Microsoft Exec Describes Azure Services Vision

Microsoft executive David Treadwell today provided a few more details about the company's Azure Services Platform in a Webinar aimed at the investment community.

The Azure Services Platform was announced late last month at Microsoft's Professional Developers Conference. It represents Microsoft's latest push in its overall "software plus services" enterprise strategy.

Treadwell is Microsoft's corporate vice president for Live Platform Services, but he noted during the presentation that the Microsoft Live Meeting connection kept stalling. It was a minor annoyance. Still, it was reminder that some services still have a few issues to resolve.

Microsoft's Azure Services Platform is helping to provide connectivity to multiple "devices," consisting of PCs, mobile phones and the Web itself, Treadwell explained. Behind it all, Windows Azure provides the utility that enables cloud-based storage and management capabilities for such services.

Microsoft's Azure Services Platform

Treadwell demonstrated how it's possible to sync data using Live Mesh. He created a text document, which, when saved in a folder on a desktop PC, subsequently became available in online storage for other users or devices to access. Live Mesh is part of Microsoft's Live Services offerings, which have been available for years. Live Services provide utilities for identity, directory, communication and presence, and search and geospatial applications.

Currently, there are more than 460 million active users of Live Services, Treadwell said. The services are being hosted on "hundreds of thousands of servers worldwide," he added.

For developers, Microsoft provides its Live Framework, an open, interoperable platform. Third-party software developers can utilize this framework to develop for the PC, mobile phone and Web. In addition, the APIs for the Azure Services Platform are based on standard protocols. ISVs are not locked into one software stack when developing for it.

The Azure Services Platform is designed to serve a broad customer base, from building social networking widgets to delivering high-power enterprise applications. Treadwell contrasted it to Google's hosted applications, suggesting that Azure Services offer a more comprehensive choice that combines the power of installed client apps with services in the cloud.

Treadwell said that Amazon "deserves a lot of credit" for leading the way with inexpensive, scalable services. However, he emphasized the flexibility of Microsoft's Azure ecosystem for developers as a key differentiating factor.

Treadwell addressed a question about possible hurdles for Azure. In response to security concerns, he noted that Live Mesh encrypts all of the data flows in the cloud. He also said that Azure gives users control over where their data resides.

He did acknowledge that some policy and legal challenges exist, especially with government sectors on sharing data over the cloud. The resolution of that problem will be an evolutionary process, he added.

Microsoft also is still trying to work out how to make money with its new cloud-computing venture. The company is considering subscription-based, ad-based and service-based business models, Treadwell said.

Currently, the Azure Services Platform is at the "Community Technology Preview" level.

"Next calendar year, we will take the core pieces [of Azure] to a shipping level," Treadwell said.

He concluded the presentation by noting that the next major release of Live Mesh will integrate FolderShare, a file synchronization service that is similar to Live Mesh. Microsoft acquired FolderShare in 2005. Currently, Microsoft's Live Mesh data sync service is publicly available at the beta release stage.

Treadwell's presentation is available at the Microsoft Investor Relations home page, which can be accessed here.


PDC: First Look at Live Mesh and Live Framework
‘What Just Happened’: Reeling, By Kurt Loder
‘Gears Of War’ Screenwriter Aims For ‘Gritty And Real’ Big-Screen Version Of Video Game

No Deep Cuts for IT Spending Seen in 2009

Despite a troublesome economy, IT staff and executive positions are safe for now, according to a market study released on Wednesday. That's one of the conclusions of a Computer Economics study, which surveyed 159 North American IT organizations in October.

The Irvine, Calif.-based research firm found that "IT executives are not anticipating deep cuts in IT operational spending or staffing levels" in 2009.

Organizations currently are focused on retaining their employees, according to the report, "Outlook for 2009 IT Spending and Staffing Levels." However, some respondents (35 percent) are reducing spending in areas such as travel, training, filling open positions and initiating major planned projects.

