• Provisioning – The provisioning aspect of governance refers to the control and visibility you have into the origin of the source code.

• Inventory – Keeping an accurate and up to date inventory of OSS in your environment enables you to focus your governance efforts around the packages and licenses that have an impact on your Compliance status.

• Requests and Approvals – Instituting a process for requests and approvals fosters communication and accountability while allowing you to proactively evaluate software that enters your environment (often without a purchase request, bypassing existing controls).

• Auditing – Once you’ve established a policy and a process, you need to check up on it, fine-tune it if any problems arise, and verify what you’re finding in your inventory.

1.  Understanding Your Status Quo

• Do you know what OSS is being used today?

• Do you know what licenses are associated with the OSS you use?

• Is there a list?  Do you keep a spreadsheet of OSS?  Who is responsible for maintaining the list of known OSS?

• Do developers declare their usage?  Is there an analysis that takes place as part of the build process?

• Is there a request and approval process already?  Who is responsible for submitting and reviewing requests?  How long does the process typically take?  What organizational groups are involved in this process?

• Finally, even if there aren’t any formal processes, how have these things been handled in the past?

2.  Build Your Business Case

3.  Develop the Process

• Provides an accurate picture at your current inventory

• Provides an intuitive workflow for Requests and Approvals

• Stores information and decisions in a central location where everyone can access it

• Allows you to leverage existing decisions and avoid duplicating efforts of license reviews and package selection

• Includes a regular and periodic review of processes to ensure they are effective

• Follows industry best practices, like those of Bank of America

• Detailed analysis of support options including key questions to consider when evaluating these options


• A comprehensive support worksheet that will help you profile your organization’s open source usage and apply support coverage scenarios


• Case studies detailing how OpenLogic’s aggregated support model helps enterprises that use multiple open source packages but lack expertise or don’t want to tie up internal resources with support issues

• Are your open source deployments properly tuned and optimized?


• Is your team up to speed on the latest versions and related technologies?


• Is your open source policy up to date, effective, and enforced?

• Android came in last in access because its source code is created behind closed doors. That is, public developers don’t get a hold of the code until Google decides it’s absolutely ready to be released to the public. This can sometimes take up to nine months – contrary to the ideology that open source project code should be freely updated and available to all developers, all at the same time.

• Android also ranked the lowest in the derivatives category because Google limits the manufacturers who can have Android Market on their devices. They must meet certain requirements and be certified to be able to advertise that the Market is available. On the contrary, other open source projects allow you to distribute code freely and use the product trademark without adhering to any requirements.

• VisionMobile dubbed Android least open in the community category because of a lack of a tiered system for rights – that is, one’s status doesn’t dictate access.

For auto companies that are using or want to use open source software, it’s important to build open source compliance processes into your development and procurement processes.

The short answer is yes, compliance is necessary even if you don’t distribute.  Let’s discuss some of the reasons.  This question comes up in sales conversations frequently and is usually a result of an internal discussion at a prospect’s company.

1. Bone Up On Open Source Policy Best Practices

2. Evaluate Your Current Open Source Policy

3. That Policy Ain’t Gonna Write Itself

• Which open source licenses are approved for use in your company’s products?

• Is open source distributed in your company’s products?

• Who’s responsible for understanding license terms and conditions and ensuring compliance with them?

• What kind of security or integrity review is required during procurement?

• Are employees allowed to contribute to open source projects?

• Are employees allowed to speak publicly about the company’s open source usage?

In my experience, people having issues with Tomcat web applications are usually experiencing new issues, from old applications, and are definitely some of the hardest to resolve.

• Any cloud - deploy wherever you want, including multiple public and private clouds

• Any technology - Rails, Tomcat, LAMP, Node.js, Django, Redis, memcached, you name it - and no limits on components or versions

• No lock-in - no proprietary scripting languages, no data stranglehold, no friction to porting or exporting anything, multiple support options

• Labor

• Software

• Hosting

• Automation

• Virtualization

• Standardization

Labor
Some estimates show that 67% of global enterprises' IT budgets are allocated to labor with 40% of this budget dedicated to application development and maintenance.  Specifically,  a 2010 IBM internal study of its own distributed infrastructure showed labor to be over 60% of the total operational cost per year.  Cloud technology will decrease the necessary person-to-server ratio over time as more applications begin running on automated platforms in the cloud.  With IT labor spend in excess of 60%, as IBM referenced in their findings, comes the biggest opportunity for cost reductions via increased capabilities of automation and decreased labor dollars earmarked to manage the infrastructure.

Software
The average enterprise has hundreds of applications making software the second largest expenditure for enterprise IT budgets at approximately 16%.  The increased accessibility of software through enhanced virtualization allows companies to leverage a pay-for-what-you-use model and reduce overall software licensing and maintenance costs.  By utilizing cloud based solutions, what was once a previously fixed cost can now be absorbed as a variable cost to be strategically optimized over time.

Hosting
As the complexity of the enterprise grows, so too does the need for a more powerful hosting infrastructure.  It is estimated that hosting accounts for 8% of the typical global enterprise IT budget.  Enterprises are now presented with an alternative to the traditional, fixed, capital expenditure (CAPEX) model that has been so common for enterprise hosting spend previously.  The new integration of public and/or private cloud hosting, will offer the enterprise an operational (OPEX) pay as you go model that can also(software) be absorbed as a variable cost and optimized over time.  The enterprise could also experience a reduction in power and cooling costs due to the increased efficiency in the use of the on site IT infrastructure.

It was only a few weeks ago when Warren Buffet invested $10.7 Billion into IBM, and rationalized the move by saying, “It’s a company that helps IT departments do their jobs better.”