Why run SAP HANA on Power
http://www-03.ibm.com/systems/ae/power/solutions/bigdata-analytics/sap-hana/
Tuesday, April 4, 2017
Why run SAP HANA on Power
http://www-03.ibm.com/systems/ae/power/solutions/bigdata-analytics/sap-hana/
Tuesday, January 24, 2017
UK.gov still drowning in legacy tech because no one's boarding Blighty's £700m data centre Ark
https://www.theregister.co.uk/2017/01/23/untying_the_government/
UK.gov still drowning in legacy tech because no one's boarding Blighty's £700m data centre Ark
Little love for Crown Hosting from Whitehall depts
Analysis Only in IT is “legacy” a pejorative term, where it is used to condemn ageing systems and forgotten workarounds.
In the UK government, as with banks, increasingly difficult-to-maintain mission-critical systems are a huge problem. Not least because of the dwindling number of folk who remember how the damn things work.
One solution to Whitehall’s myriad string and sticky-tape systems was the creation of the Crown Hosting programme in 2015. That was intended to house departments’ legacy systems in facilities run by a joint venture of which the government owned 25 per cent and small data centre biz Ark the remainder.
By “lifting and shifting” all the legacy systems and housing them in one data centre, it was hoped replaceable systems could be identified, contained and run at a much lower cost – with the eventual plan to ditch them entirely.
But since it was announced, that programme has gone eerily quiet.
The Register whipped out the Freedom of Information Act to ask for a list of public sector bodies that have signed up to the arrangement. However, we were told the Cabinet Office could not disclose the customer list for this commercial arrangement because “authorities could be targeted by individuals or groups willing to use malicious or other hostile ways to gain unauthorised access to information (sensitive or otherwise) stored at colocation sites.”
One can’t help wonder why the UK government bothered to announce the deal at all: it was supposedly meant to contain all of government’s data centre estate via Ark's two data centres in Farnborough and Corsham in a deal worth up to £700m.
But there could be another reason why the Cabinet Office veiled the project under a cloak of invisibility (beyond that being its usual modus operandi). According to numerous sources, uptake has so far been extremely low.
One source revealed that the Department for Work and Pensions had intended to shift 250 of its systems to the data centre, but is now migrating just five. That was part of the department’s mega £340m hosting services refresh to tackle its ageing infrastructure. In this instance, the department had hired hundreds of contractors to help it virtualise the current platforms onto the new kit.
Reg readers are welcome to ponder the plausibly of a government project of that size being ahead of schedule. Nevertheless, it’s possible some of the systems have been refreshed.
One source told us: “My guess is that it will be the Customer Information System (CIS) that is moving as IBM were already commissioning a replacement [CIS] at Corsham & Farnborough, currently hosted on ancient Sun E25k frames, which have caused serious outages [of] Critical National Infrastructure due to hardware failures.
“Therefore it would it make a lot of sense to put these together in the same data centres. Moving CNI systems to Ark should be a lot more secure."
One contact said part of the problem with Ark for government use was the fact that some of the departments’ legacy kit won’t fit in its racks, while in other cases the hardware is partly or fully owned by a system integrator – making it difficult to shunt their kit somewhere else.
Another said the problem is that the government knows little about its old systems – citing the Home Office’s 1995 Casework Information Database (CID) as an example – and has been patched many times in haste and changed only when legislation requires.
"There probably isn’t anyone who really knows how it works. Worse, CID isn’t just ‘CID’ – it’s a system that interacts and exchanges data with dozens of other systems, some inside the immigration department, some in the rest of the Home Office and some across government. So when you move ‘CID’ you are moving a living thing.
“Many of these systems don’t even have true disaster recovery – the ideal option would be to move the disaster recovery (DR) to the Crown Hosting site and fail over to it, so avoiding lots of hassle. But in the 1990s and 2000s government tended not to build real DR (in the sense of active / active or even active / near active).”
As a sidenote, the CID system was to be replaced by an Immigration Case Work (ICW) system in December 2008 by IBM that was intended to support applications for visas and immigration. However, the department was forced to write off £347m in 2013. The National Audit Office noted in 2014 that the CID system is plagued by problems such as freezing, a lack of interface with other systems, and a lack of controls.
According to one of our sources, the Home Office is still working on its Ark transition, building a couple of environments there for production services, but have yet to move anything. “I’ve done a lot of hosting moves in my time and, unless the folks doing it have also done a lot, they will massively underestimate how hard it is, especially if the hosting and the apps people are separate companies,” a contact told us.
For him, a failure to migrate the legacy kit comes down to "the cost being too big, with a relatively long-term payback, while managing an awful lot of risk, particularly the risk that it just won’t work because you don’t understand how the system works.”
