Internally, you recognized that to have accomplished these goals for the business, changes within your IT group had to be made:

• You examined the IT processes that historically were either poorly performing or not defined and created programs and training for staff to implement IT management processes based on ITIL
• You virtualized most of your data center except for your mission critical applications and large database systems
• You implemented an IT service management management function that resulted in a robust but practical and usable configuration management database (CMDB)
• You created an SLA enforcement mechanism for your critical applications that has the effect of notifying your systems operations center when mission critical application components fail

As a result, sales are up, costs are noticeably lower, and service quality is significantly improved. Life is sunny.

Until the clouds come (sorry, I just had to put that in!)

The implementation of your online presence in Europe has increased the traffic to your site infrastructure by 20%. Moreover, this move results in many holiday specialty items. While your ecommerce infrastructure (web site, fulfillment, inventory, and supply chain) has generally kept up with demand, it has struggled with performance and scaling issues during the holiday season. Also, the annual operational cost of the data center is quite high due to the need to support seasonal demands. This new expansion is stressing your servers even more at peak and, though you’ve grown capacity to meet the demand, your CFO is putting pressure on you to cut operational costs. As you look at your utilization reports in February and March, noting the significantly low traffic that your servers are getting, you know a change needs to be made.

To solve the performance issues and the overall seasonality challenge that’s causing significant annual operating costs, you form a task force to investigate the implementation of a private cloud environment. While you believe this will potentially solve the performance and scale issues, you’ve come up with more questions than answers. On the plus side, cloud technologies promise significant scalability benefits (elasticity) to be able to more effectively handle the seasonality concerns, including scaling back services when demand is low. This plan could also result in improvements in your ability to deliver services on demand by deploying ready-made virtual machines for web and application servers. However, many questions persist:

• What model do I choose: PaaS, IaaS, or some combination?

• If I choose infrastructure as a service, how do I guarantee the quality of the resulting applications?
• If I go with platform as a service, what standard services do I put in place that will promote agility without sacrificing quality? How do I enable flexibility and not compromise compliance?

• Will it be cost-effective? I have a charge-back model today for the services I provide to various lines of business. How will I need to redefine that model so I can keep costs in line?
• How will it affect my service delivery? Right now now I have a pretty well-defined service management system that helps me keep my critical apps up. Will there be significant VM sprawl as a result of the elasticity I should be getting? If so, how will that affect my ability to manage this sprawl for my critical applications. Heck, I just finished getting a handle on my tier 2 apps. Will I lose control of those?

If you haven’t gathered by now, there are themes here that the War on Cost team has been exploring and discussing for some time across a variety of scenarios. They are the enduring business value pillars of reducing costs, improving agility, improving quality of service, improving governance and compliance, and managing risk. All of these value dimensions are in play with the introduction of a cloud paradigm. In fact, they have the potential to be amplified:

• Agility – Possibly the value pillar with the highest potential amplitude. The cloud paradigm (whether public, private, or something in between) has the potential for extreme agility. Automatically provisioning development, test, and production environments in a matter of minutes or hours instead of days or weeks has enormous potential
• Costs – Costs have the potential to be dramatically reduced by providing a commoditized set of services that can be automatically commissioned and decommissioned at will. Also, server utilization can be significantly improved through intelligent load balancing as demands for the service change, particularly due to seasonal demands from stores and online traffic
• Quality of Service – QoS in all its forms (reliability, scalability, performance, availability, etc.) can be greatly improved by intelligently and dynamically load balancing workloads across (potentially large) arrays of servers running as VMs on a farm of servers that are well-utilized
• Governance, Compliance, and Risk Management (GRC) – These three are related values and the cloud offers huge potential benefits here too. As services are defined (whether its infrastructure, platform, or software), they are standardized (one of the main tenets of cloud computing). Standardization has the natural implication of introducing governance and compliance regulations, which, in turn, has a direct net benefit to managing risk

But, and it’s a really big but, what about complexity?

