flexera software blogs

Apache Log4j 2, Flexera and you

Kevin Miller — Fri, 17 Dec 2021 09:00:40 GMT

By now, you’ve probably learned of Apache Log4j 2. As reported across the web, there is the recently disclosed CVE-2021-44228 vulnerability in Apache Log4j 2 (widely referred to as Log4Shell) affecting organizations far and wide. This is a critical vulnerability in Apache Log4j 2, impacting versions from 2.0-beta9 to 2.14.1.

And now you’ve likely been asking, “Where is this vulnerability within my own IT ecosystem, and how do I mitigate it if necessary?”

Flexera is helping work through the issue with our customers by ensuring immediate visibility of the impact of this and other vulnerabilities within their IT estate.

Log4j 2 from the vulnerability perspective

Alerts can be generated within Flexera vulnerability solutions based on configured watch lists and notifications settings to show:

An up-to-date Secunia Advisory (SA105630) and further Secunia Advisories which contain detailed information on the vulnerability, including the solutions/patches and available CPEs
CVE associated with the vulnerability as published by a trusted source (for example, the vendor Apache or MITRE)
Threat intelligence information associated with the vulnerability patches you can publish to remediate this vulnerability for covered products as they are released by their respective vendors

Log4j 2 from the asset inventory perspective:

For more directional assessment, affected products can be detected via IT asset inventory. A definitive vulnerability status can be achieved with version granularity, but is application-specific. To find this vulnerability in internal applications, please see Revenera’s blog on Software Composition Analysis.

Impacted software product versions being detected within inventory.
- We will continue to actively work to obtain more vulnerable product versions in order to create file signatures
All impacted Apache Log4j products and/or releases are captured in Technopedia.
Any existing discovered data (a.k.a., evidence) that maps to the impacted products and/or release are recognized. Note that any bespoke evidence may need to go through a gap-fill process.
With InfoSec Content Pack:
- Impacted products will be identified with any CPEs associated with the impacted products and/or releases linked
- Up-to-date Secunia Advisory information linked to the available CPEs is provided
- CVE references associated with the vulnerabilities; the publication is dependent upon review/approval by the National Vulnerability Database (NVD)
- Threat intelligence associated with the advisory (as provided by Flexera’s Secunia Research)
With Lifecycle and Support Content Pack:
- Lifecycle dates (EOL and/or obsolete dates) for Apache Log4j releases which can help you determine supported versions and the upgrade path(s)

Critical vulnerabilities affect organizations across the globe and span industries. As businesses build more effective vulnerability assessment and remediation processes and programs, it’s important that communication continue to expand within and around IT functions, like IT asset management, information security and security operations, as well as others who have their eyes, ears and hands on the tools to manage these breaches.

For more details and updates, see our Flexera Community.

Software supply-chain vulnerabilities: A close look on code

Lars Wiebusch — Wed, 15 Dec 2021 17:50:38 GMT

Vulnerabilities that affect the supply chain of software and its distribution are easily among the most terrifying experiences any company involved must endure. Such vulnerabilities typically affect a wide range of different parties who use the affected software or parts thereof and who may distribute them further down the road.…

What you need to know about the Log4j security vulnerability

Kendra Morton — Mon, 13 Dec 2021 17:55:04 GMT

If you’re not scrambling to contain and fix this vulnerability, do so now. It’s a doozy folks! Every organization using third-party software or developing custom applications with the Java programming language is potentially impacted. All current versions of log4j2 up to 2.14.1 are vulnerable. Log4j is a very popular logging…

Extensis’ Move from On-Premise Software to SaaS: A Data-Driven Journey

Michael Goff — Mon, 13 Dec 2021 14:24:44 GMT

During his first year as CEO, Extensis’ Toby Martin sat down with the Quality Assurance (QA) team and asked about his company’s codebase. It wasn’t a typical question from a CEO, but it was from Martin, and he started his career there in charge of software development. The digital asset…

I can see (my asset inventory) clearly now, with IT Visibility

Kevin Miller — Thu, 09 Dec 2021 09:39:35 GMT

Solving problems is nearly impossible when you don’t know where to start. Likewise, building programs and initiatives are even more difficult when you don’t have credible data on which to base your strategy. That’s why it’s always helpful to begin by getting your IT data cleaned up and then visualizing your issues to pinpoint problem areas to attack. But once it’s clean and curated, how do we view our data most effectively to make IT decisions?

Sometimes we put our data into a business intelligence tool like Power BI or Tableau, and that’s a great way to take otherwise confusing, overwhelming or tedious data and reorient it into a more consumable format—like taking an Excel document and turning it into charts and graphs for those immediate “aha!” moments of clarity.

Business intelligence tools are great, but how do I cut down all the tooling?

While we can all appreciate the functionality of business intelligence tools and their power to draw insights, the process of taking data from point A to point B, and then again to point C often draws resources, time and personnel. From data discovery to normalizing this information into a consolidated and contextualized (i.e., useful) format, then combining with relevant prioritization information (like lifecycle management and license compliance), exporting and uploading into another tool (or if possible, a direct API), doing all these processes across more than one space/platform/tool…it can be cumbersome.

Not to say that it doesn’t save you exponentially in terms of resources to leverage business intelligence—just think of the visualization effort required for Excel spreadsheets—but what if you could do all that work from a single interface? From data aggregation to visualization, pinpointing areas of need and opportunity for your organization, all within a single workflow and without the need for additional tooling? Sign me up.

For IT inventory visualization, dashboard options abound

If you’ve used Flexera in the past for your data discovery and normalization efforts, you’ve probably seen some visually appealing charts, but maybe you wanted to drill down in ways that only a tool like Power BI or Tableau could provide. And that’s OK with us—at the end of the day, we want to make your job easier, more efficient and more effective. So if it’s Tableau for your needs, we’re here to support you. However, as we’ve mentioned, making you as efficient and effective as possible is our purpose. So we went ahead and upped our dashboard game.

