Managed Messaging

Unified Communications: Is the Public Cloud Your Enemy?

Stephanie Jordan — Tue, 08 Nov 2011 21:08:31 +0000

The hype surrounding the public cloud has reached a fever pitch in the past year. Amazon is making big news with EC2. Meanwhile, in the unified communications (UC) arena, Microsoft’s recent introduction of the Office365 service is really making IT departments sit up and take notice. This combined email, IM/Presence, conferencing, collaboration and voice behemoth — largely because it is delivered as a public cloud service — was billed as a panacea for the ills of the communications and collaboration world. Despite the fact that the public cloud has achieved “darling” status in the computer industry, is it really the friend of IT? Perhaps hype is getting ahead of reality.

Let’s take a look at the evidence.

The obvious starting point is the myriad of service outages that have occurred over the course of the past year. From August 23rd, 2010 through Sept 8th, 2011 there have been at least three major Gmail outages and eight major Microsoft outages of either Office 365 or its predecessor BPOS. Together, these have totaled over 50 hours of downtime for end users….and those are just the outages that have been publicized!

What about security? Just because the public cloud is generally considered more secure than enterprise datacenters, that doesn’t mean it specifically meets corporate security standards and policies. For example, multi-tenant servers, unsecured access to server logs, non-granular administration rights and spotty TLS enforcement can introduce security risks in public cloud UC services that are unacceptable in on-premise systems.

As for reliability and availability, the public cloud doesn’t really care if multiple servers die each day. This explains why downtime penalties for missed SLAs are built into cloud service provider business models.

When it comes to recovery times, these are not always satisfactory. Most public cloud providers offer downtime recovery, which does not meet expected enterprise requirements, e.g. recovery point objectives (RPO) can range from 15 minutes to 24 hours.

Do you need customization? This is not an option in the public cloud. Today’s UC deployments have become quite sophisticated and intensely customized, but yet the public cloud has rules and procedures that only allow for generic deployments.

Compliance is also an afterthought. Many public cloud providers don’t allow enterprises to customize long-term storage policies, which is often a requirement for meeting regulatory compliance requirements.

Support is quite often frustrating and slow. In many cases public cloud providers outsource support calls overseas to teams who are either not well versed in the complexities of the system, or don’t have access to the servers to make immediate changes.

You must be able to give up control, because the public cloud decides when upgrades take place and when downtime occurs. It doesn’t adapt to your business; you must adapt your business to the public cloud.

Finally, what about hidden costs? Public cloud UC systems, with add-on options like archiving, migration, mobile device support, increased network bandwidth, etc. can often be just as costly as on-premise systems. Furthermore, the ongoing costs of the public cloud are theoretically never-ending, will never decrease, and will only go up. In addition, these costs cannot be counted as an asset or depreciated as a facilities investment.

Nevertheless, the public cloud is here to stay. The question is: will it shed the cloak of immaturity and inflexibility that today makes it more of a foe than friend of IT? Clearly the answer is yes — both Google and Microsoft have already made significant forward progress with their cloud platforms. However, ultimate success in the public cloud UC space will take time.

In the interim, there is a work around that doesn’t involve overzealous server-hugging by IT. A close relative of the public cloud is available now, and offers many of the same benefits without the downsides. It’s called the Private Cloud. For many organizations that have bought into cloud computing, the main driver is not lower costs. Rather, it’s about adopting the operational advantages provided by the cloud – shared resources, hardware usage optimization, and elasticity – and applying them in datacenters using a private cloud model. The cloud can be your friend, but only if you make yourself its master.

About Scott Gode
Scott Gode is vice president of product management and marketing for Azaleos, a provider of managed unified communications services.

Feedback Loops in the Fight Against Spam

Stephanie Jordan — Thu, 05 May 2011 17:40:12 +0000

Nearly everybody gets spam. But do you ever wonder what happens when you click that “Report Spam” button on your mail reader? Does it do anything useful, or is it really the same as just clicking “Delete”?

The Internet is plagued by messaging abuse, such as spam and viruses. In the context of messaging, defenses such as anti-spam and anti-virus filters are typically deployed; however the simplest of these defense filters are easily circumvented by mutating the spam attack, either in form or in origin, just enough to avoid detection. In order to be effective, these filters must adapt to threats as they mutate to prolong their success.

Filters can only adapt when they have new details about what it is they need to filter. In the simplest case, a user issues a complaint to a customer service center about an undesirable or dangerous piece of spam, and the representative then acts on the complaint by disabling the source, retraining the filter based on the details of the complaint, or both. But in a world of automation and enormous volumes of data, such a manual system simply cannot survive; it doesn’t scale.

Learning is defined as a change in behavior based on experience. What consumers and service providers need, then, is a system that is capable of learning, with maximum accuracy, what constitutes a threat that must be kept out and what constitutes legitimate traffic that should be allowed in. To be effective in the face of mutating attacks, the defenses must themselves mutate, as quickly and accurately as possible. The filter needs more “experience” in order to learn.

Much effort has been expended to try to define what spam is in order to classify and filter it. However, not only do spam campaigns mutate to avoid detection, but we have also learned that spam is in the eye of the beholder: What one person says is junk might be of some value to someone else, with great consequences if a filter gets it wrong. A career spam fighter once opined, when tasked to define the problem: “Spam is what our users say it is.” So how do we embrace that idea in software?

We have found over time that the most effective systems are those that learn to classify undesirable content based on feedback from users. The user is truly the best judge of what is and isn’t spam. The faster consistent feedback becomes available, the sooner a filter can be re-trained to detect and respond to new attacks. This is known as a feedback loop. Cloudmark’s system, for example, takes user feedback and then identifies spam as that content which attracts mostly negative user attention, and moreover values feedback from users that typically both concur with the majority and respond quickly. A system collects and evaluates this information, yielding new data from which the system can learn about new spam campaigns in a matter of seconds.

Open solutions to the need for feedback loops have been attracting attention for several years. In particular, a mechanism called the Abuse Reporting Format (ARF) was created by participants in the Messaging Anti-Abuse Working Group (MAAWG) some years ago. ARF allows exchange of feedback information between peer Internet Service Providers (ISPs) when spam or other abuse originating at one is received at another; a user clicks a “Spam” button in the mail reader and an ARF message is generated and sent to the originating service, where automated software quickly processes the complaint, and the systems at both ends have more data from which to learn.

Once proven, the ARF work was taken up by the Internet Engineering Task Force (IETF), which has now posted it as a proposed standard. ARF continues to evolve as new categories of email threats emerge.

With the enormous growth of messaging from email into the mobile world, the same problems exist and similar solutions are beginning to appear. Trial systems now exist wherein a mobile subscriber can forward a piece of mobile SMS spam to a mobile operator for filtering and investigation, while others are working to construct learning systems using user-based feedback loops. A standardization effort has already reached prototype phase within the Open Mobile Alliance (OMA), a collaborative standards body in the mobile world that creates specifications for mobile handset software. This will define the very language used to communicate among systems when you click a “Report Spam” button on your handset when mobile spam begins to rear its ugly head in the Americas as it already has overseas. In addition, Cloudmark has collaborated with the GSM Association (GSMA) to launch the GSMA Spam Reporting Service that aggregates mobile SMS spam feedback with participating operators globally, in an effort to secure mobile networks and users around the world.

Feedback loops are a proven tool in the fight against abuse. They are key features in a highly responsive, accurate filtering system. So, yes, do click “Report Spam” instead of “Delete”. We’ll all be glad you did.

About Murray S. Kucherawy

Murray S. Kucherawy is the Director of Internet Standards & Governance at Cloudmark. His research interests include message authentication, data analysis, and reputation systems. Kucherawy received a Bachelor of Mathematics from the University of Waterloo in Ontario, Canada. He is a regular presenter and participant at MAAWG and the IETF’s applications and security areas. Contact him at msk [at] cloudmark [dot] com.

