Cognos 8 Diagnostic: IBM Monitoring and Diagnostic Tools for Java - Mem...
Cognos 8 Diagnostic: IBM Monitoring and Diagnostic Tools for Java - Mem...: IBM Monitoring and Diagnostic Tools for Java - Memory Analyzer Version 1.1 The IBM Monitoring and Diagnostic Tools for Java - Memory Analy...
Cognos Java Security Vulnerability CVE-2010-4476 Exposure Response
Products
Special offersSoftwareSoftware overviewProductsTrials and demosEvents and conferencesBusiness Analytics- Cognos- SPSSEnterprise Content ManagementInformation Management- DB2- Informix- InfoSphereLotusRationalTivoliWebSphereSystem z softwareStorageAll storageDisk systemsTape systemsStorage area networksNetwork attached storageStorage softwareHard drives/microdrivesStorage A to ZServers & systemsAll servers and systemsSystems softwarePower Systems (AIX, IBM i, Linux)System z (Mainframe)System x (xSeries)BladeCenterCluster systemsUNIX serversLinux serversIntel processor-based serversAMD processor-based serversOEM systemsInternet securityNetworkingPersonal computersPoint of salePrinting systems from InfoPrintSemiconductorsUpgrades, accessories & partsCertified used servers & storageCommunitiesSmall business productsMedium business productsHardwareSoftwareMoreSupport & downloads
DownloadFixes, updates and driversTrials and demosTroubleshootSearchDocumentationCommunitiesPlanInstallUseOpen a technical service requestCustomer supportFormer IBM productsPrinting systems from InfoPrintLenovo ThinkPads and ThinkCentresMoreMy IBM
My accountsMy profileMy interestsMy community spacesMy technical supportMy customer supportShopping cartContractsOrders and deliveryInventory and maintenanceInvoices and paymentsSelf-service toolsMore customer supportSubscriptionsMoreWelcome [ IBM Sign in ] [ Register ].Cognos Java Security Vulnerability CVE-2010-4476 Exposure Response
.Flash (Alert)
AbstractLast updated on April 19, 2011.
This Security Alert addresses a serious security vulnerability (CVE-2010-4476) which can cause the Java Virtual Machine to enter an infinite loop. This issue is described in more detail at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476.
To find out about applying the JRE patch to Cognos Business Intelligence on the Cloud, go to http://www.ibm.com/support/docview.wss?uid=swg21470017.
To find out about applying the JRE patch to Cognos Business Intelligence Special Edition, go to https://www-304.ibm.com/support/docview.wss?uid=swg21497107.
To find out about applying the JRE patch to the Cognos Now! 4.6.0 appliance, go to http://www.ibm.com/support/docview.wss?uid=swg21473104.
ContentProducts Affected
The issue exists in the Java class libraries and affects all products that use Java. IBM Cognos products that use Java include
Business Intelligence products:
□ Cognos Business Intelligence* versions 10.1, 8.4.1, 8.4.0, 8.3.0
□ Cognos Business Intelligence Developer Edition versions 10.1, 8.4.1
□ Cognos Business Intelligence Starter Edition versions 10.1, 8.4.1
□ Cognos PowerPlay versions 10.1, 8.4.1, 8.4.0, 7.5.0, 7.4.x,
□ Cognos Mobile versions 10.1, 8.4.1, 8.3.1, 8.3.0
□ Cognos Now! versions 4.6
□ Cognos DecisionStream version 7.1.4
□ Cognos Impromptu Web Reports versions 7.5, 7.4.x
□ Cognos NoticeCast versions 7.5, 7.4.x
□ Cognos Web Services versions 7.5, 7.4.x
□ Cognos Visualizer versions 7.5, 7.4.x
□ Cognos Query version 7.4.x
□ Cognos Express versions 9.5.0, 9.0.0
□ IBM Smart Analytics System Business Intelligence Module (all versions)
* Cognos Business Intelligence includes all BI components such as Reporting, Analysis, Data Manager, Virtual View Manager, Go! Search.Financial Performance Management products:
□ Cognos Business Viewpoint versions 10.1, 8.4.1, 8.4.0
□ Cognos Controller versions 8.5.1, 8.5.0, 8.4.0, 8.3.0
□ Cognos Finance versions 7.5.0, 7.4.x
□ Cognos Metrics versions 10.1, 8.4.1, 8.4.0, 8.3.0
□ Cognos Planning versions 10.1, 8.4.1, 8.4.0, 8.3.0, 8.1.x
□ Cognos TM1 versions 9.5.1, 9.5.0, 9.4.1, 9.4.0
Analytic Applications products:
□ Cognos Banking Risk Performance - Credit Risk versions 8.4.2, 8.4.0
□ Cognos Customer Performance Sales Analytics versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Financial Performance Analytics (AP, AR & GL) versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Supply Chain Performance Procurement Analytics versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Workforce Performance versions 8.4.2, 8.4.1, 8.4.0, 8.3.0, 8.2.0, 8.1.x
