Mike Walker's Blog

IFX Meeting in Boston

There will be another face-face meeting on November 5th. I was on the web services working group but I switched over to the architecture group at IFX. We are doing some really exciting things with the standard. We are in the process of moving from the legacy 1.0 standard to the future 2.0 standard. We hope to incorporate some of the new WS-* standards. We shall see though. I will keep you posted!

What in the world is Vishing?

Vishing, the latest in phishing attacks but over voice networks is getting some attention in the press more and more. The word vishing which is is short for "voice phishing" is a relatively new term. In this new twist, identity thieves are sending spam that warns victims that their bank account or PayPal accounts were supposedly compromised. However, unlike typical phishing emails, there is no website address in these phishing messages. Instead, the victim is urged to call a phone number to verify account details. The automated voice message says: "Welcome to account verification. Please type your 16-digit card number." The goal is to get the victim to enter their credit card number.

I have been meaning to post some comments on this topic for about a month or so but haven't got around to it. So the other day I ran across an article in USA today (http://www.usatoday.com/tech/news/internetprivacy/2006-07-12-vishing-scam_x.htm) about this, it is interesting. This is (or should be) a growing concern for Financial Services organizations. I know from a consumer perspective I am worried.

So let's frame this up and see how can we detour such behavior? Well let's look at the issue. You have criminals either sending out e-mails or setting up fake sites to get you as the consumer (i.e., victim) to call into a VOIP system. So when I look at this there is a good chance that the banks systems are not even touched. So how would the bank know that you have been vishing victim? The answer is that they would not.

So if there are no automated ways to tell if this is happening thus essentially keeping the bank out of the loop technology has a minimal role in deterring this behavior, right? I believe this is more of a behavioral problem with consumers. The way to detour this is to keep customers up to date with the contact information on the online presence of your banks website and statements that are sent to the customers homes. Have a strong communication plan for incidents. Keep a listing of fraudulent vishing numbers and post them on the banks website.

The bottom line is technology can help facilitate this but it is up to the banks to have a communication and action plan in place.

FSTC Enterprise Architecture Workgroup Session Update

The FSTC Enterprise Architecture workgroup session by far has been the most interesting and enlightening session I have attended regarding enterprise architecture in the past year. It was great having the agenda set by real enterprise architects, not the analyst community nor vendors. Since I previously came from a bank as an enterprise architect, I was surprised how little things have changed since I was last one.

For many organizations people are still the key. When I say people I mean that enterprise architecture is more than merely technology. Technology is actually a small component. An EA must must have business savvy, they must be able to demonstrate thought leadership and foster community within an organization. Soft skills are more important than hard skills in this role because you do not have a team of reports that can execute on the "right" objectives. You must lead through influence.

With that said, it is very hard to measure EA effectiveness. Since there are many soft skills used. As an industry we are still trying to figure out which are the right metrics. I think we are getting close, but it will still take some time. The reason I say this is because we still do not have a common understanding of "What is Enterprise Architecture". Each organization has a slightly different meaning. What we have all agreed on is that the role is a tough role to fill. It must be filled by a highly competent, charismatic, well trained in many areas of technology, tooling and methodologies.

We reviewed a survey that was sent out to many of the top ten banks in the US. The results were surprising. The industry wants change but needs a few things to get jump started. I will also say that the top five banks are a different classification of other size banks. These banks in the top ten are much more mature in the development arena for the most part. There are a few exceptions out there though. Mid size banks usually buy before for they build. So the needs of a mid or small size bank have different EA issues in their environments. I may or may not comment on that in a later post.

Unfortunately I can not share the details of the survey. I will say that it is valuable information and if you would like more information and if you are an Enterprise Architect, Chief Architect or CTO I would recommend joining FSTC. Like I said earlier, it is a bunch of us senior level architects in a room talking about real world issues and sharing ideas on how to solve them. I am now with Microsoft (as you know), however I can relate with many of these concerns and I intend on using my resources here at Microsoft to aid in this cause.

JUST RELEASED: MSDN Banking Industry Center for Architects

The new site MSDN Banking Industry Center will provide prescriptive architecture guidance addressing current and emerging challenges the industry faces. Customers, partners, and system integrators will be able to view webcasts, whitepapers, blogs and podcasts that address banking concerns.

Serivce Oriented Architecture in Banking

I was recently saw a post on the MSDN forums about SOA and Banking. I thought I would share my response:

That’s a good question. Service oriented solutions are great candidates in the Banking space. There are many reasons for this. Listed below are some of the key reasons (this is not an all inclusive list):

·         Banks are growing at an extreme rate via Mergers and Acquisition

·         Many of the services that bank offer are be proliferated to the edge as B2B services to other banks and insurance companies

·         Banks are looking for solutions that allow them to become more agile, thus many of the Mainframe based applications are being redeployed in a distributed manner either are thick/smart clients or web based clients

·         Faster product and service turn around. SOA is key to this

·         Lowering operational costs thus increasing the efficiency ratio in which many banks are gauged on

·         Last and most important, alignment with the new regulations passed by congress. Rules such as separation of duties and data privacy. This in it’s very nature service oriented.