Burden of Managing On-Premises Security Solutions Is Key Reason to Consider Cloud-Based Offerings for SMBs

Stephanie Jordan — Thu, 07 Apr 2011 10:25:54 +0000

With the increase of remote or mobile employees comes more problems when using on-premises security, finds a survey of 800 IT decision-makers in organizations with 100 to 5,000 employees in the United States, the United Kingdom and Australia. Published earlier this year by Webroot, the results revealed that these companies are 43 percent more likely to experience phishing attacks and 33 percent more likely to experience viruses or worms than organizations using cloud security.

“For companies that leverage a fair amount of remote access, the rate of compromised devices has tripled,” discloses Gerhard Eschelbeck, chief technology officer for Webroot. “What usually amounts to a 6 percent infection rate has suddenly gone up to a 19 percent infection rate.” Eschelbeck believes the reason for the increase is because it can be more challenging to keep up with security patches when the devices are frequently roaming around.

Eschelbeck states that IT administrators will know when mobility and remote access increases, “You very quickly realize the moment you have a significant portion of your users leveraging remote access through VPN or some other means to connect back to the company,” he says, “Your costs for help desk and instances of compromised customer data increases as much as 19 to 29 percent.” How much is a significant portion? When about one-fourth or more of employees are accessing servers remotely. Typically this is when help desk costs and dangers go up.

Managing On-site Security Solutions

The survey also offered a glimpse into the typical work routine of an IT administrator responsible for on-premises security solutions. Those surveyed estimated that they spend almost 16 days managing systems and related problems. “The shear amount of time that people spend today on more traditional security delivery models very quickly adds up,” observes Eschelbeck. “Organizations surveyed say they spend a couple days a month managing the software and hardware updates, a couple days on re-imaging machines that have gotten infected, as well as a couple days managing patches, and enforcing end-user policies. While the cloud will not solve all the world’s security problems, it can certainly help with these burdens.”

Those spending that average of 127 hours could spend that time in more productive ways believes Eschelbeck. “Very often the small to medium business is under staffed in terms of IT and security. The cloud can be a real blessing for those organizations.”

More and more it is the SMB that is taking advantage of the cloud. “From my experience, SMBs are the more rapid adopters of cloud-base models. That does not mean that large enterprises cannot benefit from the cloud model, but they follow the leaders, who are usually small- to medium-sized businesses.”

Often companies are using the cloud already in some shape or form. “It’s really rare to find an SMB that hasn’t outsourced one function or another to the cloud,” says Eschelbeck. “Many companies have been very aggressive to move everything to the cloud, others may start with the basics like CRM, automation capabilities, or conferencing facilities like WebEx or Go To Meeting—after all they are cloud-based services and have been used widely by everybody. Many SMBs have embraced the cloud model over the years.”

While the term cloud is newer, the technology itself is actually not new. “The cloud is now in its 10th year, while it has been called by different names and terms, it is a mature technology model,” comments Eschelbeck.

Driver of Cloud Adoption: Mobile Workforce

Most experts anticipate that users’ demand for mobility will continue to increase possibly opening up security exposures to organizations. This seems to ring true for 33 percent of the survey respondents, who rank securing mobile/laptop users as their number one challenge in the year ahead. When asked why companies might consider a cloud-based solution, mobile user protection ranked in the top five reasons.

Mobility appears to be a cloud adoption driver, as many find the cloud-based model’s transparency and consistency to the end-user to be very appealing when it comes to mobility. As Eschelbeck points out, “The cloud-base models work the same way regardless if you are inside or outside the corporate network system.”

TIBCO Launches Extreme Low Latency Messaging Solution

Melisa LaBancz-Bleasdale — Wed, 30 Mar 2011 23:01:01 +0000

On Monday, March 28, TIBCO Software Inc. launched its new extreme-low-latency messaging solution, TIBCO FTL™. What does “extreme low-latency” mean? According to a TIBCO spokesperson it’s faster than the speed of light.

Currently aimed at the Financial Services market, TIBCO FTL, is designed to give trading firms a significant competitive advantage by enables them to access services like market data and distribute information internally up to 40 percent faster.

“In stark contrast to extreme minimalist, nothing-in-the-middle design approaches promoted by other low latency messaging vendors, TIBCO has chosen to design from ground-up to deliver the fastest possible performance without compromising on messaging middleware features like Self Describing Data, Centralized Metadata Management and Content Based Addressing,” said Rourke McNamara, Sr. Director of Product Marketing, TIBCO.

The vast majority of trading in today’s financial markets is done electronically – increasingly done by high-performance trading algorithms. Speed is a key determinant of success in these hyper-competitive markets. According to an industry expert, a millisecond of latency in trading can be worth $100 million a year to a major brokerage firm. TIBCO FTL is designed to address these needs, with an average application latency in test conditions of 384 nanoseconds for intra-host communication and 3.1 microseconds for inter-host communication – surpassing the lowest reported latency claims of competitors by 42 percent.

“Markets have an insatiable need for speed. Low Latency Messaging technology is critical to any firm’s strategy to dominate today’s extreme-high-speed trading floors,” said Roy Schulte, Vice President, Gartner. “Firms compete head-to-head on speed of execution, message volumes are exploding and integration needs are getting more and more complex. Firms are looking at messaging solutions to provide the lowest possible latency to beat the competition – but also to provide key capabilities so that they are agile enough to sustain that advantage.”

Previewed in May 2010 as the first messaging middleware solution to break the microsecond barrier in end-to-end application latency, TIBCO FTL is optimized to leverage the latest advancements like multi-core processors, in-memory architectures and networking technologies like Infiniband and 10 Gigabit Ethernet. TIBCO FTL is the outcome of a strategic engineering collaboration between TIBCO and Intel to engineer high-performance middleware using next generation technology like Westmere micro-architectures and Intel® QuickPath.

“Multi-core server solutions from Intel give customers the ability to run entire trading systems on a single machine for extreme performance and improved manageability,” said Kirk Skaugen, Vice President and General Manager of the Intel Data Center Group. “TIBCO’s new messaging technology is optimized for both intra-host and inter-host messaging, something that is critical in leading these paradigm shifts in computing. As companies move more of their processing to multi-core machines, TIBCO FTL software running on Intel® Xeon® platforms will deliver an order of magnitude speed increase in areas where every microsecond – no every nanosecond! – counts. We’re excited at the results of this engineering collaboration with TIBCO. We have created technology that is revolutionizing high performance messaging capabilities.”

Key Highlights

Content-based addressing which enables applications to receive only the relevant information from a stream of millions of messages and simplifies management by avoiding complex subject hierarchies
Full support for Self Describing Data, freeing application developers from parsing binary data streams and managing metadata at the individual application level
Pluggable transports that provide the flexibility to leverage advancements in underlying networking and platform technologies without having to rewrite application code
Out-of-band metadata management that enables administrators to centrally define message formats and data distribution paths without impacting applications
APIs in C, Java and .NET to enable rapid development of high performance applications

Patton's SmartNode Products Certified Interoperable with Lotus Sametime

Melisa LaBancz-Bleasdale — Thu, 24 Mar 2011 22:07:56 +0000

Patton is a multi-national organization that designs, develops, and manufactures electronic communications equipment for network access, connectivity, VoIP, triple-play and video surveillance that is making consistently big waves in the Unified Communications (UC) space. At ITExpo in February, they announced, in alliance with the Elastix project – an open source UC distribution project – that they had released a mutually certified UC solution.

Now, Patton (USA) and Patton-Inalp (Switzerland) have announced that IBM has tested and certified the company’s SmartNode VoIP gateways, VoIP routers and IADs for interoperability with the Lotus Sametime unified communications (UC) platform.Why is this important? With SmartNode VoIP routers, Patton says large enterprises can control capital expenses while implementing UC by integrating existing public branch exchange phone systems and PSTN connections into IBM’s Lotus Sametime platform.

