Web 2.0 and Application Security

For the past year, I’ve had the opportunity to speak with hundreds of companies and organizations about Web 2.0 and Web applications.  Every company has plans to move many of their mission critical applications to the Web.  However, many companies do not have a web security plan in place to ensure these applications are free from exploits and hackers. 

One company, who has 200 Web servers and handles over a million transactions, only uses SSL for secure access.  We had a long conversation about other security strategies that included vulnerability management.  To my surprise, the company not only doesn’t use this type of solution, they hadn’t heard of the technology. 

With millions of people using the Web for banking, purchasing, selling and posting information, there is a substantial increase in network, database and Web application vulnerabilities.   In fact, Web 2.0 applications have 5 times more vulnerabilities then Microsoft products.  Companies need to research and implement vulnerability management solutions. 

There are many products on the market and even a few open solutions that can help companies detect and remediate vulnerabilities.  One of these companies is Rapid7.  Rapid7 provides a unified vulnerability management solutions for scanning networks, Web applications and databases.  This solution is perfect for companies who want and need to protect their complete network.  I had the opportunity to speak with customer of Rapid7 and found their product to be as promised. 

Web 2.0 and the User

I came across a great article today about how large companies are moving to more of a one-to-one relationship with their customers.

P&G Primes Its Pinpoint Marketing

In the article, Elva Lewis explains how she will build 60 million relationships. This is a great example of how companies are changing their thinking regarding users and customers. What is interesting is how P&G plans to use multiple avenues to make customers feel like friends. They plan to use traditional marketing as well as new technologies to advance their strategies.

One thing that is clear from the article is that companies need to use relationship technologies such as online, web 2.0 and others to cost-effectively communicate with customers. By building new and enhanced websites, email, feedback and marketing solutions, companies such as P&G can be proactive and reach out to their customers.

Technology companies can learn a great lesson from this type of relationship building.

On a side note. I used the product box.net recently and was very impressed with the features and functions. Because I have a background in both applications and communications, I find it interesting whether large organizations will use this file sharing technology that resides outside the firewall. However, it was one of the easiest web applications to start using and the interface is clear. I started using it within my organization and I think that it is a great way to replace traditional file sharing techniques. The fact that I do not need a server and software to run this application, is fantastic. I remember spending months trying to purchase a server and then use Share-point to create this type of sharing. Not anymore.

The User Generation

In the past few weeks, I’ve had the opportunity to meet with a few Web 2.0 start-ups that are not on anyone’s radar currently.  In fact, the further we move along, the more and more, I speak with companies of all sizes about Web 2.0.  I want to take a moment to restate some of the ideas that are extremely important about Web 2.0 and Enterprise Web 2.0. 

First and foremost, we are in the Generation of the User, or the “User Generation”.  This means that as companies build products and solutions, they need to think about what is important to their users from a technology as well as usability standpoint.  These users include consumers and employees.  I know this doesn’t sound new.  However, the second part of the equation is where many companies fail. 

Second, companies must use every technology to understand their customer’s needs wants and actions.  Web 2.0 is about getting in the minds of your users to deliver the best products before they realize they need them.  Sound complicated?   It’s not.  If companies choose the right applications, platforms and technologies, staying ahead of the user is simple.  It just takes thinking ahead and building customer feedback and monitoring systems. 

As I mentioned before, I spoke with a ton of small companies in the last few weeks.  Of these companies, there were browser, excel, and application vendors.  All of which, seemed like they needed/ wanted to capitalize on the Web 2.0 boom.  Of these companies, only a handful had any “real” sense of building solutions for users. 

At the top is a company called HomeGrader.com.  They provide customer feedback solutions for the real estate industry.  They have the right idea.  Get all the feedback in an easy to use manner so agents can create a better environment for their users.  So far, this company has thousands of users and claims to have most of the top sellers in the US. 

The top sellers are early innovators, and companies like HomeGrader can learn a lot form this market.  Especially in the “User Generation”

Addition – I had a great conversation with 18 -  20 year olds who had just entered the work force.  Their combined comment about their companies’ IT systems was unanimously negative.  

