Architecture matters—to your company and to your staff. Today’s business critical solutions are the heartbeat of your company’s ability to deliver product and services, and its ability to adapt to changing business demands. These business critical solutions are completely dependent on the architecture upon which they run. The computing systems, the networks; and the enabling operating systems, databases, and middleware are the components which together make up the architecture.
HTML Injection Attacks: Impact and Mitigation Strategies
Make Your Architecture Serve Your Company’s Needs and Your Own Career Goals
1. IBM Americas Solutions Advanced Technical Skills
January 2012
Make Your Architecture Serve Your
Company’s Needs and Your Own
Career Goals
A guide to best practices solutions for your
enterprise resource planning infrastructure
Authors:
Mike Mardis
Mike Sheets
Travis Smith
2. IBM Americas Solutions Advanced Technical Skills
Page 1
Table of Contents
Overview .......................................................................................................................................2
Problems with your operational environment................................................................................2
Best practice solutions .................................................................................................................3
1: Architecture Design...............................................................................................................3
2: Parallel Databases/Clusters ..................................................................................................5
3: Resource Virtualization ..........................................................................................................6
4: Industrial Strength .................................................................................................................7
5: Continuous Availability and Disaster Recovery.....................................................................7
6: Automation.............................................................................................................................8
7: Workload Management .........................................................................................................9
8: Security..................................................................................................................................9
9: Workload Consolidation.........................................................................................................9
Ensuring your staff stands out ....................................................................................................10
Summary.....................................................................................................................................10
About the Authors: ......................................................................................................................11
3. IBM Americas Solutions Advanced Technical Skills
Page 2
Overview
Architecture matters—to your company and to your staff. Today’s business critical solutions
are the heartbeat of your company’s ability to deliver product and services, and its ability to
adapt to changing business demands. These business critical solutions are completely
dependent on the architecture upon which they run. The computing systems, the networks;
and the enabling operating systems, databases, and middleware are the components which
together make up the architecture.
And, your IT staff is the mechanism which makes the architecture run and the people who
respond to business priorities and solve technical problems. You want those people to be the
best in the industry to ensure your business critical solutions are robust and that they enable
you to respond to the needs of your clients. Likewise, the individuals that make up your staff
want to be recognized as exceptional in what they do, and they want to contribute to the
company’s success. They do not want to be limited to commodity skills that can be easily
replaced by IT support located half a world away world.
So, architecture matters to both your company and to your staff. But, how do we know if we
have the right architecture? There are best practice solutions in the industry which
differentiate and enterprise architecture from commodity architecture.
Problems with your operational environment
Today’s datacenter is filled with hundreds or thousands, of computers and a series of
networks connecting these systems, with thousands or hundreds of thousands of devices that
your employees depend on every day. The cost of the computers in the datacenter is a small
fraction of the total cost of business operations, but the value to your company is enormous.
These systems give the company the information it needs to compete. Your architecture is a
multiplier. With the right IT architecture a company can succeed. With the wrong
architecture a company can become mired in a death spiral of cut backs, failure, and more
cut backs.
Enterprise Resource Planning (ERP) solutions are complex. Many companies have ERP
implementations which include hundreds of computers with operating systems, databases,
and associated middleware that contribute to your business—all of which require
management, monitoring, maintenance, and upgrading. ERP solutions interface with
thousands of other systems. And, they also require management, monitoring, maintenance,
and upgrades. This results in an extremely complex ERP environment. The complexity
makes your infrastructure expensive to operate and highly susceptible to human error.
4. IBM Americas Solutions Advanced Technical Skills
Page 3
A complex environment requires the staff to work long hours for long periods of time. In
order to reduce costs, companies frequently operate in surge mode requiring people to cover
multiple positions. When not at their desk, they may often be on-call resulting in fatigue and
low morale. This may result in human error that can escalate into a costly outage. Although
they know that their skills provide them with job security, they are also aware that services
firms offer remote IT support which can endanger their position. They have little job security
and are not likely to perform well. All of these factors can contribute to costly staff turnover.
