informatica cuts costs and mitigates risk by … · white paper: informatica cuts costs and...

White Paper Informatica Cuts Costs and

Mitigates Risk by Streamlining

SAP Test Data Management

By Brian Babineau

September, 2009 © 2009, Enterprise Strategy Group, Inc. All Rights Reserved

White Paper: Informatica Cuts Costs and Mitigates Risk by Streamlining SAP Test Data Management 2

© 2009, Enterprise Strategy Group, Inc. All Rights Reserved.

Contents

Introduction .................................................................................................................................................. 3

What No One Knows About SAP Development and Testing Processes ....................................................... 4 If it Ain’t Broke, Don’t Fix it ...................................................................................................................................... 4 A Different Perspective ............................................................................................................................................. 4 Privacy Rules Dictate Security Requirements ........................................................................................................... 6 Hidden Costs ............................................................................................................................................................. 6

Opportunities for Improvement ................................................................................................................... 7 Subset versus Copy ................................................................................................................................................... 7 Simplify Security ....................................................................................................................................................... 7 Automated Creation and Management ................................................................................................................... 8

Making the Right Investment ....................................................................................................................... 8 Informatica’s Test Data Management Solutions for SAP ......................................................................................... 8 Justifying a Purchase .............................................................................................................................................. 10

The Bigger Truth ......................................................................................................................................... 11 All trademark names are property of their respective companies. Information contained in this publication has been obtained by sources The Enterprise Strategy Group (ESG) considers to be reliable but is not warranted by ESG. This publication may contain opinions of ESG, which are subject to change from time to time. This publication is copyrighted by The Enterprise Strategy Group, Inc. Any reproduction or redistribution of this publication, in whole or in part, whether in hard-copy format, electronically, or otherwise to persons not authorized to receive it, without the express consent of the Enterprise Strategy Group, Inc., is in violation of U.S. copyright law and will be subject to an action for civil damages and, if applicable, criminal prosecution. Should you have any questions, please contact ESG Client Relations at (508) 482-0188. This ESG White Paper was developed with the assistance and funding of Informatica.



Introduction

It is no secret that most IT departments are cutting costs wherever possible. In fact, many have already implemented tactical measures, such as postponing or cancelling projects and instituting hiring freezes to meet reduced budgets (see Figure 1). It is now time for IT to find other, more permanent, opportunities to lower expenses. On the short list for scrutiny should be the creation and ongoing management of nonproduction SAP systems, including those used for development (DEV) and quality assurance (QAS)—a recurring process that is typically riddled with inefficiencies.

Figure 1. Hiring Freezes and Staff Reductions are Critical Components of IT Cost Reduction Initiatives

Source: Enterprise Strategy Group, 2009.

To build nonproduction systems, the most common option has been for IT to create full system copies of the production system and make it accessible to SAP developers and testers. This seemingly benign operation, however, is complicated by constant data growth and the need to create multiple environments for several groups. It is also extremely expensive as IT must buy and manage additional storage to support all the systems. As if dealing with out of control storage costs weren’t enough, all systems need to be secured in order to protect confidential data—such as bank account numbers and employee residential addresses—saved within SAP. Failing to do so increases the risk of a data breach, which carries significant penalties ranging from regulatory fines to loss of customers.

Since the creation of nonproduction systems and associated clients cannot be avoided—no one will allow engineers, quality assurance teams, or auditors to work with live production data—cost savings can only be realized by optimizing the process. Organizations could create subsets, rather than full copies or replicas of the production system, which represent only a portion of the data within the production system. Created correctly (with full data integrity), subsets are not only perfectly viable for development and testing activities, they can even streamline SAP change management processes.

Using subsets reduces the time it takes to set up a nonproduction SAP system or create new clients because there is less data to copy—and this also means there is less data to secure and manage during the lifecycle of a particular system or client. Development and testing expenses can be further reduced by establishing automated processes for the creation and management of data subsets. Overburdened IT staffs, especially those focused on running and operating SAP solutions, should not have to manually generate every DEV or QAS system or every client requested—a responsibility that takes away from other tasks and may be too slow to meet business needs. What’s

38%

38%

52%

61%

62%

0% 10% 20% 30% 40% 50% 60% 70%

Cancel projects

Reduce headcount

Renegotiate contracts

Hiring freeze

Postpone projects

Which of the following general measures are part of your organization’s IT cost reduction or cost containment strategies? (Percent of respondents,

N=429, multiple responses accepted)



more, a data management automation function should also be able to identify and secure confidential information as nonproduction systems or clients are built, further reducing the burden on in-house SAP specialists.

