Despite continuing price cuts, analyst firm finds margins still healthy for cloud providers.

In its latest analysis of cloud pricing, 451 Research reveals that the cloud price battlefield has shifted from virtual machines (VMs) to object storage. The analyst firm predicts that other services, particularly databases, will undergo the same pricing pressures over the next 18 months.

Until recently, the prices of services beyond compute held steady in the face of intense competition, according to 451 Research’s Cloud Price Index. Virtual machines have been the traditional battleground for price cuts as providers have sought to gain attention and differentiation. The tide has now turned, with object storage pricing declining in every region, including a drop of 14% over the past 12 months. For comparison, the cloud mainstay of VMs has dropped a relatively small 5% over the same period.

Analysts believe market maturity is leading to price cuts moving beyond compute. Other factors include increasing cloud-native development and faith in the cloud model, as well as a competitive scrum to capture data migrating out of on-premises infrastructure.

While some in the industry have speculated that cloud providers have been using cheap VMs as 'loss leaders' in their cloud portfolios, 451 Research finds that, even in the worst case, margins for VMs are at least 30%. There is little data suggesting cloud is anywhere near a commodity yet. Analysts believe the cloud market is not highly price-sensitive at this time, although naturally, end users want to make sure they are paying a reasonable price.

“The big cloud providers appear to be playing an aggressive game of tit for tat, cutting object storage prices to avoid standing out as expensive,” said Jean Atelsek, Analyst, Digital Economics Unit at 451 Research. “This is the first time there has been a big price war outside compute, and it reflects object storage’s move into the mainstream. While price cuts are good news for cloud buyers, they are now faced with a new level of complexity when comparing providers.”

The cloud storage battle started in Q3 2016 when 451 Research’s Digital Economics Unit identified a reduction in IBM SoftLayer’s object storage prices. Google, AWS and then Microsoft followed suit with cuts as well. The 451 Research Digital Economics Unit predicts that prices for virtual machines and object storage will continue to come down, with relational databases likely to be the next competitive front.

Digital solutions offer many benefits, but also present new risks as organizations become more open and agile. Tom Scholtz, vice president and Gartner Fellow, and conference chair for Gartner Security & Risk Management Summit 2017, discusses how security and risk management leaders are developing security programs for digital business and the challenges they should be prepared to meet. 

Q: How has security and risk management evolved to support digital business?

A: Digital business is about access and collaboration — organizations have to let external partners and customers in to participate. The end user has typically been deemed the weakest link in the security chain. In a digital world, end users are part of the security function and a people-centric solution. Therefore, security and risk management leaders are developing programs based on trust. Instead of a default-deny approach to security, we are now seeing a default-allow approach. This is a fundamental change in how security programs are developed.

Q: Which technologies should be on security and risk management leaders’ radars?

A: User and entity behavior analytics (UEBA) are important, as is understanding and institutionalizing adaptive security architecture. Artificial intelligence (AI) can deliver context-based situational intelligence to improve security decision making. Blockchain is transforming digital commerce and has potential value for security as a means of supporting more distributed trust.

New technologies create new risks. AI generates intellectual property that must be protected, like algorithms and institutionalized knowledge that defines what is normal for an organization’s systems. The right hack could have catastrophic effects on an organization’s production system. AI opens the door to more subtle forms of disruption, too. For instance, a hacker may just make tweaks that do not bring an entire system down so that small failures go unnoticed.

Security teams have to stay current and proactive. They need to be aware of new technologies and the vendor landscape to determine what to adopt into their security programs.

Q: What are the biggest challenges security and risk management leaders face today?

A: Chief information security officers (CISOs) are tasked with strategic planning in a digital business environment where agile and bimodal are critical to success. They also need to acquire talent to manage the IoT and integration of operational technology.

Security teams have to stay current and proactive. They need to be aware of new technologies and the vendor landscape to determine what to adopt into their security programs. They also need to understand the latest security threats because the threat landscape is evolving rapidly and becoming more complex.

The General Data Protection Regulation (GDPR), the new EU privacy and personal data protection law going into effect in 2018, presents a challenge to risk and compliance leaders because they need to make sure their organizations are compliant. Risk and compliance leaders also need to evolve and shift their focus on compliance to managing risk effectively to protect the organization. Risk and compliance leaders must make sure their organizations understand the risks and accountability associated with new technologies as they invest in digital business initiatives.

Business continuity management (BCM) leaders must continue building IT and business operations while facing threats that are more serious, as well as frequent disruptions. They have to protect against disruptions, but also plan for how their organizations overcome them and minimize their impact. Resilience, not just recovery, has to be engineered into digital business systems. Critical infrastructure must be resilient enough to withstand a cyberattack and recover from a major disaster, ideally without interruption.

This article first appeared on Smarter with Gartner.

The Internet of Things (IoT) is disrupting life as we know it, from our homes and offices, to connected cities and beyond. As IoT streamlines business processes, it empowers our ability to connect with people, systems and environments that shape our daily lives, and can vastly contribute to improving efficiencies within our organisations.

By Nick Bailey, Head of Practice, Connected World, Networkers.

In particular, IoT can help the healthcare sector to advance innovative projects within the NHS. These include the ‘Diabetes Digital Coach’ which provides remote monitoring technology to permit effective self-management of diabetes, and ‘Technology Integrated Health Management (TIHM)’ which creates wearables to help patients with dementia remain in their homes for longer.

The significance of IoT on the business world was highlighted in Networkers’ recent Technology: Voice of the Workforce research. In our survey of over 1,600 technology professionals, we found that 40% believe IoT will be the biggest future challenge for the tech industry. Crucially, 64% don’t believe their company embraces technology which will allow them to adapt for the future.

So, how can businesses guarantee they are equipped to handle IoT?

First, they need to ensure that senior decision makers are prioritising IoT, and developing employee roles within the workforce. At a high level, a Chief Internet of Things Officer (CIoTO) will keep the importance of IoT at the forefront of executives’ minds. In wider teams, there is a need for full stack developers, whose knowledge extends beyond basic software and who possess the ability to incorporate hardware programming into their skillsets.

The challenge companies will face when building this workforce, is finding the right skills. Our research found that 57% of tech professionals believe there is a skills shortage in the technology sector. As demand is outstripping supply for IT professionals who are well-equipped to deal with IoT, it will be crucial for companies to build and retain core IT skill sets.

With the number of connected things due to increase to more than 20 billion by 2020 (Gartner)[1], the pressure is on for companies to invest in IoT systems that are secure. IoT, often dubbed the ‘Internet of Hackable Things’, is vulnerable due to the high number of devices containing confidential data that are at risk of attack from cyber criminals. Consequently, the big IoT players are creating partnerships to deliver IoT ecosystems, for one simultaneous authentication across multiple devices, improving security and accelerating processes.