Sametime was designed to remove the seams between email, voicemail, instant messaging, wired and wireless phones while providing presence status, Company officials said that this enables workers to avoid such time wasters as looking up contact information and calling people who aren’t available. Moreover, SmartNode gateways offer immediate access to the world of UC for organizations using traditional analog or digital phone systems. Working together, the companies could feasibly create an even better connected world.

Their specs boast impressive any-service-any-port (ASAP) capabilities that can deliver any WAN service on every industry-standard telephony interface that is currently in use. Built to be highly scalable (SMBs all the way to enterprise-sized organizations), SmartNode scales from 2 to 120 concurrent VoIP or fax calls, and supports SIP, H.323, ISDN, and POTS telephony plus T.38 and SuperG3 FAX over TDM/PSTN and IP/Ethernet services simultaneously.

Company officials said that most IBM-certified VoIP equipment is less scalable in terms of interface types, port counts, and number of concurrent calls. SmartNode enriches IBM’s Sametime solution with advanced telephony features. Therefore, it upgrades a legacy solution in all the right ways.

These features include integration of PSTN trunks and legacy PBX systems into Sametime/Telephony Control Server (TCS); VoIP and data survivability via PSTN access/breakout/fallback and IP link redundancy; PBX backup against IP trunk failure to the IBM TCS; secure VPNs with IPsec-encrypted voice.

Additional features include any-to-any least-cost call routing and dial-map planning; routed Internet Access with QoS for toll quality voice; traffic management with voice prioritization; and more.

Salesforce Unveils Next Gen of Cloud-based Service Contact Centers

Melisa LaBancz-Bleasdale — Tue, 08 Mar 2011 21:25:54 +0000

At the CloudForce 2011 conference in NYC, Salesforce.com, unveiled their Service Cloud 3,what the company is calling the next generation of social contact centers. Service Cloud 3 was designed to let organizations engage with customers on any social community, including Twitter, Facebook and other social networks via Radian6. The intent is for companies to be able to scale their operations quickly and easily to manage a high volume of service issues, including the millions of conversations that are happening every day on social media sites. Leveraging built-in social analytics, agents can prioritize interactions across any channel and tailor support strategies to meet changing sentiments on the social web.

“The explosion of social technologies has changed the game for customer service,” said Alex Dayon, executive vice president of CRM, salesforce.com. “Facebook and Twitter taught consumers to expect social customer service in real time. Service Cloud 3 is the next-generation social contact center that lets companies prioritize and manage a high volume of customer issues over any social channel.”

“We decided to make social media an important component of our overall KLM customer service strategy after handling stranded customers via Facebook during the volcanic ash cloud that struck Europe in May, 2010. Leveraging the Service Cloud 3 is going to enable us to recognize patterns, handle cases via social media throughout different teams, and discover commercial opportunities. We believe this will allow us to pro-actively build a strong and loyal relationship with our customers and fans and enhance our service to them,” said Martijn van der Zee, vice president, E-Commerce of KLM Royal Dutch Airlines.

Service Cloud 3 is meant to enable organizations to monitor and engage instantly with customers across the social web directly within the product. Companies will be able to instantly monitor and capture conversations about their brands on Facebook and Twitter, and use Radian6 for Salesforce to monitor blogs, forums and discussion groups. Agents will be able to engage directly with customers using any device, including the iPad 2, to deliver customer service in real time.

Salesforce for Facebook: With more than 500 million members, Facebook is the fastest-growing social network in the world. Companies will be able to manage interactions with their fans in real time by converting Facebook wall posts and comments into cases within Service Cloud 3.
Salesforce for Twitter: More than 110 million tweets are posted to Twitter every day. Agents can now join conversations with customers on Twitter by creating cases and sharing knowledge—all inside Service Cloud 3.
Radian6 for Salesforce: This new AppExchange app will let agents work entirely within Service Cloud 3, engaging with customers via Twitter, Facebook and other social channels including blogs and video and photo sharing sites.

Fully automated case creation will mean that social media content is automatically added to Service Cloud 3 based on the customizable Radian6 workflow rules engine.

Managing High-Volume Social Interactions and Respond in Real Time

The proliferation of social technologies has forced a massive shift in the customer service industry and the sheer volume of social media conversations places incredible demands on today’s contact centers. An unanswered, public complaint can cause a company to lose decades of hard-earned brand equity overnight. A seemingly innocuous afternoon tweet can become an Internet sensation by the next morning if left unaddressed. Providing an optimized agent experience, Service Cloud 3 allows companies quickly wade through millions of public comments and cut through the social media noise.

With the next-generation Service Cloud Console, agents have an optimized, tabbed screen for managing all social media and case activities with fewer clicks and less scrolling. Chatter for Cases lets agents follow important cases in real time and collaborate as a team to resolve issues faster. Teams can collaborate with Salesforce Chatter around knowledge articles in real time for increased accuracy and article relevance. Using Chatter, agents can contribute comments, see input from internal experts, and stay up to date on the articles they follow.

Prioritizing Interactions Across Any Channel with Real-Time Social Analytics

With Service Cloud 3, companies can prioritize social interactions across any channel, such as phone, e-mail, chat and social communities, according to built-in social analytics. Drawing on these real-time insights, agents will be able to determine the best channel to respond to customers and tailor support strategies to effectively address changing sentiments on the social Web. Social Analytics: Companies will be able to monitor and manage customer interactions across every social channel with real-time reports and customizable dashboards that give complete visibility of the metrics that impact business. Social channel reports, customer conversation analyses, and social dashboards will help agents identify trends and alert managers of issues that are impacting the business.

Service Cloud 3 will give companies the ability to resolve a higher volume of customer issues with less agent time using live chat. Live Agent can be embedded into the company’s web site for instant chat functionality—and instant answers for customers. Live Agent will be fully integrated with Service Cloud 3 and Salesforce Knowledge.

Saleforce notest that more than 15,000 companies are delivering social, mobile and open customer service. According to a recent third party survey, companies who have deployed the Service Cloud have seen a 41% increase in agent productivity, a 34% increase in first call resolution, a 35% increase in customer satisfaction, and 85% indicated they offered improved customer service and support.

Can Data Be More Secure in the Cloud?

Stephanie Jordan — Fri, 04 Feb 2011 23:31:09 +0000

There’s no reason data stored in the cloud can’t be more secure and reliable than data stored on-premises. To make this happen, consider four key factors: operational expertise, controlled environments, encryption architectures and redundant infrastructure.

All key factors can be done on-premises, but that can be expensive and difficult, especially for processes that are not core to a business. By core, I’m referring to something that differentiates a company in the eyes of customers, such as the type of products a company provides. Everything else is context, which is important, but doesn’t impact business in the same way.

By moving context functions to the cloud, organizations can reduce costs and redirect those savings to core functions.

Operational Expertise

Security features must be planned for and built into every part of the solution, even for components that aren’t core to a customer’s needs. For example, by owning most components of the SaaS technology stack, an organization can leverage secure software development lifecycles to ensure that security best practices are accounted for in core software, tools, processes and monitoring systems.

A cloud solution also needs dedicated staff for monitoring, security, architecture, platform development, compliance and engineering. Having a dedicated and specialized staff both ensure expertise, and also increase security, because vulnerabilities often happen when technology is implemented without the right level of proficiency.

A cloud solution should also ensure, through continuous validation and auditing, that the right things are being done through a variety of mechanisms, whether those are SAS 70 Type II audits, internal audits, or security probes.

Additionally, cloud services need to operate at scale for specific applications not found in a typical enterprise, which in turn creates a need for automation, ensuring that all the right tasks are happening at the right times.

Controlled Environments

A SaaS solution needs a scalable environment made for performing one task (or set of tasks) in an automated, repeatable, and dependable way. Therefore, cloud providers need a homogenous environment from an OS monitoring tool and even hardware point-of-view in order to increase visibility and decrease risk exposure.

