Virtual press room – This is where you can find press releases and official Novell news from BrainShare Amsterdam.
General show info – Check out the BrainShare page on Novell.com for general information, schedules and much, much more.
Facebook – Come join the conversation, post pictures, and share entertaining stories in the BrainShare group on Facebook.
Novell News Blog – We'll be blogging live from the show about the latest in the world of Novell.
Twitter – We’re expecting a large group of attendees “tweeting” live from the event. For power “twitterers”, we’ll being using the hashtag #BrainShare.  If you don't use Twitter, it is easy to follow along on TwitterSearch.
Slideshare – During the show, we’ll be posting a sampling of slides from the sessions on Slideshare .
YouTube – Our fun and informative videos will be featured on our YouTube channel.
Novell OpenAudio – Stay tuned to our OpenAudio channel for podcast interviews with BrainShare speakers as well as Novell's customers and partners.

Please feel free to connect, comment and share!

Here are five cool things you can learn at Linux Day:
1. The latest technology — See live previews of SUSE Studio and SUSE Linux Enterprise 11 Service Pack 1 (due to ship in the next few weeks).

2. Actionable strategies — Learn proven strategies to get the most out of Linux in your environment …  secure it, manage it, and learn about high availability and disaster recovery.

3. The answers to your toughest questions — You'll get direct access to our Linux experts, so bring your questions. In addition to quality time with the our specialists, you’ll also hear from Intel about their latest chipsets.

4. New perspectives and collaborative ideas — This is a great opportunity meet industry peers in your local area, share ideas and make valuable connections.

5. The power of the e-book — One lucky attendee at each event will walk away with a new Amazon Kindle. The winner will be selected from registered attendees at the end of the event and must be present to win.

You can learn more here.  We hope you can join us.

Last fall, Microsoft unveiled Windows 7 and caused a gasp across the IT departments in many an enterprise. It wasn’t that the new product had issues. On the contrary, the release was one of the most well thought out and developed software in years.  The issues that caused some consternation were often related to the pain points present whenever any new software solution appears…compatibility concerns, migration logistics, hardware requirements and financial factors.

An advanced endpoint management solutions can relieve these pains and make your Windows 7 implementation less likely to induce gasps and more likely to elicit ahhhh’s.  Here are three things you should consider as you evaluate solutions to the problem:

• Better asset management – Make sure you have a solution that keeps a clear inventory of the your hardware and software as well as which assets will actually run on Windows 7.
• Simpler configuration management – Think about a single point of contact to seamlessly migrate your existing machines to Windows 7, and automatically manage and patch any future updates or service packs.  Why waste time traveling all over your corporate campus to tweak individual machines?
• Virtualized applications – When migrating your machines, consider virtualizing your applications. This would mean no more endless days of testing and long installation times after you make the switch. You'll know before you throw the switch what to expect once everyone is up and running on the new OS.

If you are interesting in learning more about ways to reduce the pains of migrating to Windows 7, we're hosting a series of events this spring. Chances are we're coming to your city and you can get firsthand view of real-world solutions that can help.

What is your greatest challenge with your Windows 7 migration?

About six weeks ago we started a new online radio show/podcast called cloudchasers. The spirit of the show is to cut through the hype and discuss real issues facing real people trying to use the cloud.  It features a guest (industry pundit, blogger or software developer) along with someone from Novell.   This is not a webinar or sales pitch.  The show has a strictly enforced "no spin zone" and a host who keeps people honest.

So why am I posting today?  We are looking for your feedback about our prior shows and ideas for future ones.  Let us know if you or someone you know would make a great guest on the show (email me at fdays@novell.com).  And finally we'd love to have you join the cloudchasers conversation this Thursday at 1:30 ET as we discuss the changing face of software development in the cloud.

Are there any cloud computing topics that you think are overhyped?

Every organization needs to be compliant with something these days. The problem is that they have to wrestle with enforcing, maintaining, and demonstrating compliance; there is no one tool or vendor that can do it all.

Are there tools out there that will aggregate data and show you if you are compliant, for example? Certainly there are. But the data these systems use comes from somewhere else and that “somewhere else” always translates into additional tools, additional people, and additional work effort.

In recent years, organizations have begun turning to identity management systems to help them address this compliance complexity. As a result upwards of 85% of new identity and access management deployments are, according to Sally Hudson of IDC, driven by compliance.

The problem there is, although identity management systems can help by automating many aspects of compliance, they were never designed to be compliance solutions in and of themselves. Still, they can serve as a critical component and even a cornerstone of compliance infrastructure if people are willing to think about compliance a little differently.

And “thinking differently” in terms of compliance calls for a paradigm shift.

This paradigm shift involves, first of all, thinking about compliance not in terms of this or that technology, or even in terms of this or that specific set of regulations (PCI, Sarbanes-Oxley, FISMA, HIPAA, etc.), but in terms of a compliance framework.

A framework-centric approach gets us out of the trap of chasing the next regulation (and the next tool to support it) by providing us with an open, flexible compliance architecture that can accommodate whatever new requirements or new technologies come down the pike next.