You’re thinking about the sheer number of VMs that can get spun up in your data center. Where once you had a hundred or so servers, you now have somewhere between five hundred and a thousand VMs (you’re not really sure). Will implementing cloud exacerbate that VM growth? How can I contain it? How much should I contain it?

So, therein lies the challenge before you: if you’re going to move to a private cloud because you and your business leadership team see the potential for huge benefits, how will you manage the complexity introduced by this cloud to be able to maintain and enhance your IT team’s ability to deliver for the business?

What do you think? Do these ideas ring true with you? Are there other major considerations to weigh? Let us know what your experience has been. Have you answered these questions for your organization? Don’t be shy. We want to hear from you.

All the best,

Erik, Strategist, War on Cost

Imagine you’re Sara, the CIO of your retail company with 10,000 employees. You have 500 employees within IT reporting to you. Your manager, Fred, the CFO, calls you into your office and asks: “Sara, how many applications does IT support?” My first thoughts (as Sara) are: “why is he asking? Is there a problem?”. My next thought is: “Does Fred want me to change the way I run my end of the business?” 

Regardless of your initial thoughts, if you’re a typical CIO, the simplest and most straightforward answer is “I don’t know”. The truth could be anywhere from hundreds to thousands for a medium/large size organization that Sara supports. A more nuanced answer would be something like:

“Well Fred, we have 8 mission critical applications supporting the store systems side of the business, another 3 supporting merchandising, 5 supporting our supply chain, 3 for customer service, and of course, our e-commerce site. They all have SLAs that we defined and track on behalf of the various business stakeholders. There are approximately 250 other applications throughout IT that support the organization, but we don’t track them very closely. Finally, there are as many as 500 applications that we host in our datacenter but we provide no support for them.”

Sound familiar? It should. This is a classic problem of limited application portfolio visibility. Most IT shops support a vast array of applications, but only the ones that are either considered mission critical or directly support the business are managed closely by datacenter operations. This typical scenario presents the following challenges for you:

1. “Rogue” applications deployed into the datacenter could cause quality of service issues for the mission critical and/or tier 2 applications
2. Changes to any application in the environment could cause sudden, unpredictable resource spikes (network, data access, server CPU/memory) affecting any of the mission critical applications (and impacting the SLA)
3. Lack of visibility into which datacenter resources are associated with what application, such that, if a server goes down, IT operations may not know how many applications would be affected by the components on those servers becoming unavailable
4. Higher costs of deploying 3rd party applications on dedicated hardware
5. Higher costs of duplicate functionality from similar applications
6. Lower agility and higher costs due to not being able to optimize the server and storage resources for the application portfolio

Do you care? Absolutely! But, what can you do? Neither application development teams nor their IT support staff typically don’t define a production IT topology specifying where various components of the app will reside.

I’d like to hear from you about your experience with this dilemma. Does it ring true for you? Are there other pitfalls you see with this lack of visibility.

In my next post, I’ll discuss the “costs” of the problem in money, time, lack of agility, poor service quality, and risk.

All the best,

Erik Svenson, Strategist, War on Cost

In a recent survey I conducted of 45 developers, DBAs, and information workers and managers, I wanted to understand what metrics were being used measure the effectiveness of current processes and technologies across a set of application platform scenarios such as building composite apps, managing app servers, and data warehousing to name a few.

What I found is that most respondents had very little sense of what measures were used to track the effectiveness of the work they do. This was especially surprising given the number of respondents who described themselves as having a very mature IT organization.

In his excellent book: How to Measure Anything: Finding the Value of Intangibles in Business, author Douglas Hubbard makes a compelling case for how it is possible to measure just about anything from a business context. The value of his message, in my opinion, is not that you can measure these things or even that you should. Rather, I think the biggest value here is how to measure. Without going into a lot of detail (and spoiling the thrilling end of the book!), he states that even if an organization doesn’t have a specific measure for some process or desired outcome, they will certainly at least have some observable way to detect an improvement that the business values. If not, you wouldn’t do it.