It could be worse, according to the report's executive summary.

"More IT organizations are cutting IT spending this quarter than was the case earlier this year, but the cost-cutting is not nearly as draconian as one might assume by reading the business news headlines."

In a released statement, Computer Economics noted that IT organizations responding "at the median and 25th percentiles forecast no change in headcount in 2009, while companies at the 75th percentile are actually forecasting a 5% growth in staffing levels."

In essence, one in four IT firms actually plans to increase the head count.

"This means that at least 25 percent of companies responding to our survey are forecasting at least a five percent increase in IT staffing levels," said John Longwell, research director for Computer Economics in a telephone interview. "Surprisingly, a significant number of companies (from the median to the 25th percentile) are forecasting no change in staff levels."

Still, IT budgeting is under the microscope. According to the report, 35 percent of surveyed organizations will be cutting back on equipment upgrades, 33 percent will reduce contractors and temps, 26 percent will cut back IT training, 25 percent will reduce costs of meals/entertainment, and 17 percent will defer planned pay increases.

Of those surveyed, only 17 percent will be cutting IT staff and only 15 percent are looking at outsource and offshore options. Others will be renegotiating vendor contracts (26 percent) and stretching out vendor payments (11 percent).

More than a third of companies surveyed said they had increased IT staff in 2008.

"Our study forecasts that IT operational budget growth will be flat for 2009. If this forecast proves to be true, it may be because IT organizations have already been proactive about tightening the belt in 2008," stated Frank Scavo president of Computer Economics in a released statement. "For many organizations, significant layoffs of IT professionals are not possible without jeopardizing the business."

The full report from Computer Economics is available here.


‘Captain America’ To Be Helmed By Special-Effects Wizard Turned Director: Report
Organizations Cutting Back on IT Security Staff
Most Enterprises Unprotected Against E-mail Security Risks, Study Says

Parallels Desktop 4.0 Gets Performance Boost, DirectX 9.0 Support

Parallels has released Parallels Desktop 4.0, an update to the company's desktop virtualization solution for Mac OS X. The new version adds more than 50 new features, including support for DirectX 9.0 and significant performance improvements.

Parallels Desktop is a virtualization solution that allows users to run Windows, Linux and other operating systems alongside Mac OS X on Intel-based Apple hardware, such as the MacBook, MacBook Pro, Mac Pro and iMac. The new 4.0 release, which began shipping on Tuesday, offers up to 50 percent faster performance than Parallels Desktop 3.0, according to the company.

Other features in version 4.0 cited by the company are:

Support for DirectX 9.0, DirectX Pixel Shader 2.0 and OpenGL 2.0;New security and backup features integrated into the software, including Acronis True Image Home (backup and restore), Acronis Disk Director Suite, and Parallels Internet Security (firewall, scanner, antivirus);Adaptive Hypervisor for dynamic allocation of resources;An overall 15 percent to 30 percent improvement in resource consumption via an optimized virtualization engine;A redesigned user interface;New Screenview modes;Speech recognition;A new Security Manager feature; andSupport for more than 45 guest operating systems.

Parallels Desktop 4.0 for Mac is available now for $79.99 for the full version. Upgrades will run $39.99 through the end of the month. Free upgrades are available for those who purchased Parallels Desktop 3.0 on Sept. 1 or later. Volume and site licenses are also available. A 15-day evaluation version is also available. Further information, including links to downloads, can be found here.


‘Flash of Genius’: War Story, By Kurt Loder
PDC: Microsoft Previews Windows Server 2008 R2

Azure Adds Risk to Microsoft's Business Model

Most everyone remembers Pearl Harbor Day in 1995, when Bill Gates -- then the CEO of Microsoft and riding high on a surging Windows 95 O/S -- agreed to nearly missing the boat on the Internet. Gates famously outlined an Internet strategy centering around Redmond's Internet Explorer Web browser, which shipped with Windows 95.