This paradigm shift requires that we recognize how compliance can be boiled down into a set of basic controls. One control element for PCI, for example, may be that passwords have to conform to certain standards in terms of strength. One control element for Sarbanes-Oxley might be that a separation of duties, when it comes to access, needs to be maintained. And so on.

The great thing is that if you apply this framework approach and boil regulations down into a set of controls, you’ll find that a lot of these regulations actually have many of the same controls!

That is, even though there may be dozens of regulations you need to comply with as an enterprise, when you get down to the control level, the variance between one regulation and another may much smaller then you anticipated. As an example, Sarbanes Oxley (SOX) has 271 I.T. Controls, while the The Health Insurance Portability and Accountability Act (HIPAA) has 160 IT Controls. However, 66 controls, or over a third of HIPAA’s controls overlap with SOX.

In other words, approaching compliance from the control level makes it easy and more manageable to expand the system to include any new regulations or compliance-related needs that may arise, because, basically, the building blocks are already in place.

One interesting aspect of this paradigm shift towards a control-focused compliance framework is that it turns issues of identity and access management into issues of content.

In order for a control-focused compliance framework to provide real value, it must be filled with content. What do we mean by content?

On the input side, the specific controls you need to implement are examples of content. You feed them into an identity and access management system, for example, in order to automate them. This is key because, frankly, the only way to enforce compliance in an accurate and reliable way is if the process is automated. Manual enforcement of compliance controls is simply too cumbersome and costly and because of that, it is not sustainable. In order to use it in this way, your identity and access management systems must be intelligent enough to “understand” this content and know how to use it.

On the output side, this content will govern the reports that you will generate in order to demonstrate to auditors that you not only have the controls in place, but that they are effective.

So, in a sense, your compliance framework’s success will be highly dependent on its ability to leverage a content framework.

Until now, operationalizing this paradigm shift was beyond the capabilities of any identity management system. The good news is that we are entering an era where it is not only becoming possible to do so, but where doing it any other way is quickly becoming unimaginable.

So, are you ready for a paradigm shift?

Five years ago, the Identity Management space was still fairly adolescent and, frankly, most customers were not very sophisticated.

In their defense, the products that were hitting the market at that time had a lot of hype around them, a lot of buzz, and vendors were saying a lot of different things about what these products could do. It was confusing and unclear what you could realistically expect from a system.

To make matters worse, once you had purchased a system, implementing it was a laborious and costly process. Basically, you were looking at a multi-year, multi-stage project that would focus on integrating business systems one at a time and one division at a time. And every step called for a lot of manual programming to be done by someone deep down in the code.

Of course, as business conditions changed, as the rules governing who got access to what changed, you’d have to bring the same programmers back in to make changes to the code they had laid down in the first place and this whole process (maintenance and updates) became a development project in its own right. To top it all off, if those programmers weren’t available, then you were in a world of hurt because now you had to scramble to find somebody who could come in and pick up where they left off.

Thankfully, things have changed and Identity Management customers are much more savvy, much more sophisticated, and have much higher expectations. Specifically, they want to know that the solution they buy is not going to cost an arm and a leg, they’re not going to need an army of Java programmers to get it up and running and maintain it over time, and, most importantly, it’s going to do the job they expect it to do fairly simply and easily.

So what happened? Well, the biggest shift we’ve seen is that the core function of the Identity Management system has become very clear in the mind of the customer.

First of all, the system must faithfully assign users to the resources they need in a timely way.

Secondly, it must do so according to policy in a way that can be tracked, monitored, and audited.

Finally, it’s got to do all this in a manner that is governable by people who have been empowered by the business to make decisions about access, provisioning, compliance, and so forth.

Moreover, it can’t be extremely difficult or take a long time to get the system to work the way the business wants or to change things as the business changes.

So how do you meet the expectations of the sophisticated consumer of identity products?

The tack we’ve taken is to put the power of implementation, deployment, and control more directly in the hands of the business user. By making the process a more visual, drag-and-drop experience, customers today can minimize the services of a developer and hand things over to a non-IT, non-developer business analyst who has authority to decide who can have access to what when. That’s a good thing.

What the customer gains here is what got lost in translation before. When the business analyst had to first specify what he wanted, then put that in terms the developer understood, then wait while it was implemented and tested, then wait again while the final result was reconciled with what he wanted in the first place, then staged, then finally rolled out, the business suffered from the very long time and high cost it required to get it done and make it work.

Today with powerful automation tools at their disposal, the sophisticated customer can lay down, configure, automate, and govern the identity management system in a timely, more accurate way that actually makes a real monetary difference to the business (rather than just endlessly ratcheting up IT costs).

An Identity Management system should serve the business, not the other way around. I think you make that possible when you provide business owners with better, more efficient tools that are easier to use.

What other suggestions do you have?