Best practice solutions
Best practices solutions are hardware and software
Best Practices Solutions
combinations which are recognized by the industry and
1. Architectural Design have proven to be reliable, cost efficient, and robust. They
2. Parallel Databases/Clusters are not what your vendor trumpets as the latest and greatest
3. Resource Virtualization
with the shiniest packaging. Those new products may
4. Industrial Strength
5. Continuous Availability and
become best practice products, but unless your company
Disaster Recovery thrives on “bleeding edge solutions,” they are probably not
6. Automation the right choice for complex enterprise solutions on which
7. Workload Management your business depends.
8. Security
9. Workload Consolidation
Likewise, best practice solutions are not often aging
products whose capabilities have been replaced by newer technologies. Best practice
solutions combine the best of old and new. They take proven winning characteristics of
earlier generations of products and incorporate them into new technologies to provide
competitive advantage.
There are nine best practice solutions which underlay successful modern day enterprise
environments. These solutions are not products that you buy. They are the practices which
are incorporated into products. Without best practices capabilities a product cannot be a best
practice product.
1: Architecture Design
Architecture design considers four issues in deciding what technologies to include:
Business issues are the requirements that must be met to be successful in a highly
competitive business environment. Technology is not purchased by a company for its own
sake, nor for the convenience of its employees. It is purchased to provide availability,
scalability, security, and flexibility required by your business. We include performance inside
availability because a system which is not performing well enough to meet business needs is
in effect not available.
5. IBM Americas Solutions Advanced Technical Skills
Page 4
Financial issues are the total cost of ownership (TCO) of a solution. TCO can make or break
the company regardless of service level objectives. It includes all costs over the lifespan of
the solution. This includes the Total Cost of Acquisition (TCA) plus other costs to operate
and upgrade the solution over its lifetime. TCO is directly related to Return on Investment
(ROI). A lower TCO results in a higher ROI. But, a key component of TCO is the cost of not
achieving the necessary Service Level Objectives (SLO). For instance, if the business requires
that all transactions be secure, and if it is discovered that those transactions are not secure,
then the company will lose money in one form or another. It will either incur higher expenses
of penalties or repair/rebuilding costs, or lost revenue from not achieving the required
security SLO.
It also important to consider the financial issues of both the project implementation phase
and the operational phase. Because these phases do not have the same requirements they
will not have the same financial issues. The costs of both phases must be included in the
financial evaluation.
Project issues are the architectural and financial issues involved in activities of the project
implementation. They involve buildup of development staff, the implementation of hardware
and software, and the operation of former solution while implementing the new. Architecture
design during this phase must consider the need for flexibility—the ability to bring up new,
and to retire old environments (development, quality assurance, training, development
sandbox) and the access needed by the project development staff. The architecture must
consider that pre-production environments are notoriously peaky. The peak workload in one
environment should not occur at the same point in time of other environments. Availability
during the project phase is important to ensure that expensive development resources like
external consultants are not idle, and that project timelines are met so that the new system is
ready to go-live on the date planned.
Operational issues include the support of all end user workload, as opposed to a few
hundred developers during the project phase. It includes workload peaks tied to business
operation not the development phase. Security becomes a business critical issue as customer
data and the protection of critical business operations become paramount. Surge capacity to
meet go-live as well as peak periods of operational demand such as end of month or end of
year processing must be considered. Continuous availability (including reliable performance)
as well as disaster recovery also becomes critically important during the operational phase.
6. IBM Americas Solutions Advanced Technical Skills
Page 5
2: Parallel Databases/Clusters
Databases are often a critical component in an enterprise system. Without them the rest of
the system is useless. Parallel databases or clustered databases are an industry standard way
of ensuring that databases are available when you need them. There are two reasons for
implementing parallel databases.
Availability ensures that should something happen to a system upon which the database
depends, that a separate database can pick up the workload and continue supporting the
business until the failed component is again available. There are two types of outages which
affect availability:
Unplanned outages are outages resulting from a device or a software failure. These “puff of
smoke in the back of a data center” are not expected, but which must be planned for even
though they do not occur often.
Planned outages are outages that are scheduled in advance. They include preventative
maintenance, release upgrades, and operational activities which cannot be performed while
the system is running.
Scalability is the second reason for implementing a parallel database. A database must be
able to grow large enough to satisfy business requirements otherwise it is not be scalable.
There are two types of scalability:
Vertical scalability is the ability for a single database to grow. This is limited by the
maximum size of the computer it is running on, but it is also sometimes a limit of the
operating system which runs on hardware.