Ultimately, to embrace IoT, public and private organisations need to build prepared workforces and develop systems that are secure. The interconnectedness of our society will benefit as a result.

[1] Source: Gartner (November 2015), http://www.gartner.com/newsroom/id/3165317 

Integration and operations now consume a significant share of technology budgets, and for IT organizations and there is no sign of slowing down. To help alleviate the burden of integrating software components many IT organizations are adopting open source software and model driven operations to reduce complexity and integration costs while improving time to market. The cloud and microservices (independent services that interact with a network) are making software implementation more challenging and distributed. The costs and intricacies of Big Software are keeping many CIOs and DevOps leaders awake at night. Where do these technology leaders turn for answers? In-house solutions are expensive to deploy and integrate, probably not. Costly systems integrators that only focus on solving one technology challenge and have a long learning curve, not optimal. Or organizations can continue to invest in siloed solutions only to achieve incremental gains, too expensive and time consuming. Forward-thinking IT & DevOps executives are adopting: 

“Buy what you can, build what you have to, and integrate for competitive advantage.” 

These hurdles are why model driven operations are changing how software is deployed and operated today. 

For CIOs and DevOps, model driven operations improves how software is not just deployed, but scaled across the enterprise or among various cloud services, providers, or bare-metal servers. One of the main values for model driven operations is the ability to share and reuse open source code that has common components and functionality so development organizations can spend their time and resources deploying solutions unique to their business.  This allows internal teams and systems integrators to leverage model driven operations to focus on what they do best while delivering business value, improve lead time and be more efficient.

For example, when a new server needs to be deployed, modelling can automate most, if not all, of the provisioning process. Automation makes deploying solutions much quicker and more efficient because it allows tedious tasks to be performed faster and more accurately without human intervention. Even with proper and thorough documentation, manually deploying a web server or Hadoop deployment, for example, could take hours compared to a few minutes with service modelling. This is why CIOs and DevOps chiefs are adopting service modelling as a way to make the most effective use of their team’s precious resources and time.

Further, model-driven operations gives development organizations more choice in how services are consumed (public, private, or hybrid cloud) and options that make it easier to replicate environments with the same software and configurations. As these systems evolve, organizations can deploy pre-configured services, private infrastructure solutions including OpenStack, and even the organization’s own code to any public or private cloud. This allows enterprises to deploy solutions that are consistent, integrated, and relevant to their business needs.

Companies like Google, Amazon, AT&T, and many others have all moved to model-driven operations to provision and deploy software and cloud services across multiple domains and environments faster and more efficiently.

Canonical’s approach to service modelling

Companies are integrating the tools and technologies that will help drive business outcomes faster, more reliably, and efficiently. Software modelling solutions like Canonical’s Juju helps customers to build and deploy proofs of concepts faster, integrate solutions more seamlessly while expanding their organization’s capabilities more broadly. Juju is a universal modelling solution that speaks to executives, developers, and operations. Imagine using a solution that enables the deployment of revenue-generating cloud services with only dragging and dropping a few commands.

Juju Charms, which are sets of scripts for deploying and managing services within Juju, allow organizations to connect, integrate, and deploy new services automatically without the need for consultants, integrators, or additional costs or resources. Companies can choose from hundreds of microservices that enable everything from cloud communications via WebRTC, IoT enablement, big data, web services, mobile applications, security, and data management tools. Further, with the rise of open source, enterprises, and programmers can leverage the power of a vast library and a community of developers to design, develop, and deploy their solutions much faster. Additionally, network administrators and developers can free up their time to focus on bringing to market revenue-generating solutions and services, rather than architecting complicated network stacks and deploying additional resources. What matters to the developer is what services are involved, not the details of how many machines they need, which cloud they are on, whether they are big machines or small machines, or whether all the services installed are on the same machine. There has been a shift from software and infrastructure orchestration to model driven operations that makes the task of deploying distributed systems - or Big Software - more efficient and faster. It’s about choice and options.

It’s time to let software do the work

The world of software deployment is becoming more and more complex. Software deployments were once simple and spread across a few machines, now they have evolved to become distributed across many machines, operating systems, regions, and environments. This shift has created both a competitive threat and simultaneously, a massive opportunity. Many CIOs and DevOps executives are exploiting these opportunities, while others risk being relegated to the dustbin of oblivion. Model driven operations helps organizations to reduce complexity, improve efficiency, and deploy revenue-generating services and solutions faster.

For more information about how Canonical can help your business to understand and move to model driven operations please contact us. If you are ready to get started, or want to learn more about how Canonical’s Juju solution can help drive model driven operations, please click here.

According to a recent report from Accenture, “Big Success From Big Data,” researchers found that 89 percent of respondents who have implemented at least one big data project see it as a way to revolutionise business operations. Furthermore, 85 percent believe big data will dramatically change the way business is done. Yet there are still operational challenges preventing businesses from fully embracing this new way to trade.

Unlocking Digital Business Data

In a world where everything is connected, IT pros are overwhelmed, searching through inundations of data for meaningful insights that can give the business any advantage over competitors and protect its infrastructure, data, and employees. It is often an arduous, time-consuming, and manual process that frequently results in analysing old and therefore irrelevant data.

An enhanced approach to scrutinising and discovering terabytes of data isn’t just favourable, it is imperative in the 4^th Industrial Revolution.

Volumes are exploding, objects are getting bigger, and even planned downtime is unacceptable and costly if you can’t meet business demands for availability and performance. Eventually every organisation will want to benefit as the lines of business push for better access to big data. But how can businesses formulate new methods of collection, storage and analysis to extract the most value from their data?

The challenge that businesses face is that the more volume, velocity, and variety of data that is introduced into the organisation the more the need for a sophisticated and scalable approach to managing the big data environment. Mastering this data is fundamental to every organisation's successful digital transformation – and failure to leverage the data and analytics will cripple an organisation's ability to meet customer expectations and competitive pressures. 

When data is siloed, such as residing in self-contained departmental databases, you’re going to get lackluster insights. It is important to take a holistic approach to a big data strategy. The big data technology ecosystem must interface with enterprise applications and data sources, such as ERP solutions and connected devices, to integrate data in one central location.

Right from the pilot phase of a big data initiative, automation processes must be put in place to ensure that data from across multiple sources can be seamlessly ingested, processed and available to the business, for on demand analytics

My IT is Better Than Yours

In the modern digital business revolution technology is integrated into every step of an organisation’s value chain. This unprecedented use of technology creates a complex challenge for IT Infrastructure and Operations organisations, as it becomes difficult to collect and organise the sheer volume of data generated by new digital business systems and sources. 

