WHITE PAPER Service Virtualization November 2012 Key Capabilities of a Public Sector Service Virtualization Solution John Michelsen CTO, CA Technologies
Table of Contents Section 1: Essential SV Capability 1 Provides development with a more live-like environment 5 Section 2: Essential SV Capability 2 Enables parallel development and testing 6 Section 3: Essential SV Capability 3 Virtualizes test data for out-of-scope dependencies 8 Section 4: Essential SV Capability 4 Supports heterogeneous technology and platforms 10 Section 5 Conclusions 11 Section 6 About the author 12 About CA LISA 13 2
Executive Summary Challenge Using traditional methods, government agencies cannot precisely represent real-world operating conditions in their application development and testing environments. As a result, they often face technical problems, security issues, schedule delays and budget overruns caused by: Limited access to mainframes and other production environments Dependencies on components that are still under development Coding stubs or mock-ups of responsive systems Physically duplicating environments in test labs Constraints such as these translate directly into risks that threaten performance, readiness, responsiveness and mission effectiveness. They may also create or fail to detect significant security vulnerabilities. Opportunity Service Virtualization (SV) is the practice of capturing and simulating system behavior, and performance characteristics in order to provide environments with enough realism for development and testing. With SV, teams can develop and test applications under conditions closely simulating the production environment. This allows them to test against a broader range of variables that could affect performance in actual deployment. It frees them to test whenever and however they need to. Benefits SV can benefit any organization that relies on IT by reducing costs, risk and inefficiencies throughout the development and testing lifecycle. For federal, state and local government organizations, SV can also provide security or information assurance benefits. It helps protect mission-critical IT resources by enabling agencies to: Develop and test without exposing live applications or data to threats or inadvertent harm 3
Key Capabilities of a Federal Service Virtualization Solution Benefits cont. Streamline secure development and testing of classified systems Reduce or prevent disruptions to essential systems and operations Mitigate a far broader spectrum of threats and risk with more development options and comprehensive testing Address a much wider range of likely or disastrous scenarios To realize the fullest range of these benefits especially security government organizations should make sure their SV solution includes these four essential capabilities: Essential Capabilities 1. Provides development with a more live-like environment Supporting These Critical Success Factors: Higher quality development and more effective regression/system testing 2. Enables parallel development and testing Reduced cycle times, earlier defect discovery, efficient use of resources 3. Virtualizes test data for out-of-scope dependencies 4. Supports heterogeneous technology and platforms Faster setup/teardown, more stability for test automation Better realism and quantity of performance testing at dramatically lower cost Note: Two other criteria should be considered table stakes for SV. Since no application development and testing environment is an island unto itself, it s critical that SV solutions provide a vendor neutral foundation for the tools of choice agencies already have in place. SV solutions must also provide target environments that work alongside existing agency application lifecycle solutions such as test management, defect management/issue tracking or leading hardware and test lab virtualization products. Both the benefits and protections of SV depend on these four capabilities. They help agencies infuse their development and testing environments with enough realism and context to: Push development forward more rapidly Begin testing sooner in the development lifecycle Accelerate integration and release processes Eliminate vulnerabilities and drive quality 4
Section 1: Essential SV Capability 1 Provides development with a more live-like environment Challenge As application development trends toward more composite, service-oriented architecture approaches, government organizations must simulate a much wider range of upstream and downstream systems in their development and test environments. To provide the most realistic or live-like possible platform, agencies should apply SV at or between any system layers where dependencies exist. Following conventional approaches (without SV), agencies risk falling into a cascade of stubbing down through the layers of a system or application. For example, if a team is developing a Web user interface (UI), it may try to move forward by building a stub that simulates expected responses from the next layer down (in this case, the Web service). In turn, the Web service developers may stub out either their own underlying layers or even mock up user requests from the Web UI above. In this way, mismatched and redundant stubs and mock-ups will proliferate up and down through every layer, introducing both inefficiencies and risk. Such a manual process cannot encapsulate the many types of connections and data that exist within enterprise software architectures. It forces developers to replicate the work of other teams as well as do their own. It may generate or fail to detect significant vulnerabilities. Figure 1. Live-like SV environment before and after 5