No doubt many poor souls tasked with working out legacy replacements would love nothing more than to pull the plug, throw it in a skip and install something else. But unfortunately when it comes to mission-critical legacy gear, that particular Gordian Knot can’t be cut. ®
In the UK government, as with banks, increasingly difficult-to-maintain mission-critical systems are a huge problem. Not least because of the dwindling number of folk who remember how the damn things work.
One solution to Whitehall’s myriad string and sticky-tape systems was the creation of the Crown Hosting programme in 2015. That was intended to house departments’ legacy systems in facilities run by a joint venture of which the government owned 25 per cent and small data centre biz Ark the remainder.
By “lifting and shifting” all the legacy systems and housing them in one data centre, it was hoped replaceable systems could be identified, contained and run at a much lower cost – with the eventual plan to ditch them entirely.
But since it was announced, that programme has gone eerily quiet.
The Register whipped out the Freedom of Information Act to ask for a list of public sector bodies that have signed up to the arrangement. However, we were told the Cabinet Office could not disclose the customer list for this commercial arrangement because “authorities could be targeted by individuals or groups willing to use malicious or other hostile ways to gain unauthorised access to information (sensitive or otherwise) stored at colocation sites.”
One can’t help wonder why the UK government bothered to announce the deal at all: it was supposedly meant to contain all of government’s data centre estate via Ark's two data centres in Farnborough and Corsham in a deal worth up to £700m.
But there could be another reason why the Cabinet Office veiled the project under a cloak of invisibility (beyond that being its usual modus operandi). According to numerous sources, uptake has so far been extremely low.
One source revealed that the Department for Work and Pensions had intended to shift 250 of its systems to the data centre, but is now migrating just five. That was part of the department’s mega £340m hosting services refresh to tackle its ageing infrastructure. In this instance, the department had hired hundreds of contractors to help it virtualise the current platforms onto the new kit.
Ignore that burning, everything’s fine
At the end of October, several contractors got in touch with The Register to report there had been hundreds of layoffs and hundreds of millions in overspend at the DWP. But that has been vigorously denied by the department. Commenting on the refresh programme, a spokeswoman said of the eight-year SSBA refresh programme: “It is ahead of schedule and has already delivered three large-scale, secured and resilient platforms.”Reg readers are welcome to ponder the plausibly of a government project of that size being ahead of schedule. Nevertheless, it’s possible some of the systems have been refreshed.
One source told us: “My guess is that it will be the Customer Information System (CIS) that is moving as IBM were already commissioning a replacement [CIS] at Corsham & Farnborough, currently hosted on ancient Sun E25k frames, which have caused serious outages [of] Critical National Infrastructure due to hardware failures.
“Therefore it would it make a lot of sense to put these together in the same data centres. Moving CNI systems to Ark should be a lot more secure."
One contact said part of the problem with Ark for government use was the fact that some of the departments’ legacy kit won’t fit in its racks, while in other cases the hardware is partly or fully owned by a system integrator – making it difficult to shunt their kit somewhere else.
Another said the problem is that the government knows little about its old systems – citing the Home Office’s 1995 Casework Information Database (CID) as an example – and has been patched many times in haste and changed only when legislation requires.
Systems from the 1990s
“It uses old versions of everything at every layer of its architecture," we're told."There probably isn’t anyone who really knows how it works. Worse, CID isn’t just ‘CID’ – it’s a system that interacts and exchanges data with dozens of other systems, some inside the immigration department, some in the rest of the Home Office and some across government. So when you move ‘CID’ you are moving a living thing.
“Many of these systems don’t even have true disaster recovery – the ideal option would be to move the disaster recovery (DR) to the Crown Hosting site and fail over to it, so avoiding lots of hassle. But in the 1990s and 2000s government tended not to build real DR (in the sense of active / active or even active / near active).”
As a sidenote, the CID system was to be replaced by an Immigration Case Work (ICW) system in December 2008 by IBM that was intended to support applications for visas and immigration. However, the department was forced to write off £347m in 2013. The National Audit Office noted in 2014 that the CID system is plagued by problems such as freezing, a lack of interface with other systems, and a lack of controls.
According to one of our sources, the Home Office is still working on its Ark transition, building a couple of environments there for production services, but have yet to move anything. “I’ve done a lot of hosting moves in my time and, unless the folks doing it have also done a lot, they will massively underestimate how hard it is, especially if the hosting and the apps people are separate companies,” a contact told us.
For him, a failure to migrate the legacy kit comes down to "the cost being too big, with a relatively long-term payback, while managing an awful lot of risk, particularly the risk that it just won’t work because you don’t understand how the system works.”
No doubt many poor souls tasked with working out legacy replacements would love nothing more than to pull the plug, throw it in a skip and install something else. But unfortunately when it comes to mission-critical legacy gear, that particular Gordian Knot can’t be cut. ®
Wednesday, January 11, 2017
How Mainframes Prevent Data Breaches
As 2017 begins, let's talk about how using mainframes to process and protect data can keep hackers from having another banner year.
