COTS Validation
Approach
for
Secure Information Infrastructure
A Collaborative Approach to Converting Business Models into Interoperable COTS-based Solutions
An ICHnet.org White Paper
Contents *
Executive Summary *
The Interoperability Clearinghouse: Bridging the Knowledge-Base Gap *
The Problem: Keeping Up with the Rate of IT Change *
Problematic Information Sources *
Supply Chain Collaboration: A Lexicon for Knowledge Management *
Standards Development Organizations (SDOs) and Industry Associations *
Independent Software Vendors (ISVs) *
Enterprise Solution Providers (ESP) *
Participation Options: *
Domain Implementers *
Participation Options: *
Integrating the IT Solutions Supply Chain *
The Interoperability Clearinghouse: An Honest Broker for IA Solutions *
Summary *
Contact Information *
The brand for Enterprise Users where failure is not an option: *
The Interoperability Clearinghouse
Honest Broker, COTS Pre-Validation Initiative
We work in a world of models.
Herein lies the problem. There is a wide variety of industry computing models (OSI’s RM-ODP, DoD’s GIG, TAFIM, VP Gore’s NII, IBM’s Open Blueprint, etc.) for designing enterprise architectures. Similarly, with the advent of the internet, there is an even wider variety of emerging standards and commercial products to plug into these internet centric computing models. The age of the internet has brought new and wonderful opportunities for quickly converting business needs into "plug and play" enterprise solutions. It has also ushered in new challenges for corporate IT who find it impossible to cope with the rate of change, inherent complexity, and tremendous marketing hype.
The problem is apparent when a CIO is asked to configure a new solution to a particular business problem for his organization and must weave through numerous offerings (standards, products, services) to get there, all the while managing the evolution of his current architecture baseline. With today’s rate of technology change, plethora of offerings, and lack of engineering details, how does his organization cope with this complexity in a timely manner, while reducing the risk of failure? Where is the true honest broker that can provide timely, in-context information on viable solution sets?
For example, if the CIO of a hospital wants to have DICOM-based patient images available on the desktop of each resident physician, eventually he would find that using a web browser in an intranet infrastructure isn’t an option—due to imaging incompatibilities. The key word is "eventually". The hospital IT department might spend thousands of research dollars and waste many person-hours and before uncovering this fact, if at all. In most cases, the project starts over from scratch due to interoperability problems. In the best case, only a portion of the time and money might be lost. What if this CIO had the ability to determine interoperability and compliance issues before starting a project? Multiply cost/time savings across all medical facilities, all financial institutions and all government agencies. The picture becomes clear. This validation information would be invaluable, especially now for those programs that are mission critical and time sensitive.
The Interoperability Clearinghouse (ICH) targets this goal. The ICH is a cooperative, non-profit organization whose primary goal is to create an industry collaboratory (honest broker) where IT information is organized, validated and shared as sets of best practices. This collaboratory is a resource to which any IS professional can map an intended solution and determine where potential showstoppers might be. Reconsider the hospital CIO. If this person could have at his/her finger tips the necessary technical data, that was based on industry implementation knowledge, he would find a virtual proof of concept or list of potential solutions sets in one source. The task becomes one of implementing, not investigating. This is sound information systems engineering, and failure to do it is the major cause of major system failure.
The ICH has major commitments to move ahead from both the public and private sectors, as well as from leading standards organizations. Work has already started. COTS-based Architecture frameworks are being defined and validated for secure information infrastructure and e-business solutions. Implementation successes from industry’s most progressive organizations have already been documented and organized. Standards groups, ISVs, testing labs, solution providers and domain implementers all need to collaborate to reduce the time, risk and cost of developing architecture blueprints for secure e-business. Your challenge is to leverage an industry collaboratory that together addresses with the complexity and rate of change, or be part of another statistic!