Opportunity By contrast, when agency teams work with data scenarios and behaviors captured as virtual services, their productivity level is higher. This is because they re working in an environment that is far more realistic, up-to-date and flexible than one created from sets of stubs that must be manually coded and maintained. Benefits Automation of virtual service creation and data maintenance is the critical technique that powers live-like environments. It enables agencies to: Remove constraints from the development process, moving teams forward instead of working to create or maintain stubs Commence development even when interface systems are unavailable Increase available testing time and reduce cycle times for test execution Reduce data dependency on other applications Improve code quality by increasing test coverage and regression testing Build a simulator quickly with low maintenance effort Section 2: Essential SV Capability 2 Enables parallel development and testing Challenge Traditional methodologies prevent development and testing teams from working simultaneously. Teams must wait for others to finish their work before they can complete their own assignments. That makes each component a prerequisite for the next, slowing the software lifecycle to a crawl. This makes it difficult for agencies to respond quickly to requirements, deliver new solutions at greater value or support the mission with constrained budgets. Opportunity With parallel development and testing, virtual services serve as go-betweens that link the system under development and the system under test in a symbiotic fashion. Here s an example: One agency team is upgrading an existing transaction management service (TMS) while another is developing and testing an e-commerce app for citizen service. The e-commerce team captures a virtual service from the existing TMS system to use as an initial back-end for testing activity. As its tests proceed, the e-commerce team communicates any new response requirements as feedback virtual service requests to the TMS team. The TMS team incorporates the feedback requests it receives into its requirements for the upgrade of the TMS system. This creates a virtual cycle that accelerates development and testing for both teams. New iterations of virtual service model updates are released with each build, based on immediate feedback from the previous versions. 6
Figure 2. Parallel development process The e-commerce team captures a virtual service from the existing TMS system to use as an initial back-end for testing activity. As its tests proceed, the e-commerce team communicates any new response requirements as feedback virtual service requests to the TMS team. The TMS team incorporates the feedback requests it receives into its requirements for the upgrade of the TMS system. This creates a virtual cycle that accelerates development and testing for both teams. New iterations of virtual service model updates are released with each build, based on immediate feedback from the previous versions. Benefits Parallel development allows agency teams to execute against virtual services when live services aren t ready or don t support a component properly. Then they can immediately switch over to live systems as they become available, functionally robust and data-synchronized. This ability to flip a switch between virtual services and live systems (knowing teams can always switch back) is a powerful catalyst for accelerating effective development and testing. It also helps agencies ensure that lab environments represent production systems and applications as realistically as possible. It keeps development and test cycles aligned with release goals. It enables agencies to: Continuously accelerate test and development cycles Power truly agile responsiveness of agile iterations with continuous integration and builds that address both test results and business requirements Reduce the burden of version control by working with existing ALM and development management tools to make them more effective Increase rate of issue acceptance and resolution prior to production Deliver functionality faster with higher quality and accuracy to specification. 7
Section 3: Essential SV Capability 3 Virtualizes test data for out-of-scope dependencies Challenge Every team that needs to provision a lab for its activities has some systems and associated data that are considered in scope and others that are out of scope. An in-scope system is one that is in active development, change or testing. Figure 3. Out-of-scope not covered by TDM An out-of-scope system is one that is required to support a system under test or development, but is not itself in development or testing. That means the out-of-scope system is considered a dependency for the in-scope system. If it is not readily available or fully functional, development of the in-scope system may be constrained. As an example, an agency team developing and testing a classified application must aggregate needed downstream and user input data scenarios, but it doesn t have ready access to these services. Standard operating procedure would be to import data from in-scope systems and stub or mock out-of-scope systems with a bit of code and a few lines of simulated data. As discussed earlier, this approach introduces as many problems as it solves. Classified systems are especially sensitive to such risks. Opportunity Instead, the agency could use SV to more precisely simulate the behavior of out-of-scope systems with a high degree of intelligence. Then, the in-scope system could interact with the simulation as if it were the real thing. 8
