ESG Blogs

I have no crystal ball, so I can’t peer into the swirling fog and read the future. This is a constant disappointment, but explains my fantasy football results. What I do have is better though: The crowd-sourced wisdom of many, many leaders in the world of big data. Based on all the candid conversations with customers and vendors, I can predict with some confidence the following trends for 2015…

SPOILER ALERT for those who prefer to preserve the surprises.

By now, every vendor, analyst, and media outlet has already published their cybersecurity predictions for 2015. I actually described some of mine on a Co3 webinar with Bruce Schneier last week, so I thought I’d put together a quick list. Here are ten predictions in no particular order.

As an information security analyst, I’ve been following the cyber-attack details at Sony Pictures for some time now, just as I followed other events (i.e., Home Depot, JP Morgan Chase, Staples, UPS, etc.) earlier this year.

Yup, each of these events received its fair share of publicity, but nowhere near the amount of press that Sony is getting.  Maybe it’s the Hollywood angle, maybe it’s the intrigue of geopolitical tensions between the US and North Korea, or maybe it’s the general impression that this hack is juxtaposed to our first amendment rights.  Whatever the reason, it’s big.  I participated in a webinar yesterday with security guru Bruce Schneier (CTO of Co3), focused on security predictions for 2015.  The Sony Pictures cyber-attack dominated the conversation and we both agreed that we could have discussed it for hours more. 

It hasn’t been lost on the IT vendor community and IT professionals that Cisco is absent from the VMware EVO:RAIL partner program. With all of the powerhouses participating in the program, you’d think that Cisco would jump right into the mix. Considering Cisco’s growth in the server market and the fact that it doesn’t currently have its own storage play, this opportunity appears to be ideal for Cisco.

EVO:RAIL with VSAN would make perfect sense—or would it?

Remember NAC?  Cisco first introduced the concept of Network Admission Control back around 2004.  Back then, NAC’s primary role was checking the security status of PCs before granting them access to the network.  This type of functionality was really in response to a wave of Internet worms in the early 2000s that were infecting and clogging up corporate networks.

NAC became an instant network security fad that everyone wanted a part of.  Microsoft introduced a competing initiative called Network Access Protection (NAP) for its “Longhorn” operating system (Vista) followed by a wave of long-lost startups like ConSentry Networks, Lockdown Networks, Mirage Networks, and Vernier.  Heck, NAC was even highlighted at the RSA Conference during this timeframe.

We conduct quite a bit of research around here at ESG. While all of it helps provide us with insight into the challenges and needs of IT organizations, there is one project in particular, on the future of storage, that seems to come up in my recent conversations more often than the others. We conducted in-depth interviews with multiple IT leaders across a number of industries discussing their thoughts and impressions on a number of emerging technologies, such as the cloud, hyper-converged, and software-defined storage. There was one finding in particular that I wanted to discuss. The results relative to software-defined storage presented a unique paradox…

• On one hand the topic of software-defined storage generated the most confusion among those interviewed, but…
• On the other hand, once the concept was explained at a fairly basic level, it seemed to resonate with the vast majority of respondents who seemed to grasp the fact that software-defined storage has the potential to help them address some of their most pressing challenges.

With so many vendors talking about software-defined, often with different definitions, it isn’t much of a surprise that there is a considerable amount of confusion in the industry. What is interesting, however, is that the confusion does not seem to curtail the interest.  I had some time the other day to sit in front of a camera and discuss the state of software-defined storage. In this video I try to help clear up some confusion. Take a look and let me know what you think.

In the last few years, we’ve seen a major boom in the converged infrastructure space. This coincides with ESG research findings, where more than 50% of respondents said they currently or plan to utilize a converged solution in their IT environments. We’re not at all surprised, since they make infrastructure tasks significantly easier for IT pros – easier to plan, easier to configure, and easier to grow. By deploying a converged solution, companies have realized gains across all facets of IT, from faster deployment times and improved service and support, to ease of management and improved TCO, scalability, and agility.

Yesterday, Cisco Systems announced the acquisition of Neohapsis, a Chicago-based security consulting and services firm.  Now Cisco’s forte is in moving bits from source to destination and inspecting packets to enforce security rules and policies.  So why is an equipment manufacturer buying a cybersecurity body shop?  Several reasons:

There is a great scene in the first Hunger Games movie where the 24 combatants are just about to start fighting. In front of them is a small stash of weapons. Some of the combatants charge toward the weapons, knowing that if they get one, they will gain a huge advantage—but if they don’t, they will be prime targets for being immediately “defeated.” Other combatants choose to ignore the premade weapons and run for the forest, presuming that they will be able to forage and somehow make a weapon themselves.

That is what the SaaS backup market looks like.

As workloads like e-mail and file services continue to be migrated from on-premises servers to SaaS solutions like Office365 and GoogleApps, most legacy backup solutions can’t follow. And so, all of the legacy backup vendors are like those combatants—and many have been looking at the only two “weapons” for protecting SaaS:

One sword and one bow … named Backupify and Spanning.

All this week, I am dissecting an IT horror story from a friend of mine, whose IT team turned on archaic archiving for their cloud-based mail service … and hopefully gleaning lessons from it.

“Change control” is a very lofty term that makes most IT folks roll their eyes:

• Some think about how change control slows down the IT changes that they want to make.
  
• Others recall when someone didn’t do change control—and that person and the organization paid for it.

As part of its annual IT spending intentions research, ESG asks IT professionals around the world to identify areas where they have a problematic shortage of IT skills. Over the past three years, information security skills topped this list. In 2014, 25% of all surveyed organizations said they had a problematic shortage of infosec skills.