The advent of the internet and secure information infrastructure has increased a proliferation of IT standards and products supported in a "plug and play" paradigm. These technologies define a new model for enterprise computing that promises to address critical IS needs not adequately addressed by the traditional client-server model:
Nearly every market has embraced distributed computing and the Internet, hoping to obtain anticipated benefits—in particular, plug and play interoperability with reduced cost of migrating systems. Realizing plug and play component-based architectures involves new challenges: testing, validation, integration and, most importantly, cooperation. The strategy is to incorporate these modules into the enterprise infrastructure as it progresses towards vendor independence. All at once, vendors are racing to add new features and functions into a flood of product releases. There is a contradiction between the goals of end-user enterprises and the competitive realities of the information technology market. Enterprises must preserve existing capabilities to maintain and enhance interworking as systems evolve with commercial technology innovations. Downtime, from poorly tested and integrated components, can cost money and lives—millions of dollars a minute in finance and telecommunications systems; life-critical systems in aerospace, defense, healthcare, and transportation. The paradigm of open systems has brought flexibility and challenge. End-users' industries have two choices for staying competitive. They can:
Or
History tells us the last alternative is full of perils. If you choose #1 as your information system (IS) model, then read on.
A federation of open system companies is bringing their combined resources to bear. Their goal is realizing an equivalent level of interoperability possible from a single vendor, but with the multi-vendor technical capabilities needed for today's business system requirements. Until now, there has been no single place to define these "integrated solution suites" (or frameworks) of products and services for a domain specific need. There is no single value-added reseller or organization to act as an unbiased solution-testing and validation clearinghouse which will bring this puzzle together. An entity to fulfill this role is obviously needed. Some information resource managers are understandably tempted to go back to a single vendor or single solution provider as the alternative to open systems. Enterprise Integration is becoming increasingly difficult, risky and costly. Technologies are becoming too complex and dynamic for any one organization to track, test and validate. These problems are intensified by the lack of a common commercial architecture science (architectonics) for research and validation. The plethora of offerings makes this puzzle impossible to understand and assemble, and the danger is in what we do not know!
Today, enterprises are spending hundreds of millions of dollars annually (approx. 12.5% of their entire IT budget) on testing commercial product suites before integrating them into their technical architectures. These organizations lack objective data on how well these new products conform to standards, and how well these products work together in integrated environments. This validation data already exists in small portions throughout the industry. Our goal is to pull these diverse knowledge sources together through a public service consortium that works together to propagate an Internet-based collaboratory of implementation best practices.
In this new era of secure e-business systems, it is nearly impossible for systems engineers to keep current with evolving standards and associated suite of interoperable products. Even large integrators struggle to create their own interoperable sets of tools to support their development and customer needs. These needs are not unique; other IT organizations and industries are struggling with the same challenge of technologies and interoperable solution sets. Corporate IS organizations spend up to 70% of their IT budgets on development, testing and maintenance of interoperable product suites. Commercial off-the-shelf (COTS) product reuse supposedly makes the process of enterprise IS development and migration simpler and less costly. However, with the rate of technology change (including constant product revisions), it is impossible for IS to manage configuration changes and incorporate new capabilities. Each change may have an impact on the entire enterprise’s interoperation. If the results of everyone’s testing and validation were collaborated into a single repository, IS developers could focus on their applications. Attempts to share lessons learned, at a smaller scale, are already being exercised elsewhere in industry: the Defense Information Infrastructure Common Operating Environment (DII COE); and throughout other major vertical industry domains; the Telecom Industry (through TINA-C), the Financial Industry (through SIMC, BITS), and the Healthcare Industry (through HIMSS and GCPR). Even these proactive initiatives have not kept up with innovations in distributed computing, security and the Internet.
Problems of the IT industry are evident in the mainstream publications of COMPUTERWORLD, Information Week, INFO WORLD, DARWIN, and PC Week. These publications have reported this "interoperability" issue is the major stumbling block to mainstream adoption of distributed computing technology. The growth of consulting services targeting COTS systems architecture, design and integration to the Fortune 100 is further evidence. Consulting firms such as Andersen Consulting, IBM Global Service, Ernst & Young, PriceWaterhouseCoopers, EDS, SAIC, Lockheed Martin, KPMG, Litton PRC, Raytheon, and others have committed to substantial practices in distributed computing systems architecture.