One flow, see your data and make decisions in real time

As you can see above, as the industry evolves, so do we—from on-premises to cloud, EC2 to container coverage—Flexera is committed to improving our solutions in line with technology, and that goes along with our customers’ ability to visualize and take action on their data in a user-friendly way.

Flexera provides key industry benchmark dashboards out of the box: software and hardware inventory, end of life and end of support (lifecycle management), sprawl and more. But improving customer visualization also means diving deep into your data, customizing your analytics and creating your own dashboards.

Via Data Explorer in Flexera One’s IT Visibility solution, harness the power of Technopedia—including 4.6 million+ products, 250 million+ data points and 4,500+ daily updates—to drag and drop categories, contextualization and enrichment over your IT asset inventory.

Whether you want to contextualize your inventory by business service, business unit, cost center or location, or measure the number of devices, installs, models or products, Flexera One provides boundless opportunity to build out data visualizations that make sense for your individual, organizational and strategic needs. As you create insights, the analytics engine offers recommended next steps, like adding trends or comparisons for the data.

Need your data in a scatter plot, a geo chart, a heat or tree map? Want to create a dashboard with several charts to share with your team or leadership? We’ve got you covered.

IT Visibility can be configured to ingest data from virtually any data source and supports the most-used sources, like Microsoft System Center Configuration Manager (SCCM), HP Universal Discovery (HPUD), Service Now Discovery and others right off the bat. Once your data is ingested into IT Visibility, visualizing is as simple as clicking a button—drawing insights is just as simple, with preset dashboards for industry standards, like software or hardware inventory, sprawl, lifecycle and more.

Set alerts for action when your metrics change and create views into your data that make sense for your use cases, whether that be end-of-life and end-of-support products, rationalizing your application portfolio or reporting up into management and leadership.

Want to see our IT Visibility dashboards for yourself? Reach out for a demo.

Solution Brief
Solution Brief

How many FTEs should be on my SAM Team?

Cyndi Tackett — Tue, 30 Nov 2021 15:00:26 GMT

Many organizations ask us, “How many people do I need on my SAM team?” Although there’s no one-size-fits-all answer, Flexera does have quantitative data on the average and median size of SAM teams across more than 20 industries.

In the Flexera 2021 State of ITAM Report, we asked respondents about the number of full-time equivalents (FTEs) on their SAM team. The responses varied widely from companies of all sizes, maturity levels and SAM tools in use. On the low end, there were three respondents in the survey who have zero FTEs on the SAM team. On the high end, there were six respondents who reported more than100 FTEs on the SAM team.

The average number of FTEs on the SAM team from all 461 respondents was 10.2. The median number of FTEs on the SAM team was four. The respondents who reported using spreadsheets as a SAM tool reported two more FTEs than average. The respondents who reported using their ITSM tool for SAM reported an average of three more FTEs than all other respondents.

Factors to consider when sizing your SAM team:

How much data do you need to manually input?

Organizations that need to manually input software licenses, product use rights, purchase orders and software signatures/models will need more FTEs than organizations with access to libraries such as product use rights, SKU and application recognition.

How many vendors, products and environments will you actively manage?

Leveraging market data and content libraries enables organizations to actively manage and optimize more vendors across on-premises, SaaS and the cloud. Organizations that rely on manual data input will not be able to manage as many vendors, leading to fewer optimized vendors and increased compliance risk. A vendor-stratification exercise (based on spend, audit propensity, strategic alignment, etc.) ought to inform which vendors the organization should actively manage.

How many manual processes do we have?

And more importantly, what processes can be automated? Don’t assume a process or workflow can solve the problem. Many workflows are actually sequences of manual tasks ultimately resulting in increased resource needs.

What are the goals and KPIs of the overall SAM program?

SAM program goals, reporting metrics and ROI targets should inform how many resources are required to meet the objectives. Organizations who establish clear business outcomes for the SAM program can back into resources required to meet those goals and show positive ROI of the SAM program.

Enriching your SAM program with libraries and market data enables you to eliminate the manual data input that strains resources.

Learn more:

Download the 2021 State of ITAM report
Download the SAM toolkit

When is the right time to conduct an open source audit?

Michael Lelchuk — Tue, 23 Nov 2021 01:08:50 GMT

No matter what industry you are in, your company’s code most definitely contains code from someone else. Today’s software is not written from scratch, but rather assembled from parts. These parts mostly originate from open source software that’s freely available from the internet. However, your awareness should not be limited…

Trends in Software Usage Analytics and Monetization 2021

Michael Goff — Wed, 17 Nov 2021 13:55:08 GMT

Revenera’s Monetization Monitor: Software Usage Analytics 2021, the second report in our annual research series, is now available for download with the latest stats and insights on software suppliers’ focus on product usage data. The latest report makes it clear that software suppliers are increasingly turning to software usage data…

Custom dimensions to optimize cloud costs—now at your fingertips

Tanner Luxner — Tue, 16 Nov 2021 15:00:51 GMT

IT leaders know that managing cloud infrastructure is a constant, ever-changing process. No matter how big or small your organization, your strategy must also evolve in order to tame this beast.

That sentiment was demonstrated in Flexera’s 2021 State of the Cloud Report, which highlighted the major cloud initiatives for survey respondents this year. Respondents indicated managing cloud costs and migrating workloads to the cloud were top challenges and priorities.

But understanding how to be nimble in order to manage your cloud infrastructure in a cost-effective manner can be difficult, especially for cloud teams that may lack customization options, whether through native cloud provider tools or third-party solutions.

Introducing Rules-Based Dimensions

But now there’s good news. To address these challenges, Flexera launched Rules-Based Dimensions for its Cloud Cost Optimization (CCO) solution, part of the Flexera One platform. CCO enables your cloud governance teams to work collaboratively with business units and cloud resource owners to optimize spend. A major contributor to wasted cloud spend is the decentralized control of cloud accounts, but this solution gives you a complete cost picture across your organization, so you can make better informed decisions.