Given that rather straightforward and somewhat obvious statement, it’s clear that every organization in a business context will have measureable processes, technologies, and/or outcomes whether or not they have specific metrics or key performance indicators (KPIs).

What has your experience been in measuring your work against specific measures? How do you measure the effectiveness of your team’s work?

Let me know at erik.svenson@microsoft.com or feel free to post a comment.

All the best,

Erik Svenson, Application Platform Lead, War on Cost Team

That area is information management. 

Total capacity of shipped disk storage systems has grown by 14.8% in the last year⁽¹⁾. While profitability for solutions vendors has reduced as the storage market has finally started to feel the impact of the economic downturn, it is clear that demand for storage capability is not slowing down.  The reality is the continual growth in the amount of data being created and needing to be stored is driving that demand. This can be seen in the associated rising costs associated with management of that data. 

Even at a personal level, how many readers have in the last two years gone from managing their personal data stores by using DVDs to running terabytes of storage for movies and music and other media on home networks?  Are you already using cloud based services such as Hotmail and the associated free storage, not to mention Facebook, Flickr etc. How many of you expect that use to slow down or diminish? How do you protect yourself from disaster?  How do you deal with replication? What’s your personal strategy on de-duplication (do you really need multiple copies of that R&B album spread across multiple machines) ? Not to mention have you considered and understood the privacy and ownership issues that relate to web based storage?

Any business faces a similar reality - they need to fully understand how they will manage the information that they own. That management load includes not only simply storing their data, but also the challenge of managing capture, duplication, retention, access, and data protection. It’s clear that products for management of information are constantly improving - but at the same time the amount of data being stored and used grows as well.  And with the widespread adoption of virtualization - storage and associated data protection form a complex environment that may create a significant potential source of frustration and challenge for an organization. Not to mention costs.

In my recent research it’s clear that there is a significant omission in the guidance available regarding information management and the associated storage solutions. While there are multiple claims of "cost savings", the majority of offerings do not define how organizations can measure any related benefits that are realized and delivered.  The cost models that are publicly available are at best limited and simplified - they focus on generalizations and simple benefits related to technology. Doing further research regarding the state of the storage world this gap has become very clear - and I'm now also left wondering due to the lack of any clear data - what is missing in terms of impact on some of the other costs in the datacenter. 

As our work continues to further understand the costs in the datacenter, it has become clear for information management that there are both benefits that can be delivered (stability via baseline measurement, agility through standardization) and investments that need to be made (quality of service by building and enabling standardization, risk avoidance through enabling backup facilities) that all assist in defining where the information management costs related to your data center will fall. There is however little or no coverage, or impact, in those models that is reflects the issues or need to have storage and its associated capabilities in place or used. That needs to change given the above.

So a clear goal in this area, and a focus of further work, is to create a cost model that reflects the major issues and challenges.  If I can build that structure then an overall assessment of how information management impacts datacenter, and ultimately cloud, related costs will emerge.  It should prove an interesting journey.

I'm interested in your feedback regarding information management, related storage implications, storage management and any associated cost models - I'd be more than happy to debate my position on the lack of well-defined cost models. 

Brett

(1) www.networkworld.com/news/2009/072409-storage-vendors-emc-seagate-report

These apps are also referred more generically to be called “Tier 1 applications”. These applications hold a special level of importance in the corporate enterprise because their failure (measured in terms of reduced service quality or complete outages) would have a profound effect on the business including any or all of the following:

• Widespread business stoppage with significant revenue impact
• Risk to human health/environment
• Public, wide-spread damage to organization’s reputation
• Company-wide productivity is compromised

Examples of these types of applications are eCommerce (amazon.com, ebay, etc.), 911 response systems, stock and commodity trading systems, and airline reservation systems (some would also put CRM and corporate email into this group too).

(Note: while some have referred to Tier 1 apps with examples such as Exchange, SharePoint, SQL, Oracle, DB2, etc., I claim they are missing the point. With the possible exception of SharePoint, these other examples support the application and need to be treated as part of the overall solution, not as the solution itself.)