As IT looks for permanent ways to reduce expenses, executives are starting to uncover inefficient processes that drain capital budgets and consume far too many operational resources. This paper focuses on one of these processes: the creation and management of SAP nonproduction systems. ESG believes there is a tremendous opportunity for improvement, and thus measurable cost savings, by streamlining and automating several of the steps within the process. By discussing some of the benefits that result from modifying how SAP nonproduction systems are created and updated, ESG intends to help organizations easily rationalize an investment in a test data management solution, such as the solution offered by Informatica, which actually makes improvement possible.

What No One Knows About SAP Development and Testing Processes

If it Ain’t Broke, Don’t Fix it

There are plenty of reasons why SAP landscapes must at a minimum contain two nonproduction systems (DEV and QAS): applying enhancement packages or OSS notes, a business rule modification requiring a configuration change, altering the underlying hardware infrastructure, or building new custom ABAP reports for business analysts for auditing purposes. Because these are common occurrences driven by merger and acquisition activity, an ever-changing regulatory climate, an increased focus on corporate governance, frequent releases by hardware and database vendors, and the need to accommodate new SAP functionality such as adding Human Capital Management (HCM) to an existing SAP Business Suite implementation, SAP specialists and Basis teams will already have a process in place for creating and updating nonproduction systems and clients. This process usually dates back to a time when databases were smaller and less complex.

One of the biggest problems is that no one examines how inefficient the process really is because most SAP specialists manage to get it done. When the end result of any business process is satisfactory, rarely is the process itself reviewed to see if it can be made more cost effective. As a result, inefficient and expensive processes continue until a business either becomes significantly unhappy with the end product or needs to dramatically cut costs.

A Different Perspective

When trying to cut costs, IT and business leaders tend to look at the largest budget line items and focus their efforts there. If their diligence unveils what drives these budget line items, it is likely business and IT leaders will quickly become familiar with current SAP test and development practices—and how much they contribute to IT expenses.

As an example, one out of control IT expense is storage. Approximately three quarters of enterprises surveyed by ESG said they were going to spend the same or more on storage hardware in 2009 compared to 2008.1 A portion of this spend is due to general corporate data growth, but a bigger catalyst for the expected storage capacity increase is the number of copies organizations make of their SAP production systems. Yes, some of these copies are for data protection, but ESG research also shows that a majority of organizations are creating up to five copies per month for both user test purposes and development environments (see Figure 2).2 In fact, 22% and 26% of respondents are creating more than six copies per month to support development and test activities, respectively.

1 Source: ESG Research Report, 2009 Data Center Spending Intentions Survey, March 2009.

2 Source: ESG Research Report, 2007 Database Archiving Survey, December 2007.



Figure 2. Number of Database Copies Organizations Create for Test and Development


With SAP production systems now measured in the high-gigabyte to multi-terabyte range, it is easy to see how copies made for development and testing purposes are driving significant storage hardware spending. As an example, if a customer has a 600 GB production system and makes four full copies for test and development, the total storage requirements for the environment jumps to 2.4 TB (see Figure 3).

Figure 3. Using Full Copies for SAP Nonproduction Systems Increases Storage Requirements


25%

39%

49%

39%

13%

12%

13%

10%

0% 10% 20% 30% 40% 50% 60% 70% 80% 90% 100%

Development

User testing

On average, how many secondary database instances (copies or clones of the primary) does your organization create monthly for each of the following

purposes? (Percent of respondents, N=110)

1 instance 2 to 5 instances 6 to 10 instances More than 10 instances



Privacy Rules Dictate Security Requirements

When IT and business leaders meet to discuss the factors influencing the future of technology infrastructures and information management, compliance with information privacy rules will always be on the agenda. Almost every business or government agency is subject to a privacy regulation, such as HIPAA (health care), FERPA (education), Gramm-Leach Bliley or Basel II (financial services), or PCI-DSS (retail or anyone that processes credit cards). In Europe, nearly every country has its own data privacy or breach laws and the same holds true for most states within the U.S. With 43% of companies stating that they consider over half of their database application information ‘confidential’3 and 33% of organizations rating themselves as ‘fair’ or ‘poor’ when it comes to tracking the movement and replication of confidential information,4 properly securing replicas made for test and development becomes crucial.