The new Rules-Based Dimensions capability gives you the power to add custom dimensions to your CCO based on the rules that are specific to your business’ structure. And once applied, they work like any other built-in dimension in CCO.

No more manual customization or siloed information

Let’s say you need to map dimensions to specific categories, such as cost owner/cost approver, Kubernetes UID or department/division. This typically requires you to export data into a spreadsheet and then manually use pivot tables or data sorting.

But with Rules-Based Dimensions, you can instead map these rules once and then instantly get the insights that matter most to your cloud costs. Ultimately, this helps you contextualize data and report to other stakeholders in your organization in a way that’s applicable to them.

The new capability also allows you to map rules across any cloud provider, giving you the ability to identify additional cloud cost savings and allocation and gain consistency across your entire cloud environment. Plus, you can create up to 10,000 of these rules, which ensures organizations of any size can map data in a way that makes meaningful insights easily and continuously digestible.

Take control of cloud costs

Now you can better monitor your cloud usage, costs and discounting for all your cloud accounts—and present smart recommendations for cost optimization opportunities. Click here to learn more ways to manage your cloud costs.

Schedule a free demo of Flexera’s Cloud Management solution today!

Field Notes: Understanding GPL Linking Exceptions

Marcus Lucero — Wed, 03 Nov 2021 20:12:34 GMT

Notes from the Field: SCA Analysts and Code Insight Product Trainers talk Observations, Trends and Findings. I find the subject of GPL Linking Exceptions resurfacing often, whether I’m on a SBOM review call with an audit client, advising on Remediation Practices and open source license policy creation, or simply refreshing…

IT asset management: trends, challenges and initiatives in an ever-evolving field

Brian Adler — Fri, 22 Oct 2021 14:00:33 GMT

IT environments have been undergoing significant change in recent years due in large part to advances in the way we procure and consume resources. The digital transformation of the enterprise is accelerating across all industry verticals, bringing complexities in asset management that were unforeseen just a few short years ago. And while the assets that need to be managed have changed, the underlying requirements of that management have not, bringing challenges to ITAM (IT asset management) practitioners.

These challenges, along with the initiatives planned to address them, are among the details revealed in the Flexera 2022 State of ITAM Report. This second annual report sheds additional light on the focus, makeup and structure of ITAM teams across organizations of all sizes, industries and maturity levels.

The report analyzes the responses of 465 global IT professionals who manage, advise and participate in ITAM activities in organizations of 1,000 or more employees. The report includes a section dedicated to European respondents, illuminating how European ITAM practices are different (or similar) to their North American and global colleagues. The insights gleaned from these responses provide vision into the current and strategic initiatives across these ITAM practices and practitioners.

The where of ITAM influences the what

In the survey, respondents indicated that their ITAM teams reported to numerous different functions within the overall organizational structure. Those teams reporting directly to the C suite (typically CTO or CIO) had the broadest set of software asset management (SAM) responsibilities, and the highest level of interactions across other IT functions within the organization. This situation was even more pronounced with European respondents, where an even larger percentage of ITAM teams report to C-level executives.

European respondents below

Challenges evolve as technologies emerge

While the organizational placement of the ITAM team affects their responsibilities and influence across the organization, their effectiveness is driven by the maturity and experience of their team. As digital transformation continues to expand across the enterprise, ITAM teams in these organizations struggle to keep pace with new technologies, and new procurement and consumption methods for these technologies. More than three-quarters of respondents indicated that increasing the maturity of their SAM practice in the face of these rapidly evolving IT environments was a challenge to their team. And not surprisingly, dealing with these new technologies and environments, such as SaaS, cloud and containers, followed closely behind.

Initiatives and metrics – misaligned?

Not surprisingly, a major initiative in most organizations focuses on cost savings and cost avoidance, and these initiatives permeate their ITAM practices as well. When asked to prioritize their upcoming initiatives across their SAM practice, respondents’ top three selections were all focused on saving money for the organization.

And while this desire for cost savings resonates with all practitioners within the SAM and HAM (hardware asset management) fields, the metrics against which these teams are measured appear to be misaligned with the initiatives they’re being asked to prioritize. Respondents indicated that the top four metrics used to measure their teams’ success are all audit-related, including external audit compliance, maintaining an accurate license position with their vendors, compliance with regulatory or internal audits and compliance with their vendor contracts. As such, ITAM practitioners may find themselves in a difficult position with respect to the initiative/metric equation: they’re being tasked with initiatives on which they’re not measured. Consequently, making progress on these initiatives will be challenging as they may become de-prioritized by individual practitioners as they must also focus on their performance and career goals.

This dichotomy is reflected in the following figure which is pulled from this year’s report, indicating that 83 percent of SAM teams’ time is spent on audit-related activities, which is a 20 percent increase over last year’s 63 percent value.

The realization that follows from this is that just 17 percent (less than a day per week) is available for these practitioners to pursue the initiatives they’re being tasked with, and that will advance their ITAM processes, tools and expertise.

The purview of the ITAM practitioner is constantly evolving as digital transformation continues to disrupt the traditional roles and responsibilities of the field. Unforeseen challenges will arise as new technologies mature and evolve, and the ITAM practitioner will have to evolve alongside them to continue to provide strategic and economic value to their organization.

The results of this year’s report provide a view into the importance of IT asset management, as well as the challenges and how they’re being addressed by ITAM teams across the industry spectrum. For many more insights and complete survey results, download the Flexera 2022 State of ITAM Report.