As I indicated in my last post, operational changes, technical innovation, and the evolving regulatory environment have introduced fairly unprecedented complexity in the world of identity and access management. Identity management has grown from a set of tools, to a product to a suite to a platform over time. Convergence and consolidation of identity management tools under a common framework, resulted in the emergence of platforms to allow you to authenticate, authorize, provision and audit in an automated fashion.

What happened next was a very disruptive phenomenon. The advent of the cloud has given rise to “ubiquitous utility computing without walls,” and in this new world a lot of the old rules, a lot of the old enforcement models become insufficient; they just fall short.

In the beginning, everyone managed their own IT infrastructure on premise and the physical walls of the enterprise provided administrators with a definite perimeter. The process of “de-perimeterization” started as soon as people began moving data centers off-site into collocation facilities and the like.

What happened next was virtualization. Thanks to virtualization, the density of data centers increased because you could virtually fit more machines into a given space than you could physically fit in a room. This brought with it a “service” model in which you were charged for energy usage, for example, rather than for the physical space your dedicated machines occupied.

Of course, there were times when you needed more computing power than you were subscribed for and one way to provide that was by bursting into the cloud.

This last stage is just the natural extension of the previous stages. First you had a traditional program running inside a physical computer. That process got virtualized so that multiple programs were running within a computer within a premise. Finally, you have multiple programs running across computers across premises, and in that most abstracted way, in that last scenario, you basically don’t have an option, but rather, a mandate to run workloads intelligently by making it “identity aware.” Here is how “identity awareness” can be thought of. Just as in a server’s run-time environment, every running process has a process identifier, every thread inside a process has a thread identifier, every fiber within a thread has a fiber identifier, the “unique identifier” concept can be applied to intelligently running workloads with the notion of a unique workload identifier.

In the cloud model, competitors are collocated on the same silos, so we have to bottom-up make sure that we keep their data channelized. The buzzword is “multi-tenant,” but that essentially means partitioning the data in a way, so that we can be continuously compliant and we have highly available systems that can be audited, logged, charged back and billed correctly.

The way to ensure that is by making injecting identity into the workload itself, thus making it intelligent and aware enough to know where it’s running, where it is allowed to run, who is allowed to access it, and what to do when there is a problem.

Our present day contemporary computing environment transcends physical, virtual and cloud dimensions. Few noteworthy call outs to make here.

First, almost all the environments are a hybrid of physical, virtual and cloud. At present ~70% is physical, ~25% is virtualized, and a <5% is cloud, although these numbers will shift radically over the next couple of years.

Second, all of the three worlds co-exist in commercial non-academic environments. There is seldom an “all virtual” or “all cloud” environment. So, the trick is to make these environments seem seamless and interoperate with each other despite their heterogeneous stacks so that it reduces complexity for end-users and improves efficiency for its stakeholders.

Third, your workload on the hybrid physical, virtual and cloud have to have consistency while performing “on premise or “off premise” and its infrastructure is all connected by pipes that you no longer fully own or control.

Finally, in a world without boundaries, unless you intelligently manage your workload by making them “identity-aware”, you are out of luck.

Intelligently executing computer workloads with “identity awareness”, is no longer an option; it’s a necessity. It’s necessary to have workloads that are identity aware; it’s necessary to intelligently manage these workloads; and it’s necessary to be frugal and prudent about the way we execute and pay for these workloads in a consumption-based or utilization-based chargeback model.

What previously was a cool thing to do is now the norm. I submit to you that identity-awareness is one of the cornerstones that make it possible to intelligently build, secure, manage and measure workloads across the physical, virtual and cloud computing environments. What do you believe?

We are previewing Novell Identity Manager 4 this week at BrainShare.  One of the major changes is that there will be three members of the Identity Manager family:

• Novell Identity Manager 4.0 “Capricorn”: Our market-leading product continues to raise the bar with improved reporting,  scalability, and programmability.
• Novell Identity Manager 4 “Dorado”: We're demonstrating Dorado at Brainshare this week.  It features integrated identity management, roles management, cutting-edge reporting, built-in content packaging framework and the ability to ensure security policy across various system domains.
• Novell Compliance Management Platform: This ensures real-time compliance by providing the most complete IT GRC, user control and certification solution on the market today.

Learn about Novell Identity Manager 4 at novell.com/idm4launch.

General show info – Check out the BrainShare page on Novell.com for general information, schedules and much, much more.

Facebook - Come join the conversation, post pictures, and share entertaining stories on the BrainShare group on Facebook.

Twitter – We'll have a group of Novell people "tweeting" live from the event.  For power "Twitterers", we'll being using the hashtag #BrainShare.  If you are just not that into Twitter, it is easy to follow along from home on TwitterSearch.

Virtual press room – This is where you can find the official Novell News from BrainShare.

Presentations – We'll be posting slides from many sessions on Slideshare.  Feel free to download and share.

Videos – During the show, we'll also be featuring a variety of fun and informative videos on our YouTube channel.

Podcasts – Stay tuned to our OpenAudio channel for interviews with customers, partners and Novellers.

Needless to say we're excited about the show.  If you have time, take a few minutes to join the online conversation.