By now, the multi-million dollar fine that TJX, a leading global retailer, paid for failing to meet state and PCI-DSS data security requirements has become common knowledge. However, the financial penalty paled in comparison to the negative publicity TJX still receives after credit card numbers were stolen from a business application database. No company wants to face a similar predicament because it failed to secure a SAP test and development system.

Hidden Costs

In addition to the storage expenses and security risks, there are even less obvious, yet still material, expenses associated with the creation and update of SAP nonproduction systems and clients. The first stems from the copies themselves: making full system or client copies means bigger servers may be needed to actually process the data replication from the sending system—typically production—to the receiving systems such as DEV and QAS. IT may also have to invest in larger servers to complete certain tests against larger data sets.

Large nonproduction systems also drive up storage capacity which, in turn, increases storage-related peripheral expenses. IT needs to provision extra power to run and cool the systems, driving up electrical utility costs. Additional investments in backup and disaster recovery are also needed to ensure that nonproduction systems are protected from data loss or corruption. As an example, a company may have to spend more on backup software as it is usually licensed and priced on a per terabyte basis.

A lack of IT operations staff, or at least the inability to simply hire additional help when needed, also plays a role in the ability to meet the business’ needs in a timely manner. Even with a reasonable process for creating and updating SAP nonproduction systems and clients in place, completing the request can take several hours, if not days, depending on the size of the system being copied and how much CPU power the servers have available. Nonproduction systems or clients also need to be refreshed periodically as different users (e.g., testers, trainers, developers, etc.) may want to execute an operation against fresh production data. Generating and refreshing these systems and clients could be a full time job, but it is typically the work of several individuals across several departments—server, storage, database, and SAP Basis administrators all have to be involved. The true expense for these IT staff members is the opportunity cost; they may not be able to complete other important job responsibilities because they are busy building development, testing, training, and other nonproduction systems and clients.

Managing nonproduction systems, especially if an organization has a plethora of SAP Business Suite applications or does a significant amount of customization to the various applications, can be a full time job. Without development and test management capabilities, securing confidential data is usually an afterthought because IT simply doesn’t know which systems have what data. When it comes time for SAP Basis administrators to report back to auditors regarding security risks, they have to perform resource intensive manual investigations of each system, which also represents an opportunity cost for IT. In some cases, auditors have to examine SAP systems themselves because IT cannot staff the investigations.

3 Source: ESG Research Report, Database Archiving Survey, November 2007.

4 Source: ESG Research Report, Protecting Confidential Data Revisited, April 2009.



Opportunities for Improvement

Subset versus Copy

ESG research indicates that an estimated two-thirds of organizations make a full system or client copy of the production environment when creating or updating nonproduction environments despite the fact that only a portion of its tables and records are needed.5 ESG believes that this statistic may be higher in SAP implementations because nonproduction systems are often created by Basis personnel making a complete backup of the production system and restoring it to another set of systems used for development, testing, training, and other purposes. The rationale for the creation of full copies is that it ensures nonproduction systems mirror the production system (i.e., all of the table definitions, ABAP code, configuration, and application data) as closely as possible. But not only do full copies consume valuable storage space, they also slow the actual creation of the nonproduction environment as it can take time to execute a replication process or restore a backup of a large production system in addition to performing all the post restore activities (i.e., apply in-process development or configuration work, OSS notes, etc.).

An ideal alternative is for SAP Basis administrators to determine—based on what needs to be tested, demonstrated, or developed against—the most appropriate data sets for the situation and then to copy only this data with its data relationships and data models intact. To streamline the creation of nonproduction systems even further while reducing the database size, IT should be able to filter the records based on date, ID number, and other criteria rather than copying every item within the identified data set.