Six Tips for Choosing a Cloud Proof-of-Concept Application

Flexera — Wed, 20 Oct 2021 18:12:26 GMT

Cloud computing gives businesses many options for hosting their applications. Cloud PoC provides instant-on for the immediate launch of tools and applications, allows end users to launch applications themselves just when they need them, and lets architects design applications that can scale up to new levels with minimal operational oversight. But if you’re among the group we identified as Cloud Beginners in the State of the Cloud Report, you may be wondering just how to take your first steps out of the data center and into the cloud. Here are six tips to get you started:

1. Start with a real application

Cloud is not a fit for every application, but every organization has some application for which it is a good fit. For your cloud proof-of-concept (PoC), pick an application that addresses a real business or technology need — don’t create some artificial test application for purposes of the cloud PoC. However, don’t pick your most difficult use case either — choose a project you can complete in 30 to 60 days. And select an application that’s a good fit for cloud’s strengths: namely speed of deployment, scalability, and ability to handle variable loads.

If you have the option, start with a new application rather than porting an existing application from your data center. For one thing, when you’ve finished, you’ll have created something new that people can use, rather than a science project. In addition, you can design your application to run in the cloud from its inception, rather than inheriting legacy requirements for the application.

A good PoC in cloud application might involve mobile or social media, big data, or batch processing. Don’t choose a use case with special security or compliance requirements because you’re just trying to learn how to use cloud right now, and simple is better.

2. Treat your first deployment as a learning experience

The first application you code for the cloud should serve not only as a solution that meets a business need, but also as a learning experience. Just creating the application is not your only goal — you want to learn things that you can use to establish good practices and help you improve your cloud development process. Your cloud applications will evolve, and your expertise and knowledge will evolve with them. Consider how you’ll manage the application over time — using Flexera’s Cloud Management is one option.

3. Use a public cloud to evaluate the feasibility of cloud PoC

Once you’ve zeroed in on an application to build in the cloud, your next decision is where to build it. You have a choice of public clouds, such as Amazon Web Services’ (AWS) Elastic Compute Cloud (EC2), Rackspace, Google Compute Engine (GCE), and Windows Azure, as well as a choice of private clouds based on OpenStack, CloudStack, and VMware vSphere.

Even if a private cloud is your ultimate goal, consider starting your cloud development in the more agile world of a public cloud. Public clouds use many of the same hypervisors and orchestration technologies as private clouds, so you can dabble with cloud technology with less up-front investment of time and equipment and see how applications function in a cloud architecture. Start with a simple application and make it work in the public cloud. Build on your success for the next stage and then iterate, adding complexity as you grow.

Eventually you may want to deploy your cloud PoC application, or some other service, to a private cloud. Private clouds are good choices for applications that need high performance. Unlike public clouds, which offer a limited number of hardware options, you can put as much power into your private cloud as your budget allows. And if security and compliance are factors, a private cloud might be a better fit, depending on your constraints.

4. Don’t try to re-create your data center in the cloud

A cloud instance is not a virtual machine in the sky. Unfortunately, you can’t simply move a virtual machine (VM) image to a cloud and expect it to work out of the box.

Traditionally, IT has built its systems from the bottom up, starting with hardware, installing hypervisors and operating systems, and finally launching applications. Successful cloud deployments turn that stack on its head, focusing first on the applications and, based on their needs, selecting the cloud infrastructure on which they would best run. The result is a highly available, highly scalable architecture at an economical price.

5. Test against technical requirements

Once you have your PoC application running on a cloud you can start to refine it. Consider the following:

Test it for performance. Common technical pitfalls are many. The biggest challenge is likely to be storage performance. You may not get the level of performance you’re used to with your existing SAN. As an alternative, consider a cloud provider that can offer tunable IOPS performance or one that provides a combination of bare metal and cloud servers. Use bare metal servers for high-performance storage along with cloud servers for elastic workloads.

Organizations often share storage in data centers by mounting the same volume on multiple servers at the same time. You can’t always do this with cloud storage, but you can get around this limitation by using shared file systems such as GlusterFS to share storage on the cloud.

Ensure that it meets your security and compliance requirements. If you need to meet security and compliance requirements, consider disk encryption and virtual private networks (VPN) to keep data secure both at rest and in transit.

Once everything is running smoothly, you can consider developing more complex workloads.

6. Measure success based on broad business goals

Once you’ve rolled out your first PoC in cloud project, how do you judge its success? The best measure is whether you’ve gained the big-picture benefits that were your goal for starting the project.

Review business agility— How quickly does the cloud help you respond to business needs and opportunities? Look at the speed and ease with which you can launch or change applications or services in the cloud, scale them up or down to meet changing demand, and offer services in new geographical areas.
Consider whether you can now give both business users and developers self-service access to resources they need, and whether you can automate routine tasks for the operations staff.
Evaluate cost efficiency. The public cloud makes the costs of running infrastructure transparent, so you can compare public cloud costs to what you’d need to pay to run the same application in your data center. A less tangible measure to evaluate is opportunity cost — if you use cloud, do you gain opportunities you would not have with traditional infrastructure?
Consider the cloud’s effect on the efficient use of your staff’s time to plan, prepare, and deploy applications and services in the cloud and manage those services compared with performing the same tasks in your data center.

Your Reward

If you develop your cloud PoC with attention to these tips, you can implement new types of solutions with cloud that you could not implement at all without it, such as highly scalable applications for web, mobile, social, and gaming. You can offer greater scalability and availability for your applications and minimize location-based latency to open up applications to users in a broader range of geographical areas. Cloud can even enhance the availability of existing data centers by providing an on-demand disaster recovery environment. And for all these uses, Flexera can add value as your cloud management partner.

It’s time for a holistic view of your IT assets—or else

Kevin Miller — Tue, 19 Oct 2021 14:00:41 GMT

We’re experiencing a technological revolution like never before. Organizations must constantly adapt in order to stay ahead in the rapidly evolving IT landscape. Keeping your technology assets secure, well-governed and cost effective is no easy feat.

And these days, complete visualization of your IT environment can be the difference between your organization’s success—or its failure.

The new tech frontier requires better IT visibility

Flexera’s inaugural 2021 State of IT Visibility Report compiled survey results from 300 global technology decision makers and users to get a better understanding of the consensus around all things IT visibility. The report discovered not as many organizations have as much of a holistic view of their estate as you may think.