“I can do more with my home computer than my work’s laptop”  “I am extremely disappointed in my companies ability provide the best working environment”  and finally, “I’m not staying here too long”

Employees are users too

Wiki’s Will Go The Way of Portals – Enterprise 2.0

Does everyone believe wiki’s will remain a stand alone product?

One thing that is absolutely certain about technology is that new innovation always has three fates.  The first fate is when the technology solutions become a stand-alone solution for a long time.  Now, don’t call me insane, but I visited three customers in the past year that are using DEC equipment.  And, by the way, they are purchasing new/used DEC equipment as we speak.  If you don’t like DEC, then there are other examples such as Ethernet.

The second fate is when the technology holds on as a stand-alone solution for a few years.  There are many examples of this fate.  SSL for security, EAI for applications etc.  Some people may argue that these technologies are still available as stand-alone products.  However, customers want and companies are delivering SSL products with other security and access technologies.  Also, EAI products are now bundled with web services, SOA and BPM solutions.  The ongoing value of the original technology is based bundled solutions. 

The third and final fate is when technologies just don’t make it alone.  As with the second fate, the third fate has many examples.  Recently, technologies such as Symantec Metadata failed as a stand-alone solution.  However there is clear value in this technology bundled within other solutions for the enterprise and across the web.   

Portals

If you think back only a few years, you will remember a day when portals ruled the world.  They were going to be the end all of all enterprise application, WebSphere, Web Logic, Plumtree, and a host of many others.  The following is a section from Wikipedia

                “…many companies tried to build or acquire a portal, to have a piece of the Internet market. The Web portal gained special  attention because it was, for many users, the starting point of their Web browser.”

One of the major issues with these portals is the length and scope of development.  For example, a few years ago, I worked with a large mid-west enterprise to convince them that thin client portals where going to replace the major vendors.  The CIO told me that he had 15 people working on their portal project.  Fifteen people – working on a portal!

Portals Today

Stand-alone portals have befallen the second fate of technology.  They have become a part of other technologies and bundled as a solution.  Yes, there are some stand-alone portals but a majority of vendors will tell you (and analysts) that they are no longer in the portal market.  Even though they spent millions buying portal companies, they choose to use that technology as part of a bigger solution. 

Portals and Wiki’s

As with the portal, Wiki’s will begin to see their value diminished by companies, analysts and even vendors.  Need some evidence – take a look

• If Wiki’s were real, big application vendors would have bought one or made one
• Application vendors and EAI vendors will dominate through SOA and BPM
• Wiki’s are nothing more than a good web application that someday will be built on SOA technology using existing and legacy infrastructure and applications
• Wiki’s will be the “new” front end technology for SOA applications
• CIO’s will understand wiki’s right after they standardize on one data base provider – in other words – never 

In the end, Wiki’s will need the added value of other technologies to prove their importance and even their existence.  

Enterprise Web 2.0 for the CIO – Applications

To survive in the next five years, companies will need to understand, embrace, and implement enterprise web 2.0 technologies and solutions.  Today, employees, partners and customers expect more access to information and in an easy to use/ customizable format.  Companies need to consider what they do today to meet the needs of today and set the foundation for the future. 

If you step outside the vendor’s skin, you realize that enterprise customers need help determining what the most important applications are how to prioritize implementations.  To do this, it is important to understand that there are three categories of enterprise applications.  Although this may seem like a simplification, it provides a framework that companies can use to prioritize.    

Enterprise applications fall into three categories:

1. Persistent Applications
2. Continuous Web Applications
3. Synthesized Applications

Persistent Applications 

After working with multiple large and medium sized clients, it was clear that certain applications do not need to be changed.  Many of these applications consist of a fat client, so users can do most of the work locally and a server component for storage.  In the past, vendors have used the term legacy applications to describe this category.  The term “legacy” is no longer relevant.  Legacy means that it is old.  Many applications in this category are old and new.   Would you call Microsoft’s Publisher a legacy application?  No, but it is a persistent application in that, you may never change it.  Further, persistent applications are ones where a customer has made a decision to leave it unchanged.   