□ Cognos Consumer Insight version 1.1.0
Description
This vulnerability can cause the Java Runtime Environment (JRE) to hang, enter an infinite loop, or crash when converting "2.2250738585072012e-308" to a binary floating-point number. The result can be a denial of service exposure. This same problem can occur if the number is written without scientific notation (that is, using all of the 324 decimal places). Any Java program that uses the Double.parseDouble method is at risk of this vulnerability.
Solution
To prevent this vulnerability from affecting your product, you must apply a patch to your existing version of Java or install a version of Java that contains the fix.
If you do not require the fix, no action is necessary.
Before you update your JRE on a production system, it is strongly recommended to:
• Apply the patch in a test environment to verify that your product is working correctly
• Make a backup before you apply any changes
Linux or UNIX Installations
On Linux or UNIX, the JRE is not provided by Cognos as part of the product. The JRE used with Cognos is a separately installed component that is available from the operating system, application server or Java vendor.
To resolve the security vulnerability, you will need to patch or upgrade the JRE to a version that is recommended by the Operating System, Application Server or Java vendor. Ensure you stop the Cognos Services before applying the patch and restart the Cognos Services once the patch has been successfully applied.
The following table provides links to vendor-supplied details and solutions to this vulnerability: IBM http://www.ibm.com/developerworks/java/jdk/alerts/cve- 2010-4476.html
HP https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXFPUPDATER
Oracle http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html
Windows Installations
Typically, a JRE is packaged with the Windows versions of Cognos products. However, you may also use a version of Java that already existed on your system.
If you are using a JRE that already existed on the system, the solution is to update the JRE to a version that is recommended by the Operating System, Application Server or Java vendor.
If you are using the JRE version that is provided with your Cognos product, interim fixes are now available for several of the Cognos products. To determine if an interim Windows fix is available for your Cognos product as well as download and installation information, please follow the instructions at http://www.ibm.com/support/docview.wss?uid=swg24029220.
It is necessary to stop the Cognos services before applying the patch and then restart the Cognos Services once the patch has been successfully applied.
Cognos is continuing to develop interim fixes for the remaining affected products. These fixes will be made available as soon as possible.
If you cannot wait for the patch to become available from Cognos, you can also manually apply the patch to your JRE using the following steps.
Determine which version of JRE you are using
1.In a command window, go to the cognos_location/bin/jre directory.
If you are using a 64-bit installation, go to the cognos_location/bin64/jre directory.
2.Type the following:
java –version
The resulting message will indicate whether you have an IBM or Sun version of JRE.
To apply a patch to an IBM version of JRE, do the following:
Go to the following Web page, and following the instructions provided: http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html
1.Download the ParseDoubleTest.jar from the link above to verify if you need to apply the patch.
2.Copy the ParseDoubleTest.jar file to the cognos_location/bin/jre directory.
3.Open a command window in the location where you downloaded the file, and type the following:
java –jar ParseDoubleTest.jar
If the result is “Test Succeeded”, you do not have to apply the patch.
4.If you have to apply the patch, download the appropriate patch file from http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html.
For example, for JRE version 1.4 on Windows, download PM31983_FIX_1.jar.
5.Download the Java Update Installer from the following location: http://www.ibm.com/developerworks/java/jdk/alerts/updateinstaller.html
Unzip the UpdateInstallerforJava.zip.