Horizontal scalability is the ability to add additional copies of the database and to run all
these copies as if they were a single database. It is horizontal scalability which gives parallel
databases their name. All the individual database members must operate in parallel and
appear to be a single database. Horizontal databases are extremely sophisticated because
they must be able to run while ensuring data integrity and reliable performance. It is not the
ability to run in parallel that differentiates one vendor’s parallel database from another’s, it is
what happens during an outage that is the real indicator of the value of a parallel database.
8. IBM Americas Solutions Advanced Technical Skills
Page 7
4: Industrial Strength
Industrial strength means the IT systems have capabilities needed by intensive workload
processing systems with corresponding continuous availability, centralized and reliable
management tools, and high levels of security required. Examples of industrial strength
include:
– Large database manageability
– Parallel/Clustered databases
– Network management
– Online reorganization
– Data and index compression
– Database table management as well as tablespace management
– Partitioning by growth
– Cloning of systems for recovery, refresh, backup, and reset activities
– Enterprise backup and recovery
– Remote parallel databases (both synchronous and asynchronous)
– Ability to change operating characteristics on the fly (workload priorities, partitioning,
database schemes, etc)
5: Continuous Availability and Disaster Recovery
Continuous availability is the combination of high availability and continuous operations
High availability is the avoidance of unplanned outages. On distributed solutions this is
typically a hardware statement only. On mainframe systems this is typically a
hardware/operating system/database statement. It is common for vendors to claim some
number of “9”s of availability, such at 99.999%. This means that the systems only have
about five minutes of unplanned downtime per year. Slow or irregular performance is a form
of an unplanned outage.
Continuous operation is the avoidance of planned outages (sometimes called preventative
maintenance). Planned outages are much more common than unplanned outages. Planned
outages often make up many hours of downtime each week. Examples of planned outages
would include offline backups, table reorganization, application of hardware, operating
system, database, or application maintenance, upgrades of hardware, operating systems,
databases, or applications, etc.
9. IBM Americas Solutions Advanced Technical Skills
Page 8
Continuous availability is what the business has in mind when they state their service level
objectives. This is the amount of time they have access to the company’s applications and
data. Continuous availability includes not only the systems upon which the applications run,
but also dependent systems without which the critical applications would not be useful.
Disaster recovery (DR) is the ability for critical workloads to failover to alternate systems
should the host systems for those applications fail. Failure could be due to something inside
the system, or it could be due to a facility failure such as power or air conditioning. Two
types of disaster recovery are usually planned for:
Synchronous DR is where a secondary data center is close enough to the primary datacenter
that data replication can be synchronous resulting in zero data loss. For these systems we
need a Recovery Time Objective (RTO) of zero and a Recovery Point Objective (RPO) of zero.
Asynchronous DR is where the secondary data center is farther away than a synchronous
connection can be reliably operated. For these asynchronous configurations the RTO can be
just a few minutes, and RPO can be a few seconds.
6: Automation
Automation is the configuring of daily processes so their operation can be executed without
manual human interaction. This is more than job scheduling. Automation provides the
intelligent interaction that a process might normally expect from an administrator or an
operator. Examples of automation include alert management, interface management, systems
management, database management, and etc.
Automation is necessary for continuous availability. Without automation a human
administrator would have to configure the failover system and the failover process, as well as
to ensure the end users and scheduled batch jobs find the machine in its new location and at
its new network address.
Automation must integrate with all dependent components. It reduces manpower costs and
increases the quality of service to the end user community. Automation improves security.
Automation should be full functioned and mature. There should be published scripts
available for common components such as locking and serialization of servers and databases.
They should be fully integrated into the systems workload management prioritization
mechanism as well as the systems resource allocation mechanism.
10. IBM Americas Solutions Advanced Technical Skills
Page 9
Automation should be dynamic—permitting immediate changes based on workload
characteristics and SLO demands. It should be automatic—capable of making frequent
adjustments to handle scheduled or planned changes. It should be able to be configured to
meet specific needs of each system—not generic. And it should require zero operator or
administrator intervention and no rebooting of the system.
7: Workload Management
Workload management should be able to prioritize work according to service level objectives
defined by the business. It should not be a relative prioritization system in which some
processes have priorities defined in relation to other priorities. Workload management
should be capable of affecting dependent systems as well, to ensure that critical business
processes are completed even when multiple systems are involved in the process.