Choosing specific data sets, as well as related business objects, and selecting a portion of the records while maintaining data integrity is called “subsetting.” Subsetting drastically reduces the amount of time it takes to create nonproduction systems and consumes far fewer storage resources when compared to complete copies of the production system. As an example, a company running SAP ERP HCM may choose to expand operations in Norway, which means adding a new “Personnel Area” to the “Enterprise Structure” within the Human Capital Management module. A portion of the current London employees are going to be transferred to the Norway office and will now carry a salary rather than an hourly wage—changes which impact “Payroll” within the application. Before modifying any of the data stored within the “infotypes,” SAP business analysts and configurators may want to create a new test system to see if making these modifications will impact the production system. To minimize the size of the new test system, the development team only needs to copy the impacted business objects and a limited number of employee records (a small number of employees being transferred is the most appropriate). SAP specialists can accomplish this by subsetting the required data within the Enterprise Structure and Personnel Structure and select a set of records based on filtering criteria (employees current location = London) to include within those tables.

Simplify Security

To prevent unauthorized access to confidential data, businesses should secure it as the actual nonproduction systems are being built. By skewing, shuffling, or nullifying sensitive data as the subset is being created, confidential information is protected before anyone begins development, testing, training, or demonstration activities.

Any security measure taken during the subsetting process should not impact the ability to complete development, test, and other operations. A technique such as shuffling shifts data values amongst individual records and is best used when real values are required. Using this type of technique ensures SAP application modules function properly, yet anyone viewing the records will not be able to make inferences from them (i.e., knowing a salary is not useful unless you know the individual employee associated with it). Data masking techniques, such as shuffling can be applied during the subset process. All of the data will exist, but the individual records will be mismatched so that developers cannot see actual employee wages or other sensitive information. This enables development and testing to be completed against real data, but prevents any risk of improperly sharing confidential data. Another

5 Source: ESG Research Report, Database Archiving Survey, November 2007.



option SAP specialists have is to ‘zero out’ or ‘nullify’ the salary information so that the data exists, but there aren’t any real values in each record. If development, testing, and training can be completed without real salary data, the company can be assured that developers will not have access to sensitive information but can still get the job done.

A critical factor in securing confidential data within nonproduction environments is completing the data masking task as a system is created, not after. This reduces the chance that someone accesses data before any security measures are put into place and minimizes the risk that SAP specialists fail to protect the information after the nonproduction systems are created.

Automated Creation and Management

Subsetting reduces the time and cost required to set up nonproduction systems and clients while facilitating proper security of confidential information. The next logical step is to automate the entire subsetting process, inclusive of management activities that occur once the subset definitions have been created. SAP specialists should be able to control who can actually execute subsetting, monitor the entire process, and know what data was moved and masked.

Management capabilities should also provide SAP specialists with a means of quickly refreshing or adding more data to an existing client without recreating the total system. Developers may want to work with the most recent data, making a DEV client created a week ago obsolete. Rather than leaving the old DEV system as is and creating a completely new system—a methodology that often leads to the need to create multiple system copies in a short period of time—specialists should be able to add the newly created data to an existing system and client. This alternative is much faster, removes management complexity as no one has to keep track of the most recent copy, and lowers storage costs because administrators and developers rarely delete old systems.

Making the Right Investment

Informatica’s Test Data Management Solutions for SAP

Informatica enables customers to transform their existing SAP development and test processes to take advantage of the aforementioned opportunities. Informatica customers are not simply creating nonproduction systems, they are managing the development and testing lifecycle—from collaborating with those that need a DEV and/or QAS system (before it is created) to retiring the system when it is no longer needed. Using the Informatica Data Subset and Data Masking offerings, which make up Informatica’s Test Data Management solutions, customers improve their test and development lifecycle through:

Simple database discovery. Before any nonproduction system is built, SAP Basis administrators, as well as those that need the system, should be able to visualize the application and supporting database constructs so they can make educated decisions as to what information (transactions, business objects, etc.) needs to be copied without consuming too much of the Basis team’s time. As part of the database discovery process, Informatica Data Subset for SAP analyzes the tables, data elements, domains, and foreign keys as well as table statistics to build a standalone data model that represents the SAP system. During discovery, Data Subset for SAP can also be configured to look for “unmanaged tables” (i.e., those that are not yet assigned to template or entity). These “Z” tables are usually created at the customer site to augment a standard SAP implementation. Additionally, Data Subset for SAP can execute a discovery process to group tables into categories such as “Master Data” and “All Application Data” for inclusion in the subset process. Data Subset for SAP maintains a representative data model within its repository that mirrors the production system and is enhanced with additional table relationships—if any modification is made to the production system, Informatica captures it and applies it to the data model. Any future subsets created from that specific production system will utilize the latest data model, ensuring that developers and testers are always working with a system that mirrors production.

SAP Business Suite Accelerators. When building nonproduction systems, the “use case”(DEV for a specific module, QAS on table structure modifications, etc.) is often very similar, yet without a data subsetting



solution, SAP specialists would have to repeat the entire database discovery process and recreate programs and data models. Data Subset for SAP removes this hassle with its SAP application “accelerators.”

The accelerators can be considered prebuilt templates with metadata consisting of relationships and business rules that enable customers to quickly create subsets of common SAP Business Suite application modules such as Financial Accounting (FICO), Materials Management (MM), Sales and Distribution (SD), and Human Resources (HR). The templates also identify fields within these modules (or business objects within the modules) that contain sensitive information, such as U.S. Social Security Number, and mask this data. The templates automatically identify what tables to subset and maintain referential integrity when a nonproduction system for that particular use case is created. SAP specialists can customize the templates that ship as part of the accelerators with their own business rules or create new templates for a particular use case by selecting tables via Data Subset for SAP’s discovery capabilities. Once a template is set up with Informatica Data Subset and Data Masking, an SAP specialist is only a few clicks away from completing a secure subset for the creation or update of an SAP nonproduction system—a task that can be executed over and over again with minimal effort so long as the use case requires the same information designated in the particular template.

Table filtering. Once business rules are applied and tables are set up within the Informatica Data Subset for SAP modeling environment, customers can further reduce the data by filtering it based on several criteria, such as transaction date, number ranges (employee ID range), geographical location (personnel area), or business unit (division). Filtering allows customers to create precise (and smaller) nonproduction systems. It also enables developers and engineers to select a specific range of records so they can execute targeted tests within a system. Additionally, it reduces the size of nonproduction systems, which speeds up the time required to actually copy the data.

Table threading optimization. Depending on the specific use case, a particular subset can contain a number of tables that vary in size. When it comes time to execute the actual subset, randomly copying tables of various size—measured by the number of records and bytes—can actually slow down the process. Informatica Data Subset for SAP enables SAP specialists to set a “thread strategy” for processing table data to be copied in order to expedite the operation. The threading option reduces the number of projects that need to be scheduled and expedites the overall subsetting process.

Subset processing and prediction. During the subset build process, Informatica Data Subset tracks the number of threads running and the average number of bytes processed per second. Informatica Data Subset utilizes this information to predict how long a subset process will take and how large the target nonproduction system will be. An SAP specialist can then take specific actions such as increasing the number of threads to hasten the subsetting process or expanding the table-space on the target system so it doesn’t run out of space—an issue that could cause processing to be halted, awaiting further action.

Empty system creation. In some situations, SAP specialists simply want to create a copy of the production system without the application data. Data Subset for SAP facilitates this process as customers can choose to exclude the “Application Data” tables to build an “empty” SAP nonproduction system. All of the production system table structures, programs, and system information are copied to the target nonproduction system.

Seamlessly manage and refresh existing test and development systems. Informatica Data Subset for SAP enables customers to quickly move new production data into an already existing subset to quickly refresh the client. Customers can configure Informatica Data Subset for SAP to execute refreshes so that all selected data from the production system will overwrite the target environment—a task that is best used when a complete regression test is required. Conversely, if a specialist wants to perform a specific unit test against an identified scenario without impacting any other activity on the nonproduction system, they can configure Data Subset for SAP so the target data “wins” and is not overwritten. This flexibility helps ensure that developers and testing engineers are working with the most recent, relevant information and do not interrupt other processes that aren’t material to what they are trying to accomplish.