In fact, less than 25 percent said they have complete visibility into their IT assets and their impact on business outcomes. Nearly three-fourths of respondents felt they had somewhat to complete visibility into on-premises hardware assets and 68 percent felt the same for on-premises software.

But IT visibility significantly declines when it comes to cloud instances and SaaS.

Threats are everywhere

Lack of visibility into cloud and SaaS is a huge concern. It’s no secret that dangerous security risks and vulnerabilities are increasing at a blistering pace. The report found over 21,000 vulnerabilities detected in 2020-21. And when asked to cite their greatest concerns about IT assets, survey respondents ranked vulnerabilities and software sprawl first and second, respectively.

With all the important business initiatives that rely upon your IT assets, leaving even a small percentage exposed to threats can be a costly mistake. Not to mention wasted spend and space.

The importance of complete visibility cannot be overstated. Most respondents from the report said understanding how their business services are powered by their IT assets—and the free flow of IT asset data to existing tools—were moderately, fairly or very valuable.

The best way to manage your IT estate is to understand how it’s all connected. When you have better visibility of your IT assets you can make better informed decisions.

If you can’t see your assets, how can you expect to know when they will reach end-of-life or end-of-support dates? How will you know when an application has multiple, duplicative versions installed? Or when something is vulnerable to costly attacks from hackers?

Without complete IT visibility, you won’t.

IT leaders need comprehensive, clear insights into their technology to fuel the data-driven decision making that leads to better results. To see more highlights from the inaugural report, check out our latest infographic or download the full report below.

2021 State of IT Visibility Report
2021 State of IT Visibility Report

2021 State of IT Visibility Infographic
2021 State of IT Visibility Infographic

Data Driven Cloud Financial Management

Jeremy Chaplin — Thu, 07 Oct 2021 14:00:47 GMT

You may have read our previous blog posts Introducing FinOps and FinOps at Flexera: Our Journey to Cloud Cost Optimization. In this next installment in the series on cloud financial management, we’ll share more about that lifecycle and how to use key performance indicators (KPIs) to ensure you remain on track to achieve your FinOps goals.

Using KPIs to measure and drive success isn’t a new topic, but in a fast-moving cloud environment, it can be very difficult to establish the success or otherwise of your well-intended processes and actions without having the appropriate cloud financial management measures in place.

The FinOps Lifecycle

There are three main stages of the FinOps lifecycle—inform, optimize and operate—and while some customers who already have good visibility of their cloud spend may jump straight in to the optimize or operate stages, we recommend you start at the inform stage—you can’t manage what you can’t see, so this stage is vital to ensure you have full visibility of your spend and can categorize it by dimensions appropriate to your business.

Source: FinOps Framework by FinOps Foundation

Inform

During this stage of the cloud financial management lifecycle, you’re looking to ensure you have complete visibility of all costs (a robust tagging strategy is essential here), and that those costs are allocated to appropriate business units, cost centers or other relevant categories.

Some suggested KPIs to help you track progress at this stage are as follows – use percentages carefully, often the actual costs are more informative:

The percentage of resources, or cost of:

All untagged or non-compliant resources (i.e., wrong spelling or case) tagged resources
Any unallocated costs, i.e., those not associated to a cost center or relevant dimension

Amount (percentage or dollars) of total cloud spend charged back (or not)
Cloud spend rate (daily/monthly)

At this stage, it’s important to consider the longer-term goal of establishing unit economic KPIs—what some may define as the nirvana stage of FinOps—whereby cloud spend can be reported using a business metric such as cost per customer, cost of goods sold (COGS), etc. While you may be a long way from reporting at this level, it’s worth considering which unit economic KPIs may be useful in the future so you can plan your tagging strategy and cost-allocation activities for implementation at a future stage. Changing these at later stages can be time consuming and harder to justify.

Optimize

At this stage in the lifecycle, it’s important to be clear on the business outcomes you’re looking to achieve, and these will likely change over time. If you’re in the early stages of a cloud migration, it may be that agility—getting your applications and services into the cloud quickly—is the primary objective. For others it may be workloads that have been migrated and are costing more than expected, and so cost control may be important. It may also be a combination of both if different teams or lines of business are at different stages in their cloud maturity.

Setting spend goals here can help facilitate those outcomes. Balancing speed, cost and quality aren’t new challenges for any IT organization, but with visibility of cloud costs during the inform stage, you should be better able to find the right line between these constraints. Accelerating your migration program and using more expensive cloud services are options when you need to go faster and know how this impacts cost. These goals may be specific spend thresholds (dollar amounts) for those who are migrating to the cloud but may also be savings targets (percentage of spend) for those already in the cloud and looking to optimize spend.

Once you’ve established these goals, the optimize phase is also about identifying opportunities to reduce spend when you find yourself exceeding expected cost thresholds or budgets you’ve set. There are two main ways to do this—usage optimization (i.e, consume less resources) or rate optimization (pay less for the resources consumed). The details behind these approaches will be a topic covered in a later blog, but some KPIs you might want to consider putting in place to track the impact of these levers are as follows:

Percentage of compute usage covered by discounts (RIs, CUDs, SPOT, etc.)
Savings realized by discounts—subtract discounted costs from the list price
Discount achieved as a percentage of costs—i.e., list price/discounted price x 100

Compute costs per hour or month—useful for trending over time
Budget variances and forecast accuracy

Operate

At this point in the lifecycle, you get to implement the identified savings opportunities and, importantly, define and establish repeatable processes that will enable you to iterate through the lifecycle effectively. As these processes mature, you can also explore opportunities for automation to reduce the resource overhead.

To track the effectiveness of this stage of the cloud financial management lifecycle, you may want to measure the potential savings opportunities over time (by team or service or other dimension) versus the savings realized over time. Teams that act upon the recommendations made in the optimize phase should see their potential savings and actual savings realized increase, but unit costs (cost per instance hour) could be used to articulate the effect of acting on the recommendations.