Most everyone remembers how Gates' December mea culpa turned out, too. Microsoft continued to grow its shares of the client and server operating system markets. Internet Explorer became the dominant Web browser. And the U.S. Department of Justice initiated antitrust proceedings -- for the second time in less than a decade -- against the company.

Industry watcher Gartner Inc. picked up a similar Pearl Harbor Day-like vibe at Microsoft's recently concluded Professional Developers Conference (PDC), although the focus this time was cloud computing. Gartner concluded that the cloud-related offerings Microsoft unveiled at last month's PDC amount to its "most significant coordinated shift in strategy since its transformation to embrace the Internet and combat Netscape in 1996."

To be fair, Gartner flagged several Microsoft news items, starting with Windows 7, the successor to Redmond's much-maligned Vista operating system. In addition, Redmond also unveiled a Web-enabled version of its Office franchise, slated to ship as part of Office 14.

There's little doubt, Gartner researchers argued, that the latter announcement -- specifically, the timing of that announcement -- was aimed squarely at Google. "By announcing the service so far in advance, Microsoft hopes to slow the adoption of Google Apps and other personal productivity applications," wrote Gartner analysts Matthew Cain, Tom Austin and Michael Silver.

The big story, however, was the availability of preview code for Windows Azure and the Azure Services Platform, Microsoft's cloud-based platform and services stack. It was Azure's debut that most contributed to the fraught atmosphere at this year's PDC.

"This most recent PDC was the most important such event Microsoft has held in a decade. At the forefront, Microsoft Chief Software Architect Ray Ozzie led Microsoft's Azure Services Platform announcement -- a significant and coordinated shift in Microsoft strategy," wrote analysts Neil MacDonald, David Smith and David Cearley. "The vision significantly expands Microsoft's 'Software plus Services' vision to encompass all of Microsoft's offerings, and it will impact all of Microsoft's products during the next decade."

There's a sense, in fact, in which Windows 7 (which Microsoft distributed on preloaded laptops to journalists, reviewers and other attendees) was something of a sideshow; the real story, the one with ramifications for both Microsoft's and the industry as a whole, was Azure.

"Microsoft is facing the most challenging decade ahead in its traditional business model, which heavily depends on Windows and Office revenue streams," they concluded. "The changes and risk to its business model are significant. However, Microsoft had to respond to the challenge of cloud computing. Microsoft has done so in a reasonably cohesive fashion, orchestrated by Ray Ozzie -- even though different units within Microsoft had proceeded independently with their cloud strategies -- leveraging its developer and enterprise IT strength with the potential of the cloud."


Ballmer Stumps for Azure Down Under
Microsoft Rolls Out Services Connector CTP
‘Madagascar: Escape 2 Africa’ Knocks ‘High School Musical 3′ Off Box-Office Peak

Live Mesh Apps Unveiled by Microsoft Lab

Microsoft has developed four demonstration applications that showcase its Live Mesh cloud-based data synchronization service, according to a report issued on Tuesday by veteran Microsoft watcher, Mary-Jo Foley.

The apps are part of a new "MeshPack," and were apparently announced late last month at Microsoft's Professional Developer's Conference (PDC). The MeshPack includes a collaborative crossword puzzle, a shared bulletin board, a collaborative list application and a group polling tool called "CrowdVote," according to Foley.

The MeshPack was produced by Microsoft Startup Labs, which creates prototypes and product concepts on various platforms, including Live Mesh, according to the lab's blog. Right now, access to the MeshPack seems to depend on having a PDC code.

The PDC event also was the venue in which Microsoft announced that Live Mesh had advanced from a Community Technology Preview (CTP) release to Beta release. Previously, Microsoft had limited the number of participants in the Live Mesh CTP. However, with the Beta release, people worldwide can now sign up to use it.

The Live Mesh Beta features additional device support. Users of the Beta version can now sync data to hardware devices running Mac OS X (versions 10.5 and higher on Intel processors) and Windows Mobile (versions 6.0 and 6.1).

