appliances vs. traditional servers: pros and cons

Appliances vs. Traditional Servers:

Pros and Cons

© 2014 Hitachi ID Systems, Inc. All rights reserved.

http://Hitachi-ID.com/

http://Hitachi.com/

Contents

1 Introduction 1

2 Definitions 1

2.1 Enterprise Software Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2.2 Traditional Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2.3 Appliance Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

2.4 Client Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

3 Types of Appliances 2

3.1 Home vs. Enterprise Equipment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

3.2 Commodity Hardware vs. Specialized Processors . . . . . . . . . . . . . . . . . . . . . . . . 2

4 Appliance Servers: Benefits 3

5 Appliance Servers: Drawbacks 4

6 Summary 5

APPENDICES 6

A About Hitachi ID 7

i

Appliances vs. Traditional Servers: Pros and Cons

1 Introduction

This document is intended to help organizations decide whether an appliance or a traditional server is anappropriate platform for hosting enterprise software applications. It is organized as follows:

• Definitions: defining relevant concepts and terminology.

• Types of Appliances: differentiating between different types of appliances and what they are usedfor.

• Appliance Servers: Benefits: an overview of the advantages of hosting software on an appliance.

• Appliance Servers: Drawbacks: an overview of the drawbacks of hosting software on an appliance.

2 Definitions

A growing number of vendors are offering what would otherwise be software-only solutions in the form ofdedicated appliances, which incorporate both hardware and software. In this section, terms and conceptsrelevant to appliances are introduced, so that the subsequent discussion can be more clear.

2.1 Enterprise Software Application

This document is concerned specifically with “enterprise software applications.” That is, applications which:

1. Run on one or more centralized servers.

2. Provide a service to many users, possibly distributed across multiple sites.

3. Must be scalable and reliable, because many users would be adversely impacted by loss of access tothe application.

At issue is whether it is preferable to host such applications on appliance servers or traditional servers, asdefined below.

2.2 Traditional Server

A traditional server consists of several components, possibly from different vendors, which may have to beassembled into a unit by the organization which wishes to run the enterprise software application:

1. Hardware – such as X86-style servers – from vendors such as IBM, HP or Dell.

2. An operating system, such as Windows or Linux.

© 2014 Hitachi ID Systems, Inc.. All rights reserved. 1


3. Possibly a web server, such as IIS or Apache.

4. Possibly a database server, such as Oracle Database, Microsoft SQL Server or MySQL.

Normally, an organization will have many such servers, and deploy one or more applications on each one.

The above description is only approximate. For example, hardware may be virtualized, other operatingsystems are available and other components may be required.

2.3 Appliance Server

An appliance server is one where all of the required functional components, including those identified inSubsection 2.2 on Page 1, plus the application software itself, are integrated and configured into a unit andpurchased from a single vendor.

2.4 Client Device

Users sign into applications using a client device. This may be a desktop or laptop PC, a telephone or smartphone, a PDA, etc.

Modern applications often use a web interface to interact with users, which means that the user’s hardwareruns a web browser, which presents a graphical user interface to the user.

3 Types of Appliances

3.1 Home vs. Enterprise Equipment

Many home users are very familiar with appliances, if not with the term “server appliance,” in the formof wireless routers, small hardware firewalls, print sharing devices, network attached storage, etc. Thesedevices are small, inexpensive and not really scalable or flexible enough to meet the needs of medium tolarge organizations.

3.2 Commodity Hardware vs. Specialized Processors

Server appliances intended for enterprise deployment have two basic types:

1. Commodity server hardware, with pre-installed software.

2. Specialized processing hardware.

The commodity hardware approach serves mainly to reduce the initial setup and configuration effort fororganizations deploying the product. “Inside the box” is just a traditional software server, assembled andsupported by the vendor.



Specialized processing hardware is used mainly where the performance characteristics of the system can-not be easily reached with a conventional server. This is typically required in the context of specializednetworking equipment, such as SSL processors, virus scanners, application firewalls and more, all of whichmust perform complex at “wire speeds” – 100Mbps or more.

4 Appliance Servers: Benefits

The main benefits promoted by vendors who sell solutions in the form of appliances are:

1. Easy installation:

The operating system and application software are pre-installed on the hardware, which reducesinstallation time and effort. To the extent possible, the software is normally either pre-configured orself-configuring.

It should be noted that this is only a significant advantage for applications that require minimal integra-tion with existing infrastructure, and minimal customization. Where such integration and customizationis required, it normally takes up the bulk of configuration time, so the savings from faster initial setupis inconsequential.