In this environment, there’s not one key person who has access to everything. Instead, there are strict controls regarding when and who can do what, which should be automated to provide an additional level of security.

Data Encryption Architecture

Enterprise-class cloud vendors must ensure that data is encrypted both in transit and at rest, no matter where it resides. Crucial to this are encryption keys, which should be separated from the data or application. One way is to have data in the cloud and keys onsite. Alternatively there could be one cloud where keys are maintained and stored and a separate cloud for data encryption and decryption. Those clouds should communicate through controlled protocols so unauthorized users can’t access both.

Redundant Infrastructure

To deliver services reliably, across multiple datacenters and at scale, cloud solutions need redundant infrastructure. To ensure reliability and disaster recovery, it should be at the core of all architecture.

Redundancy is often overlooked because it is complex, not always cost-effective, and many times it’s an afterthought. But it provides additional security. If attackers target one datacenter, other datacenters are still running.

If an organization looks for SaaS solutions that hit on all of these four factors, they can rest assured that their data will be secure and reliable, even in the cloud.

—

About Andrés Kohn

Andrés Kohn is currently responsible for Proofpoint’s email archiving business unit and has been responsible for setting Proofpoint’s product direction since the inception of the company. In addition, Andrés is responsible for developing strategic technology partnerships that complement Proofpoint’s solution offerings. He joined Proofpoint from Critical Path, where he was director of product management and responsible for the global direction of their messaging products and services. Before joining Critical Path, Andrés held several product marketing positions at PeopleSoft, and various management roles at International Paper as well as Procter and Gamble. Andrés holds a B.S. degree with distinction and an M.S. degree in engineering from Cornell University. He also holds an M.B.A. degree from Stanford University.

Business Continuity and the Cloud

Stephanie Jordan — Thu, 04 Nov 2010 02:25:06 +0000

Implementing sound business continuity practices within the workplace allows organizations to avoid disruptive events and continue operation without stoppage. Today, email is a mission critical application that must be accessible with minimal outage since even momentary downtime can have serious consequences for an organization’s bottom line. It’s for this reason that businesses of all sizes should have a plan to maintain the continuity of email during planned and unplanned downtimes.

Benefits of the Cloud

Building a highly available network and server environment can be a costly undertaking. Fortunately, cloud-based services can lower the financial burden of performing in-house IT maintenance by outsourcing the responsibilities to a service provider who oversees a company’s network and information system.

Moving email to the cloud has a number of business critical benefits. First, customers may add layers of protection and eliminate the need for deploying and supporting applications internally. Protection is provided in real-time to thwart off threats before they enter the network. Second, there is no hardware or software to maintain, upgrade or support. Third, the financial cost for cloud-based services is minimal when compared to traditional in-house IT costs. The ability to adopt on-demand services on a pay-as-you-go basis give many customers greater cost controls and flexibility.

Potential Challenge

Once a business elects to use a cloud-based provider, they could be moving their business critical email hundreds, to even thousands, of miles away from their location. So what happens if there is an outage on the Internet? Most of the time, the Internet is very stable and able to handle issues with minimal impact to users. However, as with all things in the computer/technical world, problems can and do happen.

Performance issues can occur outside the service providers’ control, including Internet bottlenecks and other latency issues. To combat such problems, look for cloud-based service providers who use technologies that optimize the route between customer location, mobile device or desktop computer, to where customer data is stored. Such technology achieves LAN-like network consistency, performance and reliability over the Internet.

Business Continuity and the Cloud

While most businesses think of catastrophic events, such as a hurricane or an earthquake, when devising a business continuity plan, something as simple as a power failure can create the need for a call to action.

Whether a company chooses to partner with an outside vendor or not, a good business continuity plan can keep a company up and running through interruptions of any kind. In order to create a plan, there are a number of policies to take into consideration: a solid business continuity plan can take months of planning and each aspect of the business should be involved in the process. Business leaders and IT leaders should work together to determine what type of plan is necessary and which systems and business units are most crucial to the company. Sound planning from the start will pay off large dividends later.

About James Dean

James Dean joined AppRiver in 2008 as the Senior Exchange Engineer. Dean is primarily responsible for managing AppRiver’s Secure Hosted Exchange and SecureTide environments, which supports a customer base of 45,000 (and 6 million users) worldwide.

Microsoft's Price Reductions

Michael Osterman — Tue, 29 Dec 2009 19:15:50 +0000

Microsoft’s announcement recently that its hosted Exchange service would drop in price from $10 to $5 per seat per month, coupled with the announcement that BPOS would drop from $15 to $10 per month, has generated quite a bit of buzz in the hosted Exchange community.

Phil Wainewright on his “Software as Service” blog may be correct in that the pricing cut was designed to counter IBM LotusLive adoption. While I agree that some of the motivation may have been to counter LotusLive and the significant progress that IBM has made in generating new customers for its SaaS offering, I think there is more to the story:

Our research shows that there is a perception in the marketplace that on-premise management of Exchange is cheaper than it really is—many decision makers don’t sit down to calculate the actual cost of Exchange, and so often underestimate the actual cost of their on-premise deployment compared to a SaaS alternative.
As a result, there is a decent amount of education that needs to occur to help decision makers understand the cost differences that already exist between on-premise deployments of Exchange and hosted Exchange. The price drop may be an admission that the company has not convinced enough customers of the price deltas that already exist.
While Microsoft may be attempting to counter LotusLive, they are also trying to counter Google’s success at penetrating the SaaS market with their $50 per seat per year offering. Google has done quite well in this market.
I believe that Microsoft may also be expecting a move from Cisco in the enterprise SaaS market and the price drop may be an attempt to reduce the impact of a Cisco announcement in this area in the near future. Cisco is clearly a force with which to be reckoned given that they have the pieces of a formidable messaging and unified communications capability (PostPath, WebEx, IronPort, ScanSafe, etc.). I believe that long term, Cisco may be the company with which Microsoft competes most heavily in the communications market.

It will be interesting to see what impact the price reductions have on the hosted Exchange community. At a minimum, it will make Microsoft more competitive with them, force price reductions by some hosted Exchange providers, and motivate some to provide additional value added services (hosted SharePoint, hosted archiving, etc.) that offer them the ability to retain their margins. It may also motivate some to expand their offerings to include hosted Zimbra and other platforms.

Perceptions About Cloud Computing

Stephanie Jordan — Tue, 01 Dec 2009 04:47:24 +0000

About a year ago, I wrote Pinching Pennies with SaaS for Messaging News. At that time, I wrote:

There is a lot of talk about “cloud” computing, often being used interchangeably with the term SaaS (software-as-a-service). It is interesting to note that these terms mean different things to different people. According to IDC, cloud-based software, as well as SaaS and hosted messaging security are “essentially variations of the same thing; such software is characterized by the software, services, and support offerings that are specifically built and designed for one-to-many delivery over the Internet.”

Earlier this month results were announced from an August survey, conducted by Osterman Research and Proofpoint, Inc., which concluded that cloud computing confusion continues.

It seems that the confusion still stems from the fact that “cloud” means different things depending on definitions and perceptions assigned to the term. The contention of the survey is that this confusion may be stalling enterprise adoption of cloud computing technologies.

The uncertainty is not only among non-IT folks — although of the 200 information technology (IT) professionals that participated in the survey just 24 percent thought their CEO could define cloud computing, and 59 percent thought their CEO would fail – but also IT types too.

According to the report: “Nearly 40 percent of IT professionals answered ‘yes’ to the question, ‘when I hear the term ‘cloud computing,’ I am generally confused given the many definitions’ (52 percent answered ‘no’). Thirty-three percent believe cloud computing is more hype than substance, while 24 percent ‘weren’t sure’.”