With technology that enables the collection, storage, and analysis of this data, business demand for big data deployments has moved from experimentation to production. At the same time, IT needs to keep integration with existing business systems in mind. For instance, structured data remains the main focus, so IT needs to keep traditional storage and analytics solutions in place while exploring big data. 

To leverage the benefits of the data explosion, organisations need to prepare their IT teams properly. An IT operations management tool with enterprise-grade capacity optimisation and visualisation can help IT plan and right size the data ecosystems—including compute, storage, and network resources, ensuring control over infrastructure costs. Not to mention, having the right actionable data helps you to be proactive when you’re troubleshooting any IT operations issue.

But the most valuable use of big data analytics is not reporting what’s already happened; it is accurately predicting future outcomes and behavior affecting the important areas of the business. Through predictive big data analytics, organisations can change operations in real time and build strategic, forward-looking plans to drive faster business outcomes, which give companies a competitive edge. One of the most powerful types of data for actionable insight is the ability see how measurements change over time, intelligence indicating trends upward or downward to enable action before a condition impacts end users.

With IDC predicting that the digital universe will double every two years to about 1.7 MB of new information created every second for every human by 2020 it is clear that data in the modern age is the currency that guides all decisions and actions. Complete and accurate analysis will empower IT operations to make fast, data-driven decisions that support continuous digital service improvement and innovation.

Then, as is the case of all emerging technology use cases, market confusion began. Is social media really important in business? Is it digital marketing? Is it social media for business? Is it social marketing? Does it fit in lead generation or communications? 

In the end it was rightly determined that social media is merely a tactical approach that is part of a bigger marketing and business strategy and wouldn’t be as valuable if that strategy were not developed first. And, as with most strategic development, sometimes research and more advanced tools are required to glean the information to put the right tactics in motion. 

Fast forward to the mid-2010s and we’re in a similar dilemma with the crowded cyber threat intelligence (CTI) market, especially in the discussion around digital risk monitoring. According to Forrester, digital risk is assessing cyber risk, brand risk, and physical risk emanating from open web properties, social networks, and some computer and mobile applications. Much like tactical social media tools, a good intelligence-rich strategy needs to be developed in advance of any digital risk monitoring implementation in order to be most effective.  

Business Risk Intelligence (BRI), on the other hand, provides strategic intelligence gleaned from the Deep & Dark Web that informs organisations what the actual threats are that are critical to their business. While many organisations do have digital risk monitoring in addition to BRI, many organisations end up adding BRI later on to address the intelligence gap that digital risk monitoring approaches leave open. Many concerns often stem from missed information around insider threats, fraud, anti-money laundering, geopolitical intelligence, supply chain, and a need for more sophisticated threat actor profiling or directed actor engagement.  

For one, putting the tactical before the strategic is going to land most organisations in a corner where they are missing business critical information. Second, digital risk monitoring solutions, even if they offer data from the Deep & Dark Web, do not often have expertise beyond purely automated approaches to gain information, which can never be rich enough to be considered intelligence.

Just as strategy needs to come before tactics, BRI must come before digital risk monitoring. Digital risk solutions are good for setting and monitoring already known information, or as I’ve said before, “answering the questions companies already know to ask.” But BRI is what helps determine what needs to change in operations, policies, and protections across an organisation. 

Here’s an example based on the insider threat use case. In one incident, intelligence from an underground forum revealed that a rogue employee of a multinational technology company was preparing to profit from stolen source code from unreleased, enterprise-level software. With this intelligence, the company was able to be alerted and then supported in completing an internal investigation, work with law enforcement to support the employee’s arrest, prevent the illicit sale, and preserve the company’s intellectual property. 

Digital risk monitoring could not have been used to detect or mitigate this insider threat. BRI, on the other hand, found the threat in its relevant context, enabling the company to take the appropriate steps to minimise its risk. 

According to The Forrester Wave: Digital Risk Monitoring, Q3 2016: "Generic online or social media monitoring provides a false sense of security. Many security and risk] and marketing pros remain naïve about serious risks in their organisation’s digital presence, because they believe their existing social media monitoring or cyber threat intelligence (CTI) tools will detect them. That notion, however, is increasingly misguided.”

It’s misguided, of course, because these basic tools are tactical and do not provide the intelligence alone that is needed. The challenge of digital risk is that it rests somewhere between basic social media and brand monitoring, sprinkled with traditional cyber threat intelligence. Digital risk doesn’t have the scalable technology and human power behind it to produce BRI that helps all departments in an organisation determine the best strategies for protecting their digital, human, and physical assets.  

Digital risk monitoring is a helpful tool for organisations that already have rich intelligence and not just data. Failing to distinguish between the two can be problematic. It is nearly impossible to form relevant context without first considering how the data relates to the entire risk profile of an organisation not just a tactical report. Observing digital risk through the open web is not enough to develop necessary context and thus cannot enable organisations to apply and operationalise the data to address their challenges effectively. BRI must come first.

#1 Understand the importance of connectivity

The pace of communication and connectivity technology evolution and adoption has resulted in a whole new set of expectations – from customers, partners, employers and employees. We need to respond faster, be able to connect to colleagues easily, and generally adapt to an ‘always on’ world.

The challenges of staying connected are both compounded and addressed by the mobile work force. Being able to work from anywhere sounds nice, but it also introduces new issues in how all that interconnectivity and communications should be managed.

Also, considering that surveys consistently indicate that in a typical enterprise, management spends up to 35 per cent of their time in meetings, and executive staff up to 50 per cent of their time, the importance of being able to stay connected to collaborate with colleagues, staff, partners and customers is incredibly important, and thus technology must evolve with changing work scenarios.

#2 Adopt tools that work in a natural environment

Communication technology today is driven by consumers: FaceTime, SnapChat and Skype. Employees want that type of functionality in their workplace, especially if their workplace is the home or based around their ubiquitous mobile device. If you can FaceTime your grandmother with one click, why do you need a long dial string to connect to your boardroom?

A large fraction of lost productivity time is a result of technical complications – setting-up, managing, administering and securing communications and collaboration processes. Now more than ever, platforms and tools must be as painless and friction-free a possible for employees to embrace them, for the productivity benefit to be fully realised, and to realise maximum ROI for management.