6.Ensure that you have the patch file and the unzipped Java Update Installer in the same location.
7.In a command window, go to the location where you downloaded the patch file and the Java Update Installer, and enter the following command:
java -jar JavaUpdateInstaller.jar -install [patch JAR file] [JAVA_HOME of target JDK]
For example, for IBM Cognos products, the [JAVA_HOME of target JDK] is cognos_location/bin/jre/.
If you are installing the update for JRE version 1.4 to a default IBM Cognos installation location, the command would look like the following:
java -jar JavaUpdateInstaller.jar -install PM31983_FIX_1.jar C:/Program Files/IBM/cognos//bin/jre//bin
To apply a patch to a SUN version of JRE, do the following:
1.Download the compressed file for Java SE Floating Point Updater Tool:
http://www.oracle.com/technetwork/java/javase/downloads/index.html#fpupdater
2.Uncompress the file, and then copy fpupdater.jar to cognos_location/bin/jre//bin.
If you are using a 64-bit installation, copy fpupdater.jar to cognos_location/bin64/jre//bin.
3.In a command window, go to the cognos_location/bin/jre//bin directory, and enter the following command:
java -jar fpupdater.jar -u -v
.
Cross Reference information Segment Product Component Platform Version Edition
Business Analytics Cognos Business Intelligence Not Applicable AIX, HP-UX, HP Itanium, Linux, Solaris, Windows 10.1, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos Mobile Not Applicable Windows 10.1, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos Series 7 Not Applicable AIX, HP-UX on PA-RISC, Solaris, Windows 7.5, 7.4 All Editions
Business Analytics Cognos Now! Not Applicable AIX, HP-UX, Linux, Solaris, Windows 4.6, 4.5 All Editions
Business Analytics Cognos Express Not Applicable Windows 9.0, 9.5 All Editions
Business Analytics Cognos Real-time Monitoring Not Applicable AIX, HP-UX, Linux, Solaris, Windows 10.1 All Editions
Business Analytics Cognos Business Viewpoint Not Applicable AIX, HP-UX on PA-RISC, HP Itanium, Linux, Solaris, Windows 8.4.1, 8.4, 10.1 All Editions
Business Analytics Cognos 8 Controller Not Applicable Windows 8.5.1, 8.5, 8.4, 8.3 All Editions
Business Analytics Cognos Executive Viewer Not Applicable Windows 9.5 All Editions
Business Analytics Cognos Finance Not Applicable Windows 7.5, 7.4 All Editions
Business Analytics Cognos Planning Not Applicable Windows 10.1, 8.4.1, 8.4, 8.3, 8.1 All Editions
Business Analytics Cognos TM1 Not Applicable AIX, Linux, Solaris, Windows 9.5.1, 9.5, 9.4 All Editions
Business Analytics Cognos Analytic Applications Not Applicable AIX, HP-UX, Linux, Solaris, Windows 8.4.2, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos 8 Workforce Performance Not Applicable AIX, Solaris, Windows, HP-UX 8.3, 8.2 All Editions
Business Analytics Cognos Consumer Insight Not Applicable Linux 1.1 All Editions
Business Analytics Cognos 8 Go! Not Applicable Windows, AIX, HP-UX, Linux, Solaris 8.4.1, 8.4, 8.3 All Editions
Special offersSoftwareSoftware overviewProductsTrials and demosEvents and conferencesBusiness Analytics- Cognos- SPSSEnterprise Content ManagementInformation Management- DB2- Informix- InfoSphereLotusRationalTivoliWebSphereSystem z softwareStorageAll storageDisk systemsTape systemsStorage area networksNetwork attached storageStorage softwareHard drives/microdrivesStorage A to ZServers & systemsAll servers and systemsSystems softwarePower Systems (AIX, IBM i, Linux)System z (Mainframe)System x (xSeries)BladeCenterCluster systemsUNIX serversLinux serversIntel processor-based serversAMD processor-based serversOEM systemsInternet securityNetworkingPersonal computersPoint of salePrinting systems from InfoPrintSemiconductorsUpgrades, accessories & partsCertified used servers & storageCommunitiesSmall business productsMedium business productsHardwareSoftwareMoreSupport & downloads
DownloadFixes, updates and driversTrials and demosTroubleshootSearchDocumentationCommunitiesPlanInstallUseOpen a technical service requestCustomer supportFormer IBM productsPrinting systems from InfoPrintLenovo ThinkPads and ThinkCentresMoreMy IBM
My accountsMy profileMy interestsMy community spacesMy technical supportMy customer supportShopping cartContractsOrders and deliveryInventory and maintenanceInvoices and paymentsSelf-service toolsMore customer supportSubscriptionsMoreWelcome [ IBM Sign in ] [ Register ].Cognos Java Security Vulnerability CVE-2010-4476 Exposure Response
.Flash (Alert)
AbstractLast updated on April 19, 2011.