Some example KPIs to track over time:

Savings recommendations (dollars)
Savings realized (percentage)
Savings realized as a percentage of recommendations
Unit costs (cost per compute hour, cost of goods sold)

You may also wish to consider a balanced scorecard approach. In many cases, the savings opportunities of each team will be directly related to the amount of spend, and so weighting their scores based on their percentage of overall consumption of your cloud bill will provide a more balanced view of how effective teams are when implementing savings recommendations.

As you iterate through the lifecycle each time and your confidence grows in the recommendations being made and implemented, you may choose to then automate certain areas of the operate phase—using tooling to implement “lights on/off” policies, deleting unattached volumes and releasing unused IP addresses. These are just some examples of commonly automated tasks, and as your confidence grows, you’ll want to continue to develop your automation capabilities as this will enable you to operate at scale as your cloud consumption grows.

To hear more about how Flexera’s cloud cost management solutions can help you implement and adopt a successful KPI-led FinOps strategy, contact our cloud team.

Flexera knows Kubernetes are in the IT estate. Do you?

Harrison Leachman — Thu, 30 Sep 2021 14:00:44 GMT

Containers post a significant challenge for IT

Many organizations now face unprecedented challenges. Employees are working remotely almost entirely, and IT needs to keep up with the demand for new devices, software and more. IT also needs to keep an eye on utilization, maintaining governance and optimizing spend.

All these demands are coming on top of managing assets in complex environments as more disruptive technology enters the mix. And containers are causing chaos in IT environments right now; managing licenses on-premises and in the cloud is demanding enough for most organizations, but it’s even more difficult for IT to get visibility into the software they have running in containers.

Container management can be precarious for an organization, and you can easily lose sight of applications and whether or not you are license compliant. Additionally, with an uncertainty of how container-based licensing is going to play out, there are compliance and cost issues that may result.

Here’s how Flexera helps with container management

As demonstrated by our latest release, Flexera is focused on helping organizations discover and visualize software running in containers.

With Flexera One, you can discover assets running in containers with expediency and accuracy, including those in Kubernetes. Additionally, we now provide a single source of truth for IBM product container licensing and reporting as well as granular transparency into Kubernetes OpenShift-orchestrated containers. With Flexera One, you can be sure that no stone is left unturned when it comes to visibility within your organization’s containers.

Our latest release introduces a new tool for collecting Kubernetes cluster and container image software inventory – the Flexera Kubernetes inventory agent – initially available on Linux x86_64 platforms. This is in addition to the existing FlexNet inventory agent, which remains available as always.

The Flexera Kubernetes inventory agent brings new functionality in three key areas:

Resources—The Flexera Kubernetes inventory agent uses the Kubernetes API to collect resource information assigned to each cluster to report on nodes, pods and annotations assigned to images.
IBM License Service—For license compliance for IBM products running within Kubernetes clusters, use of the IBM License Service is mandatory for tracking/reporting sub-capacity consumption of purchased entitlements for the IBM VPC or IBM PVU licenses in use.
Inventory—The Flexera Kubernetes inventory agent can return software inventory from both the nodes and from container images running in your Kubernetes cluster(s).

Visibility regardless of provider

As part of our latest release regarding containers, we’ve also ensured that our product is up to date with the latest version of AWS Kubernetes EKS. You can be assured that our unified discovery clusters continue to run with a supported version of Kubernetes.

Want to see how we can help you with container management?

Build Your Next Software Installation in the Cloud

Kendra Morton — Wed, 29 Sep 2021 17:52:41 GMT

The global pandemic’s impact on business continues to surface in both small and big ways, including security issues, work-from-home challenges, reopening approaches, and profit losses. Because of this new normal many organizations are engaging in strategies to migrate to the cloud and more seriously consider paths to digital transformation. For…

Hot Off the Presses: Revenera’s 2021 Monetization Monitor on Software Monetization Models and Strategies

Michael Goff — Tue, 21 Sep 2021 13:03:17 GMT

Revenera’s Monetization Monitor is an annual series of reports based on surveys of software suppliers’ monetization and deployment models and their adoption of product usage analytics. We just announced the first report for 2021 that focuses on Software Monetization Models and Strategies, with a second report on Software Usage Analytics…

How developers can drive open source compliance

Kendra Morton — Mon, 20 Sep 2021 18:25:21 GMT

Perhaps you’ve seen the delightfully clever new ad for the iPhone and Apple Watch integration, in which a farmer taps a button on his watch that then signals his phone, lost in a huge haystack, to beep. He reaches in and finds it in seconds. Pre-Apple Watch, we might characterize…

The 7 questions you must answer when planning your IT for 2022

Kevin Miller — Tue, 07 Sep 2021 14:00:23 GMT

Imagine you’re a football coach preparing for the next big game. Before you drafted your game plan, you’d need to know the capabilities and strengths of your offense and defense. You’d want to understand how they perform under pressure. You’d seek an assessment of how each player executes his position, and what their specific weaknesses were.

And if your responsibilities included management of the roster, you’d need to assemble the best combination of players that fit within the salary cap.

As a seasoned coach, you’d understand that you couldn’t possibly expect to get to the postseason without this critical intelligence. And if you drafted your game plan without it, there’d be little chance of victory.

How are you planning to win?

We’d likely all agree that this kind of comprehensive asset assessment is essential for game planning.

But year after year, IT executives draw up their annual plans with a shocking lack of visibility into their organizations’ IT infrastructures, the individual assets that comprise them, their per-unit costs and their many complex interdependencies.

The last year and a half have been the most challenging for business in virtually anyone’s memory. Unprecedented demands were placed on IT infrastructures and the executives who manage them, and the expectations for IT are only increasing as we enter a post-pandemic era.

As the stakes grow ever higher, it’s essential that IT leaders use the best data, tools and resources available to get the comprehensive visibility and responsive control that allow for a strategic IT planning framework.