It’s obvious that these applications are important to the business for the reasons listed above as well as others. They represent a significant importance to the business when they run well and a huge impact to the business when they don’t.

Tier 1 Apps Put Quality and GRC Ahead of Cost

What I find interesting, however, is that these apps hold a special place in the minds (and the wallets) of business and IT leaders. Despite the IT maturity of an organization, companies will “invest” whatever it takes to keep these applications up and running with the highest levels of quality expected of their customers.

Even for organizations that do not have a culture of IT maturity improvement, Tier 1 apps will always enjoy financial and human resource availability to ensure those apps remain highly available. While the driver for most applications in the organization (60%-80%) is cost (delivery and ongoing maintenance), Quality of Service (QoS) and Governance, Risk Management, and Compliance are foremost.

The implications of this can be profound, particularly for companies that do not have a practice of IT maturity improvement. Highly mature organizations imbue the practices of service delivery with high quality, high compliance, and low risk across the entire portfolio of their service catalog, without incurring the huge costs of maintenance.

Less mature organizations, on the other hand, will tend to be reactive in nature and waste resources to ensure these Tier 1 applications remain healthy. The costs incurred can come from many sources such as expensive consulting resources, inefficient, time-consuming processes, and an over-reliance on expensive technologies. In short, these organizations will throw whatever is necessary at a Tier 1 app to keep it up and running to meet any explicit or implicit quality and compliance bars exist.

What to Do? Learn The Lessons from Tier 1 App Delivery and Management

Regardless of how you define it, every business of any appreciable size has Tier 1 applications. Unfortunately, many IT organizations do not have a very high level of IT maturity and yet, these Tier 1 apps demand it. As a result of this gap, significant wasteful costs are incurred to keep them up and running. Where there are pockets of good, mature IT practices, they probably exist within the realm of Tier 1 service delivery.

Unfortunately, what also exists is REALLY bad process too, all in service of maintaining high quality of service. In my role as an enterprise consultant for many years I’ve seen countless “all hands on deck” events when a Tier 1 app went down. There was a mad scramble to restore service, all the while work on other important IT functions was put aside.

For that reason, IT organizations should look at the mature practices and policies they do have have (many of which will be implied) for their Tier 1 apps and see how to apply them across their IT service portfolio, but not simply because it’s “good practice.”

The organization needs to also take a hard look at recent emergency situations as much to understand what cost is being incurred to restore service as to understand how to minimize their occurrences.

By using the lessons learned from their Tier 1 app efforts (both the good and bad), IT organizations will reduce their overall delivery and operating costs by becoming more efficient in the deliver of IT services through such activities as:

• Rationalizing the costs of high availability
• Reducing the reliance on expensive consulting and support resources
• Becoming smarter and more targeted about information security
• Designing apps with the right level of service (how many “9s” are needed?)
• Resolving incidents more quickly with appropriate service monitoring

Conclusion

The overall message is simple and taken from an old adage: an ounce of prevention is worth a pound of cure. IT organizations and the businesses they support will lower their overall delivery and operations costs when they look to the best practices learned from the delivery and maintenance of their Tier 1 apps and apply them generally across their organization.

All the Best,

Erik Svenson, Application Platform Lead, War on Cost Team

IT Maturity is often thought of in terms of process maturity or technical maturity. In the realm of IT maturity models, there are no shortage of frameworks that cover this area with Capability Maturity Model Integration (CMMI), COBIT, Microsoft’s Infrastructure Optimization (IO) Model, and Gartner’s Maturity Model being among the most popular. (Process improvement models such as ITIL and the Microsoft Operations Framework (MOF) share a close relationship with these maturity models but don’t, in and of themselves, promote a specific path to improved IT maturity.)

Unfortunately, none of these models do a complete job of clearly defining the various maturity levels they espouse. The levels that are defined as part of their models are descriptive in nature without clear boundaries described between the various levels that give quantifiable measures of success.