This Security Alert addresses a serious security vulnerability (CVE-2010-4476) which can cause the Java Virtual Machine to enter an infinite loop. This issue is described in more detail at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476.
To find out about applying the JRE patch to Cognos Business Intelligence on the Cloud, go to http://www.ibm.com/support/docview.wss?uid=swg21470017.
To find out about applying the JRE patch to Cognos Business Intelligence Special Edition, go to https://www-304.ibm.com/support/docview.wss?uid=swg21497107.
To find out about applying the JRE patch to the Cognos Now! 4.6.0 appliance, go to http://www.ibm.com/support/docview.wss?uid=swg21473104.
ContentProducts Affected
The issue exists in the Java class libraries and affects all products that use Java. IBM Cognos products that use Java include
Business Intelligence products:
□ Cognos Business Intelligence* versions 10.1, 8.4.1, 8.4.0, 8.3.0
□ Cognos Business Intelligence Developer Edition versions 10.1, 8.4.1
□ Cognos Business Intelligence Starter Edition versions 10.1, 8.4.1
□ Cognos PowerPlay versions 10.1, 8.4.1, 8.4.0, 7.5.0, 7.4.x,
□ Cognos Mobile versions 10.1, 8.4.1, 8.3.1, 8.3.0
□ Cognos Now! versions 4.6
□ Cognos DecisionStream version 7.1.4
□ Cognos Impromptu Web Reports versions 7.5, 7.4.x
□ Cognos NoticeCast versions 7.5, 7.4.x
□ Cognos Web Services versions 7.5, 7.4.x
□ Cognos Visualizer versions 7.5, 7.4.x
□ Cognos Query version 7.4.x
□ Cognos Express versions 9.5.0, 9.0.0
□ IBM Smart Analytics System Business Intelligence Module (all versions)
* Cognos Business Intelligence includes all BI components such as Reporting, Analysis, Data Manager, Virtual View Manager, Go! Search.Financial Performance Management products:
□ Cognos Business Viewpoint versions 10.1, 8.4.1, 8.4.0
□ Cognos Controller versions 8.5.1, 8.5.0, 8.4.0, 8.3.0
□ Cognos Finance versions 7.5.0, 7.4.x
□ Cognos Metrics versions 10.1, 8.4.1, 8.4.0, 8.3.0
□ Cognos Planning versions 10.1, 8.4.1, 8.4.0, 8.3.0, 8.1.x
□ Cognos TM1 versions 9.5.1, 9.5.0, 9.4.1, 9.4.0
Analytic Applications products:
□ Cognos Banking Risk Performance - Credit Risk versions 8.4.2, 8.4.0
□ Cognos Customer Performance Sales Analytics versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Financial Performance Analytics (AP, AR & GL) versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Supply Chain Performance Procurement Analytics versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Workforce Performance versions 8.4.2, 8.4.1, 8.4.0, 8.3.0, 8.2.0, 8.1.x
□ Cognos Consumer Insight version 1.1.0
Description
This vulnerability can cause the Java Runtime Environment (JRE) to hang, enter an infinite loop, or crash when converting "2.2250738585072012e-308" to a binary floating-point number. The result can be a denial of service exposure. This same problem can occur if the number is written without scientific notation (that is, using all of the 324 decimal places). Any Java program that uses the Double.parseDouble method is at risk of this vulnerability.