2. Fewer skills required:

The simplified installation and configuration lead to scenarios where fewer IT skills are required toimplement the solution. This is particularly true where the application is quite simple and requires littleor no further configuration beyond initial activation.

3. Sole-source technical support:

Any questions about hardware compatibility or operating system patches are eliminated when a singlevendor supports every “layer” of the solution, starting with hardware and ending with the applicationsoftware.

4. High performance specialized hardware:

In the case of specialized processing hardware, the additional and overriding benefit is increasedperformance. Note that this is not generally true for commodity hardware bundled as an appliance –this advantage is only relevant where the appliance incorporates specialized hardware, most often toprovide a specialized network infrastructure function.



5 Appliance Servers: Drawbacks

Hardware appliances provide some benefits, such as somewhat simpler installation and configuration, butthey also have some drawbacks. These include:

1. Low performance commodity hardware:

In order to reduce manufacturing costs, hardware appliances often incorporate previous-generationcomponents. CPU capacity, memory cache, RAM and disk space are often significantly smaller inan appliance as compared to a contemporary general-purpose server. The result is that commodity-based appliances often have significantly lower performance than the same application software run-ning on newly acquired commodity servers.

2. Poor hardware support:

Appliance servers are not developed, sold or supported by software vendors. Instead, this work iscontracted out to a hardware vendor who simply images the software vendor’s OS and applicationonto their standard hardware, which is then branded as an appliance for that software vendor. Sinceneither the software vendor nor the appliance hardware vendor (with few exceptions, such as Dell) islikely to have local support staff in many cities, technical support normally leads to customers mailingtheir appliance to a depot for repair or replacement.

The absence of a local support network, such as might be offered by a big-brand PC server manufac-turer (IBM, HP, Dell, etc.). means that hardware repair takes at least 24 hours – the time required tocourier a replacement unit to a customer. This reduced SLA (Service Level Agreement) leads to thenext problem:

3. Difficult jurisdictions:

Delivery of hardware appliances to some jurisdictions may require import licenses, export licenses,payment of duties, invoicing in local currency and may present a range of other challenges relatedto physical delivery of advanced, cryptographic technology to far-away places. This leads to longerlead times to deliver hardware to some locations in the world, higher cost and the need for morelocally deployed infrastructure, usually in precisely those locations that would not otherwise meritextra capacity.

4. Expensive disaster recovery:

Because hardware repair cannot be provided promptly by either appliance software vendors or ap-pliance hardware manufacturers, most vendors that sell appliance solutions encourage customers tobuy redundant appliances. This means that where a customer might normally deploy a single con-ventional server, they must purchase and deploy two appliance servers for the same task, to get acomparable assurance of availability.

5. Inability to virtualize:

Appliances are just that – pre-packaged hardware. This means that they cannot be virtualized. Orga-nizations seeking to migrate their systems and applications away from raw hardware, and onto virtualservers and perhaps private or public clouds, cannot do so with an appliance.

Virtualization offers some important benefits, so this can be a serious problem:

(a) Energy and space savings, from efficient use of hardware capacity.

(b) Flexible resource allocation, adding or removing CPU, memory and disk as required.



(c) High availability, with the ability to recover crashed applications in minutes or even seconds.

(d) Snapshot capability, so that bad configuration changes can be quickly rolled back.

Using an appliance negates all of these benefits.

6. Not suitable for high density server environments:

For many of the same reasons that organizations are increasingly using virtualization technology, theyare also using blade technology to increase the space and power efficiency of their server environ-ments.

Appliances do not generally come in a blade form factor, so cannot contribute to a power and spacesaving server management strategy.

6 Summary

There are specific use cases where appliances are attractive:

1. Deployment of simple applications, which require minimal customization and integration, into small tomedium environments.

2. Deployment of very high performance network devices, where specialized hardware provides a sig-nificant speed boost.

There are also use cases where appliances are unattractive:

1. Deployment into high density IT environments.

2. Deployment into IT environments where virtualization is widely used.

Appliance based solutions reduce initial setup time, but increase hardware cost (for redundancy) and wherespecialized hardware is not used, usually also reduce scalability.



APPENDICES



A About Hitachi ID

This white paper was produced by Hitachi ID.

Hitachi ID Systems, Inc. delivers access governance and identity administration solutions to organizationsglobally, including many of the Fortune 500 companies. The Hitachi ID Management Suite is a fully inte-grated solution for managing identities, security entitlements and credentials, for both business users andshared/privileged accounts, on-premise and in the cloud.