8: Security
Security involves the protection of data and applications. It involves the protection and
auditing of systems, databases, applications, networks, and storage.
Security issues to consider include:
– EAL 5 certification
– Database trusted context with enhancing authentication
– Database roles with enhancing authorization and auditing
– Encrypting specific tables with strong encryption
– DASD/disk encryption with strong encryption
– Tape storage encryption with strong encryption
– DRDA data stream encryption between the database and the application servers
9: Workload Consolidation
Workload consolidation involves the consolidation of enterprise workloads at one of three
levels:
Consolidation of disparate systems into a common datacenter to deliver consistent
operational support and to reduce costs through economies of scale.
Consolidation of multiple workloads into a common system to make use of resource sharing
and enterprise tools such as automation and centralized management tools.
Consolidation of multiple applications with similar schemes into a single application with a
common set of data. An example of this is consolidation of multiple regional systems a single
global instance.
11. IBM Americas Solutions Advanced Technical Skills
Page 10
Ensuring your staff stands out
Your IT staff is the key to making your IT systems serve the business needs. Implementing
enterprise solutions with the above best practices affects you and your staff in two ways:
Daily operational impact on you and your staff. This includes risk mitigation due to
improved security, reduced manual activity due to automation and reduced night time and
weekend work due to continuous availability. This leads to improved customer satisfaction
due to continuous availability and prioritized workload management, and improved IT
visibility within the corporation due to improved business responsiveness and reduced TCO
and improved ROI.
Career impact with your present company and with future companies. Implementing best
practices adds to your portfolio of skills. Having enterprise skills is a differentiator which
enables you and your staff to stand out in your peer group of professionals as someone having
both distributed as well as enterprise skills and experience. Skills learned on an enterprise
system can be transferred to other platforms which make you more valuable and increase the
job security for you and your staff.
Many IT professionals feel the threat of an remote consultant working for pennies on the
dollar. These consultants have experience in commodity operating systems and databases.
They are good for off shift system monitoring, but are not usually reliable or dependable for
critical IT activities. Differentiating your and your staff’s skills from these resources means
superior support for your company’s end users and suppliers as well as a higher morale for
your internal staff upon who you are most dependent.
Summary
Your architecture can help you address problems with your daily operational environment
and with your staff. Architecture is an enabler for modern companies—in effect a multiplier.
It can turn a small problem in to a business failure, or it can take a small initiative and turn it
into a competitive advantage. Architecture is a mechanism which differentiates run-of-the-
mill technical staff, from an enterprise skilled professional who responds confidently to
changes in business direction, and stands above the crowd struggling to find a place in the
industry. Implementing business critical solutions on enterprise architectures is the key for
both your company and for your staff.
For more information about IBM Solutions implementing best practices policies please click
on the following link: IBM Smarter Computing IT Optimization for SAP.
12. IBM Americas Solutions Advanced Technical Skills
Page 11
About the Authors:
Mike Mardis, Mike Sheets, and Travis Smith are members of the World-Wide IBM System z®
SAP Solutions Advanced Technical Skills teams based in North America. They have over 30
years experience each in areas covering enterprise systems technology, IT architecture design,
product development, market management, and sales.
13. IBM Americas Solutions Advanced Technical Skills
Copyright IBM Corporation 2012
IBM Systems and Technology Group
Route 100
Somers, New York 10589
U.S.A.
Produced in the United States of America,
01/2012
IBM, IBM logo, System z and zEnterprise are trademarks or registered trademarks of the International
Business Machines Corporation.
Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the
United States, other countries, or both.
Java and all Java based trademarks and logos are trademarks or registered trademarks of Oracle and/or its
affiliates.
Linux is a registered trademark of Linus Torvalds in the United States, other countries, or both.
All statements regarding IBM’s future direction and intent are subject to change or withdrawal without notice,
and represent goals and objectives only.
Performance is in Internal Throughput Rate (ITR) ratio based on measurements and projections using
standard IBM benchmarks in a controlled environment. The actual throughput that any user will experience
will vary depending upon considerations such as the amount of multiprogramming in the user’s job stream,
the I/O configuration, the storage configuration, and the workload processed. Therefore, no assurance can
be given that an individual user will achieve throughput improvements equivalent to the performance ratios
stated here.
ZSL03162-USEN-00