#3 Reduce the number of tools being used

So, while the consumerization of communication technology gives us a lot of options and certainly has established a model for simplicity and ease of use, it also has resulted in a crowded and complicated range of tools that IT management has to deal with. Studies have shown that an average employee uses 16 apps at work, all of which represent security, quality, integration and management issues for IT. Another study, by Frost & Sullivan, revealed that 80 per cent of employees use non-approved tools and apps at work. The result is a lack of company-wide collaboration, redundant functionality, administration confusion and security risks – in short, a major IT headache.

Adding more tools in an ad hoc way leads to user frustration, siloed work environments and a significant increase in administration costs. Sure, it’s tempting for a worker to use the newest IM app his teenage daughter is raving about at work, but each new addition adds a new level of complexity and potential risk that must be controlled.

#4 Take back control and increase security

If there is one reason to manage the number and types of collaboration tools in use at a company, it’s security.

Security needs to be strategically planned, to be baked in from the start. A standardised set of IT programmes allows you to take back control of your programmes, enhancing security and streamlining communication within your organisation. But it must be done without being overly restrictive or disruptive to the end user.

#5 Adopt cloud-based video conferencing

When it comes to efficient, productivity-oriented communication and collaboration, there is no question that video conferencing is an outstanding option, if not the best (besides in person interaction, of course).  Long perceived as a bastion of the corporate boardroom, it has now evolved to be an accessible tool, easily used by anyone in the work force, regardless of location, platform or job function. Thanks to cloud-based solutions, video conferencing is now a very straight forward proposition from a deployment, management and use standpoint. Simple one-click offerings provide the ease of use of consumer apps, with the performance, features, and security of enterprise solutions.

For dispersed workers and groups, the face-to-face interaction enabled by cloud-based video conferencing is unmatched by any other communication and collaboration tool– be it email, voice, web based conferencing, IM apps, etc. It results in more productivity, shorter meetings, better and clear communication, and ultimately the ability to build better relationships across distances.

We know it’s difficult to keep up with the pace of technology and the impact it has – both positively and negatively – on keeping a smooth running operation. Factor in a dispersed workforce using any number of devices, platforms, apps and tools, the task of keeping everyone synced is even more daunting. Cloud-based video conferencing can be a critical tool in addressing the most demanding communications and collaboration requirements of the modern workforce.

But the raw power, scale and sophistication for sale via those clicks is growing at unprecedented rates. The catalyst for this momentum is, yet again, unsecured Internet of Things (IoT) devices. This is known as the DDoS of Things (DoT).

Selling 'Stressers'

Capitalising on the ease of building global botnets via new strands of publicly available malware (e.g., Mirai, Leet), threat actors, criminals and hackers are marketing DDoS-for-hire services to anyone with a few dollars in online currency. 

While all manners of online weapons are available for sale, DDoS-for-hire services are typically labeled as ‘stressers’ or ‘booters.’ Regardless of nomenclature, they’re the same thing. Some criminal outfits like to use the ‘stresser’ term to thinly veil their service as a legitimate testing tool.

My colleague,A10 Networks’ Networks Director of Cyber Operations Dr. Chase Cunningham recently said: “Basically everything is for sale. You can buy a 'stresser', which is just a simple botnet type offering that will allow anyone who knows how to click the start button access to a functional DDoS botnet.”

From there, the user has access to massive global botnets capable of launching global DDoS attacks at organisations, online services, gaming platforms, etc.

Crime-as-a-Service

Most of these services use SaaS-based subscription models, wrote journalist Ryan Francis. His story notes that most services cost about £25-35 a month and include tools and 24-7 support. Prices go up based on attack duration, throughput, subscriptions length and tools included.

Cunningham predicts that cyber criminals will soon give everyday buyers options to specifically purchase IoT-based traffic to push their DDoS attacks to greater capacity thresholds.

He said: “I haven’t seen many yet that specifically include the option to ‘purchase’ an IoT-specific traffic emulator, but I’m sure it’s coming. If it were me running the service, I would definitely have that as an option”.

DDoS Protection Solutions

To prevent large-scale DDoS attacks, enterprises, service providers and security-conscious organisations can implement threat protection systems that detect and mitigate multi-vector DDoS attacks at the network edge, functioning as a first line of defence for your network infrastructure.

Some of the best protection systems enable DDoS mitigation against attacks up to 300 Gbps with a single appliance; scaling to 2.4 Tbps when deployed in a cluster.

From a consumer perspective, IoT has become a dominant – but arguably a gimmicky – trend. CES 2017 was awash with connected products, from the smart toothbrush to the connected blind. However, there is reason to believe that the biggest impact from IoT will be felt in industry. We need to question what that impact will be and how it will change business models.

The Internet of Things has been steadily edging its way into industrial applications and could revolutionise the way organisations deliver operational excellence. At the same time, we’re seeing a transformation in ICT models, as Cloud and Hybrid IT become an increasingly important approach to delivering digital services.

The big question for industry, across construction, engineering, and utilities, is how they might have to change their strategy – and even their business models – to really make the most of the opportunities these innovations present.

Hybrid IT – combining new cloud applications with the power of legacy systems – is arguably the most effective way to balance innovation, reliability and cost savings. And we’ll need a hybrid of different IT approaches to create the Internet of Things that the industry needs.

We are gradually seeing the worlds of information and operational technology converge, and along with this so are their budgets. This presents a great opportunity for all industry sectors – from transportation to engineering to utilities. To embrace this change and the new business models it will enable it will be critical to ensure they can deliver a great digital experience for their customers.

Aligning organisational ICT on common platforms and extending intelligence to the most detailed logistical or operational level holds potential for great benefits. Organisations can be far more effective when they are agile and empowered with comprehensive data that they know they can trust. This data enables better decision making – it’s more important to do the right things, than to do the wrong things more efficiently.

This approach also reduces risk and costs. As the IoT becomes more pervasive in industry, it will be essential for organisations to align their core services on trusted ICT platforms. This control is necessary to guard against malware & security intrusions, and also reduces software maintenance costs.

As smart cities become a reality, organisations will need to learn how to leverage IoT opportunities, provide connected experiences and drive intelligence around the performance of their assets. For example, the government is now providing real time intelligence about what’s happening on roads via social media. Jaguar are also piloting real-time pothole detection & data sharing with their connected car concept.  And of course, concepts such as the connected van could transform field engineering. Innovations like this will create a much bigger impact than the likes of the connected fridge – as they connect things which aren’t traditionally connected and genuinely improve our lives.

Our focus is on how we use the IoT to create a better society, and that sometimes means applications you might not expect – such as connected cows. In Japan, Fujitsu has been working with farmers to develop sensor & data analysis capabilities for livestock that can even help to decide the optimum time to impregnate a cow to produce a female calf. It’s also possible for farmers to track their herds using connected pedometers – essentially, Fitbits for cattle.