Definitions are not the only inconsistency. Perceptions in quality also range when it comes to cloud-based offerings. “When asked about the difference in the quality of cloud-based email security services and cloud-based email archiving services, a large number of IT professionals polled believe the differences are significant,” says the report. “Forty-six percent of respondents see a significant difference between the cloud-based email security offerings on the market (19 percent do not), while 43 percent see a significant difference between the cloud-based email archiving solutions (21 percent do not).

Regarding the survey, Gary Steele, CEO of Proofpoint, comments: “The takeaway is that clearly all clouds are not created equal. Given the increasing number of SaaS email security and compliance solutions available and differences in data security, service level agreements, effectiveness and ease-of-use, enterprises must conduct their due diligence when moving these types of functions to the cloud.”

Regardless of the confusion, interest in the cloud continues to grow, aided by current economic conditions. As an example, in this month’s cover story Preserving Email Through Hosted Archiving, The Radicati Group’s research shows that while a greater percentage of archiving solutions are deployed on-premises, “the deployment of hosted archiving solutions is growing at a faster rate than the deployment of on-premises products. Hosted services are much more affordable in the short run, which helps many companies to give them a try particularly in a slow economy.”

It will be interesting to see where we are in the definitions, perceptions and adoption of cloud-based solutions a year from now.

Eye on Messaging is written by Stephanie Jordan, editor in chief of Messaging News. If you have story ideas or news to share, email her: sjordan [at] messagingnews [dot] com

Preserving Email Through Hosted Archiving

Stephanie Jordan — Tue, 24 Nov 2009 18:20:47 +0000

When message archiving came on the scene, most thought of it as a concern for only the most regulated vertical, like financial services. In December 2006, however, when the Federal Rules of Civil Procedure (FRCP) were amended to include the discovery of electronically stored information, archiving took on a whole new importance to a much wider audience. For organizations, it meant re-thinking and changing the way electronic communications were collected, reviewed and made available in response to a discovery request. Many sought out on-premises archiving solutions to meet electronic discovery and regulation compliance, but others felt archiving, while important, ranked low on the priority list for precious IT budget dollars.

Today, according to The Radicati Group, “On-premises archiving products continue to be the most popular way to deploy an archiving solution, with 75 percent of all archiving solutions sold as on-premises products, compared to 25 percent of archiving solutions sold as hosted services.” This may not remain the case. Radicati research also shows that, “The deployment of hosted archiving solutions is growing at a faster rate than the deployment of on-premises products. Hosted services are much more affordable in the short run, which helps many companies to give them a try particularly in a slow economy.”

With the rise in acceptance of other software-as-a-service (SaaS) offerings, it makes sense that archiving in this model will also enjoy a spike in popularity. “I think for companies that are not in financial services, it may be perceived as a little riskier,” observes Stephen Marsh, CEO and founder of Smarsh. “We saw the exact same behavior in financial services several years ago. Everyone was hesitant early on, but companies ultimately started realizing that they were wasting their own time and money. Service providers, in many cases, are more secure and have better measures to protect data, because their businesses depend on it. In-house IT staffs have a million other projects completely unrelated to data protection. The reality is the service provider has the better infrastructure.”

Benefits of SaaS Archiving

Cost savings is often seen as a primary reason for going the hosted route. “Osterman Research’s recent analysis of the cost of email archiving solutions showed that SaaS email archiving can offer dramatic cost savings versus an on-premises approach,” confirms Michael Osterman, CEO of Osterman Research. “These savings can be realized even for very large organizations and regardless of required retention periods, compliance requirements or redundancy requirements.”

Most industry experts will point to cost being a prime benefit of the cloud model. But there are other benefits too. Mary Kay Roberto, senior vice president and general manager for Mimecast, says a top customer mention is that: “The streamlining of email administration is significant—since the admin no longer has to be concerned about the hardware and software maintenance, the cost reduction associated with hardware and software to support the archive, and the elimination of the costs of upgrading hardware and software and eliminating the need for storage additions. This saves significant time and enables the administrator to focus on proper policy management for the archive and operational management for the email system.” (Of course this also brings in the cost-savings benefit again too, Roberto says the cost of upgrades is particularly burdensome as is the cost and management of storage. She says it is common to see cost savings in the 30 to 60 percent range over on-premises systems.)

That cost benefit is especially attractive in our current economy. “We have seen a big, big shift over the last year and a half, as a function of what is happening in the economy,” observes Marsh. “A lot of larger organizations are less certain about what their organization might look like in the next six to twelve months. If there is any risk of downsizing, they do not want to make the capital investment to buy a large on-premises solution or to build a solution that today might accommodate 10,000 users and in six months may need to only accommodate 5,000 users.”

Another benefit often cited, says Roberto, is the continuity aspects of a cloud archive, which gives an organization significantly better access to data when there are issues in the data center without the extensive cost of having second data center location. “As a foundation of all of this, is the fact that IT will contribute to their corporate ‘green initiatives’ by reducing the number of servers required to provide email management. In our cloud solution, we typical see a reduction of 30 on-premises servers for one of Mimecast’s.” Roberto notes that the reduction statistic incorporates the organization utilizing the Mimecast Unified Email Management, which includes inbound and outbound perimeter security, email continuity, and archiving.

With these benefits, one wonders why the hosted model hasn’t been embraced sooner. “We have seen, going back to financial services in the early days, many of the medium to larger firms that have their own IT staff initially gravitate toward on-premises solutions,” says Marsh. “The perception is that it is more secure, that there is more control, and that they can produce data quicker. In fact, all of those things are counter-intuitively not true.”

According to Marsh, he has seen a lot of customers move from on-premises to the hosted platform for a variety of reasons. “A lot of times companies get fed up with the whole process of upgrading their software, their systems, add additional storage, etc. The IT departments, who initially wanted control, get fed up with having to support their legal department, their HR department, and their end-users, when it comes to email archiving. In many of these organizations, the legal department is asking for data on a weekly basis. I think the legal or compliance departments struggle with getting the data quickly, it is like pulling teeth in some occasions.” Marsh points out that Smarsh provides a service whereby a dedicated customer service department does nothing but help produce data when needed.

Customers being disillusioned with on-premises solutions are something that Andres Kohn, vice president of technology and product management for Proofpoint has seen too. The reason for that, he says is partly due to the maturation of archiving. “The first generation of archiving solutions were all on-premises—where you had to build up infrastructure to keep email,” explains Kohn. “In fact, the original archives were all about storage management. Taking email out of Microsoft Exchange and putting it somewhere else that was a lower cost, yet could still be accessed somehow. But once we got into more of the eDiscovery, it becomes a lot harder, and more expensive to manage that scale. We have customers that routinely come to us and say, ‘I run a search on my on-premises archive and it may take hours or days or weeks even to get the search results back.’”

Security

When weighing between on-premises and SaaS, security is a concern that can tip the favor toward on-premises. It is perceived that the data is more secure onsite. Not true says Kirk Averett, director of product for the Email & Apps division of Rackspace, “The cloud is more secure than on-premises systems for our email archives. Why? Real data centers have true physical and logical security, generally far more than even some of the world’s biggest and best enterprise companies. Combined with our DoD and PCI-DSS level encryption and separate storage silos for customers we have a high degree of confidence that the data is secure.”

Roberto believes that a vendor should be able to demonstrate the encryption strategy for data, describe and validate the physical security, and demonstrate the interface to the customer’s LDAP. “Often with these three elements, the data is more secure in the cloud than it is on premise,” she asserts.

For Proofpoint, the company saw the security issue as one of the biggest concerns people think of with SaaS. Kohn describes it this way: “I am now sending a copy of every email that I send and receive to somebody else. People got over that with inbound scanning, because they figured it was coming from the Internet anyway, but when you talk about all your internal email correspondence, that gets scarier. So people were really looking for a high-level of security, and that is where we have stepped into the fray.”