Every day is game day

Because this competition is personal. You’re being asked to do more with less, and your competitors certainly aren’t standing still. Your reputation and the success of your team and, ultimately, the ability of your organization to effectively compete are all at stake.

That’s why Flexera is committed to providing the tools and resources—along with the unparalleled IT asset data—that enable IT professionals to deliver the most value to their organizations.

At Flexera, we call that technology value optimization (TVO). When you achieve TVO, you multiply the return on your IT investments and free up funds to accelerate strategic initiatives like digital transformation, digital experience, cybersecurity and cloud migration.

But TVO and a strategic IT plan can be achieved only by having the answers to the following seven key questions.

1: Do we know exactly what’s in our IT estate?

IT infrastructures are sprawling, impenetrable networks full of blind spots, wasted spend, unanticipated vulnerabilities and missed opportunities. Comprehensive visibility across the entire estate, from on-premises to SaaS to cloud, has long been regarded by IT leaders as an impossible dream. But the unprecedented view delivered by Flexera One’s IT Visibility application—powered by current, refined, enriched IT asset data—gives you the command and control you never thought possible, and makes planning infinitely more effective.

2: Are our software licensing costs optimized?

Software licensing agreements are confusing and opaque by design, putting customers at a decided disadvantage in negotiating price, tracking usage and withstanding audits. Flexera One’s IT Asset Management application levels the playing field, helping organizations rightsize usage, establish effective license positions and negotiate from a position of informed strength.

3: Can we control our organization’s SaaS costs?

When anyone and everyone with a company credit card can buy a SaaS app, how in the world can IT control costs and defend against threats? With the resources delivered by Flexera One’s SaaS Management capabilities, which enable you to support the agility of SaaS adoption while governing its costs and usage.

4: Are our cloud costs optimized?

Public cloud, private cloud, hybrid cloud—it takes a wizard to understand the complexity of it all and give business units the capacity they need while keeping costs in check. Flexera One’s Cloud Cost Optimization application makes you that wizard, with the power to optimize usage, institute rule-based chargeback and policies, establish alerts for cost and compliance, and so much more.

5: How can we optimize our migration to the cloud?

Migrating interdependent workloads to the cloud is a dauntingly complex task, and a single misstep can prove costly for an organization. Flexera One’s Cloud Migration and Modernization application removes the guesswork, giving you the cost analysis, workload placement and prioritization that allow you to chart your course to the cloud with confidence and cost efficiency.

6: How can we get more from our investments in ITSM and ITFM?

Want to turbocharge your IT service management and IT financial management solutions? Fuel them with the enriched IT asset data provided by Flexera One’s IT Visibility application and see the difference. But don’t expect miracles from your ITSM and ITFM platforms alone. They cannot by themselves provide the comprehensive visibility and responsive control you need to plan effectively, despite the claims their salespeople may make.

7: What are the costs of doing nothing?

With each passing day, your IT estate increasingly resembles an unharnessed beast. The gap between your allocated software licenses and actual usage widens, exposing you to the risk of costly true-ups. Your cloud costs spiral further out of control. SaaS adoption accelerates without brakes. And every unoptimized dollar spent reduces your ability to help your company grow.

Plan to win

How much more effective and precisely targeted would your strategy and budget be if you had comprehensive visibility of your entire IT estate? It’s time to find out.

Our free, comprehensive guide helps you get the answers you need to accelerate the return on your IT investments and achieve technology value optimization. See how better-informed decisions can give you and your organization the greatest chance of sustained success.

IT planning guide
IT planning guide

Want more 2022 planning?

Intro: The 7 questions you must answer when planning your IT for 2022
Q1: Do we know exactly what’s in our IT estate?
Q2: Are our software licensing costs optimized?
Q3: Can we control our organization’s SaaS cost?
Q4: Are our cloud costs optimized?
Q5: How can we optimize our migration to the cloud?
Q6: How can we get more from our investments in ITSM and ITFM?
Q7: What’s the cost of doing nothing?

Automation is King. Good News for Today’s Software Development Teams.

Kendra Morton — Mon, 23 Aug 2021 14:04:36 GMT

When most of us want to leave 2020 behind as a year of unquestionable struggle, we can’t ignore the impact it’s had, specifically on the need for organizations to step up their efforts to meet changing digital transformation requirements. We’ve been talking about it for a while. You may think…

Piracy’s Last Stand: Why Piracy Will Be Irrelevant by 2030 and What to Do About It Now

Victor DeMarines — Mon, 02 Aug 2021 11:01:42 GMT

Here’s a bold pronouncement: In less than 10 years, we won’t be talking about enterprise software piracy much anymore. Certain regions will continue to see piracy, but I predict that a downward trend in piracy globally will only accelerate. In 2013, 43% of the software installed on computers around the…

Revenera Software Container Delivery Helps Accelerate Revenue Recognition for Containerized Software

Michael Goff — Tue, 20 Jul 2021 13:10:30 GMT

We’re excited to announce the availability of Software Container Delivery today. It’s the first solution to deeply integrate the delivery of software containers with entitlement management, providing a fully automated provisioning and monetization process and a single source of truth for reporting for software producers that deliver Docker containers and…

Will your customers want proof of a secure software supply chain?