2016 was a strange year marked by everything from election surprises to a seemingly endless spate of celebrity deaths. But when historians look back at this mirum anno—weird year—it may end up being known as the year of the data breach.
Of course, this sort of thing isn’t restricted to 2016, but its impact on the world was hard to ignore. Among government organizations, the IRS and FBI suffered data breaches, and corporate victims included LinkedIn, Target, Verizon and Yahoo. Literally millions of people had their private information exposed to black hats, thieves and other ne’er-do-wells of the digital world. This epidemic of data theft calls upon security experts to get serious about creating new solutions.
You don’t need to hack my computer (in fact, please don’t do that!) to discover I’m going to advocate for one piece of established technology in particular: mainframes. The term “Big Iron” conveys strength and security for a reason. Housing all of one’s data in a single, powerful machine lowers the overall vulnerability of that data. Protecting a single mainframe is much easier than defending data spread out to all corners of a company firewall, and it carries the added advantage of the mainframe’s processing power helping to prevent fraud and other malfeasance.
“But isn’t that putting all your eggs in one basket?” I hear you saying to your computer screen. If it were, the basket is incredibly powerful and easy to secure: it’s more a vault than basket. And it’s still a better idea than spreading data where it can’t all be strictly monitored in real time, allowing hackers to sneak in through various weak points. Don’t forget that all of those ETL scripts are exacerbating the issue by making lots of copies of sensitive data and sending it out to more places and opportunities to be hacked.
This is why I strongly recommend keeping your data and analytics together—to reduce the potential breach points. Housing data across multiple systems is a governance nightmare because widespread data gets breached in small clusters all the time, making it hard to track the origin of the hacks.
Blockchain on mainframes
Mainframes also make it easier to implement security measures such as Blockchain to prevent hackers from tampering with the files they access. Created to protect the security of Bitcoin and dark web transactions, Blockchain essentially keeps data from being altered without authorization.
Today, Blockchain is stepping out of the shadows, having been adopted by IBM and financial institutions such as JPMorgan Chase to ensure the ironclad integrity of their data. Experts predict Blockchain will soon help protect patient information in the healthcare system, and from there perhaps facilitate a period of more secure data.
I say “a period” because no safe is uncrackable, no firewall unbreachable, and no system foolproof. Eventually the bad guys will find a way around every new protection. That’s why security experts all say it’s not about 100 percent safety but about making every system as arduous to crack as you can.
Yes, hackers will try to exploit weaknesses in Blockchain or breach the security of a mighty mainframe, but these systems working in tandem can create enough of a roadblock to discourage their efforts, or slow those efforts long enough for security to kick in. No data is ever completely safe, but any data is a whole lot safer in the care of Big Iron.
This Blog by Bryan Smith is re-posted with the author's permission. It was originally posted here.
2016 was a strange year marked by everything from election surprises to a seemingly endless spate of celebrity deaths. But when historians look back at this mirum anno—weird year—it may end up being known as the year of the data breach.
Of course, this sort of thing isn’t restricted to 2016, but its impact on the world was hard to ignore. Among government organizations, the IRS and FBI suffered data breaches, and corporate victims included LinkedIn, Target, Verizon and Yahoo. Literally millions of people had their private information exposed to black hats, thieves and other ne’er-do-wells of the digital world. This epidemic of data theft calls upon security experts to get serious about creating new solutions.
You don’t need to hack my computer (in fact, please don’t do that!) to discover I’m going to advocate for one piece of established technology in particular: mainframes. The term “Big Iron” conveys strength and security for a reason. Housing all of one’s data in a single, powerful machine lowers the overall vulnerability of that data. Protecting a single mainframe is much easier than defending data spread out to all corners of a company firewall, and it carries the added advantage of the mainframe’s processing power helping to prevent fraud and other malfeasance.
“But isn’t that putting all your eggs in one basket?” I hear you saying to your computer screen. If it were, the basket is incredibly powerful and easy to secure: it’s more a vault than basket. And it’s still a better idea than spreading data where it can’t all be strictly monitored in real time, allowing hackers to sneak in through various weak points. Don’t forget that all of those ETL scripts are exacerbating the issue by making lots of copies of sensitive data and sending it out to more places and opportunities to be hacked.
Experiencing DB2 Performance Problems or DB2 Memory Utilization Challenges?
The Buffer Pool Tool for DB2Blockchain on mainframes
Mainframes also make it easier to implement security measures such as Blockchain to prevent hackers from tampering with the files they access. Created to protect the security of Bitcoin and dark web transactions, Blockchain essentially keeps data from being altered without authorization.