Solution
To prevent this vulnerability from affecting your product, you must apply a patch to your existing version of Java or install a version of Java that contains the fix.
If you do not require the fix, no action is necessary.
Before you update your JRE on a production system, it is strongly recommended to:
• Apply the patch in a test environment to verify that your product is working correctly
• Make a backup before you apply any changes
Linux or UNIX Installations
On Linux or UNIX, the JRE is not provided by Cognos as part of the product. The JRE used with Cognos is a separately installed component that is available from the operating system, application server or Java vendor.
To resolve the security vulnerability, you will need to patch or upgrade the JRE to a version that is recommended by the Operating System, Application Server or Java vendor. Ensure you stop the Cognos Services before applying the patch and restart the Cognos Services once the patch has been successfully applied.
The following table provides links to vendor-supplied details and solutions to this vulnerability: IBM http://www.ibm.com/developerworks/java/jdk/alerts/cve- 2010-4476.html
HP https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXFPUPDATER
Oracle http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html
Windows Installations
Typically, a JRE is packaged with the Windows versions of Cognos products. However, you may also use a version of Java that already existed on your system.
If you are using a JRE that already existed on the system, the solution is to update the JRE to a version that is recommended by the Operating System, Application Server or Java vendor.
If you are using the JRE version that is provided with your Cognos product, interim fixes are now available for several of the Cognos products. To determine if an interim Windows fix is available for your Cognos product as well as download and installation information, please follow the instructions at http://www.ibm.com/support/docview.wss?uid=swg24029220.
It is necessary to stop the Cognos services before applying the patch and then restart the Cognos Services once the patch has been successfully applied.
Cognos is continuing to develop interim fixes for the remaining affected products. These fixes will be made available as soon as possible.
If you cannot wait for the patch to become available from Cognos, you can also manually apply the patch to your JRE using the following steps.
Determine which version of JRE you are using
1.In a command window, go to the cognos_location/bin/jre directory.
If you are using a 64-bit installation, go to the cognos_location/bin64/jre directory.
2.Type the following:
java –version
The resulting message will indicate whether you have an IBM or Sun version of JRE.
To apply a patch to an IBM version of JRE, do the following:
Go to the following Web page, and following the instructions provided: http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html
1.Download the ParseDoubleTest.jar from the link above to verify if you need to apply the patch.
2.Copy the ParseDoubleTest.jar file to the cognos_location/bin/jre directory.
3.Open a command window in the location where you downloaded the file, and type the following:
java –jar ParseDoubleTest.jar
If the result is “Test Succeeded”, you do not have to apply the patch.
4.If you have to apply the patch, download the appropriate patch file from http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html.
For example, for JRE version 1.4 on Windows, download PM31983_FIX_1.jar.
5.Download the Java Update Installer from the following location: http://www.ibm.com/developerworks/java/jdk/alerts/updateinstaller.html
Unzip the UpdateInstallerforJava.zip.
6.Ensure that you have the patch file and the unzipped Java Update Installer in the same location.
7.In a command window, go to the location where you downloaded the patch file and the Java Update Installer, and enter the following command:
java -jar JavaUpdateInstaller.jar -install [patch JAR file] [JAVA_HOME of target JDK]
For example, for IBM Cognos products, the [JAVA_HOME of target JDK] is cognos_location/bin/jre/.
If you are installing the update for JRE version 1.4 to a default IBM Cognos installation location, the command would look like the following:
java -jar JavaUpdateInstaller.jar -install PM31983_FIX_1.jar C:/Program Files/IBM/cognos//bin/jre//bin
To apply a patch to a SUN version of JRE, do the following:
1.Download the compressed file for Java SE Floating Point Updater Tool:
http://www.oracle.com/technetwork/java/javase/downloads/index.html#fpupdater
2.Uncompress the file, and then copy fpupdater.jar to cognos_location/bin/jre//bin.
If you are using a 64-bit installation, copy fpupdater.jar to cognos_location/bin64/jre//bin.
3.In a command window, go to the cognos_location/bin/jre//bin directory, and enter the following command:
java -jar fpupdater.jar -u -v
.