Yet, you do we trust to provide us these COTS blueprints? Syndicated Research firms like META Group, Gartner Group and others were recently lambasted for not keeping up with the rate of technology change and/or being conflicted through their relationships with the vendors they report on. In the March cover story of Darwin Magazine (CXO Media) entitled "Under the Influence", Christopher Koch explains how the efficacy of syndicated research firms is being compromised. "Corporations pay technology analysts $15 billion a year for unbiased technology research. But many common analyst practices look suspiciously like conflicts of interest." This complete article can be found at http://www.darwinmag.com/read/030101/influence.html
The Wall Street Journal’s Aaron Elstein echoes this sentiment in his April 17th article Heard on the Net. His investigative reporting confirmed the work done by IDG, and when confronted, was able to get the leadership of these syndicate research firms acknowledge there lack efficacy in their own research. This complete articles can be found on line at: http://interactive.wsj.com/fr/emailthis/retrieve.cgi?id=SB987461281622019063.djm
Industry and Government decision makers increasingly share a nagging fear spawned by the impossible challenge of grasping even a fraction the understanding that they know they need in order to keep their information secure. And even if they could get the necessary information and understanding right now, they know that it’s reliability is suspect to begin with and increasingly less useful day by day. On average, an IT organization expends 12.5% of its annual IT budget on tracking and evaluating technology, and still major IT programs fail at an alarming rate (54% for industry, 75% for government per IDG, CMP and OMB). Adding to the waste is the tremendous difficulty most organizations have in executing enterprise purchasing agreements that support their strategic architecture directions. Without an architecture view, or an understanding of COTS combinitorics (what works with what), reliable assurance cannot be expected.
Only now are the metrics justifying migration to secure internet infrastructure being documented. Preliminary analysis shows a significant return on investment, and reduced cost of development (5/1) versus traditional client/server 2-tier computing. Early adopters have shown that COTS information assurance and the Internet together reduce infrastructure costs compared to stovepipe approaches. A major challenge is in developing an interoperability road map to get from the "as-is" state to the "to-be" state. The lack of a roadmap or of metrics is a primary stumbling block to acceptance. The Interoperability Clearinghouse (ICH) initiative proposed in this document is a feasible approach for solving these problems. In particular, the ICH would automatically guide IT users through the maze of standards and product data into customizable interoperability roadmaps directing industry toward interworking products for the enterprise.
Unless industry can find a way to collaborate more effectively in sharing implementation best practices, the solution to this multi-faceted problem requires a significant investment in internal IT research and testing. But thanks to investments from both industry and government, industry has found a way to effectively share implementation and best-practices knowledge through the Interoperability Clearinghouse (ICH). The ICH was conceived in 1996 as a joint government/industry consortium where standards groups, software vendors, solution providers and practitioners could "publish" their respective offerings and implementation experiences for the benefit of all. By leveraging the Internet, emergent knowledge management and portal technologies and new architectonics techniques, this information can also be self-validating.
The Interoperability Clearinghouse: Bridging the Knowledge-Base Gap
In 1996, a non-profit 501(c)(6) corporation was conceived to provide industry the necessary mechanisms for dealing with both the complexity and rate of change of IT offerings the internet age brought upon us. With its goal to serve IT suppliers and buyers alike, the Interoperability Clearinghouse (ICH), now provides the forum, methods, knowledge base, and research services to take one of the greatest challenges in making sound and timely architectural choices for E-Business and Secure Information Infrastructure.
Large organizations are especially susceptible to interoperability problems due to the autonomy of departmental system buyers, and the inability to assess the impact of new technologies on the existing infrastructure. It is not surprising that major IT program failures are at an all time high, running between 54 to 70%, with those who can least afford failure leading the pack; the public sector. In 1996, the Clinger-Cohen Act was signed into law, requiring government IT managers to establish better processes for adopting commercial technologies and avoiding the risk of customer software development when possible. However, few mechanisms have been established to help IT program managers actuate this mandate.
IT architects need a better way of keeping up with the rate of technology change, the plethora of offerings. They need information on technology that is based upon in-context information, not guesswork and marketing illusions. They need to map business needs to known solution sets!
Enterprise architects need a means of determining what is the mainstream of technology from many perspectives, but cannot afford the time, energy and cost of extracting the "gems" of knowledge from each. The ICH facilitates this collection of data by establishing collaborative relationships with those organizations who are contributing to one or more of the enterprise puzzle pieces, and help bridge the gaps between these disparate value chain providers including the following;
Beyond just information gathering, there are deeper critical issues for any IT organization that also must be addressed:
In most cases, third-party interoperability knowledge exists. Somebody outside of your organization has already invested and discovered the answers. In fact, most organizations expend 12.5% of their IT budgets for in-house product insertion testing. The interoperability and compatibility answers may be found at the company across the street or right around the corner on the Internet. This is the gap bridged by the Interoperability Clearinghouse (ICH).
The ICH’s Architecture Baseline, Mentoring, Validation and Immersion Programs are designed specifically to help IT decision-makers build successful architectures based on third-party-proven evidence.