The Beta provides only a "Limited Mac Tech Preview," according to a Microsoft blog. When fixed number of Mac clients is exceeded, new sign-ups won't be able to join the Mac preview. Likewise, the Beta restricts Windows Mobile device access to just U.S. or U.K. residents.

The Live Mesh Beta includes some new features. It now permits WAP-based mobile phone access. You can now establish "roles" to control folder access permissions by other users. Additionally, users can drag multiple files to Live Desktop folders, instead of just one at a time. Users can store of up to 5 gigabytes of data in the cloud using Live Mesh.

Live Mesh originally had its debut in April, way before Microsoft's unveiling of its Windows Azure "operating system in the cloud," which was the big announcement at last month's PDC. However, Microsoft actually considers Live Mesh to be part of the Windows Azure platform. It's part of Azure's Live Services component.

The main portal to sign up for the Live Mesh Beta, which requires a Windows Live ID, is located here.


‘Gears Of War’ Screenwriter Aims For ‘Gritty And Real’ Big-Screen Version Of Video Game
‘High School Musical 3′ Named Most Likely To Succeed At Box Office
Sync Framework: It’s Still at Version 1.0
PDC: First Look at Live Mesh and Live Framework

IT's Security Dilemma: To Patch or Not To Patch

Security administrators faced a familiar if uncomfortable position: Just one day after Microsoft released an out-of-band patch to fix vulnerabilities in several versions of Windows, exploit code appeared in the wild.

The latest vulnerability -- with its near-same-day exploit code -- was too serious to go unpatched, experts warned, but it put administrators in a bad spot: Damned if they patched and damned if they didn't.

Industry watcher Gartner, for example, urged IT administrators to bite the bullet and patch their systems. "Microsoft made the right decision to issue an out-of-cycle patch for this vulnerability, given the evidence of active attacks against the Windows Server service and the ease at which exploits can spread across the majority of Windows systems," wrote Gartner analysts John Pescatore and Neil MacDonald. "Although Microsoft reports that these privately reported attacks have been limited and targeted, [it] is being very aggressive in pushing these patches out to prevent large-scale downtime for businesses around the world."

Gartner argued that the stakes were just too high for IT administrators to do otherwise.

IT pros have been in this situation before. For example, during the summer of 2001, Microsoft's Windows franchise was rocked by the first of the truly blockbuster exploits: Code Red. In June of that year, media outlets alerted users to a dangerous new vulnerability that affected Windows NT 4.0 and Windows 2000 systems running Microsoft's IIS 4.0 and IIS 5.0 Web servers. Microsoft did its part, e-mailing alerts to the more than 250,000 subscribers of its security mailing list and urging them to install a patch to fix the problem. Redmond also announced that it had dispatched representatives to many of its largest corporate customers to urge them to install the patch, too.

Despite Microsoft's efforts, the result, as everyone now knows, was Code Red: a malware worm that infected tens of thousands of vulnerable, unpatched systems. Just why did so many systems remain unpatched?

A closer look at Microsoft's history, particularly when it comes to software patches, helps answer that question. Earlier that same summer, Microsoft required three attempts to successfully patch a serious vulnerability in its Exchange 2000 Outlook Web Access Component. Prior to that, Microsoft had botched at least two service pack releases (Windows NT 4.0 SPs 2 and 6), more than a few NT 4.0 hotfix updates, and a variety of maintenance releases (Office 97 SR-1, Office 2000 SR-1). In many cases, Microsoft software patches have severely damaged systems; in some cases (Windows NT 4.0 SP2), they've rendered certain systems altogether unbootable.

This helped inculcate a prejudice among IT managers (who, understandably, tend to be risk-averse). Many viewed the prospect of installing an untested Microsoft software update as too risky.