Kendra Morton — Thu, 24 Jun 2021 15:31:35 GMT

A little more than a week before the Colonial Pipeline attack, two government agencies issued an overview and guidance on how software buyers and vendors could identify, assess and mitigate software supply chain risks. In that 16-page document, “Defending Against Software Supply Chain Attacks” the National Institute of Standards and…

How Ikon Science Unearthed More Licensing Flexibility and Automation for Its Customers

Michael Goff — Tue, 22 Jun 2021 19:00:27 GMT

For more than two decades, Ikon Science has been the leader in helping those in the energy exploration and production industry get the insights they need to push the field further. The UK-based, global firm delivers software and services that help energy companies collect and consume a complex and continually…

Get Some Open Source License Compliance Advice

Kendra Morton — Wed, 02 Jun 2021 19:11:31 GMT

Going way back to the days of in-person trade shows and random encounters that led to meaningful conversation with like-minded strangers, one chat I had at 2018’s Open Source Summit always stands out in my mind, and I often reflect on what that attendee said: “Open source is not just…

New Scheme from Microsoft: ms-appinstaller

Venkat Ram Donga — Wed, 02 Jun 2021 17:47:51 GMT

While building your packages is the first step, the next logical step is distributing your packages. You want to make this process trivial for your users. What if your users could directly install from the web. Let’s learn how! New Scheme from Microsoft – ms-appinstaller Microsoft makes this possible by…

Everything You Need to Know About Software Licensing

Ravi Trivedi — Fri, 28 May 2021 13:57:14 GMT

Perhaps you’ve seen the documentary The Last Blockbuster, which tells the story of the video rental giant’s demise through the lens of the last remaining store and the people around that store. An interesting aspect of that documentary is not Blockbuster’s end, but the video rental’s beginnings. The video rental…

The New Cybersecurity Executive Order: 2021 is the Year of the SBoM

Kendra Morton — Thu, 13 May 2021 23:38:18 GMT

Back in February my colleague Alex Rybak posted a blog titled 2021 Will Be the Year of the Automated Software Bill of Materials. Well, yesterday, in an executive order signed by President Biden, that prediction got a lot closer to reality. The order—focused on cybersecurity—includes new security requirements for software…

6 Tips for New Software Monetization Models in 2021

Victor DeMarines — Thu, 22 Apr 2021 14:48:45 GMT

Right now, the dominant monetization models for software providers (perhaps not surprisingly), are perpetual licensing and subscription-based licensing. But within the next 12 months, the move toward usage-based licensing will accelerate, growing as much as 48%, according to our 2020 Monetization Monitor survey, alongside continued growth in subscription licensing (at…

Look Who’s Talking: SoftSummit 2021

Michael Goff — Tue, 30 Mar 2021 12:17:11 GMT

We are excited for you to join us at SoftSummit 2021 on April 15. This year’s virtual event brings together an amazing array of speakers on software monetization topics for a global audience. Be sure to register today so you don’t miss it. We’re focusing on the adoption of new…

Tracking Desktop Applications with Google Analytics: What You Should Know

Dan Barrett — Tue, 09 Mar 2021 15:00:00 GMT

By far the de facto name in analytics is Google Analytics and for good reason. As a solution Google Analytics provides many benefits to users with a wide variety of reports, from out-of-the box metrics to fully customized reporting. It starts at a nice price, too: free (if you are…

Why make your code open source?

Revenera — Mon, 08 Mar 2021 18:10:59 GMT

There are several reasons why companies or developers publish their own code as Open Source: Open Source-Code is a good way to build the brand and awareness for the company or a developer. If a project becomes popular, a community of likeminded developers will take on a lot of work…

Unpacking MSIX: What the MSIX journey will bring in 2021

Venkat Ram Donga — Wed, 06 Jan 2021 19:42:28 GMT

Two years after Microsoft debuted its next generation app deployment package, MSIX continues to gain acceptance and adoption because of the benefits it brings in terms of security, ease of use and reliability in application installations. Some 75% of those surveyed in a recent Revenera poll plan to bundle software…

Introducing “MSIX Central”

Venkat Ram Donga — Wed, 02 Sep 2020 19:17:48 GMT

Back in 2018, MSIX was announced by Microsoft as the next generation deployment package. MSIX is a Windows app package format that provides a modern packaging experience to all Windows apps. It enables organizations to stay current and ensure their applications are always up to date. At Revenera, we introduced…

MSIX Values – Modification Packages

Venkat Ram Donga — Wed, 01 Jul 2020 14:18:02 GMT

Introduction In my previous blog, I talked about Package Support Framework and how MSIX solves the problem of running traditional Win32 apps by a community driven route. Now I would like to focus on another important piece of MSIX—Modification Packages and why they are important if you are an ISV…

Apple’s Application Notarization for macOS

Venkat Ram Donga — Thu, 25 Jun 2020 17:30:40 GMT

If you are a software vendor developing apps for Apple’s macOS, you may be well versed with the processes involved with distributing to App Store. However, if you are among those who don’t want to publish your apps to the store and prefer a sideloading approach, by this time, you…

InstallShield 2020 Release Offers Fast and Reliable Installs for Windows® Apps

Venkat Ram Donga — Wed, 13 May 2020 14:21:04 GMT

Let’s face it. Everything we do in business focuses on delivering the most complete customer experience possible. For software companies competing in today’s business environment, that’s being challenged. They are under pressure to do more with less while accelerating time to market. Solutions that cater to their ability to meet…

MSIX Values: Introduction to Package Support Framework (PSF)

Venkat Ram Donga — Thu, 26 Mar 2020 18:04:04 GMT

In the last article, we talked about how MSIX is the next gen deployment package. We touched upon few perks of using MSIX. One item we didn’t go into detail is how MSIX manages to run Win32 apps with breeze and what the shortcomings are. Running Win32 Apps Well, if…

MSIX Values: The Basics of MSIX

Venkat Ram Donga — Wed, 11 Mar 2020 19:28:14 GMT

Introduction We are pleased to announce a series of MSIX articles where you can find short and crisp information about MSIX as a deployment type and why you should care. Some articles will illustrate examples and take a deep dive into the technology. Recap MSIX was announced during Microsoft Build…

Flexera Acquires Software Usage Analytics Leader Revulytics

Nicole Segerer — Wed, 05 Feb 2020 19:21:41 GMT

Combined Offering Expands Software Monetization Portfolio and Provides Software Suppliers with Industry-Leading Solutions for Monetization, Compliance and Usage Analytics We have excellent news to share. Today, Flexera announced the acquisition of Revulytics, a recognized leader in Software Usage Analytics. “This acquisition is a game changer for software suppliers looking to…