Figure 4. Virtualize out-of-scope test data SV automatically captures relevant downstream scenarios that are out of scope. That eliminates the problem of missing data for the in-scope system. The example above may seem too simple but it s actually how an agency s testing process should interact with external or out-of-scope dependencies. Benefits Virtual models ensure that agency development teams always have on-demand access to relevant datasets for systems under test and that data will cover an almost infinite range of valid data scenarios to support high-volume performance and regression testing needs. SV must include capabilities for incorporating the behaviors and data of all dependencies into the development and test environment. It should provision data from out-of-scope systems and enable agencies to: Eliminate delays, due to lack of access or current data from out-of-scope systems Maintain 24/7 availability of valid test scenarios across multiple test and development teams Prevent conflicts over test data and invalidation of other teams activities by overwriting or changing data in systems Avoid disruptions to critical live systems Support complex processes with stateful transactions that cross multiple technology layers and maintain specific values such as dates, customer IDs, etc. Reduce time spent on data setups and resets by up to 90 percent Cut overall test lifecycle times by up to 40 60 percent 9
Section 4: Essential SV Capability 4 Supports heterogeneous technology and platforms Present a logical, structured discussion of the key industry and business challenges. Start from a broad point of view, and develop the need concepts for a reader who may not have a very deep understanding of the issues or dynamics involved; without talking down to the reader, we must make sure that we provide a solid fundamental explanation of the key elements of the issue at hand.] Challenge Heterogeneous systems are the norm in enterprise IT environments. Therefore, a SV solution must be able to support a broad variety of dependencies that might impact the system under test. This includes Web traffic (HTTP), Web services (SOAP/XML), integration layers and enterprise service bus (JMS, etc.), as well as simulating transactions and connections with underlying mainframes (CICS, CORBA, etc.), databases (JDBC, etc.) and third-party services. Figure 5. Virtualized services for system under test Since every connection point in an agency s software architecture represents a potential point of change or failure, it s critical that SV provides an effective way for teams to virtualize everything else and thereby isolate themselves from dependencies on heterogeneous components. 10
Opportunity Using SV, agencies can consolidate hundreds of pre-production labs into a single, cost-effective and easy-to-manage infrastructure. Each team maintains its autonomy with software-based provisioning on demand for any type of required environment. Projects that are idling (not currently under development, change or test) no longer consume power, generate heat or occupy floor space. Dependencies are captured and reduced or eliminated. Benefits Every team that needs to provision a lab for its activities has some systems and associated data that are considered in scope and others that are out of scope. An in-scope system is one that is in active development, change or testing With service virtualization, agency development teams can be more rigorous and thorough, yet work more rapidly because they now control their own critical path. This enables agencies to: Accelerate delivery with anytime 24/7 access to isolated lab environments for all development and test teams Reduce the cost of conventional pre-production infrastructure, potentially saving millions of dollars per year for larger enterprises Reduce or eliminate service costs and fees of accessing remote systems Allow teams to shift testing left and build in quality at a component development and system integration level far before conventional User Acceptance Testing activities Section 5 Conclusions As government budgets shrink, delivery failures become more catastrophic. Programs overshooting their schedules or budgets may not have a chance to recover. Now more than ever, agencies must get development and testing right the first (and possibly, only) time. The traditional approach of stubbing and mocking dependencies seems to be more effective at generating risk and excuses than results. But agencies can t afford rationales for failure such as these: We were supposed to get the build for the system last month but we just got it last week. Every new build of the system introduced some new things we needed but broke other things we already had working. The stub that other team gave me only has one profile in it, so I can t build or test any of the other scenarios that I really need in order to get this thing done. 11