Today, Blockchain is stepping out of the shadows, having been adopted by IBM and financial institutions such as JPMorgan Chase to ensure the ironclad integrity of their data. Experts predict Blockchain will soon help protect patient information in the healthcare system, and from there perhaps facilitate a period of more secure data.
I say “a period” because no safe is uncrackable, no firewall unbreachable, and no system foolproof. Eventually the bad guys will find a way around every new protection. That’s why security experts all say it’s not about 100 percent safety but about making every system as arduous to crack as you can.
Yes, hackers will try to exploit weaknesses in Blockchain or breach the security of a mighty mainframe, but these systems working in tandem can create enough of a roadblock to discourage their efforts, or slow those efforts long enough for security to kick in. No data is ever completely safe, but any data is a whole lot safer in the care of Big Iron.
This Blog by Bryan Smith is re-posted with the author's permission. It was originally posted here.
The Unknown IBM i – Part 2
The Unknown IBM i – Part 2
Bob Losey
Certified IBM Advanced Business Partner at IBM POWER (iSeries/AS400) Specialist | IBM i (i5 OS/OS400) Specialist
“COOL” IBM i Technology We Take For Granted That Saves You $85,000 Per Year
Some of you may recall I posted “The Unknown IBM I” blog on August 15, 2016.
It began:
“Many of you may be old enough to remember the Gong Show and the “Unknown Comic” who wore a paper bag over his head. You could not see his face, so you did not know who he really was. That was part of the gag.
“I have a similar tale. Too bad the punchline of this real story is so true.”
Well, here is Part 2.
This last week I was talking to several technology writers. They all have strong Microsoft backgrounds. Besides writing about technology they all had brought technology projects to life.
As I described some of the high-level difference between IBM i and Windows, I was surprised with their amazement that IBM i had an integrated SQL relational database. To them, this concept was stunning.
I further explained that the IBM i single-level storage and data management architecture.
For example, I explained how the IBM i would manage object within the system. Frequently-needed object stayed in memory for fast access. Commonly-used data and program objects are stored on the physical disk units outside edge for faster access. Infrequently-used objects are stored deeper inside the physical disk drive – closer to the center – because it takes the disk access arms longer to retrieve --- which is infrequent.
In this way, the IBM i manages itself for optimal performance. No extra staff is required for load-balancing or system tuning.
Their response?
“COOL!”
I continued. This is more than just “cool” technology. It has REAL economic advantages that too many technical or business people do not recognize.
It saves business money!
How much?
Depending on skill-level and location, a systems engineer earns between $65,000 - $130,000 per year. Most commonly about $85,000 per year. In most cases, this is an IT staff member an IBM i user does not need.
In other words, most small-to-medium sized IBM i users do not have to pay an extra $85,000 per year to keep their server optimally running.
At that point they offered something I had NOT heard before from folks with a strong Windows background.
“If we had that technology in our past projects, we could have deployed our project faster and with far fewer hurdles than we encountered,” they volunteered.
So, these IBM i features would have made project deployment way easier…not just less expensive.
“Yes!” they said.
They explained they could have benefited from the OS-integrated SQL relational data base without setup delays that could range from several weeks to several months.
They would have also benefited from proper SQL setup and system self-management.
So, I asked, you would have been able to bring your technology projects to life faster and with fewer holdups?
“Yes! We sure wish we had something like that.”
Just as these technologists were unaware…and amazed…with the IBM i capabilities, my sense is that most IBM i users and management are also unaware of the extraordinary IBM i features.
We need to educate and remind our teams about what makes the IBM i so exceptional.
So, when someone suggests “we need to get off the IBM i and go to Windows because the hardware is so much cheaper”, we can remind them that they could be paying lots more in staffing, delays, and extra support to minimize disruption, prevent viruses and malware, improve load-balancing.
Cheaper hardware without IBM i architecture may cost LOADS MORE – in staffing, delays and on-going support.
Some of you may recall I posted “The Unknown IBM I” blog on August 15, 2016.
It began:
“Many of you may be old enough to remember the Gong Show and the “Unknown Comic” who wore a paper bag over his head. You could not see his face, so you did not know who he really was. That was part of the gag.
“I have a similar tale. Too bad the punchline of this real story is so true.”
Well, here is Part 2.
This last week I was talking to several technology writers. They all have strong Microsoft backgrounds. Besides writing about technology they all had brought technology projects to life.
As I described some of the high-level difference between IBM i and Windows, I was surprised with their amazement that IBM i had an integrated SQL relational database. To them, this concept was stunning.
I further explained that the IBM i single-level storage and data management architecture.
For example, I explained how the IBM i would manage object within the system. Frequently-needed object stayed in memory for fast access. Commonly-used data and program objects are stored on the physical disk units outside edge for faster access. Infrequently-used objects are stored deeper inside the physical disk drive – closer to the center – because it takes the disk access arms longer to retrieve --- which is infrequent.
