them the system quickly. We can give them the systems reliably. We can give them the systems with good performance, and from a corporate perspective, do it at a much better cost than we did before.

Our business agility and ability to respond to market drivers is greatly improved by this.

Gardner: One of the things that was intriguing to me was the training instance, where people were coming in and needed a full stack of SAP applications, perhaps third-party applications that were mission critical. Tell me how the training application in particular, or the use of virtualization in that instance, demonstrates some of the more productive aspects of cloud?

Roggenkemper: The most interesting part about that is that you don’t need a vanilla system, but a system that is prepared for a particular class, which has the correct set of data. You need a system that can be reset to a controlled stage very quickly after the end of a training class, so that it’s ready for the next training class.

So there are two aspects to it. One is the reliable infrastructure on which the systems run, and second part is to get the correct system for that particular class ready in a short period of time.

Gardner: On the issues of control of the data, security, and even licensing, are there unintended consequences or unintended benefits that come when you approach the delivery of these applications through the full virtualization and this cloud model?

One is the reliable infrastructure on which the systems run, and second part is to get the correct system for that particular class ready in a short period of time

Roggenkemper: For unintended benefits, the thing that comes to my mind is that it allows us to take advantage of new computing infrastructure more quickly. We reduce the use of power, which is always a good thing.

For an unintended downside, the only thing that would come to my mind is that when in development, you are tuning for performance. That is a slightly different thing. In some areas, if you do general tuning, where you run a couple of iterations instead of just running to identify where your hotspots are, and if it’s a highly critical component, you might have to go to dedicated hardware to get to the last few percentages.

So in that area, you have to behave differently, but it affects only a small window of your total development time. Most of the time, you still take full advantage of a virtualized environment. Once you go into tuning, then you move the system to dedicated hardware and do your job there. If you average it out, you still have a substantial advantage.

Gardner: This idea of agility when producing these applications with their full data and production ready, even if you are in a training and development environment, where you're not necessarily facing their customers, proves this concept of IT as a service. Do you see it that way, and if so, is it something that you are going to be bringing to other applications within SAP?

Roggenkemper: Absolutely. And obviously, what we use internally benefits our customers as well. To have these systems available in a much shorter period of time for the customer’s development environment is as important for them as it is for us.

Future plans

Gardner: And a question about future plans. It sounds as if this works for you. Then the virtual desktop infrastructure (VDI) approach of delivering entire client environments with apps, data, and full configuration would be a natural progression. Is that something that you're looking at or perhaps you're already doing?

Roggenkemper: Some things we're already doing, We have a hefty set of terminal servers in our environment, as well, which people, especially if they are on the road or work from home, take full advantage of.

Gardner: David, let’s go to you. I was very interested to hear today your version of IT as a service, really a vision that you painted. I think essentially you're saying that advances in pervasive virtualization and cloud methods are transforming how IT operates, but it’s giving you the ability of, as you said, saying yes when your business leaders come calling. What have you have been able to say yes to that exemplifies this shift in IT?

Giambruno: I can’t equate that to numbers. We've increased our project throughput over the past couple of years by 300. So my job is to say, "yes." I'm just here to help. I'm a service. Services are supposed to deliver. What this cloud ecosystem has delivered for us is our ability to say yes and get more done faster, better, cheaper.

The correlating effect of that is we have seen not only this massive increase in our ability to deliver projects for the business, because that’s really what business alignment is. I do what they want and I give them some counsel along the way.

The second piece is that we've seen a 70 percent reduction in the time it takes us to deliver applications, because we have all of these applications available to us in the task and development site which is part of our DR.

So this ability to move massive amounts of information where everything is just the file, bring that up and let our development teams at it, has added this whole speed, accuracy, and ability to deliver back to the business.

Gardner: So we understood with SAP that they're a very big, global delivery of business applications for all sorts of companies. They have an internal cloud that they're using for some specific training and some specific development activities.

That’s really what business alignment is. I do what they want and I give them some counsel along the way.

But Revlon is also a global company. Tell us a little bit about the role that you have for our listeners who might not be familiar, the extent to which your applications are being used, and the type of mission-critical activities that you're involved in?

Giambruno: It’s probably easier to quantify it this way. We have 531 applications running on our internal cloud. Our internal cloud makes roughly 15,000 automated application moves a month. Our transaction rate is roughly 14,000 transactions a second. Our data change rate is between 17 and 30 terabytes a week. Over 90 percent of our corporate workload sits on our internal cloud, and it runs most of our footprint globally.

Gardner: We're talking about mission-critical apps here -- ERP, manufacturing, warehousing, business intelligence. Did you start with mission-critical apps or did you end up there? How did you progress?