Service virtualization helps eliminate these problems by enabling agencies to conduct development and testing in parallel across as many teams as they need. Every team associated with a composite application is able to create (and change) their own lab, according to their own requirements, as needed, on demand. Teams don t wait for limited access to production environments or for downstream dependencies to be developed. Service virtualization simulates both as needed. Because agency development teams control the critical path of their development and testing programs, they work faster, smarter and more thoroughly. They expend more of their efforts on actual development or testing, not on creating the tools they need to do the job. They can consider more options, test more scenarios and mitigate more risk, even while working more rapidly. That makes Service Virtualization a technical solution, an economic solution and a security solution for agencies. Section 6 About the author John Michelsen, Chief Technology Officer, CA Technologies As the chief technology officer of CA Technologies, John is responsible for technical leadership and innovation, further developing the company s technical community, and aligning its software strategy, architecture and partner relationships to deliver customer value. John is also responsible for delivering the company s common technology services, ensuring architectural compliance, and integrating products and solutions. John holds multiple patents including market-leading inventions delivered in database, distributed computing, virtual/cloud management, multi-channel web application portals and Service Virtualization (LISA). In 1999, John founded ITKO, and built LISA from the ground up to optimize today s heterogeneous, distributed application environments. Under his leadership, LISA s platform for agile development grew in breadth and depth. The company was acquired by CA Technologies in 2011. CA LISA s suite reshapes customers software lifecycles with dramatic results. Today, it delivers impressive ROI for customers and is a lead offering in the Service Virtualization market. Prior to ITKO, John led SaaS and E-commerce transformations for global enterprises at Trilogy and Agency.com. He also founded a boutique custom software firm that focused on distributed, missioncritical application development projects for customers like American Airlines, Citibank and Xerox. John earned degrees in business and computer science from Trinity University and Columbus University. He has authored a best practices book, Service Virtualization: Reality is Overrated. He has contributed to dozens of leading technical journals and publications on topics ranging from hierarchical database techniques and agile development to virtualization. 12
About CA LISA The CA LISA platform is the first and leading service virtualization solution, helping customers to reshape their enterprise application development lifecycles. CA LISA Service Virtualization software optimizes complex and cloud-based applications throughout the software lifecycle, helping eliminate costly constraints and defects, while improving agility in an environment of constant change. CA LISA solutions help eliminate software dependencies, decrease release times and increase the reliability of composite applications that leverage cloud computing, SOA, BPM, integration suites and ESBs. CA LISA s global customers include five of the top six Fortune 500 commercial banks, five of the top six Fortune 500 telecommunications firms as well as leading firms in insurance, travel, retail, utilities and government agencies. For more information, visit www.ca.com/us/service-virtualization.aspx Connect with CA Technologies at ca.com Agility Made Possible: The CA Technologies Advantage CA Technologies (NASDAQ: CA) provides IT management solutions that help customers manage and secure complex IT environments to support agile business services. Organizations leverage CA Technologies software and SaaS solutions to accelerate innovation, transform infrastructure and secure data and identities, from the data center to the cloud. CA Technologies is committed to ensuring our customers achieve their desired outcomes and expected business value through the use of our technology. To learn more about our customer success programs, visit ca.com/customer-success. For more information about CA Technologies go to ca.com. Copyright 2012 CA. All rights reserved. All trademarks, trade names, service marks and logos referenced herein belong to their respective companies. This document is for your informational purposes only. CA assumes no responsibility for the accuracy or completeness of the information. To the extent permitted by applicable law, CA provides this document as is without warranty of any kind, including, without limitation, any implied warranties of merchantability, fitness for a particular purpose, or noninfringement. In no event will CA be liable for any loss or damage, direct or indirect, from the use of this document, including, without limitation, lost profits, business interruption, goodwill, or lost data, even if CA is expressly advised in advance of the possibility of such damages. acs2926_1112 13