Cross Reference information Segment Product Component Platform Version Edition
Business Analytics Cognos Business Intelligence Not Applicable AIX, HP-UX, HP Itanium, Linux, Solaris, Windows 10.1, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos Mobile Not Applicable Windows 10.1, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos Series 7 Not Applicable AIX, HP-UX on PA-RISC, Solaris, Windows 7.5, 7.4 All Editions
Business Analytics Cognos Now! Not Applicable AIX, HP-UX, Linux, Solaris, Windows 4.6, 4.5 All Editions
Business Analytics Cognos Express Not Applicable Windows 9.0, 9.5 All Editions
Business Analytics Cognos Real-time Monitoring Not Applicable AIX, HP-UX, Linux, Solaris, Windows 10.1 All Editions
Business Analytics Cognos Business Viewpoint Not Applicable AIX, HP-UX on PA-RISC, HP Itanium, Linux, Solaris, Windows 8.4.1, 8.4, 10.1 All Editions
Business Analytics Cognos 8 Controller Not Applicable Windows 8.5.1, 8.5, 8.4, 8.3 All Editions
Business Analytics Cognos Executive Viewer Not Applicable Windows 9.5 All Editions
Business Analytics Cognos Finance Not Applicable Windows 7.5, 7.4 All Editions
Business Analytics Cognos Planning Not Applicable Windows 10.1, 8.4.1, 8.4, 8.3, 8.1 All Editions
Business Analytics Cognos TM1 Not Applicable AIX, Linux, Solaris, Windows 9.5.1, 9.5, 9.4 All Editions
Business Analytics Cognos Analytic Applications Not Applicable AIX, HP-UX, Linux, Solaris, Windows 8.4.2, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos 8 Workforce Performance Not Applicable AIX, Solaris, Windows, HP-UX 8.3, 8.2 All Editions
Business Analytics Cognos Consumer Insight Not Applicable Linux 1.1 All Editions
Business Analytics Cognos 8 Go! Not Applicable Windows, AIX, HP-UX, Linux, Solaris 8.4.1, 8.4, 8.3 All Editions
Cognos Java Security Vulnerability CVE-2010-4476 Exposure Response
Products
Special offersSoftwareSoftware overviewProductsTrials and demosEvents and conferencesBusiness Analytics- Cognos- SPSSEnterprise Content ManagementInformation Management- DB2- Informix- InfoSphereLotusRationalTivoliWebSphereSystem z softwareStorageAll storageDisk systemsTape systemsStorage area networksNetwork attached storageStorage softwareHard drives/microdrivesStorage A to ZServers & systemsAll servers and systemsSystems softwarePower Systems (AIX, IBM i, Linux)System z (Mainframe)System x (xSeries)BladeCenterCluster systemsUNIX serversLinux serversIntel processor-based serversAMD processor-based serversOEM systemsInternet securityNetworkingPersonal computersPoint of salePrinting systems from InfoPrintSemiconductorsUpgrades, accessories & partsCertified used servers & storageCommunitiesSmall business productsMedium business productsHardwareSoftwareMoreSupport & downloads
DownloadFixes, updates and driversTrials and demosTroubleshootSearchDocumentationCommunitiesPlanInstallUseOpen a technical service requestCustomer supportFormer IBM productsPrinting systems from InfoPrintLenovo ThinkPads and ThinkCentresMoreMy IBM
My accountsMy profileMy interestsMy community spacesMy technical supportMy customer supportShopping cartContractsOrders and deliveryInventory and maintenanceInvoices and paymentsSelf-service toolsMore customer supportSubscriptionsMoreWelcome [ IBM Sign in ] [ Register ].Cognos Java Security Vulnerability CVE-2010-4476 Exposure Response
.Flash (Alert)
AbstractLast updated on April 19, 2011.
This Security Alert addresses a serious security vulnerability (CVE-2010-4476) which can cause the Java Virtual Machine to enter an infinite loop. This issue is described in more detail at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476.
To find out about applying the JRE patch to Cognos Business Intelligence on the Cloud, go to http://www.ibm.com/support/docview.wss?uid=swg21470017.