Further, the descriptions themselves do not cover all aspects of maturity. CMMI and Gartner, for example, focus exclusively on process improvement in which each of the maturity levels describe better and better states of process maturity. The Microsoft IO Models consistently define maturity in terms of an organization’s ability to automate processes.

What is needed is a unified maturity model that incorporates what it means for an IT organization to be mature around the following:

• People

The right staff is acquired and retained for the right job. They have access to appropriate training and, at the highest levels of maturity, have appropriate industry certifications and training credentials.

• Process

While this area has been covered in depth by most of the models, process maturity should also include why processes are being improved in the first place. CMMI, for example, defines Key Process Areas (KPAs) such as “Requirements Management”, “Product Integration”, “Causal Analysis and Resolution” to name a few. While these process areas are categorized into various maturity levels, they are not inherently linked to specific measures of business value.

Improving a process that isn’t measurably linked to enhancing the business’s effectiveness around any of the four War on Cost Value Pillars (https://blogs.technet.com/itbizval/archive/2009/02/27/the-role-of-information-technology-in-today-s-economy.aspx) is a waste of time and effort.

• Technology

This area has also been covered in detail by various models such as the Microsoft IO Model. The technology aspect, however, is a means to an end, not an end in and of itself. Very often, technology is used as a means to improve processes by automating them. By focusing on process automation, the value of technology is sold short. Technology should be utilized to help improve the maturity of people as well by maturing training, access to information, as well as the quality of that information.

The War on Cost team is in the process of studying these concepts further to help unify these areas of maturity so that a more practical model of how technology can and should help customers become more mature can be defined. More to come.

Happy New Year everyone! On behalf of the War on Cost team (Elliott, Bruce, Brett, and Erik), we hope you have a prosperous and successful 2010!

All the best,

Erik

War on Cost Application Platform Lead

But what about all those other activities that are not considered “best practice”? I would contend that many activities that an IT organization does would not be called a best practice. They may be effective, but not most effective. As an example, an organization might manually distribute client install discs for an application rather than create an automated software distribution mechanism. As another example, a development team may test an application completely manually rather than using techniques such as code coverage analysis and automated testing tools to increase software quality.

In both these examples, the job gets done but with significantly differing results on quality, cost, agility, and/or risk. I’d like to suggest that both these cases above are examples of what I would refer to as “Practices”, borrowing the Wiktionary definition as “The ongoing pursuit of a craft or profession, particularly in medicine or the fine arts.”

Forgetting the “particularly in medicine or the fine arts” bit, I find this concept is useful because it provides a way to group activities that can be aligned along a maturity curve such as the Microsoft Infrastructure Optimization Model. A practice could be called “Test Pre-production Application” for example, containing such activities as:

• Develop test plans
• Perform manual testing
• Perform code coverage analysis
• Perform automated testing
• etc.

As you can probably see, some of the sample activities above could be performed at a very basic level, whereas some could be more advanced, requiring sophisticated sequences and a higher degree of automation.

Further, a practice is inherently associated with one or more of the War on Cost Value Pillars: Agility, Quality of Service, Cost, or GRC (governance, risk management, and compliance).

Practices Are Not Processes

There are many models out there that describe processes. COBIT for example, defines 34 core processes across four domains. ISO 20000 and other organizations also describe groups of processes as part of their model.

While these processes and have their place, what they lack is a distinct linkage to sets of activities that can be assessed for maturity along some value curve such as service quality, agility, or compliance. For example, the COBIT process “Ensure Continuous Service” does not say anything about how well the organization performs that process.

Also, these processes do not inherently align to specific value measures that are relevant to the business. While some of them may be implied, no model currently published makes this clear.

The Value of Practices

By defining sets of activities into practices and further classifying those activities into groups based on a maturity curve such as the core Microsoft Infrastructure Optimization (IO) model, it will be possible for us to assess how effective an IT organization is at delivering a service by determining how mature the organization is at delivering it (i.e., what activities does the organization perform at a given maturity level?).