In this way, the IBM i manages itself for optimal performance. No extra staff is required for load-balancing or system tuning.
Their response?
“COOL!”
I continued. This is more than just “cool” technology. It has REAL economic advantages that too many technical or business people do not recognize.
It saves business money!
How much?
Depending on skill-level and location, a systems engineer earns between $65,000 - $130,000 per year. Most commonly about $85,000 per year. In most cases, this is an IT staff member an IBM i user does not need.
In other words, most small-to-medium sized IBM i users do not have to pay an extra $85,000 per year to keep their server optimally running.
At that point they offered something I had NOT heard before from folks with a strong Windows background.
“If we had that technology in our past projects, we could have deployed our project faster and with far fewer hurdles than we encountered,” they volunteered.
So, these IBM i features would have made project deployment way easier…not just less expensive.
“Yes!” they said.
They explained they could have benefited from the OS-integrated SQL relational data base without setup delays that could range from several weeks to several months.
They would have also benefited from proper SQL setup and system self-management.
So, I asked, you would have been able to bring your technology projects to life faster and with fewer holdups?
“Yes! We sure wish we had something like that.”
Just as these technologists were unaware…and amazed…with the IBM i capabilities, my sense is that most IBM i users and management are also unaware of the extraordinary IBM i features.
We need to educate and remind our teams about what makes the IBM i so exceptional.
So, when someone suggests “we need to get off the IBM i and go to Windows because the hardware is so much cheaper”, we can remind them that they could be paying lots more in staffing, delays, and extra support to minimize disruption, prevent viruses and malware, improve load-balancing.
Cheaper hardware without IBM i architecture may cost LOADS MORE – in staffing, delays and on-going support.
Tuesday, November 15, 2016
Where Is The ROI To Leave IBM i In Favor Of Another Platform?
Where Is The ROI To Leave IBM i In Favor Of Another Platform?
Bob Losey
Certified IBM Advanced Business Partner at IBM POWER (iSeries/AS400) Specialist | IBM i (i5 OS/OS400) Specialist
Last week I was talking with an IBM iSeries IT Manager. Specifically, we were talking about his IBM 9406-520, the end of IBM hardware support January 31, 2019, and what his plans were when there would be no more IBM support.
Possible Move To New Platform When IBM Support Ends
“Bob, my management expects to move to a Windows solution by the time IBM hardware support is gone,” he said.
I asked what Windows business applications his company was considering.
“We haven’t even started looking yet,” he responded.
Windows-Based ERP Conversion In 2 Years? Not Likely
Sheepishly I asked him how his company could successfully convert from his 9406-520 to a new Windows-based ERP in about 2 years.
He thought it would be very unlikely. He volunteered that over the years he witnessed many companies move from the IBM i/OS400 platform to other systems. He shared several cases where the transition took 5-7 years and huge sums spent before their systems were working. He told me of others that failed and these companies sold out to competitors.
IBM i To Windows Move 5x-6x More Expensive: Software, Hardware, Infrastructure, Staffing
“Bob, what most people don’t understand is that when they move from the IBM i server to Windows, they spend 5-6 times more on software, hardware, infrastructure and staffing than with IBM i. Worse, they are vulnerable to viruses, hacking and ransomware. I am now a 1-man IT shop that supports everything. Moving to Windows will be like Mario Andretti who needs a pit crew to compete. This company will need at least 3-5 more people to manage the new Windows environment. The new environment will be far more fragile than the IBM system we have now,” he explained.
I then asked what this would mean to him when his company moves to Windows.
IBM IT Manager Chooses Retirement Over Windows Project
“I will most likely retire. By that time I will be 70. My company will no longer have an interest in our IBM i system. And, I don’t want to be part of the Windows project which I expect will take way longer than they think, cost far more than they will be told, and not work like they hope. I have seen and heard this story all too often,” he concluded.
I agreed with him. I explained that over the last 20 years, those companies we worked with that moved off the IBM server took between 7-11 years to fully move to something else.
Fortune 1000 ERP Consultant Agrees
I wrapped up the phone call. Afterwards, I called a friend who consults major Fortune 1000 companies to help with software selection and implementations.
I shared with him this recent case of this user’s company planning to move off the 9406-520 to a Windows solution.
Where Is The ROI?
I told him that I must be missing something, but I could not understand the ROI in the decision to make this change.
Straightforward, he said, “Bob, there is no ROI for these kinds of changes.”
What? I was stunned by his blunt response.
Experienced ERP Consultant Explains
I asked, "As an ERP consultant, you have worked with big, successful and global companies. In your experience as a consultant, you say there is no ROI for these kinds of changes. How come?"