The Management Suite is well known in the marketplace for high scalability, fault tolerance, a pragmaticdesign and low total cost of ownership (TCO). Hitachi ID Systems is recognized by customers and analystsfor industry leading customer service.

The Management Suite is an integrated solution for identity administration and access governance. Itstreamlines and secures the management of identities, security entitlements and credentials across sys-tems and applications. Organizations deploy the Management Suite to strengthen controls, meet regulatoryand audit requirements, improve IT service and reduce IT operating cost.

The Management Suite is designed to efficiently create, manage and deactivate user objects, identity at-tributes and security entitlements across systems and applications in medium to large organizations. Thisis done using a combination of automation and self-service:

• Automation propagates changes from one system to another.

• Workflow invites business users to participate by completing their own profiles, authorizing changesand reviewing the current state of users and privileges.

• Consolidated management enables security staff to manage access with a user-centric, rather thanapplication-centric view.

• Password synchronization and enterprise single sign-on reduce the number of passwords that usersmust remember and type.

• Reports enable auditors, security officers and system administrators to analyze current state andreview historical changes.

A rich set of connectors are included, to easily integrate with most common systems and applications andto manage credentials including passwords, challenge/response profiles, biometric samples, OTP devices,PKI certificates and smart cards.

The Management Suite is designed as identity management and access governance middleware, in thesense that it presents a uniform user interface and a consolidated set of business processes to manageuser objects, identity attributes, security rights and credentials across multiple systems and platforms. Thisis illustrated in Figure 1.

Figure 1: Management Suite Overview: Identity Middleware



Employees, contractors, customers, and partners

Users Hitachi ID Management Suite

Target Systems

Business processes

Synch./PropagationRequest/AuthorizationDelegated AdministrationConsolidated Reporting

User Objects

AttributesPasswordsPrivileges

Related Objects

Home DirectoriesMail BoxesPKI Certs.

The Management Suite includes several functional identity management and access governance modules:

• Hitachi ID Identity Manager – User provisioning, RBAC, SoD and access certification.

– Automated propagation of changes to user profiles, from systems of record to target systems.– Workflow, to validate, authorize and log all security change requests.– Automated, self-service and policy-driven user and entitlement management.– Federated user administration, through a SOAP API (application programming interface) to a

user provisioning fulfillment engine.– Consolidated access reporting.

Identity Manager includes the following additional features, at no extra charge:

– Hitachi ID Access Certifier – Periodic review and cleanup of security entitlements.

* Delegated audits of user entitlements, with certification by individual managers and applica-tion owners, roll-up of results to top management and cleanup of rejected security rights.

– Hitachi ID Group Manager – Self service management of security group membership.

* Self-service and delegated management of user membership in Active Directory groups.

– Hitachi ID Org Manager – Delegated constuction and maintenance of Orgchart data.

* Self-service construction and maintenance of data about lines of reporting in an organization.

• Hitachi ID Password Manager – Self service management of passwords, PINs and encryption keys.

– Password synchronization.– Self-service and assisted password reset.– Enrollment and management of other authentication factors, including security questions, hard-

ware tokens, biometric samples and PKI certificates.

Password Manager includes the following additional features, at no extra charge:

– Hitachi ID Login Manager – Automated application logins.

* Automatically sign users into systems and applications.* Eliminate the need to build and maintain a credential repository, using a combination of

password synchronization and artificial intelligence.

– Hitachi ID Telephone Password Manager – Telephone self service for passwords and tokens.

* Turn-key telephony-enabled password reset, including account unlock and RSA SecurIDtoken management.

* Numeric challenge/response or voice print authentication.* Support for multiple languages.



• Hitachi ID Privileged Access Manager – Control and audit access to privileged accounts.

– Periodically randomize privileged passwords.– Ensure that IT staff access to privileged accounts is authenticated, authorized and logged.

• Group Manager is available both as a stand-alone product and as a component of Identity Manager.

The relationships between the Management Suite components is illustrated in Figure 2 on Page 9.

Figure 2: Components of the Management Suite

www.Hitachi-ID.com

500, 1401 - 1 Street SE, Calgary AB Canada T2G 2J3 Tel: 1.403.233.0740 Fax: 1.403.233.0725 E-Mail: [email protected]

File: /pub/wp/documents/appliance-vs-server/appliance-server-pros-cons-1.texDate: 2008-10-20

http://Hitachi-ID.com/

appliances vs. traditional servers: pros and cons

Technology

appliance servers

traditional software

traditional servers

application software

commodity server hardware

users hardware

term server appliance

form of appliances