Proofpoint ARCHIVE is a hybrid model, where it is neither all on-premises, nor all in the cloud. “We decided to put what we thought were the right components in the right places,” explains Kohn. “Most of the infrastructure lives in our data centers. We also place a lightweight appliance that sits at the client site. What happens is that the appliance talks to the mail server; it grabs copies of all the messages, and encrypts it with a key that only the appliance has, and sends it to us encrypted. We have no way of ever being able to read any of the content, because the only key sits at the customer site. When a customer wants to do a search, they go to the appliance and the appliance encrypts the search terms and sends that to us. We get the results, but we do not even know what they are searching for.”

This concept of the third-party vendor not snooping through an organization’s email records is important. “Sometimes the security question might be a smokescreen over a different concern around who controls the customer’s data: the hosting company or the customer,” says Averett. “Rackspace, as well as every other responsible email archiving provider, has strong policies and protections in place to make sure that data remains private and in the control of the customer.”

Disaster Recovery

For some, the fact that the data is located at another site is a benefit of the SaaS approach. “We have found the disaster recovery (DR) aspect interesting,” says Kohn. “People are doing back ups, but they do view the archive as a little bit of a DR solution. If there is a gap in a back up or somebody wants something they deleted from their mailbox, they know there is a copy in the archive. So even though it is not meant to be a back up and restore, it does provide a second-layer of protection beyond a backup, and it is offsite.”

Marsh acknowledges that Smarsh customers also like the DR angle. “Organizations can use the storage at a third-party as a disaster recovery solution as well,” he agrees. “Inherently to get the data to a service provider, you have a copy securely stored somewhere else. Many of our customers will use that to rebuild email servers if they have problems, to re-populate an email server, or they use our service to restore even individual messages that in the past required the IT department to reload tapes and find a single message. It is an entirely overlooked benefit to using a service provider.”

While no one believes that a company should consider SaaS archiving to be the same as a true DR solution, it can be of help in a truly unusual circumstance. “Email archiving offsite, particularly at the low price point that we offer of $3 USD per mailbox, is the fastest and least expensive way to make email data available through a second service and location, in the unlikely event that something catastrophic happens at a primary data center,” states Averett. “Keep in mind that people using a hosted email solution almost always have live copies of all of their data, so only the most disastrous of circumstances would make the continuity features necessary.”

Reducing eDiscovery Costs

While DR may be an unexpected bonus of archiving, an expected benefit is the reduction of litigation costs. Deployment of an email archiving solution will save organizations both time and money in their early case assessment programs, contends the Smarsh paper, Reduce Litigation Costs Using Email Archiving for Early Case Assessment. “As we talked to more and more fortune 500 companies, and others that have a general counsel, a theme lately has been reducing eDiscovery costs,” reveals Marsh. “It was bound to happen sooner or later, but the economy has really accelerated that. Firms do not want to take all their email and hand it over to outside attorneys and say: ‘Here, find anything that is relevant.’ They want to do more themselves, but currently do not have the tools to do even a cursory search of their archive to find out what might be lurking out there in their emails or what an eDiscovery might find.”

By doing more in-house, organizations can reduce outside legal bills. “The cost of eDiscovery has increased over time, often because of the burden of location and restoring information, if it is not in an archive,” warns Roberto. “Archives with robust search capabilities will facilitate the eDiscovery process and help reduce the overall cost. Part of the cost is the salaries or consulting fees required to gather data, if it is not in an archive. As an example, even for a mid-sized organization who might take eight to 10 hours to retrieve data from DVD or tape for individual cases could reduce that time to an hour or less with the appropriate archive. From a risk management standpoint, being able to verify a search and show validity of data can save significant legal costs as the case proceeds. Finally, avoiding sanctions because data cannot be produced in a timely and accurate fashion is essential for a corporation’s legal department. All of this supports having an archive in place, particularly if the organization can set appropriate retention policies to different segments of the email data, thus being able to demonstrate compliance with corporate policy.”

Sometimes the reduction on eDiscovery costs, however, is hard to calculate. “There are two major components of that,” offers Kohn, “One is cost of finding the data, getting back up tapes, getting users laptops, etc. The other and biggest cost of eDiscovery comes when a company passes a ton of email to a law firm to process it. They are going to charge based on how much data is given to them. If instead, you have a solution that allows you a very flexible and powerful search capability and you are able to hold down the amount of data provided to the law firm, then they can charge only for what is given them, so there is huge savings there.”

Keeping Up With Regulations

Another area where SaaS archiving can offer unique benefits is business regulations. Understanding, and complying with an evolving list of rules is challenging, if an organization is not aware of what regulations they’re responsible for. “A service provider deals with conflicting regulations all the time,” says Marsh. “I would certainly not say that we are a consulting firm that sells advice, but we have other clients that have been through similar scenarios. We do have practical opinions and perspectives that we can provide just from our many customer relationships. That also translates into SaaS customers getting the latest technology all the time, not just from a whiz-bang perspective—because there is value in your getting the latest and greatest technology—I think it is also relevant that as regulations evolve, companies that use a service provider don’t have to change anything to be compliant or implement industry best practices. Once we hear from one customer that a court says they have to do X, we start to develop trends and can make changes to our product adding new features and functionality that benefit all our customers. For those with on-premises, they are going to have to upgrade in order to add features and functionality.”

Moving to the Cloud

If The Radicati Group is correct in its prediction that deployment of hosted archiving solutions are growing faster than on-premises, it signals that organizations are becoming more comfortable with the platform. “Many customers were initially hesitant to make the move to the cloud because their data is so important to their business operations,” states Roberto. “Once they understand the level of security, the range of functionality, and the simplicity of email management, they became comfortable with the concept. They were also reassured when they understand that they would still administer their system and set their own policies, and that they were totally in control of their data.”

Perhaps it is archiving as a whole that has become more accepted. “The trend away from archiving as a specialty need is growing more and more,” says Averett. “A year ago you could find companies beginning to think about archiving as a productivity tool, and now that seems to be the most common case. It will always be valuable for regulatory compliance, and we won’t be surprised if more industries are required to archive in the future.”

Being in the cloud does offer the ability to more easily manage what promises to be ever-growing piles of data. “For us, the power of having a SaaS solution is that we are able to spread the data out for any given customer across many, many servers. When they come to a search, on average 30 servers will light up and perform that search. So the results are able to come back really quickly, because each server is doing only a little bit of work. There is no way anyone is going to buy 30 servers to deploy an on-premises solution, but we can do that because we can share that compute power across many different customers, and that is the power of the cloud.”

With the viable options for either on-premises or SaaS, there is no reason not to archive anymore. SaaS pricing makes the cost of archiving predictable for any size organization, and archiving protects companies in the event of an electronic discovery request, and helps to comply with various rules and regulations. “In the 15 months since we acquired Fortiva, there has been a change from people saying: ‘I would love to do archiving, but it is further down on my priority list’ to people that are talking about and actively implementing archiving,” observes Kohn. “We have seen a greater shift towards SaaS, interestingly, not only from people who are for the first time saying: ‘I should do something and there is a lower cost way to do it now’, but also getting a lot of traction in organizations that already have an in-house archiving solution that are realizing after several years that with the amount of data they have, it is not usable and is hard to manage. Even they are saying: ‘I can move this to a SaaS solution, with less hardware and people, and I can save money.’”

As the benefits of having an archiving solution are better understood, attitudes toward archiving will change. The reason that has not yet happened may be that organizations are only starting to see beyond the practice as a necessary evil or as regulations that must be complied with, suggests Marsh: “There are a lot of benefits. Rarely do companies consider the IT benefit of off-loading the mail from their primary server so that they can keep that server lean and operating optimally. They may not consider the DR functionality, of being able to produce a single message for an end-user in ten seconds versus restoring back up tapes for hours down in the data center. They probably do not think about the value of retaining all of their institutional knowledge that is exchanged in email day in and day out, or consider that as employees leave, there is potential for all that data to go out the door with them.”