Opportunities such as these generate intelligence, which is great for industries. More data equals more insight – which can lead to happy customers, as their wants and desires are being addressed. So while there is clearly great power in the connected future, it is vital that we’re connecting the right things.

While databases and data visualisation tools can be invaluable when it comes to finding the narratives in big data, the larger a dataset is, the technical constraints of such tools can mean that the data must be reduced in some way to allow for easier processing, movement and manageability. This not only reduces the amount of data available to work from, but sacrifices data granularity to the point where important stories are lost. 

So, what can be done? Let’s look at a real-life example of how ALL of the data can come into play when you have the right tools available.

Data-Driven Storytelling 

Back in November 2016, at Tableau’s worldwide customer and partner conference, InterWorks’ Tableau Zen Master Robert Rouse took part in the event’s ‘Iron Viz’ competition with tough rivalry from other Tableau experts. The challenge was for each contestant to show the best use of Tableau when creating a data story, based on the same 14 Gigabytes and 161 million rows of New York taxi business data. Robert chose to visualise the effect that snow days had on New York taxi fares. He analysed how snowfall and public holidays affected trip counts and overall taxi fares. The contest provided a valuable insight into Tableau’s utility in creating data-driven stories through visualisations.

For the competition, Robert worked from a condensed data extract by taking a daily aggregate of trips taken and fares earned over the year of 2014. For the map visualisation, the dataset was shrunk further to just three days to highlight trip frequency changes that a single snow day caused across New York’s five boroughs. The data was shrunk to this degree because it was simply not possible to address the complete dataset directly in Tableau, and this reduced dataset lost much of its granularity and detail.

Following the competition, Robert chose to re-run the analysis for an InterWorks webinar to demonstrate the effectiveness of Tableau, but this time using EXASOL’s in-memory analytic database instead of Tableau data extracts. In this re-run, Robert demonstrated the work that goes into identifying and extracting a story from such a massive dataset, and by using a powerful database he could draw from the complete dataset of 1.3 billion rows, working at the row-level detail which encapsulated all the data from 2009 through to 2016, without the need to run aggregations.

In situations that involve searching for a story in a large dataset, it is therefore clearly of great benefit if you have access to the data contained within at the most detailed level possible. Transactional databases can be a limiting factor for this, because if they are too slow for interactive analytics, then it can make the exploration frustrating and cumbersome. As Robert demonstrated, having the ability to turbocharge the dataset with a fast analytic database saves time and effort.

The Importance of Maximising Speed and High Data Granularity

InterWorks’ Robert Rouse, said: “When you’re still at that level where you’re trying to figure out what the data means and find the story that needs to be told, you need to have access to as much data as you can at the finest level of granularity that you can manage. Being able to consider the data over a long period of time, rather than restricting yourself to a month or quarter, means you can see trends and patterns that might not otherwise be visible.”

How Things Fit Together

As data analytics integrates itself further into the core of an organization’s business model, there is a tangible shift underway towards companies diving into data analytics by combining software packages to create bespoke solutions to their various needs. This can be achieved while reducing reliance on data scientists and IT resources, allowing for the creation of self-service business intelligence, taking the often-daunting time and complexity factors out of data analytics. 

With a fast database purpose-built for analytics, a data preparation tool such as Alteryx, and a visualisation tool such as Tableau, a complete “big data analytics stack” can be created.

The Benefits of the Best Big Data Analytics Stack to Business 

So what impact can this have on business? Over the years, businesses have been investing in applications and systems to automate processes, which add value. Data from these applications has grown beyond control and is still typically locked in silos. It is important to bring it all into a data warehouse for analysis and reporting. More than this, it is important to have the right stack in place to ensure competitive advantage with the best quality of data, fast analysis and the best visualisation. Only with the right technology in place will the organisation be able to make better decisions across every corner of the organisation.

Many of our customers continue to reap the business benefits of faster data analysis. One example is IMS Health. Thanks to improved performance through using our fast in-memory analytic database, the process of supplying and graphically representing data has been reduced from several days to one day or from hours to minutes. This enables IMS Health to better meet its customers’ needs. For customers, faster delivery of required data translates into significant profits, as the ability to make fast and well-informed decisions based on high-quality data is especially important in the pharmaceutical industry. 

‘It’s not the problem that matters: it’s how you deal with it’ as the old saying goes.  So how well-prepared is your organization to respond to a cybersecurity incident such as an attack, data breach or unexpected outage?  According to the 2016 SANS Incident Response Survey, 87% of organizations said they responded to at least once incident in the past year, and 59% of these resulted in a breach.  As such, it’s critical to handle these incidents in a way that minimizes damage, recovery time and costs. 

To help them do this, organizations have introduced a range of tools and processes to make incident response more intelligent and effective.  But a gap still exists in many organization’s response processes, which is the ability to identify the business context of incidents.  Let’s take a close look at what this means, and why it matters.

Most incident response processes are built around a SIEM (security information and event management) system, which collects alerts and logs from security sensors including anti-virus, firewall alerts and so on. This can amount to hundreds or even thousands of alerts per day in a large enterprise, which the SIEM system and associated tools filters to remove false alarms and low-level alerts, flagging only the events that merit closer investigation by the security operations center (SOC).

For every relevant alert – let’s say 100 per day – that is classified as a genuine incident that needs closer scrutiny, the SOC then needs to make two key steps.  The first is to triage the incident, gathering information on what is happening, what it affects and what the potential for real network damage it is; and second, to put together and implement a prioritized action plan. 

Context matters

Currently, most businesses do not have an automated process for handling these steps. Some may have documentation to guide the SOC engineers on what to do, or in other cases the entire process may be ‘free-form’, relying on the engineers’ experience and intuition.  What’s frequently neglected is the business context of the incident.

Business context in incident response is all about connecting data regarding the security incident to the actual, real-life, business processes or critical applications that the incident may affect.  The aim, ultimately, is to enrich the technical detail of the incident, such as ‘this server is affected by this piece of malware’, with the context of the business applications it affects, such as ‘this server is part of our European ecommerce system, and it connects to these core payment applications, and if we shut it down we will be unable to process any payments from European customers.’

As such, business context not only helps the SOC identify which security incidents need to prioritized, but also which course of action is most appropriate and crucially, when it would be best to address them.

Let’s, for example, imagine that your SOC discovers that your European e-commerce system needs critical security patches. It’s a business priority – but does it absolutely need to take place during peak European shopping hours, with the risk of unexpected downtime and substantial lost revenues? Could it instead wait until 2am Central European Time? With the intelligence provided by the business context, your SOC can quickly weigh up the security risks versus the operational risks, and make the smartest incident response decisions from a business perspective 

Making the connections

Another process that can further enhance an organization’s incident response capability is connectivity analysis, offers the SOC team an even deeper understanding of an incident’s potential impact by highlighting the connectivity between compromised assets.  In other words, it shows how far the attack could potentially spread, and highlights the security risk. 