Trust, but verify

Giambruno: I have a couple of "isms" that I live by. The first one is “Crawl, Walk, Run” and the second one is “Trust, but Verify.” When we started our journey roughly five years ago, we started with "Crawl" -- very much "Crawl" and “Trust – but Verify.” At Revlon, we didn’t spend any more to put this in. We changed how we spent our money.

We were going through a server refresh, and instead of buying all the servers, we only bought roughly 20 percent. With the balance of that money, we bought the VMware licenses. We started putting in our storage area network (SAN), and although core component pieces, and we took some of our low-hanging fruit file systems and started moving all that.

As we did that, we started sharing with the business. We showed them what we're doing and that it still worked. Then, we started the walk phase of putting applications on it. We actually ran north of six nines.

System availability went up. Performance went up. And after this "Crawl Walk Run," "Trust and Verify," it became "Just keep Going." We accelerated the whole process and we have these things that we call "fuzzies," things that we can do for the business that they weren't expecting. Every couple of months, we would start delivering new capabilities.

One of the big things that we did was that we internalized all our DR. We kept taking external money that we were spending and were able to give it back to the business and essentially invest in ourselves, because at Revlon I'm not going to be a profit center.

We kept taking external money that we were spending and were able to give it back to the business and essentially invest in ourselves.

For Revlon, the more money R&D has to develop new products to get to our consumers and for marketing to tell that product story and get it out to our channels and use the media to talk about our glamorous products, that really drives growth in Revlon.

What we've done is focused on those things, taking the complexity out, but delivering capability to the business while either avoiding or saving money that that the business can now use to grow.

Gardner: So you've been able to say yes when they come and ask you for new services and capabilities. You've been able to keep your costs at or below the previous levels. That’s pretty impressive. Do you credit that to virtualization, to cloud, to the entire modernization? How do you describe it?

Giambruno: To me it’s the interaction of the entire ecosystem. It is a system. Virtualization is a huge part of that. That’s where all it started. As you look through the transition, it's really been interesting. I'm going to segue back to the saying yes pieces and what it’s allowed us to be.

We have this thing called Oneness. I always talk about being the Southwest [Airlines] of computing, and I live inside of very simple triangle. The triangle has three sides, obviously. One side is our application inventory, the other side is our infrastructure capabilities, and the other side is my skill-sets.

Saying yes

If you're inside that space I can say yes, very quickly. What’s happened inside that space helped us contain cost . When we first started work, our ratio was one physical to seven virtual. A couple years later, we're at 1:35. It’s roughly a 500 percent increase in capacity without any commensurate cost. I give credit to my team for owning the technology and for wielding the technology for the benefit of the business and to get the most out of it.

The frame of reference to keep ourselves grounded is that we make lipstick, and it’s really how much money we can save and how well we can wield that technology to deliver value and do more with less. That’ll enable our company to grow.

We love simplicity and we have this Southwest computing model of taking a very complex ecosystem and making it simple to use. To a large degree it's kind of like an iPad, where the business wants to touch it, but they don’t care what’s going on underneath.

It's our job to deliver that, to deliver that experience and capability back to the business, without them having to think about it. I just want them to ask that we’re here to help and that we can figure a way to deliver it and keep exercising our technical capabilities to wield the technology to do more.

Gardner: I'm intrigued by this notion of the ecosystem being a whole greater than the sum of the parts. One of the things that you've been able to do, in addition to saying yes and keep your costs in line, is to improve your data and manage your data lifecycle, according to what I heard today.

It's our job to deliver that experience and capability back to the business, without them having to think about it.

Tell me about this notion you said of all the data becoming structured. What are some of the upsides on the data, when it comes to this ecosystem approach?

Giambruno: When you were talking to Heinz, you talked about unintended consequences. One of the things that we have is a big gestalt after our cloud was live. We literally had all of our data in one place.

One of the big challenges historically was that we had all these applications geographically dispersed. The ability to touch them, feel them, get access, access controls, all of these things were monumentally challenging. In Revlon, as we went to the Southwest or Oneness model, we organized globally our access controls and those little things.

So when we had all this data and all these applications now sitting at one place, with our ability to look at them and understand them, we started a fairly big effort for our master data model. We’re structuring our data on the way in So when we're trying to query the data, we already know where it is and what it does in its relationships, instead of trying to mine through unstructured data and make reasoning out of it. It’s been this big data structure.

I’d say we "chewed glass." We spent a couple of years chewing glass, structuring all this data, because the change rate is so big, but there's value in information to the business. I joke, if you've missed at this, we’re in the information age. So how well we can wield our information and give our leadership team information to act on is a differentiator. The ability to do this big data and this master data model has been really what we see as the golden egg going forward, the thing that can really make a difference with the business.