For instance, one large customer had a brand new CAD application.  The users never accessed the application outside of work and they would never consider logging in after hours.   This company wanted to switch to a web application or create services from the legacy.  After researching alternative options, they decided to leave this application alone. 

Note: Microsoft’s Outlook and Office may be considered the largest/ most used Persistent Applications.  Many companies may argue that other office and web mail companies are gaining market share.  However, the reality is that for now, Microsoft owns this space.   

Continuous Web Applications

As easy as Persistent Applications are to understand, Continuous web applications and synthesized applications are very hard to understand.  Just to make things more confusing, synthesized or SOA enabled applications can and usually are delivered as web applications.  So why do we need a distinction between the two?  The answer is simple and straight-forward, Continuous web applications are like monolithic and persistent application, only web apps are delivered over the web and through a browser.   

Web applications can be hosted on premise or by the application provider.  When the application is hosted and managed by the application provider it is called Software as a Service (SaaS).  In the minds of many vendors, the SaaS model is very different from the old Application Service Provider ASP model that failed as the bubble burst.  How the ASP model and SaaS model differ is for the vendors to explain. 

Note:  Continuous web applications can be delivered solely within the enterprise.  For instance many of the new wikis are just web applications.   

Another interesting side note:  I recently spoke with a wiki provider who would not let their employees work remotely and a remote access company that needed all their employees in one location.  These are the companies we rely on to drive enterprise web 2.0.   Whether wikis will survive in the long term or be replaced by Synthesized Applications such as SOA, BPM and Mash-ups, remains to be seen. 

Synthesized Applications

SOA is still confusing to many customers, users, business people and even many vendors.  Now, let me make even more confusing and then simple.  SOA applications can be delivered as web applications.  In fact, most SOA enabled applications are based on web applications.   

The major characteristic of this category is – using multiple inputs to create a single application.   These inputs can be many things including but not limited to services, processes, data structures, data, other applications,

So why choose “synthesized”?  Many vendors, customers and analysts use the term composite applications.  However, because of the over use of the term and the association with SOA applications it is important to create another category. 

Synthesized applications are much more than SOA.  Synthesized applications include enterprise application integration (EAI), business process management (BPM), Enterprise Service Bus (ESB), Service oriented architecture (SOA), and mash-ups.  Yes, mash-ups. 

Note:  “Synthesized Applications” is the only category that provides a foundation for companies to build a complete enterprise web 2.0 strategy.   

Application Framework

For many organizations, new technologies are those that were introduced three of four years ago.  For example, I spoke with a technology vendor that was implementing WLAN access to its executives.  That’s right, the executives…the next step was to certain employees and then, maybe, across the enterprise.  Can we expect customers and clients to embrace new technologies when vendors are struggling to stay ahead of the latest?   

The short answer is – yes.  Customers will embrace new ideas and technologies by creating a solid framework, building a foundation and managing changes.  As part of the overall “Enterprise Web 2.0 for the CIO” series, this blog provided the framework for companies understand and analyze how new applications will be built and/or bought and how legacy applications will be delivered. 

Time to vote on the next blog:

1. More on Enterprise Web 2.0 Applications
2. Next area of Enterprise Web 2.0 – Connectivity

Enterprise Web 2.0 for the CIO

Business Will Depend on EW2.0 – What you need to know today to survive tomorrow

Today, users, customer and employees expect to get information from anywhere and to work from everywhere in the world. From everywhere, they want everything. This means applications and services must be available in as many places as possible. If you doubt this, take a look at the exploding interest in Web 2.0, Office 2.0, Enterprise 2.0 and Enterprise Web 2.0. These 2.0’s are real and will drive how organizations communicate with customers and business partners now and in the future. For many companies, these 2.0 technologies will determine whether they are in business in five years.

In all the years of IT, we’ve never experienced such rapid growth in technologies and user needs that we have today. 2.0 technologies are revolutionizing business and IT. The word “revolution” may seem a bit harsh. However, if you look at Service Oriented Architecture (SOA) and Business Process Management (BPM) as evolutionary, than 2.0 is revolutionary.