So, turning again to the example of a server being infected by malware, a connectivity analysis process asks: what is that malware going to do next? What is that malware going to do next?  One typical action might be an attempt to spread to and infect other systems on the network.  Another might be to try to steal data from the infected server, and attempt to send that information out to an external controller. A third action might be to open the server to connections from external addresses to trigger a download of further malicious code (which is typical behaviour for ransomware). 

The potential severity of these actions depends on the structure of the organization’s network, and where in that structure the compromised machine is placed.  Is that server able to make outbound connections to IP addresses on the internet?  If so, then malware on that machine is likely to be able to exfiltrate data – which makes resolving the infection a priority to avoid data breaches.  However, if traffic from the compromised server is blocked by a perimeter firewall, then the risk of a breach is reduced. 

Similarly, if the malware cannot move laterally to infect other systems that host critical data, because the network is robustly segmented, then security staff are in a better position to prioritize incident response. 

As with business context, connectivity analysis helps categorize and prioritize incidents according to their risk and impact level.  The analysis is done by using a security policy management solution to run automated ‘what if?’ traffic simulations, to identify which assets on the network have been compromised, and which other systems and resources those assets can connect to, both inside and outside the network.  For example, the simulation may show that an infected machine is secured against external connections, but not properly segmented from internal servers hosting sensitive material.  As such, infections on that machine should be prioritized for cleanup before the infection spreads laterally.

Together, business context and connectivity analysis help organizations to answer the “what if?” questions:  what could that incident lead to? What could its impact on the bottom line be?  What’s the optimum approach to fixing it, and when?  They enable more efficient incident response by helping IT teams to focusing on what really matters to the business.  

Computer-Aided Design (CAD) and Computer-Aided Engineering (CAE) often use extremely large files, which make remote working and collaboration difficult to achieve. Most businesses are able to work remotely with laptops, smartphones and tablet PCs, but the processing power required to create, store and share CAD files over a wide area network is often prohibitive. Yet with the power of the internet they can work remotely and collaboratively.

By Graham Jarvis, freelance editorial consultant.

The key challenge, because the files they send to their colleagues and CAD partners across the globe are so large, is about how their IT teams mitigate the effects of latency in Wide Area Networks (WAN) to enable them to work uninterrupted by slow network connections. Strained WAN resources aren’t the only issue that concerns them. They need to deploy remote access control technology to protect their data as it flows across the internet, and from cloud to cloud, to ensure that only authorised individuals can work on any given CAD or CAE projects.

In essence, the internet and more recently cloud computing has become an enabler of remotely situated design, manufacturing, construction and engineering teams. Not only can they share their skills, knowledge and expertise, but also their data. Cloud can handle the peaks in storage and computing demand, but organisations must be able to get it up and down quickly in order to benefit from the potential cost efficiencies and the infrastructure agility that it can offer.

“With the ubiquitous access to the internet it is now possible to gather data from every part of the world and bring it back to a central hub for analysis, and you can design an aircraft or a car in one country while manufacturing it in another”, says David Trossell – CEO and CTO of data acceleration company, Bridgeworks. He points out that this means a huge amount of data is constantly being moved around and that all of the data is logged.

It’s about time

The Engineer says in its 23^rd June 2016 article, ‘It’s About Time – Evolving Network Standards for the Industrial IoT’, “The Industrial Internet of Things (IIoT) promises a world of smarter, hyper-connected devices and infrastructure where electrical grids, manufacturing machines, and transportation systems are outfitted with embedded sensing, processing, control and analysis capabilities.”

The article recognises that latency can still be a problem, and it claims that:

“Much of today’s network infrastructure is not equipped to handle such time-sensitive data. Many industrial systems and networks were designed according to the Purdue model for control hierarchy in which multiple, rigid bus layers are created and optimised to meet the requirements for specific tasks. Each layer has varying levels of latency, bandwidth and quality of service, making interoperability challenging, and the timely transfer of critical data virtually impossible. In addition, today’s proprietary Ethernet derivatives have limited bandwidth and require modified hardware.”

The article adds: “Once networked together, they’ll create a smart system of systems that shares data between devices, across the enterprise and in the cloud. These systems will generate incredible amounts of data, such as the condition monitoring solution for the Victoria Line of the London Underground rail system, which yields 32 TB of data every day. This Big Analog Data will be analysed and processed to drive informed business decisions that will ultimately improve safety, uptime and operational efficiency.”

Commenting on the article, and specifically about the London Underground example, Trossell says: “Everything is real-time, and so the question has to be: How can we get the data back as fast as possible to analyse it and to inform the appropriate people. Some elements of this task may be in-house first for a quick exception analysis?” Some of this data may then be pushed to the cloud for further in-depth analysis by comparing present data with historical data to see whether anything can be learnt or improved from a maintenance and service perspective. With an unimpeded network, big data analysis from a wide range of data sources is possible, adding the ability to gain insights that were once not so easy to obtain.

From IoT to IIoT

Trossell thinks that the broader expression of the Internet of Things (IoT) is just one of the current buzzwords that everyone for a variety of reasons is getting excited about. “Most people think of this as their connected fridge, the smart meter for their utilities or the ability to control their heating system at home, but with the ever increasing diversity and the decreasing cost of sensors for industrial use, the term takes on a new level of sophistication and volume when applied to industry”, he explains.

In industry, IoT gives birth to IIoT, which involves monitoring the performance of complex machinery such as gas turbines, aircraft, ships, electrical grids and oil rigs. So it’s not just about a diversely spread group of CAD engineers working collaboratively across the globe. “IIoT has never been so diverse and in depth with vast amounts of data being created every second. To put this in perspective, each Airbus A350 test fight can received measurements from 60,000 separate sensors”, he claims. That’s a phenomenal amount of data that needs to be transmitted, backed-up, stored, and at some point it needs to be analysed in real-time in order to have any value.

“An example of this is a company that has developed a system where the aircraft technician can download the data from the black box flight recorder, send it over the internet where it is analysed with artificial intelligence for anomalies exceptions and then passed to an expert for investigation”, he explains. The benefit is that this approach can engage several experts, for example from an air transport safety board and involve manufacturers, across the globe to find out, unusual pilot activity, or sensor data can be collated to enable an airline to reduce maintenance and unplanned outages and possible safety implications  to a minimum therefore improving availability and profitability.