Customers can also recreate a subset if the target environment has been corrupted by development activities or is no longer useful without having to repeat the actual data selection process. Within Data Subset for SAP, SAP specialists can export a subset as files, which contains all of the data and table properties of the data subset. These files can serve as a backup and can be imported back into Data Subset for SAP to recreate the original subset target system. This import process is much faster than actually executing the entire subset operation again, making it very easy for specialists to recover or recreate a client within a nonproduction system.

Auditing and logging. By using Informatica Data Subset for SAP to create nonproduction systems, SAP specialists can track all of the systems, including what data (transactions, business objects, etc.) was selected to be copied, how long the subset process took, errors or warnings encountered during the process, and additional application log information. SAP specialists can also view all of the subset definitions that have been processed as well as those that are scheduled to be processed.

Justifying a Purchase

According to ESG research conducted in March 2009, 63% of large enterprises (organizations with 1,000 employees or more) said that reduction in operating costs will be the most important consideration in justifying a technology investment over the next 24 months. Applying this criterion to Informatica’s Data Subset and Data Masking for SAP should result in a very easy decision for an organization that consistently creates and leverages test and development systems to improve overall SAP implementations. First, customers can maintain existing staff levels despite more requests to set up nonproduction systems or clients for numerous uses cases—Informatica makes it very easy to create and manage reusable subsets. Second, developers and test engineers can complete customization, modifications, and testing exercises faster—SAP specialists can easily generate these systems with Informatica’s SAP Business Suite via a template-driven process

Adding the operating expense savings to the reduction in capital expenditures—namely, storage capacity savings—made possible by subsetting the data rather than making full copies should also help a customer rationalize an investment. Creating four 150 GB subsets for nonproduction purposes rather than full copies can reduce development and test storage capacity requirements by 300% (Figure 4).

Figure 4. Subsetting Data for SAP Nonproduction Systems Reduces Storage Costs


HCM_PROD600 GB

HCM_SANBOX150 GB

HCM_DEV150 GB

HCM_QAS150 GB

HCM_PRE_Prod150GB

Data Subsets Total Storage for HCM Test &

Development Systems =

600 GB



The case for Informatica’s Data Subset and Data Masking for SAP becomes even stronger when taking into account the risk mitigation resulting from the proper masking of confidential information within nonproduction systems. Avoiding a data breach means that a company avoids the associated litigation expenses, including any attorney fees and potential settlements of fines. In addition to these savings, many companies also realize that any investments that facilitate compliance also pay off in other ways, so they constantly try to fund these projects. A recent ESG research study revealed that information security and regulatory compliance projects are the two top initiatives least likely to be impacted by expected IT budget reductions put into place in the next 24 months.6

The Bigger Truth

Organizations must realize that being in “IT cost reduction mode” often means actually spending money to save money. To be clear, these types of investments must be targeted at controlling those IT processes that drive up capital and operating costs. In some cases, the process may be effective, but inefficient. The creation and ongoing management of SAP development and testing systems falls into this category and it is time to do something about it. The status quo will result in exploding storage costs and immeasurable security risks.

When it comes to improving SAP Business Suite development and testing processes, there are plenty of ways to reduce costs. Creating subsets versus full copies of production systems is a great start. Putting security measures in place to protect confidential information before it becomes part of a development or test system mitigates compliance risks. Automating management tasks, including data refreshes and auditing subsets, alleviates much of the operational burden on SAP specialists and Basis teams. These benefits are very hard to ignore, making it very easy for IT to invest in technology, such as Informatica’s Data Subset and Data Security for SAP, capable of actually making them achievable.

6 Source: ESG Research Report, 2009 Data Center Spending Intentions Survey, March 2009.

20 Asylum Street | Milford, MA 01757 | Tel:508.482.0188 Fax: 508.482.0218 | www.enterprisestrategygroup.com

informatica cuts costs and mitigates risk by … · white paper: informatica cuts costs and...

Documents