 

Your later question related to bandwidth at the branches, there are many models and there will be some guidance on this on the Financial Services Architecture Center shortly. But I can tell you from personal experience there are many options at the branch and it really depends on your organizational goals. I hate to be so vague but I don’t have enough background on your specific problem to give you an intelligent answer. If you would like to submit your specific question I can definitely help.

 

Listed below are a list of resources that may be helpful:

http://msdn.microsoft.com/architecture/industry/finservs/

 

Realizing the power of smart clients:

http://www.microsoft.com/net/smartclient_businessvalue.mspx

 

Financial Services Firm Supports Growth Through Microsoft Infrastructure Optimization

HSBC acquired a large local bank in Mexico with more than 1,400 branch locations and wanted to take control of its decentralized IT environment. Manual deployment of software applications and security updates could take months, and the company lacked tools to monitor its IT resources effectively. To improve system management, HSBC Mexico implemented a centralized solution based on the Windows Server 2003 operating system and the Active Directory service, Systems Management Server 2003, and Operations Manager 2005. Now the company can automatically install updates, get new financial service software to market quickly, and cut IT travel costs. It can also monitor systems in real time and plan for change and business growth. HSBC Mexico estimates that effective management of IT resources will help it support up to 30 percent growth with its existing infrastructure.  Full case study and one page PPT slide on the effort is posted at: http://members.microsoft.com/CustomerEvidence/Search/EvidenceDetails.aspx?EvidenceID=14540&LanguageID=1

Technorati Tags: SOA,Banking,ESB

Microsoft ESB Architecture Guidance

At the SOA/BPM conference we announced that we are providing ESB architecture guidance. This will come in the form of:

• Pragmatic or "Real World" approaches to ESB Architectures that show a more iterative approach rather than the prevalent "Big Bang" approach that is often promised.
• Patterns
• Reusable Code
• Implementation Guides

So what does this mean for the Financial Services industry? Well personally, I believe that this could be very big. There has been quite a bit of demand for this. Specifically around the guidance. The following aspects are specifically important to Financial Services organizations:

1. Comprehensive Guidance - I think the issue with many of the vendors out in the industry is that they treat ESB as a Product or SKU. I'm not saying that without any background or reference or that I work for Microsoft but in the recent past I have been involved in WebMethods implementations and WebSphere implementations. When we purchased these we were sold on the promise that we would be up in running with an ESB in just a few weeks. That couldn't be further from the truth. It took us upwards of 12- 16 months to deploy. This was mainly due to the recommended implementation process, which was top down. Very ivory tower type of stuff. What I like about our approach is that we take a pragmatic view that is iterative. I will discuss this more in other posts.

2. Bringing it all together - Most likely Banks and Insurance companies already have the right technologies to enable ESB's. However, there is the perception in the industry that ESB’s can be bought. The advantage here is that organizations can roll out ESB’s at their own pace. In addition, this framework works well with other integration frameworks. With all of the new BizTalk product updates, partner ecosystem and new .Net 3.0 technologies (WCF, WPF, WF, CardSpace) to usher in the Microsoft SOA story.

3. Adapters, Adapters, Adapters - The list goes on and on. Not only from an horizontal perspective but also from a Financial Services perspective. We have adapters for IFX, ACORD, FIX, SWIFT, FpML, TWIST and more. For more adapter information go here: (http://www.microsoft.com/biztalk/evaluation/adapter/partner/2004.mspx)

3. WCF Technologies - Banks and Insurance companies are not in the business to build technology they are in the business to sell their products and services. This will dramatically reduce the amount of redundant code and improve quality thus will make them more interoperable with their B2B partners. The reason why I pointed out B2B rather than many other areas is due to all of the outsourcing of services or the increased need to poll third party services such as: credit or fraud services.

This is great that we put this together. This is something we have needed for some time now. In the past we have had pits and pieces but not the whole story, now we are starting to change that. We may not have everything yet but we will soon!

 

Technorati Tags: Enterprise Service Bus,ESB,SOA,BizTalk,Guidance

Microsoft SOA Business Process Conference

I will be attending the Microsoft SOA Business Process Conference from October 3rd - 6th. I will be attending part of the time. We will be talking a lot about BizTalk 2006, WCF, Office Server (MOSS) and ESB techniques in the context of SOA.

My boss will also be presenting one of the keynotes.

Sign In