“However, just like the consumer internet, moving vast amount of data across the internet has it challenges – especially when the data may be half the world away”, he warns. These challenges include increased network latency due to the teams working at a distance over a WAN, and potential security breaches. He adds: “Moving files around between various data silos can be inhibitive even over a LAN – the cost of 10Gb networks are dropping considerably, but with WANs the problem is about moving data over distance because of latency.”

Yet in spite of the gremlins posed by security threats and network latency, there are many companies around the world that are established virtually thanks to the internet. They are often specialists in their chosen disciplines, and each of them can add a bit to the whole picture, but Trossell believes it’s no good to collect or generate data if you can’t use it to encourage and enable the collaboration of globally dispersed multi-disciplinary teams, to allow for innovation and for the creation of efficiencies. The data – including sensor data - must get to the right people at the right time if it is to add any value, but latency can prevent this from happening and latency can turn invaluable data into redundant and out of date data that adds nothing of worth or merit. 

Being smart

Companies investing in IIoT and remote working therefore need to protect their businesses by investing in solutions that can mitigate the impact of network latency while enabling data to be securely sent at velocity between the various data users and analysers. With smart systems, the challenges can be harder to overcome because in a traditional Purdue system data flows up and down the model, but Trossell says that smart systems and IIoT data tends to flow in all directions like a web. Being smart is also about mitigating latency and reducing the potential threats to data. With this in mind, Trossell offers five top tips that could ensure that your company gains the most from its data:

•      Remember that the two biggest killers of performance in WAN is packet loss and latency. When you have them together then you will suffer massive performance hits.

•      Adding bandwidth to your WAN will not necessarily increase performance, but it will increase costs!

•      Marshal and consolidate data if possible rather than allowing lots of individual streams as this is a more effective use of WAN bandwidth.

•      Use a product such as PORTrockIT to accelerate data transmissions, and use applications that pre-compress and encrypt data before it is sent to the WAN.

In essence, by mitigating latency and improving data security, industrial organisations can maximise the potential of the industrial internet. With the growing amount of sensor data, and the growing need to work collaboratively with remote teams across the world, these challenges are going to become more and more prevalent and obstinate. Industrial organisations therefore need to act today to ensure they protect their businesses well into the future, to enable them to participate in the industrial internet of things, and to allow them to benefit from real-time big data analysis right now. In other words, there is no point in using smart technology if you aren’t being smart with it too. 

Successful rollout of enterprise digital transformation continues to be a mixed bag. We continue to see the explosive increase in connected devices (the IoT phenomenon) and large advances in application capabilities to improve enterprise productivity. But we’ve also seen the challenges of securely implementing these technologies potentially delaying greater enterprise adoption.

Security certainly became the hottest issue in late 2016 in the aftermath of high-profile attacks. The Mirai botnet, which knocked some of the world’s leading websites offline, and the recent admission by Yahoo of a 2013 data breach of over a billion user accounts are just two examples.

And these problems will be compounded as organisations begin to adopt more connected devices and IoT technology, while still attempting to maintain their legacy network infrastructures.

There will be three particular focus areas that will have a big impact on corporate networks in the next 12 months: safeguarding the network from potentially vulnerable IoT deployments, ensuring protection from costly distributed denial of service (DDoS) attacks, and the adoption of ‘as-a-Service’ deployment methods to cost-effectively move toward a more secure network infrastructure.

1. Containing, not constraining, IoT technology

More and more industries are reaping the benefits of IoT – healthcare, education and manufacturing are just a few of the markets where new IoT-enabled devices deliver productivity improvements, reduced costs on energy, and expanded visibility. However, the benefits of these new connected devices come with a new set of issues for the IT team - they are poorly secured and IP-enabled devices at the network edge offer a backdoor into the corporate network for attackers.

The rise of IoT is forcing network engineers to think of new ways to manage networks and the growing number of connected devices. Continuous quality of service (QoS), intelligent device prioritisation and high availability all contribute to a quality experience for the network’s users. But a large, insufficiently managed network will inevitably develop weak points in security over time. By ‘containing’ IoT into several virtualised environments on a corporate network, businesses can greatly decrease the worst-case scenario of a network breach. The break-in is contained and cannot spread to threaten wider business operations.

How to effectively secure and manage IoT networks will become a major discussion point over the coming year or so, and IoT containment will form a core part of the solution. Using a segmented IoT approach allows deployed devices to be managed and operated only by personnel that make use of them, making IoT management simpler for the enterprise. For example, the IoT network can be segmented so that the HVAC control system is operated by the HVAC specialists, who can configure, monitor and operate the HVAC system without impacting the rest of the network. This eliminates the burden on the overtaxed IT organisation from having to take on another management task.  

2. DDoS protection will be a must-have for every business

Containment also has an important role to play in managing the security of enterprise networks. By controlling access to the virtual networks and devices, containment can stop compromised devices from reaching other areas of the network. 

Do you recall the major network breach suffered by U.S. retailer Target in 2014? The entire Target network was accessed after a minor breach in the connected air conditioning system. Simple network segmentation would have eliminated any wider threat from an unsecured air conditioning system by containing it to the area it accessed.

According to Akamai, DDoS attacks on enterprises increased by over 12 percent in 2016 compared to 2015 – and this trend is expected to continue. We witnessed one of the largest ever DDoS attacks in 2016. A botnet from IP-enabled devices infected with the Mirai malware hit Dyn, a major provider of managed domain name services (DNS), resulting in major websites being offline for hours. As IoT devices are hastily rolled out by businesses and consumers with default security settings and passwords, malware such as Mirai can scan for unsecured devices and take advantage of them.

This makes the DDoS threat to enterprises doubly concerning. First, there is the direct threat of falling victim to a DDoS attack on your network. The second concern is that the DDoS attack can infect your connected devices, carrying out attacks not only within your network but against other enterprises. This is just one area of concern for the largest online organisations and ISPs – imagine the financial losses if the online presence of an e-commerce business was knocked offline during a busy holiday period?

Over the next year, businesses and organisations should scrutinise every aspect of their networks, right down to network infrastructure equipment. DDoS attacks are difficult to prevent entirely, but by introducing protection at the access switch level, enterprises can improve their first line of defense by detecting, filtering and ultimately blocking malicious traffic before operations are hindered.

Existing legacy network technology, however, often does not have the embedded intelligence to provide this layer of defence. Enterprises, when looking to enhance their network infrastructure, whether to support the new bandwidth and networking demands of IoT devices or as a general replacement of legacy equipment, should look toward devices that have at least these three critical security capabilities to better provide a comprehensive first line of defence:

1.     The system source code has been independently certified by industry security experts;

2.     The software will be scrambled in the hardware’s memory, to minimise the ability for attackers to find vulnerabilities in the system;

3.     Software that can be delivered by a trusted, secure infrastructure, to eliminate the risk that tampered code is received and installed on the system.

