I’m republishing here an interview I originally did for BPM Delivers quite a while ago – but updating it with further comments which are in italics. Strangely, not much has changed.

Question 1: In Delphi Group recently surveyed 110 firms about their 2006 investment priorities. The top three responses were related to Service Oriented Architectures (SOA) and Business Process Management (BPM). Is this a hype or a real trend?

Answer: The trend is real. A number of major organizations that I’ve talked to – mostly in the financial sector – have multi-year projects running in these areas. As time passes the number of such companies just grows. In my view BPM ceased being hype in 2004 and SOA ceased to be hype in 2005. Those were the years when I noticed genuine benefits being delivered to IT users by these respective technologies (neither of which, by the way, are mature).

Comment: Now, of course, there’s no question. All the questions are about the maturity of the technology mostly from the sudden discovery that there are lots of technology gaps that need to be plugged. Now we’ve moved into a software world that is driven by components, engines and platforms. It’s the world of SOA whether it’s good SOA, bad SOA, or so what SOA.

Question 2: What is your personal definition of the two approaches?

Answer: Technically, BPM is the marriage of work flow with web services. It is a business process designing and building capability that empowers business analysts. The important point is that you can design and implement end-to-end processes utilizing existing business applications and adding new business logic where necessary.

As for SOA, I like to think of BPM as the tip of the iceberg with SOA being the iceberg. SOA embraces BPM because it is the architecture that best enables BPM. But SOA also orchestrates the IT infrastructure and delivers sustainable IT service levels. If you want a definition, try this: SOA is an architecture for building business applications as a set of loosely-coupled black-box components orchestrated to deliver a well-defined level of service.

Comment: There’s nothing to add. The SOA definition here is the one we used in SOA for Dummies and it has legs. It’s now used everywhere.

Question 3: How do they relate to each other? Is there success for one without the other?

Answer: I answered the first part of this in the last question. So, could SOA be successful without BPM? In theory it could, but SOA does so much to enable BPM that it is difficult even to imagine any organization implementing SOA without BPM. Why would anyone do that? It would be like building a boat and not sailing it anywhere.

Can BPM be successful without SOA? Well, to be honest, it could. Some of the workflow and document management systems of the past could be called BPM-without-SOA. The problem is that without SOA you end up over-investing in technology and ultimately you run into scalability problems – and actually many other problems too. No-one in their right mind would implement BPM without planning to implement SOA at some point. Mix a lot of BPM with too little SOA and you will surely have a mess on your hands.

Comment: We’ve moved on a little here I think. Now everyone sees BPM and SOA as brother and sister.

Question 4: What do you consider the greatest myth about BPM and SOA?

Answer: There are a number of myths surrounding BPM and SOA. Choose your favourite. All are equal, but some are more equal than others.

• BPM and SOA are just marketing terms. Not so, but they are terms that do seem to confuse marketing people.
• BPM mandates rules-based software development. Only if you’re a salesman of rules-based BPM tools.
• We can do BPM with the software tools we’ve got. And you can fell a tree with a hammer rather than an axe, but it takes a lot longer and it’s not clever.
• SOA is just Object Orientation with a new hat on. Not so. It’s got a new wardrobe entirely and it’s had surgery.
• SOA is like sex with aliens, you hear reports but there’s no evidence that it happens. Actually, close encounters of the third kind do take place.

Comment: Nobody would now dispute that SOA really happens and happens in your back yard. The jury is still out on sex with aliens.

Question 5: What are the most difficult steps within a BPM project – and what makes a SOA project tedious?

Answer: The most difficult steps within a BPM project are the early ones. The problem is cultural. As a fact of business history and IT history, all organizations are siloed. Hell, I know it’s a cliché and a platitude, but its also true. The siloed nature of organizations is ingrained. You have to get people to think end-to-end rather than silo. This means everyone, the business folk and the IT folk and any other folk who happen to be around. The IT folk are siloed too, you know. You need to “get their minds right” because with BPM you need cross-discipline teams who don’t indulge in turf wars.