Gardner: While we’re on this notion of unintended consequences and unintended benefits, does anything along the lines of security or licensing also come to mind?

Self selection

Giambruno: From a licensing perspective, along the journey we called it self-selection. Licensing is important. Everybody has to make money. We live in capitalism. So from a procurement perspective, we always want to make sure we’re legal, but at the same time, vendors will self-select, depending on their licensing model in the virtualization world. That's our triangle. That's our infrastructure. Through that, we’ve had to manage relationships and we’ve done that.

From a security model, the structuring of all of our infrastructure, putting the in the Southwest model of computing, this Oneness, getting our data, our access controls, all of that plus with greatly simplified security, all of that is completely ubiquitous. There were even some of the crazy things that we did --we restructured the IP-ing of everything in Revlon to make all of our IP blocks contiguous. So when we move things around the world inside our cloud, we move entire blocks of IP addresses.

As you look forward, one of the interesting things that I find is that, as you look at streaming our applications, there is a huge security paradigm shift. Essentially no data will ever leave my data center and sit on a device.

In five years, that would be my goal. I think I can do it in 24 months, but really from a horizon, it’s like five years. At that point, I can literally encrypt my data center. Think about PCI and HIPAA and all the controls around that. Encryption is one of those big first checkmarks. If you can do that, you solve a lot of your compliance challenges.

Second, you have this trusted computing model, where I know the person from an access control. I know the device. I know what that person is supposed to have access to. I've encrypted my entire data center, so when that person comes in, I can let them have access only to what they’re supposed to have in the context that they're supposed to have, and decrypt it on the way out. They’re only viewing a device, and no data ever lives on a device.

They’re only viewing a device, and no data ever lives on a device.

So bring your own device. I wouldn’t care, because there's almost no security concerns at that point. I've encrypted. I know the user. Going one step further, as companies progress, you’re going to look at these internal marketplaces that everyone is going to build.

What the iPad has done is make it so I want to turn it on. I want to click on the app that gives me the information to do my job. I want my workflow, my exception management, the information I need to do for the day or do my planning, whatever I need to do. But they want that information in context.

Roll the tape forward a couple of years, and the capabilities that’s coming out on VMware, we fully expect to take care of that, to adopt that model, and that’s what we’re pushing for.

Gardner: It’s fascinating hearing you talking about large-scale virtualization and internal cloud. This has allowed you to have a much better grasp over your costs and deliver your apps and services readily, so that you can say yes to your business users.

In addition, you're getting master data management (MDM) benefits. You’re getting a better handle on licensing. You’re seeing great improvements in security now, and perhaps more to come, as you stream apps to a more virtualized client model.

Symbiotic relationship

You also mentioned something when it came to disaster recovery (DR) that piqued my interest. It sounds almost as if there is a symbiotic positive relationship between high levels of virtualization and DR. It almost sounds like DR has become the ability to move entire data centers as assets that are fungible, and that that gives you a lot more capability, in addition to being able to recover.

Is that true? Tell me how this DR plays into this larger set of values.

Giambruno: We’ve actually done this. No one was hurt, but last year, our factory in Venezuela burned. It was on a Sunday afternoon and they had what we call a drib. If you look at VMware architecture, they have data center in a box. I always joke that we’re years ahead of them in that. We use dribs, strategically placed throughout the world where we push capacity to for our cloud. They largely run dark.

So our drib "phoned home" that it was getting hot. We were notified that the building was on fire. It took us an hour and 45 minutes, and most of that time was finding one of my global storage guys who was at the beach. We found Ben, and got him to do his part, which was to tell the cloud to move from Venezuela to our disaster site in New Jersey.

So we joke that our model in DR is that we just copy everything. We don’t even think about tiering or anything. It’s this model, sometimes a Casio is just better than a Rolex. Simplicity rules, and not thinking about it ensures that we have all the data available. Again, it goes back to our cloud and virtualization. Everything is just a file. We just copy the deltas all the time. We never stop.

For us it was available in less than 15 minutes. We went in, we broke the synchronization, we made sure everything was up-to-date, and we told our F5s and our info blocks that Venezuela is now New Jersey. Everything swung, we got everything in, we contacted the business units to test everything and verify everything.

It's this whole idea of simplicity, where you're just not putting the complexity into the system.

Then we brought up all the virtual desktops and we used Riverbed mobile devices. We e-mailed their client to everyone. So people either worked from home or we had some very good partners that gave us some office space where people could use the computers. They loaded the Riverbed mobile devices on those computers. They brought the virtual desktops, people went to work, and the business didn’t go away.