Much has changed since that summer. To its credit, Microsoft has significantly improved its software patching process. Gartner conceded as much, citing "Microsoft's investment in a secure software development life cycle process" along with the increased use of network intrusion protection software in many enterprise shops as two factors that have "greatly reduced the success rate of attacks trying to exploit these types of vulnerabilities."

All the same, risk-averse IT administrators probably still approach the prospect of installing an untested Microsoft patch with some degree of trepidation. More to the point, the systems management and software development lifecycles in most shops simply aren't designed with rapid (that is, untested) patch deployments in mind.

A Certified Information Systems Security Professional (CISSP) with consultancy and services firm Booz Allen Hamilton put it best: "The threat that comes from the outside is an unknown. In a case like this, it might never materialize. [So] if your systems go down because of an external threat...you're not off the hook, but it's more understandable than if you install [a patch] and it takes them down.

"If in the commission of updating and applying a patch you broke your own system, you're kind of stuck on the hook for that. Chances are that [management] won't buy it if you said you were only doing it to protect your systems."

That's why this security pro said it's still important to test -- even in cases where exploit code is in the wild.

"The best you can do is compress your testing schedule. The most immediate threat is that the patch could break your application, so you have to test it, even if the testing is compressed," the CISSP said.

It's a rule for which few, if any, exceptions are made. "When SQL Slammer appeared [in January of 2003], that was the only time in my life when I know that a patch was installed immediately. Other than that, the management process of the application system in question dictates how quickly a patch will be applied," the CISSP said. "You have to weigh the risk of the patch taking down your system versus whatever damage could be done by the exploit."

Approaches to patching can vary from organization to organization, too. Shops that are certified according to the rigorous capability maturity model index tend to be much charier about how or when they install patches.

"A CMMI organization would very much prefer to run a full regression test rather than just throw it on the server and hope for the best," the CISSP said, "so the typical approach [in CMMI shops] is to thoroughly test it and then to apply it -- but to apply it not right away but during the next scheduled patch cycle."


‘Max Payne’: Rain Man, By Kurt Loder
Microsoft Ups Exploit Code Warning
Off-Cycle Microsoft Patch Targets Worm-Like Windows Bug
‘Twilight’ Event Turns Ugly When Thousands More Fans Show Up Than Expected

Microsoft Offers Security Dev Lifecycle Solutions

Microsoft on Monday announced Security Development Lifecycle (SDL) solutions for IT and development pros.

The company released Version 3 of its SDL Threat Modeling Tool and rolled out the Microsoft SDL Optimization Model as free resources available at the Microsoft Developers Network (MSDN) Web site.

The new solutions are part of the company's broader outreach on security, which also includes the Microsoft SDL Pro Network. The network includes nine consultancies, with Verizon Business, IOActive Inc., Security Innovation Inc. and others as members. The group specializes in application security and provides guidance to businesses that are implementing SDL practices.

The release marks Microsoft's foray into what was once exclusively the domain of independent IT security consultants, big-five IT audit firms and independent compliance shops.

Microsoft is providing a resource planning and development support for high- and granular security benchmarks. The tools include matrices and assessment templates.

The company's SDL efforts got a public boost in August when Microsoft kicked off a more collaborative effort on security issues at the Black Hat Conference. Microsoft also promised greater transparency during its security patch release cycles.

Bola Rotibi, principal analyst at Macehiter Ward-Dutton Ltd., applauded the move, saying that enterprises have high expectations of software applications.

"Tools that enable developers to become more efficient, effective and productive are very much needed, particularly in times of budget constraints," Rotibi said.

The SDL program offers four tiers of service -- "Basic, Standardized, Advanced and Dynamic" levels of optimization. Enterprise shops and channel partners can decide for themselves whether they want to use only certain parts of the program or fully integrate the Windows-based workflow template into their everyday IT resource planning and deployment efforts.


Fake Microsoft Security Update Makes Rounds
‘Max Payne’: Rain Man, By Kurt Loder
‘Flash of Genius’: War Story, By Kurt Loder