Also, we can also align these practices to specific value measures that the organization wants to better understand. For example, practices such as “Manage Policies & Compliance” and “Perform Change Impact Analysis” have clear alignment to Governance, Risk Management, and Compliance (GRC). An organization that has a clear goal to assess their maturity around GRC can look at specific practices that are associated with that value dimension.

A Business Value Model

As the War on Cost team matures this definition of Practices, we will publish more information about how it relates to our larger definition of the War on Cost business value model. More to come…

All the best,

Erik

• what types of applications are being delivered and managed
• generally, how much does it cost to deliver and manage those applications
• how are web services being used
• how well are cloud computing solutions being adopted

In my first post about what I learned from this investigation, I wanted to first share my thoughts about the concept of “application criticality”.

We’ve all heard the term “line of business application”. While there are many specific definitions of what an LOB app is, a generally accepted definition is:

An application that is vital to running a business

This extremely vague term, while generally descriptive, doesn’t get down to the level of specificity needed to understand how one LOB app compares to another in importance, scope, or complexity.

In order to better understand the population of applications being delivered and managed, I needed to get to a lower level of granularity.

Our team therefore defined the concept of Application Criticality to better distinguish line of business apps from each other in terms of their importance to the business as well as their relative scope of influence on the business. Below are the 4 levels of criticality and their definitions. The descriptions of these levels of criticality are defined in terms of the impact on the business if these applications become unavailable.

While there may be other ways to define these classes of criticality, we find it useful to refer to them in terms that line of business owners typically care about.

What do you all think of this definition of application criticality? What would you add or change? Do you have a similar or different concept of application (or service) criticality in your company?

I’d like to hear from you. Feel free to contact me at erik.svenson@microsoft.com.

In a subsequent post I’ll share some of the results I from my study on this subject.

All the best,

Erik

Arguably, business agility is the brass ring of an organization’s ability to deliver for its customer. This agility will be determined in part by IT’s ability to build repositories of reusable components and construct new services from them. Before this can happen on a wide-scale basis, however, several things have to happen:

1. The business needs to see IT as a business enabler rather than a cost center
2. IT needs to have a clear understanding of what constitutes a business service and be able to report critical success factors and KPIs at a the service boundary
3. Disruptive technologies such as virtualization, newer programming models such as AJAX, and cloud computing need to be adopted based on the assumption of delivering the right levels of service needed by the business. Too often, these technologies are treated like a panacea, when more often they do little more than add complexity

The ability for IT to raise its profile with the business has traditionally been based on a reactive relationship with the business. Improved management practices that truly deliver high quality service management will help to change the perception and allow the organization to treat IT as a full partner in delivering high quality products and services to its customers.

When my study concludes at the end of the summer, I’ll share some of the insights gleaned from it. In the meantime, let me know how your experience has been with the shift from application delivery to service delivery.

All the best,

Erik Svenson, Application Platform Lead, War on Cost

erik.svenson@microsoft.com

Why would that be if web service adoption was having an increasing level of importance to the business, at least as function of what IT is delivering? Is it because it’s too hard to implement? Are these structures too costly to put in place? Are these Service-Orientation practices not thought of as valuable? Some combination?

My initial conclusion is that it is some combination of these challenges. Quantifying the value of things like service discovery or having a service repository may be difficult. Not implementing them in favor of increasing the manual labor cost required to accomplish the same task may seem easier, and less complex overall. But, do you sacrifice the very thing you set out to accomplish with web services in the first place: reuse? Do you find that you are re-implementing variations of the same customer lookup service across different departments for example instead of standardizing on one, well-defined, well-managed service?

What other obstacles to you encounter in improving the management picture of your web services environment?

Let me know your thoughts. Drop me an email at erik.svenson@microsoft.com. I’d like to hear your opinions on the subject.

All the best,

Erik Svenson, Application Platform Lead, War on Cost