Gardner: So you were able to say yes, even when a factory burned to the ground. That's pretty impressive.

Giambruno: This is a real-world example of how you can do it, and it wasn't a lot of effort. It's this whole idea of simplicity, where you're just not putting the complexity into the system. I always go back to this iPad view of the world, where the business just wants to know what's available and we will do the rest underneath.

This high degree of virtualization lets us move all of this data around the world, and it's for DR, development, and a myriad of capabilities that we keep finding new ways to use this capability.

Gardner: I suppose it elevates the concept of fit for purpose to that data-center level?

Redundancy and expense

Giambruno: Correct. And some of the other unintended consequences are interesting. You talk about redundancy and expense. Two is one and one is none in a data center. Do you really need to be fully redundant, because if something happens we'll just switch to the other data center?

I only need one core switch or whatever. You start to challenge all these old precepts of up-time, because it's almost cheaper for me or less-expensive. I can just roll the computer over here for a little while. I get that fixed, if I have a four-hour service-level agreement (SLA) with my vendors for repairs.

You can start to question a lot of the “old ways of doing things” or what was the standard in figuring out new ways to operate. One of the interesting things I love about my job is you can question yourself and figure out what you can do next.

Gardner: One last item that I suppose also fits into this unintended positive consequences issue. You've mentioned something about supply-chain value and getting to the point where you can take your external cloud, push it out to your suppliers and contractors, and begin sharing with permissions and control. This is a much better approach than the old way of virtual private networks (VPNs) and the headaches around access and so forth. So tell me about this extended business-process value that you're starting to explore?

Giambruno: One of the things we realized is that we could start extending our cloud. We spend a lot of time managing security and VPNs, and the audits that have to go around that.

At the end of the day, it's about collaboration with our community of vendors and suppliers, and enabling them to interact with us easily.

If I could just push out a piece of my application or make that available to them, they could update their data, reduce the number of APIs, the number of connections, all of that complexity that goes out there, and extend our MDM.

Then we can interface our MDM through our cloud to do some of this translation for us that they can enter data, or we can take it from their systems, from our cloud edge securely and in context and bring that back into our systems.

We think there are huge possibilities around automating and simplifying. But at the end of the day, it's about collaboration with our community of vendors and suppliers, and enabling them to interact with us easily.

So you're always trying to foster those relationships and get whatever synergies you can. If we make it easier on them to interact with us from a system’s perspective, it just makes everybody happier. We've got some projects slated for deployment this year. Maybe in a year, if you come back, I can tell you how well we’ve done or what we’ve done. But one of the things that we are looking is we can think really change how we operate as a company.

Gardner: That's fascinating. You talked about a lot of efficiency, reducing your footprint on the physical plant, on energy, keeping your cost in line, spinning up more applications and data. But now we are talking about not just efficiencies, but actually doing things entirely differently, things that could not have been done before because of cloud. That to me is really the essence of where we are going to be talking in the next few years.

So, David, thanks so much for your time. We have to leave it there. You've been listening to a sponsored podcast discussion in conjunction with a VMware-organized media roundtable event in San Francisco.

We've been exploring two prime examples of organizations that have gained huge benefits from high degrees of virtualization and aggressive cloud computing adoption with mission-critical applications. The two organizations of course have been Revlon and SAP.

I’d like to thank our guests David Giambruno, Senior Vice President and CIO of Revlon. Thanks so much, David.

Giambruno: My pleasure.

Gardner: We have also been here with Heinz Roggenkemper, Executive Vice President of Development at SAP Labs.

This is Dana Gardner, Principal Analyst at Interarbor Solutions. Thanks to our audience for joining, and come back next time.

Listen to the podcast. Find it on iTunes/iPod. Download the transcript. Sponsor: VMware.

Transcript of a sponsored podcast on how cloud and virtualization deliver benefits in cost, efficiency, and agility. Copyright Interarbor Solutions, LLC, 2005-2012. All rights reserved.

You may also be interested in:

• Case Study: Strategic Approach to Disaster Recovery and Data Lifecycle Management Pays Off for Australia's SAI Global
• Virtualization Simplifies Disaster Recovery for Insurance Broker Myron Steves While Delivering Efficiency and Agility Gains Too
• SAP Runs VMware to Provision Virtual Machines to Support Complex Training Courses
• Case Study: How SEGA Europe Uses VMware to Standardize Cloud Environment for Globally Distributed Game Development
• Germany's Largest Travel Agency Starts a Virtual Journey to Get Branch Office IT Under Control