As for SOA projects, I don’t believe one should even think in terms of implementing SOA as a project. SOA is a road and it’s a road that everyone will ultimately have to take, because it’s the road that the IT industry has already taken.

Is there anything tedious on this road? Yes there is; turf wars and inadequate technology.

Comment: It’s still true. It’s still the case that the cultural problems are the biggest block to SOA.

Question 6: What best practices do you recommend to organisations looking to initiate a BPM / SOA project?
I could write a book about this, in fact we did write a book; SOA for Dummies. So let’s just pick two things that I believe to be critically important:

Answer: Get sponsorship right from the top. There are many reasons why this is necessary, because SOA and BPM usually cause significant changes to an organization.
Also pick an easy first target. Make sure to go for low hanging fruit on the first project. You know what I mean, low risk, high benefit. You really don’t want the first project to stall in any way.

Comment: Now I would add, that you should look to implement comprehensive Identity Management as soon as possible and also go after coherent Asset management. The big note on the wall shoudl read: “It’s the plumbing, stupid.”

I was interviewed by email, by Alejandro Torres Duran for an article to be published in a Mexican IT magazine or newspaper. This is a script of the interview.

ATD: How did you conclude that antivirus software would come to an end?

RB: What happened was that I came across a security company called SecureWave (about 3 years ago) that had an alternative approach to stopping malware – called whitelisting. After technical discussions with that company I concluded that the standard approach taken by AV companies (signature recognition) was wrong and doomed to be ineffective. I therefore began the AVID (Anti-Virus Is Dead) campaign to let everyone know that AV technology was ineffective and there was an alternative. As it happens there are now many companies with alternatives (Bit9, AppSense, etc.)

ATD: So, does this mean the end of the antivirus companies as we know them today?

RB: Not exactly. It would be the end of AV technology based on signature recognition. The AV companies have collective revenues of around $4 billion from AV software and they have a massive customer base. It will take a while for current AV technology to fade away. They have all the time they need to change their technology, and most of them have enough funds to invest in a better approach.

ATD: What do they have to do?

RB: They need to adopt whitelisting as a foundation for software authentication. Whitelisting is simply the holding of a database of authenticated software – software that is known to be valid and can do no damage. Technically it is more complicated than that, but that’s the basis.

You can think of it like this. Who do you let into your house? The approach of AV technology is to let anyone in who is not known to be a criminal. The whitelisting technique is to first let in those who you know are not criminals (friends and family) and to keep a close watch on those you let in who you don’t know, throwing them out if they do anything suspicious. When you think of it like that, it is obvious which is the best approach.

ATD: Do you have an idea about how the new approach will work for them?

RB: This is already clear. They will simply upgrade their technology. Some AV companies have already adopted whitelisting, partly because of the AVID campaign, and there are others in the process of doing so. The first of the AV companies to do so was CA. Then Symantec followed them and recently Kaspersky announced that it would be using whitelisting technology in its next release. I’m also expecting Trend Micro to do so fairly soon.

ATD: Are they all aware of the problems with AV technology?

RB: They are all aware. I have had discussions with some of them. They are aware that signature based techniques are ineffective. They have known this for years. They even invented a term for viruses that they couldn’t stop. They called them “zero-day threats”, pretending that they were something really sophisticated that had not been met with before. But “zero-day threats” were simply new viruses.

ATD: Why do you think we’re moving to the end of antivirus?

RB: The antivirus approach is now broadly acknowledged to be inadequate. But there are also other reasons. As we move forward we can see that the way software inter-relates is getting more sophisticated. In a world where one program rarely needed to connect to another program there were fewer security dangers. But now we have the trend to Service Oriented Architecture (SOA) with companies building whole architectures for connecting programs together.

We also have the emergence of mash-ups, programs which connect different software services together. In this new world software authentication becomes not only important but necessary. Without software authentication none of this will be secure. AV technology is NOT software authentication and it never can be. Whitelisting is the only known technique that will work.