Acquisition of IT architectural components is challenge enough for IT decisions-makers in our rapidly changing IT market. Gathering information and keeping up-to-date with the necessary knowledge of architectures, standards, and products in an unbiased, in-depth form, goes way beyond the internal capacity for most IT shops. Moreover, without accurate information for selecting products and configurations that fit the target architecture, risks can be substantial. For every technology acquisition, one needs to resolve several key issues:
To answer these questions usefully, the ICH must necessarily remain an "honest broker" of IT understanding. The ICH represents a real-time collective of just-in-time (JIT) IT architecture guidance based on the real-world, third-party, best practices of right now. The ICH is a self-updating, trustworthy resource, organized such that IT decision-makers receive the knowledge and in-depth IT understanding they need, in its specific context, for sound planning, decision making and proactive action that will stand the test of time.
The Problem: Keeping Up with the Rate of IT Change
Facing the IT challenges described above, IT decision-makers need to leverage the best of current IT technology offerings and maximize productivity and capability while not wasting existing legacy investment.
Furthermore, as IT architectures evolve into secure distributed networked environments, they encounter a new set of technical challenges for the systems engineering process. These challenges in a modern enterprise integration environment can be characterized by the same driving factors that originally influenced the creation of the ICH evaluation criteria for a constant flux of enterprise technologies. The ICH focus and knowledge base addresses standards, products and implementation services for the following components of an integrated digital environment for e-Business and secure information infrastructure;
IT decision-makers are in critical need of a formalized, success-based methodology for defining enterprise architectures and a means of keeping these "blueprints" updated. In order to develop and maintain these architecture models, IT practitioners and system engineers need several mechanisms to deal with the inherent complexities of these models and a way of keeping up with the rate of change;
After years of research, the combined work of standards groups, ISVs, solution providers and domain implementers has formed this virtual non profit collaboratory that incorporates these existing puzzle pieces into one dynamic, self-maintaining collaboratory -- The Interoperability Clearinghouse.
Problematic Information Sources
Resolving these issues presents a challenge because most of the information available for such decisions is located in marketing communications, a source known for "stretching" functionality assertions. Furthermore, periodicals and research organizations often use this questionable source of information for their reports. Diligence, therefore, precludes basing IT decisions upon marketing information and press releases.
What is needed is unbiased, factual information, based upon hard experience, testing results, and implementation successes -- third-party evidence of proven and interoperable technology selections that have worked in other environments similar to a given procurement’s architectural context. This is exactly the role filled by the ICH as a mentor and honest broker.
Supply Chain Collaboration: A Lexicon for Knowledge Management
The critical information to most of our most pressing questions already exists within vertical industry IT supply chains. To facilitate the bridging of these knowledge gaps, "owners" of these knowledge sources need only to agree on the lexicon by which architectural artifacts are described.
Standards Development Organizations (SDOs) and Industry Associations
Standards, whether de facto or de jure, represent the "blueprints" by which technology is defined and agreed upon. Since most standards organizations cannot identify or advise on optimal implementations, a mechanism is needed to link business requirements with standard specifications with product implementations. By creating a lexicon or meta-model of these interdependent standards and technologies, systems architects can incorporate these disparate architectural artifacts into optimized enterprise-solution models. Thanks to advances in collaboration technologies, these lexicons can enable the development of enterprise architecture models by domain.
In the same vein, Industry Associations provide a valuable forum in defining domain architectures. These groups can leverage existing validation efforts to keep its membership up on technology developments and successful implementation strategies.
Advancements in architectonics (the science of architectures) provide specification approaches for defining these models. IEEE 1471 provides much of the nomenclature, while ISO’s Reference Model for Open Distributed Processing (RM-ODP), provides the different views for rendering these models. Successful application of these architecture methods can be found in the TINA-Consortium and Object Management Group's Object Management Architecture (OMG OMA).
Participation Options:
Independent Software Vendors (ISVs)
One of the greatest challenges for many ISVs is communicating their unique capabilities in this fast paced, ever changing market. Supply chain partners' attempts to articulate these solution offerings into a standards-based architecture model compounds this problem. The recent surge in industry portal efforts provides evidence of industry’s most recent attempt to deal with these complexities and to collaborate. However, the best proof of viability and applicability is past performance. So how can an ISV model these past successes in a re-useable model for both Solution Providers and Domain Implementers?