3. New network delivery models – pushing IT beyond OPEX

The containment of the IoT devices and DDoS mitigation strategies often require capabilities found only in the latest generation networking access equipment. But the challenge for the enterprise is they often already have a legacy infrastructure – and with the continually shrinking capital budgets in most organisations, little budget to procure and implement this new equipment.  

So how does an enterprise manage to do this? One way is to take a play from the software-as-a-service (SaaS) playbook. Over the past several years, we have seen the rapid shift in the software world from CAPEX deployments of software applications (such as databases, CRM systems, and office productivity suites) toward OPEX and cloud deployments, with lower upfront costs and flexibility to adapt quickly to the enterprise needs, as well as providing ubiquitous availability for today’s increasingly mobile workforce. Now, this similar benefit can be found with network infrastructure as a service (NaaS) offerings.   

Similar to SaaS, NaaS implementations have substantially lower upfront costs and can be managed on an OPEX on-demand or pay-per-use basis. IT organisations can roll out the latest generation, security networking technology to support their IoT, mobility and digital transformation needs with little upfront costs and only ongoing operational expenses. This is often at overall lower costs than they are spending to just keep the lights on with their existing, legacy infrastructure.

Digital transformation can be done securely

Digital transformation is an imperative for corporations to maintain relevance in today’s rapidly evolving digital era. But deploying it can have its pitfalls that can result in significant impact, both financially and for your company’s reputation. A properly laid out plan that can leverage a single network infrastructure to isolate and contain the various IoT systems, provide inherently secure access infrastructure, and ensure that you are deploying the latest generation networking equipment can help guarantee that your digital transformation activities deliver the best possible outcome for your business.

Today, in many organisations, there is more open source than homegrown or proprietary code in a company’s product.  Unfortunately, most companies, while taking advantage of Open Source Software (OSS) in order to create products faster, are not respecting the open source licenses associated with the software components they use.  While OSS is free of cost, it is not free of obligations.  These obligations run the gamut from passing along a copyright statement or a copy of license text, to providing the entire source code for the company’s product.  Data shows that most companies are aware of only a small percentage of the open source they depend on.  By not knowing what you are using, it is impossible to comply with the obligations specified in the license.  Additionally, software can have bugs or vulnerabilities which may affect your product.  By not keeping track of what you are using, it can make it possible to be far behind on upgrades or patches that fix known software vulnerabilities.

However, there is great value in open source. 

Discovering, Managing and Complying in Five Steps

Once the issue of OSS compliance or vulnerability management comes up, the first question is often “What can I do to get a handle on what open source components are we using?”

There are five steps that can help you understand what your company is doing and set up a process for discovering, managing and complying with the OSS you are depending on.

Step 1:  Understand how OSS enters your company

There are many ways that open source enters your company.  The classic case is that a developer decides to use an open source component and downloads the source code and incorporates that source code into their product.  This is still a very common case but there are many other ways that open source ends up being used in an organisation.  It is very common today that developers will be using what is known as a Repository Manager.  These tools allow developers to specify the components that they want to use, and then the Repository Manager will be responsible for downloading the source code, or compiled binary file as well as any dependencies that this component may have.  These Repository Managers typically store the open source components in a separate repository outside of your classic source code management system.  Some common Repository Managers are Maven, Nuget or npm.

Another way that open source comes into an organisation is as a subcomponent of a commercial or larger open source component.  It is very common to have multiple open source subcomponents or dependencies for a single, top-level component.  These subcomponents are often not disclosed or managed.

Additionally open source will be used as runtime infrastructure pieces such as Web servers, operating systems or databases.

All of these components may be pulled in by developers, graphic designers, procurement, professional services, IT administrators and many others.  This is no longer only a developer-based process.

Step 2:  Start looking for OSS

Once you know the way that open source is selected and used, you can start performing an assessment of what components you depend on and how they are being used or distributed.  This is typically known as building your Bill of Materials (BOM), or creating your open source disclosure list.  This list is used to follow the obligations, modify OSS policy and react to published vulnerabilities.  It is common to find open source packages that have licensing obligations that your organisation is not able to follow.  This puts you out of compliance with the license.  In these cases, the open source component needs to be removed and the functionality replaced either through the use of another OSS component or by writing equivalent functionality.

Codebase reviews, interviews and scanning tools can be helpful during this process.

Step 3: Question your development team

As projects get larger, more complex and more distributed, it has become harder to discover all of the pieces that are in use.  This makes it important to have periodic conversations with the developers, devops and IT personal involved with the creation, deployment and running of the project in question.  Asking targeted question such as “What database do we use?” or “What encryption libraries do we use?”  can be helpful in discovering other modules that may have been missed the first time.

Simply asking “What open source are we using” rarely creates a complete list for a few reasons, including that the knowledge of what OSS components were selected often has disappeared from memory or the company.  There is also a misunderstanding or lack of knowledge among many developers about what is considered open source.

Step 4: Understand how incoming OSS is managed

There should be a consistent and enforced process for managing your third-party usage.  This allows your organisation to properly comply with open source license obligations, and well as be able to react to new vulnerabilities.  It is common to have teams with varying level of completeness and compliance.  Some organisations are currently only tracking components that have been “Requested” by developers.  These types of companies find that they are often only tracking the larger pieces of open source, or have some developers who are better than others in following the process.

Other companies use scanning technology to help discover and track OSS.  Depending on the scanner used, or the level of analyses performed, varying degrees of discovery will be found.  Some tools only discover license text, not actual OSS components.  Others can find components managed by package managers but can’t find anything else.  It is important to understand the level of analysis performed, and what should be expected to be found.  It is common to come into compliance in phases as more components are discovered and managed.

Step 5:  Look for evidence of OSS compliance

Once you create policies, start looking and managing OSS, and requiring compliance with the OSS obligations it is important to confirm that this compliance is visible.  Do you see the required attributions or copyright notices in the product or documentation?  Do you see the license text as required?  Is there a written offer for source code or the actual source code distributions for any Copyleft-style licensed content you may be using?  These are all visible indicators of an effective open source management process.

By following these five steps, educating your company about proper OSS usage and encouraging others in your ecosystem to do the same, you will be able to use open source to create powerful modern applications, while at the same time, respecting the open source licenses and organisations that make this possible.  Additionally, the more you know about how your product is assembled, the third-party pieces that compose it and the current vulnerability status of them, the more secure and supportable your product is.