ATD: Will the new kind of approach for securing pc’s and servers be less profitable. Are companies waiting to the last moment for changing the way they way they work for that reason?

RB: I don’t think that software authentication (whitelisting) is likely to be less profitable. It works in a different way and it can replace AV technology. It is possible that it is a big opportunity for AV security companies. The security workload is increasing not decreasing. However, it takes time to change. In a few years time all AV companies will probably have made the change.

ATD: Do you think that AV companies knew that there were better ways to keep information secure than antivirus software, but since it was a very profitable business, the AV companies kept the same business model? (I ask this because there are rumors about the antivirus companies actually developing the viruses themselves)

RB: I do not believe that the AV companies developed viruses to boost their own businesses. There are too many Black Hats (hackers) for them to need to even think of doing that. There are government “agents” and many criminal gangs that need to develop viruses for their own purposes (theft, espionage, etc.). If AV companies ever did this (which I doubt) there is no need for them do so now

Sixto Ortiz Jr., a journalist writing an article for Processor Magazine, pinged me with a set of questions on SOA Security. Here are the questions asked with answers – for the benefit of those who won’t get to read Processor Magazine.

1. What are the main security issues that can occur in an SOA environment?

The fundamental issue is one of authentication. This has two aspects:

1. Typically, within an organization, users are enabled to use specific applications or parts of applications. With SOA you no longer think in terms of applications but of services and end-to-end processes – and you build end-to-end processes. This means that the application security mechanisms that were in use prior to SOA are unlikely to work, because an end-to-end process is likely to involve multiple applications and each could have different user security mechanisms. In other words, the old security mechanisms are unlikely to work under SOA. The antidote to this problem is to implement a capable Identity Management system that has sophisticated provisioning capabilities.
2. With an ID Management system, users can be authenticated and have capabilities provisioned to them and this solves the first problem, but it doesn’t solve the “boundary problem”. The boundary problem occurs when one of your processes within your SOA wants to interact with a process in someone else’s SOA (could be another department or another company). Here we have a situation of software taking to software but each side must have a real (or implied) user behind it that has the authority to carry out certain activities.

Then you need to authenticate that:

• the software that you connect to really is the software you’re intending to connect to.
• that your user has the authority to make the connection and carry out the activities that the connection enables.
• that the other user you’re connecting to has the authority to connect to you.
• that the other software is only given the level of access that has been agreed.
• that everything happens according to a defined policy including disconnection and clean up.

2. What are some examples of potential problems?

As these issues are fundamentally about authentication the potential problems that can arise, if you don’t bring them under control are legion. For example; your users may do things they are not authorized to do in your systems or in another company’s systems, you may connect to rogue software which destroys data or commits a fraud, etc.

3. Why do these security issues occur in an SOA environment?

Put simply, the answer is:

1. Because current software environments never implemented a coherent authentication mechanism either for users or for software itself.
2. Because SOA integrates multiple software components from multiple environments and thus carves out paths of software activity that never previously existed and for which no security mechanisms are set up.

4. What security mechanisms do enterprises need to put in place to counter the security issues that could occur in an SOA environment?

As a basis they need

1. Identity management
2. Asset management and authentication for all software (including any software that is connected to outside the organization)
3. A system for exchanging security tokens which can act as credentials with other SOA domains.
4. Logs of user activity

5. What should administrators do in order to ensure security issues are addressed when developing their SOA infrastructures?

Implement security mechanisms using the technology described in 3. above. If this is not possible then, for the time being implement perimeter security around the SOA domain and allow no connections outside that domain. Also be sure to log all user activity.

6. Anything you’d like to add

This is not the whole story as, for example, it does not secure the environment against unauthorized use of computer resources or unauthorized access to specific data. Stirring those into the mix makes SOA security even more complex – however those are problems that exist with or without SOA.

The background to this interview is that I was making a presentation in Spain to the II International Walqa E-business Meeting in 2002. The organizers interviewed me so they had some extra content to publish in the proceedings.

Q: You have compared the appearance of the Internet with the appearance of the printing press. Do you believe that current society is already aware of the advantages that can be gained from the new technologies that have emerged?