Participation Options:
Enterprise Solution Providers (ESP)
System integrators, solution providers and independent testing labs feel the greatest pressure of keeping up with the rate of technology change and the increasing complexity of developing secure and interoperable solutions for industry. Thus, the problem is two-fold;
By using the predefined ICH lexicon, ISVs and enterprise solution providers can collaborate to validate their architecture piece parts (COTS products) and interoperability connectors while also articulating their unique capabilities using ICH domain-specific architecture models. By architecturally collaborating in this way, supply chain partners can accelerate the rate of technology adoption while at the same time minimizing the necessary internal validation resources needed to support their enterprise customers.
The crushing demand for reliable, in-context architectural product specification data is a primary motivator for technology domain implementers (corporate users). It is appropriate, therefore, that the IT industry, whose services these users invest in, finds better ways to articulate how their disparate technologies are used to serve corporate users' IT needs. The "blueprints" by which these artifacts are defined comprise systems architectures. It follows therefore, that in this era of greater collaboration, SDOs, ISVs, and ESPs must work more closely together to help reduce the cost, time and risk of defining these enterprise solutions for E-Business and Secure Information Infrastructure.
Integrating the IT Solutions Supply Chain
Since the supply chain partners are motivated to share information, and validation cycle time is the enemy of the process, a neutral clearinghouse where these architectural artifacts can be rendered and maintained is a critical need. With the advent of web-enabling technologies and knowledge management tools, the practicality of filling this void can finally be resolved. Together with the Interoperability Clearinghouse as the honest broker of these architectural artifacts, the IT industry now has a means of reducing the cost, risk and time of building enterprise solutions.
The Interoperability Clearinghouse: An Honest Broker for IA Solutions
The Interoperability Clearinghouse (ICH) provides validated and architecturally relevant answers on appropriate emerging technologies. The ICH is a consortium of standards development organizations (SDOs), Independent Software Vendors (ISVs), solution providers (and integrators), commercial developers, and domain specific practitioners focused on reducing the chaos in the IT industry. This ICH collaborates on defining enterprise architectures based on best commercial practices. The goal of this consortium is to bring maximum value to the IT architect by providing timely information resources to the IT implementation team. Through the ICH, top architects and systems implementers are pooling their resources to make e-commerce and distributed network computing a reality. The ICH delivers validated and interoperable enterprise architectures, based on best practices and validation data synthesized from reliable testing and implementation experiences. The ICH collaborative validation model provide the key ingredients for coping with the rate of technology change, and the means of configuring secure and reliable solution. The entire IT supply chain is served by leveraging one or more of the following ICH Membership services;
Through the ICH, leading industry IT providers bring the best of commercial practices to bear in the delivery of IT solutions for business challenges. IT implementers can get the facts about technology standards, product offerings, and implementation services through a non-profit solutions consortium that provides value. The ICH has the flexibility to engage industry’s best and brightest so organizations can learn from success and avoid previous documented failures.
For industry to succeed in coping with the fast paced Internet age of rapidly changing technology and increased user demand, it must refocus IT efforts back on technical architectures as a way of reducing complexity and risk, while creating a mechanism for unambiguously communicating technology choices. Industry is already struggling with the ten-fold increase in technology offerings and the multitude of functions and interfaces each of these bring. To cope and to survive, industry must collaborate on its technology research and validation efforts, because there is just too much investigation required for any one organization to deal with. The Interoperability Clearinghouse provides a neutral collaboratory, with the tools and technique needed to facilitate dynamic exchange of technology research and validation effort artifacts.
In facing the daunting rate of change in today’s IT marketplace, industry practitioners need an honest broker who:
The ICH is that honest broker, and through its membership, IT practitioners gain the advantage of real-world, third-party-validated expertise, viewed from within their specific context. With this resource, long-term IT decision-makers can make architectural calls that will stand the test of time because they are based on the shared combinatorial successes of others. As we move forward with this new computing paradigm, we invite those open systems advocates to show their colors, and join this collaborative industry initiative. Together, we can help IT get "From Architectures to Implementation Reality".
The Interoperability Clearinghouse network may be accessed through the following:
The Interoperability Clearinghouse
904 Clifton Drive, Alexandria, VA 22308
(703) 768-4975 (voice) - (703) 765-9295 (fax)
email: info@ICHnet.org
web: www.ICHnet.org
The brand for Enterprise Users where failure is not an option:
