Market Trends

To start, I’ve taken a series of snapshots from the excellent Google Trends showing global search volumes for each of the Big Four offerings to measure the level of interest.  It’s reasonably clear to see from the graph below that interest in OBIEE shows a small but steady growth whilst Reporting Services shows a marked decline and the other two offerings remains roughly static (maybe a small decline?), this surprised me given that with the release of 2008 R2 I think that Reporting Services is really getting to the point where it offers a legitimate choice in the BI marketplace.  Perhaps the issue that Microsoft have fragmented their BI offering to include a mixture of terms with Excel, PowerPivot, SharePoint, Analysis Services and Reporting Services all making up the BI stack and nobody really knows what to call it?

This year has also brought an increased emphasis on Mobile BI with the iPad and iPhone fast becoming common executive playthings, Business Objects making it’s Explorer and Xcelsius products available on Android in addition to the iPhone (Explorer only).  MicroStrategy took the mobile emphasis a step further (perhaps to help stick their head above the crowd) by announcing a strong focus on the mobile BI market and offering a free 25-seat licence for their Mobile Suite.  Despite a strong focus on marketing Mobile BI I’m still not convinced that any of the vendors have really hit the nail on the head with their solutions in that whilst many offer pretty visualisations and slick interfaces most seem to lack the kind of simplicity that helps to present information quickly and succinctly, even the frankly beautiful independent product RoamBI just feels a little overdone when it comes to actually using it.

Major Product Releases

It’s been quite a year in the BI & Database world with the launch of Microsoft SQL Server 2008 R2, Oracle Business Intelligence Enterprise Edition (OBIEE) 11g and IBM’s Cognos 10…

Microsoft’s launch is effectively a moderate evolution of SQL Server 2008 in most areas with little change to the database engine, it’s ETL tool Integration Services and it’s OLAP engine Analysis Services.  That said, R2 did bring some handy incremental features which will be especially welcomed by the budget-conscious with an increase in the DB size of the free Express Edition from 4GB to 10GB and the addition of Backup Compression to Standard Edition.  There were some interesting additions with PowerPivot, Master Data Services and StreamInsight thought I’m not sure that either will find a natural home for a good year or so as busy DBAs and developers struggle to find the time to try these new features out.

Despite the major jump in the version number Oracle’s release too seems to be mainly an evolution and as a great fan of the product I’m quite considerably relieved since Oracle could quite easily have been over-zealous in integrating their ‘own’ tools like Discoverer and Warehouse Builder with bought-in technologies like Siebel Analytics (which became the bedrock of OBIEE), Hyperion’s Essbase and Sunopsis (now Oracle Data Integrator).  One of the less exciting but fundamentally important additions is that the semantic layer employed in OBIEE will be directly and immediately compatible with future releases of other Oracle products in the CRM, ERP and Finance application spaces.

I’m not as familiar with Cognos as the other two tools having only experimented with Cognos 8 for a couple of weeks but from everything I’ve read it seems that Cognos 10 was certainly a major milestone in the product’s lifecycle.  Aside from the shiny sounding features such as Social Networking and iPad support (actually a very serviceable looking mobile BI app) there are some very cutting-edge additions to the product including a statistical engine drawn from SPSS and Active Reports which allows users to explore and analyse offline data including interactive email reports.

The Future?

No good review and roundup article ends without a nod to the future and whilst I’m not keen on making absolute predictions there are a few developments I’ll be keeping my eye on for 2011 and beyond.

The main event I’m anticipating is the release of Business Objects XI Release 4, I’ve not seen too many concrete details about functionality but over the last few years Business Objects have seen themselves distracted by the Crystal acquisition (including the shoe-horning of their core product into Crystal Enterprise) and in turn their acquisition by SAP.  As a regular and long-term user of Business Objects I’m really hoping that they’ll blow away some of the cobwebs and deliver some new functionality as well as rounding off some of the edges that in previous versions feel a little unfinished, it would be great too if they finally included the key functionality from the legacy desktop client (which many long-term customer still rely on) in their core Web Intelligence product (Freehand-SQL & Grouping – I’m looking at you).

Another area to watch in Business Intelligence and Data Warehousing as well as the wider enterprise market is cloud computing, Informatica’s ETL in the Cloud offering has seen improvements and adoption throughout 2010 and it’s almost a given that Microsoft will be adding some degree of ETL capability to their SQL Azure platform. I’d expect an announcement if not a release along these lines in the coming year, though it’s possible that ETL comes behind providing cloud based analytics (something SSIS guru Jamie Thomson suggests).

In a broader sense I’m expecting to see a little more interest and pickup in the open source BI market, I’ve been saying this for a while (“this time next year, Rodders…“) and I might be wrong for some time to come but I always keep an eye on companies using an Open Source model such as the ETL vendor Talend who recently acquired Sopera (a middleware and SOA vendor), BI vendor Jaspersoft and all-rounder Pentaho.  With the global economy still suffering a hangover from the sub-prime mortgage crisis and banking collapse people have been looking for cheaper alternatives and open source companies provide a great way to achieve that, though some of Talend’s high-end offerings are almost comparable in price with other commercial products.

Another possible area to watch out for is the area of Personal Intelligence, essentially Business Intelligence for the individual.  A colleague and I spoke about this back in 2008 and we could both see that as people increasingly become data-aware they’ll start to look inwards and aim to measure things about themselves, one obvious starting point is fitness and we already have sites to log and chart your weight and calorie intake as well as the brilliant Nike+ product that measures your pace, time and distance during a run using either a sensor in your shoe or GPS (iPhone app), see the sidebar of this blog or below (one of my runs on the Nike+ site) for examples of the output.

The ultimate goal of the project is to build a rootkit that would reside in the NIC’s firmware and be capable of performing all sorts of nefarious tasks and once installed it could implement a range of countermeasures to avoid detection.  One problem for the would-be malware writer is the limited memory available on the NIC, perhaps instead of acting as the primary payload the NIC rootkit could act as a wingman to a larger malware toolkit and even persist in the event that the OS infection was removed.

The rootkit could monitor outbound traffic to sense when it’s primary payload had been deactivated, report back to the command & control servers and wait to be notified of a hardened upgrade that could then be installed by exploiting communication with the driver layer via Direct Memory Access.  Alternatively it could be used to thwart detection by network scanners like Nessus or perform port scans on the rest of the network, again – all without the knowledge of the host OS.

This may seem somewhat speculative but to me it’s the way of the future, many devices connected to your PC have flashable firmware and I imagine that within the next couple of years an example of exactly this kind of attack will be found in the wild – until then, stay tuned to the big conferences like Black Hat, Defcon and Hope.

The second talk was Matt Whitfield‘s ‘CLR Demystified’ and not being a developer I’ll admit that much of it went over my head but I get the basic principles and most importantly I know what’s possible and where I might make use of CLR. The most interesting avenues for me are the ability to write custom aggregate functions and define custom data types – I was also impressed with the opportunity to increase performance in certain text processing / forward log parsing situations.

The next talk I attended was a gentle introduction to PowerShell and James Boother did a good job of showing where it might be useful for admin tasks, in particular the example of purging old backup/log files based on age lit my eyes up. There was also a demo of PowerShell authenticating with Twitter and posting tweets as admin alerts, alas the demo failed but that could well have been a timeout on the Uni’s WiFi network or just plain old demo-gremlins. I must say thou that I still can’t view PowerShell with some sense of disappointment because with all it’s flexibility and power it’s so damned wordy and many of the tasks it performs could be achieved with less code that a good old Bash script.

As with Friday I attended Quest‘s lunchtime session run by Kevin Kline, Ian Kick, Brent Ozar and Buck Woody – they’re some of the most experienced guys in the SQL community and when you get them together they’re funny as he’ll too so I was both entertained and informed in their myth-busting quiz.

My first afternoon talk was Gary Short’s session on NoSQL which predictably sparked a few polite but irate rebuttals from argumentative DBAs but the session itself was an excellent whistle-stop tour of the predominant NoSQL technologies and use cases. I was encouraged to hear from someone experienced in the field that nobody has quite put together all the pieces to hook up BI tools (that traditionally expect relational/dimensional models or OLAP sources) to the NoSQL back-ends, it’s a shame since I might need to do so pretty soon – I guess I’m going to have to get my hands dirty then!

The final talk was from Kevin Kline of Quest who covered SQL Injection, it was an informative talk that gave me pause for thought about a couple ‘best practices’ that I probably ought to harden a little. Kevin recommended a few tools that I’ll definitely be checking out at some point, notably:

• HP Scrawlr
• URLScan
• Source Code Analyser for SQL Injection
• Assessment and Planning Tool
• Discovery Wizard

And a few handy sites/articles:

• SQLSecurity.com
• MSDN ms161953
• MSDN ms998271
• ferruh.mavituna.com

Once more it was a great conference and the free day was every bit as good as the paid day, I can honestly say that I walked out of the event already looking forward to the next one.

From July 16th – 18th 2010 in New York City the guys behind 2600 Magazine will be hosting The Next Hope, a conference for hackers of all types: amateurs, hobbyists, professionals and the generally curious.

Topics are wide and vary from IPv6 to Phone Phreaking, Disaster Relief to Graphic Novels and Cooking to DNS Sec – here’s the full talk schedule announced Monday (see table with abstracts here)…

Friday 16th

Saturday 17th

Sunday 18th

Well, there’s a great solution – you can use a temporary email address.  There are several sites out there that will randomly generate an email address that become valid for a fixed period of time before the account (and all of the mail) is deleted.  One thing that you should know is that the content of the emails themselves should not be personal since there there is often no authentication, it’s really just a quick and easy solution and is not secure in itself.

The site I tend to use if Guerrilla Mail, their temporary addresses last for 60 minutes but can be extended and they also let you pick your own address or take a randomly generated one.  There are other sites out there but the only one I’ve had any experience with is 10 Minute Mail, I’m sure some quick googling will bring up a load of alternatives.

Essentially a bootkit is a small piece of code that can be inserted into the Master Boot Record of a PC’s main boot drive, this code is then executed every time the PC is switched on and executes before the operating system loads.  This is effectively a variant of more traditional rootkits which tend to install themselves as low-level drivers as part of the operating system and they are both equally dangerous in that once a system has been compromised the writer of the rootkit/bootkit can effectively do whatever they like.  This may range from logging and transmitting keystrokes and capturing bank details to bypassing product activation or enabling law enforcement to gain access to allow forensic analysis.

The Stoned Bootkit is effectively a technical demo and whilst it is entirely effective I am not aware that it has been put to any nefarious purpose, in fact it was released by Peter Kleissner at the Black Hat security conference in 2009 to an audience of security professionals and I believe intended by the author as an ‘eye opener’ for the industry.  Notably, Stoned is the first bootkit that has been tested an verified on Windows 2000, Windows XP, Server 2003, Server 2008 and Windows 7.

So why does this blow my mind?  It’s not that the technology is brand new – MBR viruses have been around for decades which is something which Kleissner acknowledges himself by naming his boot-kit after one of the earliest examples: the Stoned Virus from 1987 (I remember encountering the variants Manitoba and Zapper in the early nineties).  The reason that I was so awed by Kleissner’s presentation is the comprehensive list of attack scenarios he presents, the ease with which this is possible and the fact that it can be used to entirely bypass whole-disk encryption (tested against Truecrypt and DiskCryptor).  The bootkit is available for download as an ‘infected PDF’ or even as Live CD that can be used to boot and infect any PC to which you can gain physical access.

There has been some debate between Kleissner and Truecrypt about whether this constitutes a ‘valid’ attack, the debate is fairly academic since Truecrypt themselves acknowledge that the attack is effective provided that the attacker has administrator privileges (most non-technical users run this this way), that administrator privileges can be gained (most likely by other exploits) or through physical access to the machine.  I’ll concede that Stoned isn’t a valid attack against Truecrypt itself but it is a valid attack against the PC and a such can still be used to entirely bypass Truecrypt which still allows an attacker to achieve the same aim.

As a footnote, it appears that Peter Kleissner is being sued by his former employer, Ikarus Security Software GmbH, for an alleged intellectual property violation (source code theft), given that he is only 18 years old I sincerely hope that this does not harm or curtail Peter’s future career and potential.  Alarmingly there are reports (English here) that Ikarus and Kaspersky are attempting to build a criminal case agains Kleissner on charges including “distributing malicious code”, if this sticks it could be worrisome for all security researchers (particularly hobbyist hackers with no money for a good legal defence) who often write code that could be classified as malicious whether they intended it or not – all security flaws could be exploited, does that make it wrong to point them out?