Plugging In to Continuous Availability

Stephanie Jordan — Mon, 14 Sep 2009 11:00:00 +0000

Understanding the importance of data protection of messaging systems and its continuous availability is critical. Messaging today has become much more than just another application. “Most businesses are just beginning to realize that messaging has evolved from an application to a corporate communication platform,” believes Manish Kalia, founder and vice president of marketing for Teneros, Inc. “Email, BlackBerry/iPhone, voicemail (unified messaging), fax, archiving and compliance, document management and CRM are just a few of the IT systems that are dependent on messaging. As a result, messaging has emerged as the number one application that needs to be protected for disaster recovery and high availability.”

That dependency upon messaging needs to be considered, when addressing disaster recovery (DR) and high availability (HA). “When it comes to protecting a messaging system, one of the things we are keen on talking to customers about is whether the organization is protecting messaging or other components of the IT infrastructure,” says Eric Pitcher, VP technology strategy for the recovery management and data modeling business unit at CA. “You cannot have DR just for an individual component. If you only worry about DR for backup, then getting back the individual file is easy. However, getting back the full email server is not. One of the things about applications—and email is just as susceptible as any other application—is that it lives in an IT ecosystem. It has to have other services available in order for email to work and be accessible, such as security, your LDAP, or Active Directory or whatever you are using. Making sure your messaging systems are seamless and how you protect your IT infrastructure is critical.”

Andrew Barnes, senior vice president of corporate development for Neverfail Group also believes that messaging has extended its reach, “When people are looking at business continuity it is no longer an application in isolation. It is no longer just about Exchange, but about everything else that goes around it.” Barnes then asks: “Do you want three or four different tools to manage three or four different types of applications? Or do you want one product or one interface to manage it? This is a good debate to have. How many tools do you use to deliver HA and DR protection of messaging and messaging related systems?”

Virtualization and Business Continuity

Another consideration is the complexity of the infrastructure. Is it a physical or virtual environment? Often today’s IT ecosystem is mixed. Where does the virtualization trend enter into HA and DR? “One thing we have been hearing a lot from the virtualization vendors is that the primary reason to buy virtualization is to reduce cost,” responds Pitcher. “This is done, of course, by allowing multiple applications to run on a single piece of hardware, but there are pros and cons to that.” He explains that while virtualization does help to reduce costs, it also adds complexity to the IT infrastructure. “If you are running a physical environment, you can have your DR environment be virtual,” he says. Pitcher notes that CA XOsoft takes care of all the complexities of replicating and creating application HA between a physical and virtual environment, “As a matter of fact it is the most common install I see of our technology today: messaging systems running physical, but their DR site is running virtual with CA XOsoft protecting that environment.”

Virtualization, while bringing benefits to business continuity, does require careful planning. Barnes reminds that while virtualization can be a very reliable stable platform protecting against hardware failures, it may not recognize what is going on within an application. “It is important to look for ways in which you can understand what is going on inside the virtual machine,” he cautions. “Neverfail can do that because it is application aware and doesn’t care if its running on virtual or physical, then you can make decisions about failover, based on what’s going on inside the application, inside the virtual machine.”

Kalia also sees the role that virtualization can play, saying: “Virtualization provides protection from hardware failure. However, that only accounts for a small percentage of failure scenarios in the messaging world. Common messaging failure reasons include: database corruption, software errors, storage failure or operator error.” Kalia recommends virtualization in conjunction with transactional database replication and application level failover/failback logic to provide a comprehensive DR solution for the messaging infrastructure. “For applications other than messaging, that are not databases, such as Web servers or file servers, virtualization can provide an effective DR solution by itself,” he adds.

With the increase of interest in virtualization, Pitcher notes that DR and HA implementations are aiding migrations from physical environments to virtual. “One of our number one customers actually bought our replication capabilities specifically for doing physical to virtual migration. One of the problems you run into with a virtualized environment is when you virtualize a server, you have to do the physical to virtual conversion—it’s usually all or nothing.” Pitcher states that, “A lot of CA customer sites are setting up a virtualized server, get it tested and running, ensure the impact that virtualization has on their DR plan is understood and then use CA XOsoft to replicate the email messaging system from a physical environment to a virtual environment. When they are comfortable with the DR environment running they do a manual failover, and shut down the physical server and bring up the virtual server. What’s neat about this is a customer has now migrated its application to a virtual environment, but if the virtual server is not performing, it still has the physical server available. It gives them an immediate backup, so that if anything fails, all they do is failback and everything is up and running again.”

Continuity Planning

Most experts agree messaging infrastructures do require special planning and consideration. “Messaging is not just about idle communication, it is often part of a critical workflow process, so what ever you use to protect email to keep it up and running you might want to consider if that’s the right technology to use for ancillary components, or vice versa,” suggests Barnes. He goes on to offer an example of a customer that had HA of Exchange and HA for BlackBerry, but with two different tools. “What if one of them goes down and the other doesn’t? You have a problem, because for the one that goes down you might want to switch somewhere else.” He continues by noting that the solution for this customer was Neverfail for RIM BlackBerry protecting BlackBerry service through a disaster site some 40 to 50 miles away. “But then what you get is potential latency because you get lots of network traffic where BlackBerry has to talk to Exchange to deliver email,” Barnes explains. “So they wanted their Exchange systems failed over as well, so they bought a product from us called Neverfail ClusterProtector, ensuring its Microsoft Exchange environment was able to failover to the same location as the BlackBerry Enterprise Server, so now both are in the same place and both available to the end-user. This is a good example of thinking about not just protecting one application, but protecting multiple applications and making sure that you maintain the optimum configuration when that happens.”

Planning, however, is not just about technical implementation. Pitcher notes that he works with organizations like Contingency Planning Exchange (CPE) where companies help each other with business continuity needs. “With business continuity planning only one-third of the problem is technical,” he believes. “Two-thirds of the problem is people and processes.” Pitcher notes that CA offers a booklet on its site: CA Business Continuity Planning: IT Survival Guide.

“The primary theme of the booklet is how critical messaging is to business continuity,” he reveals. “Since it’s the one piece of infrastructure that everybody relies on, the most critical thing is getting that communication back up and running, so that management can talk to the employees and customers and let them know what to do. In the primer, we give examples of the importance of and ways of keeping communications open.”

Barnes points out that DR can give a false sense of security. “To many people DR is sending a copy of the data offsite, or replicate offsite,” he says. “But if all you do is replication, you still have to recover a working system. You still have to make sure you have the right copy of Exchange, that you have a server available to run Exchange, and that Exchange is pointing to the database. That process can take a couple of hours, which is not usual if you have to rebuild the application server. That is two-hours without email and for some organizations it doesn’t matter, but for others it can be absolutely critical. So people will think that replication, and therefore data offsite, is DR and it is up to a point, but it’s not the same as disaster availability.”

With messaging a vital part of today’s business processes, many organizations realize that messaging infrastructure needs to be treated differently when it comes to HA and DR. “Messaging is a very database-intensive application as compared to other IT applications,” observes Kalia. “This requires special HA and DR planning through choosing the right technologies for messaging DR that is resilient to database corruption and data loss scenarios due to database divergence that is very common in DR.” As messaging is the glue for many IT applications, Kalia concludes: “As a result, if messaging is down, the entire IT infrastructure is affected and there is no communication collaboration capability left within the business.”

For recommendations for choosing a high availability/disaster recovery solution read: Preparing for a Failure Event.

Alliance Formed to Combat Security Threats

Stephanie Jordan — Thu, 03 Sep 2009 10:00:00 +0000

Proofpoint, Inc., and Purewire, Inc., providers of SaaS-based security services, announced this week they are alliance partners, and are engaged in joint sales and marketing activities to bring enterprise customers security solutions.