The platform-as-a-service (PaaS) market got its start back in 2007 and it has taken 7 years for the last of the leading ISVs to deliver a product. Seven years is a long time. Apple launched the original iPhone back in 2007. It’s been said that until the iPhone, the only thing smart about a smartphone was you had to be smart in order to use one. Given the accelerating rate of change in the application development and deployment market, 7 years is almost an eternity.

Now that all of the leading ISVs are PaaS-enabled, it's the perfect time to take a critical look at how the vendors and their products are performing. A number of obvious issues come to mind immediately.

In a recent survey, ESG found that more than one-third of research respondents have deployed integrated computing platforms (ICPs). The results validate the idea that an alternative IT infrastructure consumption model other than DIY methods has tremendous value. What’s responsible for driving this trend? All three points of the iron triangle—improved economics, reduced time, and predictability. For more details, check out the ESG infographic, Why ICP? A Practical Guide to Integrated Computing Platforms, and the ESG TechTruth: The Private Cloud-Integrated Computing Platform Connection.

John (not his real name) logged in Monday morning to find that several of his mail folders had far less stuff in them. In fact, in very small font, he discovered his Outlook now showing “Global Retention Policy = 6 months” … and yes, everything older than six months was now in a very archaic e-mail archiving service that was long since presumed retired.

To be clear, I am a fan of archiving, when done properly—and am against any IT process that isn’t.

In 2014, SDN gained a lot of momentum and many organizations are already piloting SDN or planning deployment projects for next year. Good news for network security because SDN holds a lot of promise for improving the role of the network with incident prevention, detection, and response.

On a rainy day in the Bay Area, MongoDB, Inc. recently held its 5^th annual MongoDB Days event, and had an opportunity to lay out its vision of the future. As it turns out, this is a vision all about migrating and building applications on the popular open-source database technology. “Popular” is an understatement. Most sessions on the day were packed with every row and column chock full of DBAs and developers, sort of underscoring the thematic point about the need for the sort of rapid scalability that the NoSQL database provides when demand outpaces capacity.

CTO and co-founder Eliot Horowitz took the main stage to outline what he sees as the imperative design principals of the database, namely:

Just this past June I was writing about updates to the ZS3 from Oracle, a platform initially introduced the prior year. Now we have the ZS4-4, Oracle’s new flagship NAS system. The reason I mention the prior blog is because I want to extend some thoughts from it in considering the ZS4 and placing it in context. When looking at the earlier product I focused—although I didn’t actually use the word—on what one might call its personality and (sometimes) hidden abilities. I’ll recap a couple of pertinent points here shortly, but the interesting thing to me about the ZS4 is what it reveals about Oracle’s true soul and intentions. If this all sounds a bit airy-fairy and new age, please bear with me and read on….

• The ZS3 made me reconsider some of my (and probably your) perceptions and understandings of Oracle storage itself; for instance, I discussed its impressive numbers—the significant overall capacity scale, the large amount of solid-state, and the SPC-proven compelling price-performance. In addition, I mentioned Oracle’s increasing efforts at openness, and its credible riding of the powerful IT convergence wave. Few of these were attributes I'd traditionally thought of when thinking "Oracle storage."
• The ZS4, on the other hand, reveals insights into what one might call Oracle’s “soul” (or minimally, and less ethereally, its DNA) because it is essentially all about storage being optimized for use with Oracle's Database. And this is some good stuff—for instance, the container-level storage access, visibility, and analytics for 12c users doesn’t just add speed and flexible efficiency, but also allows much faster identification of any issues (67% fewer steps according to Oracle). And you don’t get this when using other vendors’ storage.    

It’s not that the ZS4 doesn’t have great—at times pretty jaw-dropping—raw “regular storage” specifications to shout about. There is better, faster, and bigger everything (for example, up to 3TB of DRAM together with more, new processors that help to grow throughput from the 17GB/sec of the ZS3-4 to over 30GB/sec in this new box) and there’s data at-rest encryption. But, frankly, such things as these—or at least the natural progression of all vendors with these kinds of criteria—are commonplace in the leap-frog world of the "add on" storage industry: Oracle’s ZS4 approach is more of an “add in” storage model. While that may seem to be a small semantic distinction, it represents genuine differentiation for "Big Red," and significant value for its users.  

Why? Well, the biggest single point here is to reflect on Oracle's DNA: It is, at heart, a database company, and the ZS4 will excel as—essentially—an integrated extension of the Oracle database. Put another way, it can make 12c more appealing and valuable—indeed probably actually helping to drive the adoption of the pluggable database facility because now there’s a “virtuous circle” of value between the database and the storage.   

The website, Urban Dictionary, defines the expression “don’t poke the bear” as follows:

A phrase of warning used to prevent oneself or others from asking or doing something that might provoke a negative response from someone or something else. 

I saw a great quote recently—my friend Richard Heard (the CEO of Red8) uses it in his corporate deck. It is from Jack Welch: "If the rate of change on the outside exceeds the rate of change on the inside, the end is near.”

Boy is this true across a myriad of endeavors…and boy is it a challenge for traditional vendors in the storage industry these days. For years—well, decades—IT organizations have essentially hand-built their infrastructure and systems, combining a multitude of components to achieve their desired and/or required results. Now, admittedly, the components have always been extremely complex and sophisticated—whether they be switches, blades or storage systems—but they are also ultimately dumb until the “white coated magicians” of IT integrate, tune, and give them meaningful-results-oriented life. But this approach—so long the norm—is under attack; instead of people buying seats, engines, and wheels to build custom vehicles, an increasing number of actual car and truck manufacturers (that is, integrated systems, purpose-built appliances, and everything-as-a-service) is arriving...and—just as important—users are testing and demanding such options. People want to transport themselves and their stuff (i.e., run applications and deliver IT and business results) rather than merely build and care for the automotive solution (i.e., infrastructure) that can do so. But wait, there’s more…