RB: I currently believe that society is very far from realising what is possible and indeed business is also quite a way from realising what could be achieved. There are very good reasons for this and it makes sense to pursue the analogy of printing to consider this:

Printing was the first information technology that proliferated widely. Indeed printing caused reading and writing to become a common skill over time. In the same way computers and the Internet are making typing, email, surfing and quite a few other things into common skills.

Printing also had other major impacts. It completely destroyed the central control that the Roman Catholic Church had established over Christian doctrine, because suddenly people could print their own Bibles. It made the central control of any kind of knowledge very difficult to impose.

One consequence of the Internet is that information is proliferated far more quickly and there is a much greater amount of feedback possible from those who receive information. Nowadays when you introduce a new idea you get instant feedback. Journalists and even writers and researchers like myself are unable to avoid feedback whether it is critical or not. Everything develops much faster and we have not yet become accustomed to this change of speed.

Also there are many developments that have yet to occur and will not occur until the Internet evolves a little further. Bandwidth availability, for example, is constraining the development of video based business ideas and particularly e-learning, which on its own will constitute a revolution.

Q: After the collapse of the dotcoms, have companies lost confidence in the Internet or is confidence reviving?

RB: The dotcom collapse was in some ways a healthy economic development – but it is also a cause of delay in the onset of a number if new technologies and developments which will have a revolutionary impact on the way that businesses work and individuals behave.

Dealing with the positive side first, a whole number of business experiments were taking place on the Internet and the dotcom collapse brought many of them to a quick conclusion in one way or another. It forced many web sites to prove that they had viable business models.

Thus it is clear that the ISPs have a genuine business model even if Yahoo and AOL no longer look as healthy as they were. Ebay has proved that on-line auctioning is a real market, but has also demonstrated that there is not room for many on-line auction houses. Amazon has demonstrated the viability of e-retail for easily packaged items such as books, CDs and videos. A whole host of other retail sites have demonstrated the e-retail is a viable market.

Next Page

Continued….

However now that the promise of getting rich quickly is no longer there, most companies are taking time in developing their use of the Internet and being cautious. The statistics still indicate that e-retail is growing at above 60 percent per year and that the population of Internet users is still rising at over 100 million people a year.

For most companies an Internet presence is absolutely necessary, but many companies have slowed their efforts in the light of the dotcom collapse. At the moment there is no strong driving force to lend urgency to their efforts and we do not believe that one will arise until wireless Internet access develops.

The problem here is that the 3G auctions have made access very expensive and at the same time, most of the wireless operators are performing poorly (in financial terms). The use of mobile technology has not gone much beyond phone calls and text messages, but when it does a whole series of business developments will occur that will drive many companies forward. The most important of these will be the use of mobile technology as a mechanism for payment.

Q: You advocate the use of the Internet as a means to capture new customers and keep them loyal and also to differentiate from your competitors. But in large firms is it not the case that customers feel distanced from their suppliers when the relationship is managed through the Internet. Is it not a fact that communication through a computer is colder and more distant?

This is a correct observation. Computer communication is cold and distant compared to what it could be. There is a strong technology factor involved in this. Quite simply voice technology and video technology have yet to become a direct part of the Internet interface.

The point here is that currently there is little that a company can do to improve the coldness of the Interface because both voice technology and video technology demand high bandwidth – which most customers do not have – and the integration of these technologies also needs to go through a period of development before it becomes clear what is possible.

In reality, the coldness of the Interface has more to do with the lack of direct visual interaction and sound interaction with the computer than with the lack of human-to-human contact. In time people will become used to a richer interface and it will become clearer which types of interaction can become automatic human-to-software interactions and which need to be human-to-human.
Inciedntally, it is not easy to predict this ahead of time. It has already been discovered for example that if people are receiving phone-calls in respect of debt chasing, they prefer to talk to an automated voice system than a real human being. Naturally there is also a cost factor involved in this. Human beings cost more than software.

< Previous | Next>