As an example, the companies offered Technical College System of Georgia (TCSG), which has deployed the Proofpoint ENTERPRISE SaaS email security solution to protect its more than 10,000 inboxes. TCSG also deployed the Purewire Mobile for BlackBerry in October 2008 to fill a gap left by its legacy on-premise URL filter. Later, TCSG selected the Purewire Web Security Service to protect its 44,000 users browsing the Web on campuses, and via laptops and BlackBerry devices.

“Security threats are no longer confined to an email inbox or a Web site, but take advantage of both attack vectors,” says Steven Ferguson, security engineer at TCSG. “By working with Proofpoint and Purewire, we’ve been able to easily secure the online activity at each campus across the state and keep our users safe.”

Of the alliance, Ramon Peypoch, executive vice president of business development for Proofpoint comments, “Purewire’s SaaS-based Web security solutions are the perfect complement to our SaaS email security, archiving and data loss prevention products. SaaS is a cost-effective way for enterprises like TSCG to address the risks posed by today’s increasingly complex blended threats.”

APIs for Building SMS and Push Notifications Into Applications

Ben Gross — Thu, 20 Aug 2009 14:55:12 +0000

In many ways, text messages/SMS messages delivered to mobile phones are the default for near real-time consumer notifications. The advantage of text messages is that they are fast, reliable, and nearly all Internet connected consumers have access to them, even when they are not at their computers. US consumers are catching up to the rest of the world in familiarity with text messages so people increasingly use them for everything from flight arrival information to bank balance notifications to Twitter updates. The problem is that SMS messages can be expensive for both businesses and consumers. Carrier rates vary, but in general rates for consumer SMS messages have increased. Each message sent or received without a bulk message plan can cost up to $0.20 per message for domestic messages and even higher for international messages An unlimited text messaging plan can cost $20 per month per line. This means that SMS messages can be quite expensive for individuals without a bulk message plan or for those who go substantially over their alloted number of messages. Sending SMS notification messages can be a significant expense for businesses, even with substantial discounts for bulk purchases. Some very large SMS senders have managed to strike deals with carriers as the carriers generate revenue from delivering the messages from the large volume SMS senders.

Developers have many SMS aggregators to choose from such as Bulk SMS, Clickatell, Esendex, and Ribbit that provide developer APIs for integrate SMS into applications. Developers who wish to build their own SMS service can choose from a number of commercial an open source packages. Kannel is the most well known open source SMS (and WAP) gateway. Slingshot SMS from MobileActive is a new open source option that is simple and can run from a laptop or USB drive with a standard GSM modem or cell phone. Slingshot SMS is written in Python and will run on Mac OS X, Windows, and Linux. The O’Reilly ebook How to Build an SMS Service O’Reilly Media by Brian Retford, Jordan Schwartz is an excellent primer on beginning development, although the book was published in 2007 and some information needs an update. The authors describe building SMS services with the open source SMS Toolkit for the .NET Framework from Microsoft Research India.

Push services are rapidly becoming a viable alternative to push data and notifications to smartphones. Push notifications are delivered can be delivered over both cellular data and WiFi data connections. Since most US smartphone users have unlimited data plans, there are no concerns about additional charges from push data. The disadvantage is that push notifications require a data connection and are queued for delivery when a data connection is not available. SMS messages are delivered over the voice channel and arrive even when no cellular data service is available. Users who do not have unlimited data plans or who roam internationally, have a very real concern that push data could result in significant additional charges.

RIM’s BlackBerry has long been known for the speed and reliability of its push-based email service and RIM recently opened up a BlackBerry Push API to developers. Microsoft Exchange ActiveSync Direct Push is well established on the Windows Mobile and Symbian Smartphone platforms. Palm is readying its own push infrastructure for its WebOS on the Palm Pre, called the Mojo Messaging Service. Google will enable the Mobile Java Push API for Android devices in 2009. The Apple Push Notification service (APNS) for iPhone or an Internet connected iPod Touch devices has received far and away the most public attention and developer support.

With first version of the iPhone OS, Yahoo! email was only push-based email option available. The second version of iPhone OS brought support for Microsoft Exchange ActiveSync Direct Push to deliver messages, events, and contacts. Apple’s Push Notification service arrived with the third generation of the iPhone OS. APNS keeps a persistent connection open to each device allows developers to deliver real-time messages. Third party developers are not currently allowed to run applications in the background on the iPhone OS.

For developers, there are a few potential difficulties with Apple push notifications. First, even though the system is designed to be highly reliable, there is no delivery information available. Second, all push notifications are centralized and must be delivered through Apple’s servers. Third, even though all push notifications must be delivered through Apple, developers must run their own infrastructure in order handle push operations for their application, this infrastructure must scale as the user base grows. Urban Airship offers a service to simplify the integration of push notifications into iPhone applications.

Difficulties aside, iPhone developers are rushing to add push notifications where they make sense. Push notifications have only been available for about two months and already AOL, Associated Press, Ebay, E*Trade, Yahoo!, Zillow, and many smaller developers have added push notifications to their applications. Boxed Ice, a UK software development firm has published a nice tutorial called How to build an Apple Push Notification provider server.

The Evolution of Message Management

Stephanie Jordan — Thu, 30 Jul 2009 20:55:26 +0000

The past decade has witnessed an explosion in both the volume and variety of digital communications used by consumers. Currently, most of us are wired to email, IM and SMS messages, and many of us are using Facebook, Twitter, RSS feeds and other channels to receive info and communicate with others on a constantly increasing basis. Enterprise technology solutions, however, are still lagging behind the changes in consumer behavior. The infrastructure for processing messages at most enterprises is based on twenty-five years of legacy technology, and the explosive growth in message size, complexity and volume (including spam and unwanted messages) is outstripping current infrastructure. This dynamic creates a multitude of problems on all sides. Most ISPs are struggling to keep pace with the complexity of managing email right now, and it’s only going to get worse as additional channels of communications are added. Enterprises can’t communicate with customers the way they prefer/demand. Most email senders and ESPs want to respect the preferences of ISPs and customers, but aren’t sure how to do it without undertaking huge capital investment. And consumers are left to sort out the mess.

Message management technology needs to evolve from a commodity based product (MTA) that simply sends and receives emails to a more holistic framework that serves as a central integration and processing hub for all forms of digital messaging, including email, SMS, and IM. For senders, this means providing new technology to deliver relevant messages that build long-term, profitable customer relationships by constantly monitoring and updating those messages according to the customers’ preferences. For ISPs and telecommunications carriers, this evolution is all about containing costs, reducing customer churn, and exploiting new revenue sources.

The message management solutions of tomorrow will function as the nodal point for connecting internal and external data sources, applications and systems within a company’s messaging framework. A successful message management platform will have multi-faceted capabilities, enabling it to be configured as a controlling gateway, smart router and/or advanced transfer agent for managing messages consistent with a company’s specific business rules. And ultimately, it will be the source for optimizing customer relationships by managing communications across the board.

For ISPs and telecommunications carriers, message management will evolve from a cost center to a profit center in the coming decade by helping service providers to reduce operating expenses and customer churn, better leverage existing infrastructure and capital expenditure, and find new ways to monetize their services. ESPs and enterprises will benefit from new message management technology through increased ROI on marketing campaigns and huge improvements in deliverability. And with the implementation of new message management technology on both sides of the equation, consumers will also enjoy better service and support for their messaging needs as they continue to change.

About George Schlossnagle

As President and CEO of Message Systems, George Schlossnagle has a dynamic vision for how technology can be harnessed to advance digital messaging for the benefit of all stakeholders and enhance the customer’s ultimate experience. Before co-founding Message Systems in 1997, he was lead systems administrator at iVillage. George is an internationally recognized expert in the PHP language. He earned an M.A. degree in Mathematics from John Hopkins University and a Sc.M. degree in Mathematics from Brown University.