“That’s right, Bob. The people who make these decisions don’t understand the differences between Windows server and IBM server characteristics. IBM servers are designed to handle lots of transactions and big databases quickly and efficiently with a small staff. Windows servers can’t keep up with the IBM server capabilities. So, you have to add more Windows servers, which leads to server sprawl. That leads to more complexity and more staff.
“These decisions to move away from IBM i are generally political instead of based on technology or business. There is NO ROI.
Missing Ingredient – IT Education For Management
My friend continued, “What is often missing is the IT team does not educate the management team about their systems. When I was an IT manager, we would have an annual presentation to our management to educate them about the basics – what is a record, what is a file, what is a database, what is a transaction, and how things work. We would also explain how the IBM i managed the system to avoid the staffing issues and the problems common with Windows servers. My management team understood what they had and continued to invest in their IBM i system with confidence – and with an ROI.”
My friend continued, “I think the missing ingredient is IT education. If business managers had a clear idea of technology, their business goals and how to measure ROI, you would not see these types of sweeping changes to move to new systems. I also believe you would have far fewer delayed conversions and out right failures.”
Have questions or want to learn more? Contact me Bob Losey at blosey@source-data.com
Possible Move To New Platform When IBM Support Ends
“Bob, my management expects to move to a Windows solution by the time IBM hardware support is gone,” he said.
I asked what Windows business applications his company was considering.
“We haven’t even started looking yet,” he responded.
Windows-Based ERP Conversion In 2 Years? Not Likely
Sheepishly I asked him how his company could successfully convert from his 9406-520 to a new Windows-based ERP in about 2 years.
He thought it would be very unlikely. He volunteered that over the years he witnessed many companies move from the IBM i/OS400 platform to other systems. He shared several cases where the transition took 5-7 years and huge sums spent before their systems were working. He told me of others that failed and these companies sold out to competitors.
IBM i To Windows Move 5x-6x More Expensive: Software, Hardware, Infrastructure, Staffing
“Bob, what most people don’t understand is that when they move from the IBM i server to Windows, they spend 5-6 times more on software, hardware, infrastructure and staffing than with IBM i. Worse, they are vulnerable to viruses, hacking and ransomware. I am now a 1-man IT shop that supports everything. Moving to Windows will be like Mario Andretti who needs a pit crew to compete. This company will need at least 3-5 more people to manage the new Windows environment. The new environment will be far more fragile than the IBM system we have now,” he explained.
I then asked what this would mean to him when his company moves to Windows.
IBM IT Manager Chooses Retirement Over Windows Project
“I will most likely retire. By that time I will be 70. My company will no longer have an interest in our IBM i system. And, I don’t want to be part of the Windows project which I expect will take way longer than they think, cost far more than they will be told, and not work like they hope. I have seen and heard this story all too often,” he concluded.
I agreed with him. I explained that over the last 20 years, those companies we worked with that moved off the IBM server took between 7-11 years to fully move to something else.
Fortune 1000 ERP Consultant Agrees
I wrapped up the phone call. Afterwards, I called a friend who consults major Fortune 1000 companies to help with software selection and implementations.
I shared with him this recent case of this user’s company planning to move off the 9406-520 to a Windows solution.
Where Is The ROI?
I told him that I must be missing something, but I could not understand the ROI in the decision to make this change.
Straightforward, he said, “Bob, there is no ROI for these kinds of changes.”
What? I was stunned by his blunt response.
Experienced ERP Consultant Explains
I asked, "As an ERP consultant, you have worked with big, successful and global companies. In your experience as a consultant, you say there is no ROI for these kinds of changes. How come?"
“That’s right, Bob. The people who make these decisions don’t understand the differences between Windows server and IBM server characteristics. IBM servers are designed to handle lots of transactions and big databases quickly and efficiently with a small staff. Windows servers can’t keep up with the IBM server capabilities. So, you have to add more Windows servers, which leads to server sprawl. That leads to more complexity and more staff.
“These decisions to move away from IBM i are generally political instead of based on technology or business. There is NO ROI.
Missing Ingredient – IT Education For Management
My friend continued, “What is often missing is the IT team does not educate the management team about their systems. When I was an IT manager, we would have an annual presentation to our management to educate them about the basics – what is a record, what is a file, what is a database, what is a transaction, and how things work. We would also explain how the IBM i managed the system to avoid the staffing issues and the problems common with Windows servers. My management team understood what they had and continued to invest in their IBM i system with confidence – and with an ROI.”
My friend continued, “I think the missing ingredient is IT education. If business managers had a clear idea of technology, their business goals and how to measure ROI, you would not see these types of sweeping changes to move to new systems. I also believe you would have far fewer delayed conversions and out right failures.”