Let’s take a look at SOA and BPM for a moment. Most companies have just begun to evolve and implement SOA and BPM. Even with evolutionary technologies such as SOA and BPM, there is a ton of conflicting evidence and analyst rhetoric about whether they will help companies succeed. For this reason, the decisions companies make today regarding SOA, BPM and 2.0 will either help or hinder their ability to compete and survive in the next few years.

 

EW2.0 is more than delivering web applications and providing portals for collaboration. EW2.0 is made up of three areas. Each of these areas is important to the success and level of acceptance of EW2.0. The three areas are:

1. Applications and application integration
2. Connectivity (Internet, wireless, network)
3. End-point technologies such as PDA’s and laptops

EW2.0, Applications and Application Integration
This includes portal, wiki, mash-ups and web technologies that companies need to understand and implement. There is a huge difference between web applications such as salesforce.com and web services applications such as eBay. Web applications are easy to manage and deliver. However, most applications can not be delivered as web applications. Legacy applications and databases need to be exposed as web services (SOA). These web services need to be orchestrated (BPM) into a composite (portal) application that can be delivered via the web. For this reason, companies need a solid yet flexibly infrastructure of applications and integration that provide a foundation for EW2.0.

EAI, SOA, BPM

• webMethods
• IBM
• TIBCO
• BEA

Tools

• Backbase
• Nexaweb
• JackBe
• Skyway Software
• Adobe
• Securent
• Crosscheck Systems

Web 2.0 companies – too many to list (another thing to write about)

• Wikis
• Mash-ups
• Search – Google, Yahoo, Ask.com, Gigablast

EW2.0 – Connectivity
Users today are demanding access to information anywhere, anytime. These demands will only increase in the future. What will our 15 year olds, who use portals such as Myspace and Google expect when they enter the workforce? They will expect “always-on” technologies and solutions. IT departments need to know and implement the correct connection and network access to be successful with EW2.0. This includes technologies and security issues and solutions.

Data Connectivity and Infrastructure

• Citrix
  
• Cisco
• Juniper

Feeds - Too many to list

Wireless:

• WLAN
  
• WirelessMAN
• WWAN

 

EW2.0 – End-User Devices
The third area of EW2.0 is end-user technologies and devices. These access devices provide the vehicle for employees, customers and partners to access information and applications from anywhere in the world. How companies utilize and standardize on these technologies is critical to their success. Companies need a framework making decisions on what types of devises are best for different organizations.

Roadblock – People
Even after understanding how the three areas of EW2.0 will improve or hinder adoption of EW2.0, there are other challenges that are important to consider. Changing how people work is a big roadblock to the adoption of any technology. Individuals such as customers and employees will always revert to the standard way of operating. Companies need to understand acceptance levels of users and management before embarking on the transformation to EW2.0.

What You Need to Know
There is an enormous difference between a web application such as Salesforce.com and a web service portal application. Companies need to decide when to build applications and when to purchase external web applications. Companies need a framework to help define organizational goals pertaining to EW2.0. With these goals, companies can list and prioritize applications. Then based on their understanding of the three main areas of EW2.0, companies can make informed decisions on whether to purchase or build, who can access, and how applications will be delivered.

 

 

Web 2.0 Companies That Will EXPLODE in 2007

Over the past few months, I’ve had the opportunity to meet with over 30 start-ups in the web 2.0 space. These meetings include multiple interviews and information exchanges. The companies in this list range from middle ware to applications, to providers to social networking products.

Of the 30 or so start-up companies with whom I met, the following is a list of the companies that have a great chance to succeed.

Before, I get started I want to explain that my predictions are based on the following criteria.

• Product/ solution. I don’t care what you call it, does it work?
• Customers – customers are real – no customers – no list
• Revenue – Does the company have revenue? Can the company make money?
• Management – does the management team “get it”? You can have all the IT background in the world, but without the management team, it is a big hill to climb.

Ok, let’s get to the companies

Social Networking

The clear leader in this space is Mocospace. Mocospace provides a wireless social networking portal for users of any age. The fact that this is done on your cell phone puts Mocospace well above the rest of the social networking companies. Also, they have customers, ad revenue and some solid partnerships. Finally, the management team is very smart and has a passion for delivering the best product on the market – look out other social networking companies, this is the real deal.

Web Services / SOA

The leader in this space is Crosscheck Networks. This is hands-down leader. Testing web services and security is the next big thing in Enterprise Web 2.0 and Crosscheck has the easy to use product, strong management and solid revenues. Unlike many other companies in this space, they are a strong standalone company with the opportunity to dominate in 2007

AJAX

I think every company out there claims to have an Ajax Web 2.0 product. However, Backbase has arguably the best product and the most revenues to date. For a start-up, they understand the market and the customers. They have top name “paying” customers and a revenue stream unparalleled in the market place. Watch as they explode in 2007 and become one of the clear leaders in Ajax development and support.

Security

Securent is the leader in Entitlement Management. It has delivered the industry’s first XACML-standards based Entitlement Management solution that has been proven in mission-critical enterprise environments. Strong product, great management and customers make this a company that may not be alone for long.

BPM/ Document Management and ECM

The clear leader in this space is Document Advantage. DocuVantage provides enterprise document management software designed to help organizations streamline their document and information management processes, share and distribute information between employees and customers while maintaining regulatory compliance. DocuVantage products electronically capture and manage information that include paper documents to electronic files and information.

Another one to watch in 2007 or 2008

Pramiti is one of the first companies to recognize the need for solutions platforms. They have a management team that understands the space and can help direct and create the future. Pramati Technologies is an end-to-end Enterprise Java platform vendor with a product suite that includes application servers, component development tools, and an extensible web based management framework. Pramati helps customers build and manage robust J2EE^TM solution environments with a service suite of architecture, deployment and performance engineering. The result is invariable: faster time to market, lower engineering expenses and superior performance.

 

Coming up, I’ll take a look at some big software vendors.

Web 2.0 – BPM, SOA and SaaS Converge at DocuVantage

I received over 40 emails from people asking me to explain the idea of the solutions platforms.  Right now, I will go one better, I will provide and example of all the above - delivered as a solution. 

We’ve all read about companies and vendors that have customers using their collaboration tool and the vendors call it – Web 2.0 or Enterprise Web 2.0.  We haven’t heard much about vendors customers that use the products to make existing problems and issues better.  That is about to change.  Web 2.0 and Enterprise Web 2.0 are not just about collaboration.  They are about solving customer issues by using existing or legacy infrastructure (documents, data and applications) with web technologies such as Ajax, SaaS, and web applications.  As far as I know, there is only one company that can truly claim to do all these things and do them well.    

Document Advantage is a small start-up in the document and content management space.  It may seem like a very busy space right now with large vendors such as Documentum, Filenet and others taking all the leads and opportunities.  Nothing could be further from the truth.  Recently, I had great conversations with the CEO and CTO of Document Advantage or DocuVantage as I call them, and a few of their customers.  What I found out is that many small companies and LOB are actually doing BPM, SOA and Web 2.0 better than some of the largest organizations.  I know this because, I’ve worked with thousands of enterprises in the past few years.   DocuVantage is an on-demand or SaaS solution for the enterprise LOB and the SMB that provides document management.  For many of the large vendors, SaaS or on-demand is only a dream or unrealistic.  However, the DocuVantage product truly delivers on its promise to be easy to use, quick to implement and it helps reduce IT costs.  Ok, enough of the marketing.  DocuVantage provides a BPM workflow tool for organizations (technical or not) to easily implement a new process or modify an existing process.  None of the major vendors in DM, ECM or BPM can claim to have a solution that gets organizations up and running in hours, not months.    Second, DocuVantage uses SOAP to take advantage of the services architectures such as SOA.  Finally, they have web 2.0 technologies in place for a complete, user friendly GUI.  Take all of that and deliver it as a SaaS solution and you have exactly what Enterprise Web 2.0 stands for.   

Unfortunately, their web site does not reflect all that I have stated above.   In fact, it was actually refreshing to see a company who is on the cutting edge of technology, NOT boast.  Delivery is everything – and they have it down. 

Web 2.0 Solution Platforms – Part 3

Business Value of Solution Platforms

By shifting from building solutions to building solution platforms, companies will increase revenue, reduce infrastructure costs and improve customer satisfaction.

First, solution platforms increase revenue by making services and products easier to purchase, shorten sales cycles and provide up-sell opportunities. For example, many analysts predict music software and online retailers such as Apple’s iTunes will replace music retailers. Companies such as Apple and Yahoo created platforms where customers can research (play sample music), collaborate (music ratings), self-assemble (purchase one song at a time) and consume (download to multiple formats). All of these features shorten the sales cycle because it is easier for consumers to access and evaluate music.

Second, solution platforms reduce infrastructure costs by moving purchasing to online resources and allow vendors to easily measure and discontinue products that do not generate revenue. Businesses in every sector and market report that online sales increase year over year. For most organizations, web or e-commerce sales are much less expensive than retailer or direct sales. Now, these same companies are using new technologies such as web 2.0 and Ajax to help increase revenue. In addition to moving to the web, companies who use solution platforms get direct and instant feedback on what services and products are important to their customers. This allows companies to make faster and better decisions on what products will help build the bottom line.

Third, customers who purchase products or services through solution platforms are more satisfied. Solution platforms provide an environment where consumers can use or demo products such as the iTunes example, research and compare competing products on eBay, and collaborate with other consumers through Instant Messaging (IM) or product and vendor ratings. This additional information reassures consumers that they made the right purchase decision based on their needs which increases their satisfaction.

Conclusion

Companies that understand and embrace solution platforms will be better positioned for future success and even survival because solution platforms are based on user’s needs and wants. Current users have extremely high expectations and their expectations continue to grow. Companies who embrace solution platforms will recognize the real and tangible benefits such as increased revenue, reduced infrastructure and improved customer service.

Web 2.0 – Solution Platforms Part Two

Part Two

Examples of Solution Platforms

Wireless cellular plans provide an easy to understand example of solution platforms. Since cellular telephones were introduced, carriers offered limited, prepackaged plans. These plans were solutions, rather than products, and were designed to answer customer needs. A plan consisted of talking minutes, roaming charges and other features. Every customer had their choice of plans that suited their needs. Today, many wireless carriers offer customized plans where the customer selects the services and features they want and need. This type of offering comes from the concept of customer built or self-assembled solutions. The carriers who embrace this type of buying behavior have a clear advantage now and in the future.

eBay and Salesforce.com also provide customers with an easy way to self-assemble solutions that best fit their requirements. These innovative companies created solution platforms that allow customers to construct business processes based on a standard set of reusable services. eBay’s solution platform provides individuals and vendors with the tools necessary to list, price and sell their products and services. Salesforce.com’s platform offers clients a laundry list of services that help companies’ mange customers from lead creation to ongoing account management.

The Need for Solution Platforms

In the current IT environment, users, customers and employees are not bound to the office or a dial up connection. They want to access information from everywhere and demand to work from anywhere. This means applications and services must be available in as many locations as possible. If you doubt this, look at the exploding interest in Web 2.0, Office 2.0, Enterprise 2.0 and Enterprise Web 2.0. All of these concepts provide users with a solutions platform that enables them to develop customized solutions that can be accessed from any location. Solution platforms are about usability and availability. The latest hype revolves around the category of content including video and audio. However the manner in which end-users access and use content is more important than the actual content. For instance, take a look at Google’s latest acquisition. Google recently purchased YouTube for over $1 billion. Is a company that provides on-line video worth that much money? The answer is no. Google’s interest in this video company lies in YouTube’s self-assembly platform and video on-demand system. The important part of this acquisition is not about what content this company provides, it is about the way people access and use this content. In other words, it is a solutions platform that allows end-users to gather data, collaborate with other users and purchase or distribute content in an easy to use method.

Next in Part Three – Business Value of Solution Platforms