Have questions or want to learn more? Contact me Bob Losey at blosey@source-data.com
Friday, November 11, 2016
time software vendor HelpSystems thinks the future still looks promising for the
 | |||||||||||||
| |||||||||||||
Tuesday, September 13, 2016
The IBMer Who Decoded Bernie Madoff's RPG
The IBMer Who Decoded Bernie Madoff's RPG
Published: September 12, 2016
Published: September 12, 2016
by Alex Woodie
When Bernie Madoff's massive Ponzi scheme collapsed in 2008, erasing $65 billion in supposed wealth, the midrange community was somewhat surprised to learn that an AS/400 was at the heart of the operation. Soon thereafter, FBI agents called Rochester, Minnesota, with a request for IBM: Give us an expert witness who can untangle the ancient RPG II code and explain how it works to a jury. That job eventually fell to longtime IBMer Rich Diedrich.
Diedrich had worked in Lab Services since the early 1990s, back when it was called the Custom Technology Center. While Diedrich has expertise in many areas, including cryptography, it was his knowledge of System/36-era code that got the 29-year IBM veteran the job as the federal prosecutor's expert witness in the trial of Madoff employees Jerry O'Hara and George Perez.
"I have enough gray hair that I could understand the old RPG II code," Diedrich tells IT Jungle. "I was the highest-level application person in Lab Services that did AS/400 kinds of things, as it was referred to throughout the trial."
In August 2010, federal prosecutors working in U.S. Attorney Preet Bharara's office asked Diedrich to fly to New York for a meeting. "I met with the FBI and DOJ lawyers, and basically they showed me some of the code, ask me to look at it, tell them what I saw, and if I wanted to be the witness," Diedrich says.
Diedrich had never been an expert witness in any trial, and wasn't sure what it would entail. Working in Lab Services, he was used to dealing with clients who were clear in what they wanted. The federal attorneys, on the other hand, were cryptic about what they wanted from Diedrich, who had to remain unbiased and objective.
"The DOJ attorneys and FBI didn't tell me what to look for," he says. "They just said, here's the case, you tell us what you want."
Despite the open nature of the request, he agreed to take the job. While Diedrich would spend months deciphering the RPG and OCL code that ran Madoff's Ponzi scheme, he would not receive any additional compensation for the work. The contract between the federal lawyers and IBM gave Diedrich a degree of independence, which the task required.
Random Number Generators
The first time Diedrich took a look at the code for the feds, a few things immediately stood out. For starters, the RPG II code, which dates back to the 1970s, was in surprisingly good shape.
"It really wasn't badly structured, given what it was," Diedrich says. "There were a few things that caught my eye when I was glancing through it, like random number generators in the code that looked a little suspicious."
As Diedrich dug deeper into the RPG II and OCL code, he realized he would need some assistance to reverse engineer two key the programs, which totaled about 2,000 lines of code. "I looked at some of the normal code analysis tools, but none of them did exactly what I wanted them to do," he says. "Given that it was RPG II, OCL stuff, it made it a little trickier to use any of the standard tooling to do the reverse engineering that we needed done."
Finding nothing on the open market suitable for the 40-year-old syntax, he did what any normal IBM i programmer would do: he built the tools himself. "I actually wrote code that parsed the OCL to figure out what was called from where," he says. Then he built a slew of static Web pages that he could use to show the jury how the programs worked.
At the end of the day, he documented how the Madoff code worked using about 20,000 HTML pages. He would eventually use a fraction of these when he testified on the stand in late 2013, when the trial finally began.
A House Divided
As the DOJ's expert witness, Diedrich was asked to understand everything there was to know about the programs Madoff ran on the AS/400. (It's unclear what actual models Madoff used at the time of his arrest in 2008, but it's generally accepted that they were vintage, AS/400-era machines running OS/400 version 5.)
Diedrich was actually asked to analyze programs running on two separate AS/400 used at Bernard Madoff Investment Securities: One from "House 17," which generated reports for the fake trades involved in the Ponzi scheme, and another from "House 5," which did legitimate trading activities.
"House 17 was a fully separate system and it didn't talk to any other computer. It didn't do trades. It just printed out reports that looked like it was doing trading," Diedrich says. "They had written code that basically back-generated the trade. You could end a trade up to two years before whatever the current date was, which makes it much easier to have profits on paper."
When Diedrich used his tools to analyze the House 5 system, he didn't find anything suspicious. The programmers involved in running that system were never charged.
Code Was 'Nicely Commented'
While the reports generated by the House 17 system fooled Madoff's clients for years, it would take a little more work to pull the wool over the Securities and Exchange Commission (SEC). As Diedrich discovered, Madoff's programmers spent a lot of time preparing the House 17 operation to pass SEC audits.
"For the audit, they needed to have counter-trade trades. You needed to have who you were buying from, who you were selling from, the blocks you were buying and selling," he explains. "They had to essentially create all the documentation for the trades. So they had a program that would go out and essentially take a trade and then split it into sub-trades, and then it would go through and generate all the reports of all the trading tickets. They could print them all out."
Madoff not only fooled the SEC this way, but he fooled other banks that invested into his Ponzi scheme. In fact, the programmers used the same code for all audits, but changed the names of trading partners depending on who was doing the audit.
The Madoff programmers, Perez and O'Hara, were tasked with keeping track of all these changes and keeping everything straight, lest the whole house of cards come falling down. So the pair resorted to what any normal RPG programmers would do: They added comments to the code.
"The programmers nicely commented the code, which made explaining some things easier, because they said this is what they're doing," Diedrich says. "The jury didn't have to try to read the code. They said 'This is how we're generating these numbers.'"
Perez and O'Hara also added comments to ensure their audit preparation was up to snuff. "There were comments in the code hat indicated, for this kind of audit we need this kind of information," Diedrich says. "The code would say, 'We don't need this for this audit,' so they commented it out from the code at times, then they would put it back in for the other audits."
Fabricating transaction IDs posed a bit of a problem for the programmers, but they eventually rose to the challenge. As Diedrich explains, they came up with a creative method that was never spotted by auditors.
"One trick they used was they took the hundredth and the tenth digits from the transaction number, moved it over one spot, and subtracted it from the transaction number to get an earlier transaction number," Diedrich says. "That was one of the techniques they used to make up transaction numbers."
But how did Diedrich discover this method? "It was commented in the code!" he says. "Then they gave a simple example in the comment."
Growing Sophistication
As the Ponzi scheme wore on, and with more time on the saddle, Madoff's programmers got better at their jobs of fabricating an actual trading system, according to Diedrich.
"Over the years I could actually see how they had improved some of the random number generators," he says. "At first they used really simple ones. Then I could see where both programmers--in the same month actually--started using a more standard linear congruential random number generator. You could see the code being added. They got more sophisticated over the years."
Like most AS/400 shops, Madoff Securities protected its business by backing up data to tape. The FBI brought the backup tapes to Rochester for Diedrich to inspect, which gave him another view on how the code changed over the years.
"In April of 2006, they went through and deleted the special programs," including many starting with the letters SPCL. "They essentially wiped them all off the system. Something caused them to essentially delete all the special programs and some other programs on the system."
While it's not clear what caused somebody to delete the programs, that mere act actually helped Diedrich zero in on SPCL1K, which was the latest version of a key program used to perpetrate the massive fraud (the letter "K" represented the 11th version of that program). "It actually made it easier for me to figure out which programs to focus on," he says. "I'm going to be more interested in the ones that were deleted."
Conviction and Sentencing
In late 2013, after years of delays, the trial of Perez, O'Hara, and three other Madoff associates, including Daniel Bonventr, Anette Bongiorno, and Joann Crupi, finally began. Diedrich spent two-and-a-half days on the stand, including two days under direct examination by Bharara's prosecutors, and a half-day under cross examination by the defendant's attorneys. His testimony was limited to his analysis of the code maintained by the RPG programmers, Perez and O'Hara.
During cross examination, the defendant's attorneys asked Diedrich whether the programmers were just following orders, and if it was possible they didn't understand the scope of their actions.
"The impression I got was that the programmers understood the code, and that this is what it was doing, and what it was written to do," Diedrich says. "Random number generators and SEC audits indicate you're probably doing something wrong. You can be prosecuted for that, and these guys were."
Perez and O'Hara were found guilty for their role in the fraud, and were sentenced by U.S. District Judge Laura Taylor Swain to two-and-a-half years in prison, which was the minimum sentence. The prosecutors expressed dissatisfaction with the light sentence--it was even lighter than some defendant's attorneys had requested--but the judge was clearly swayed by defendants' position that they didn't understand the scope of what Madoff the mastermind was doing.
In any event, Diedrich found the experience worthwhile. "The whole thing was very interesting," says Diedrich, who has since retired from IBM. "It was a brand new experience for me. It was fun."
Diedrich is now working as an independent consultant with his company, Rich Diedrich Consulting, in Rochester. He's focusing a lot on application modernization, but don't ask him for help with System 36-era code. "I don't want to do RPG II anymore," he says. "I'm into the latest RPG and how do you use it effectively."
Diedrich will be sharing his experience as the DOJ's expert witness in the Madoff trial this fall at the COMMON Fall Conference scheduled to take place next month in Columbus, Ohio. His session, "RPG Programs Used by Madoff," will take place at 8 o'clock on the morning of Wednesday, October 26--the same day that O'Hara and Perez become eligible for early release.
RELATED STORIES
http://www.itjungle.com/tfh/tfh091216-story01.html
Subscribe to:
Posts (Atom)