To find out about applying the JRE patch to Cognos Business Intelligence Special Edition, go to https://www-304.ibm.com/support/docview.wss?uid=swg21497107.
To find out about applying the JRE patch to the Cognos Now! 4.6.0 appliance, go to http://www.ibm.com/support/docview.wss?uid=swg21473104.
ContentProducts Affected
The issue exists in the Java class libraries and affects all products that use Java. IBM Cognos products that use Java include
Business Intelligence products:
□ Cognos Business Intelligence* versions 10.1, 8.4.1, 8.4.0, 8.3.0
□ Cognos Business Intelligence Developer Edition versions 10.1, 8.4.1
□ Cognos Business Intelligence Starter Edition versions 10.1, 8.4.1
□ Cognos PowerPlay versions 10.1, 8.4.1, 8.4.0, 7.5.0, 7.4.x,
□ Cognos Mobile versions 10.1, 8.4.1, 8.3.1, 8.3.0
□ Cognos Now! versions 4.6
□ Cognos DecisionStream version 7.1.4
□ Cognos Impromptu Web Reports versions 7.5, 7.4.x
□ Cognos NoticeCast versions 7.5, 7.4.x
□ Cognos Web Services versions 7.5, 7.4.x
□ Cognos Visualizer versions 7.5, 7.4.x
□ Cognos Query version 7.4.x
□ Cognos Express versions 9.5.0, 9.0.0
□ IBM Smart Analytics System Business Intelligence Module (all versions)
* Cognos Business Intelligence includes all BI components such as Reporting, Analysis, Data Manager, Virtual View Manager, Go! Search.Financial Performance Management products:
□ Cognos Business Viewpoint versions 10.1, 8.4.1, 8.4.0
□ Cognos Controller versions 8.5.1, 8.5.0, 8.4.0, 8.3.0
□ Cognos Finance versions 7.5.0, 7.4.x
□ Cognos Metrics versions 10.1, 8.4.1, 8.4.0, 8.3.0
□ Cognos Planning versions 10.1, 8.4.1, 8.4.0, 8.3.0, 8.1.x
□ Cognos TM1 versions 9.5.1, 9.5.0, 9.4.1, 9.4.0
Analytic Applications products:
□ Cognos Banking Risk Performance - Credit Risk versions 8.4.2, 8.4.0
□ Cognos Customer Performance Sales Analytics versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Financial Performance Analytics (AP, AR & GL) versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Supply Chain Performance Procurement Analytics versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Workforce Performance versions 8.4.2, 8.4.1, 8.4.0, 8.3.0, 8.2.0, 8.1.x
□ Cognos Consumer Insight version 1.1.0
Description
This vulnerability can cause the Java Runtime Environment (JRE) to hang, enter an infinite loop, or crash when converting "2.2250738585072012e-308" to a binary floating-point number. The result can be a denial of service exposure. This same problem can occur if the number is written without scientific notation (that is, using all of the 324 decimal places). Any Java program that uses the Double.parseDouble method is at risk of this vulnerability.
Solution
To prevent this vulnerability from affecting your product, you must apply a patch to your existing version of Java or install a version of Java that contains the fix.
If you do not require the fix, no action is necessary.
Before you update your JRE on a production system, it is strongly recommended to:
• Apply the patch in a test environment to verify that your product is working correctly
• Make a backup before you apply any changes
Linux or UNIX Installations
On Linux or UNIX, the JRE is not provided by Cognos as part of the product. The JRE used with Cognos is a separately installed component that is available from the operating system, application server or Java vendor.
To resolve the security vulnerability, you will need to patch or upgrade the JRE to a version that is recommended by the Operating System, Application Server or Java vendor. Ensure you stop the Cognos Services before applying the patch and restart the Cognos Services once the patch has been successfully applied.
The following table provides links to vendor-supplied details and solutions to this vulnerability: IBM http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html
HP https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXFPUPDATER
Oracle http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html
Windows Installations
Typically, a JRE is packaged with the Windows versions of Cognos products. However, you may also use a version of Java that already existed on your system.
If you are using a JRE that already existed on the system, the solution is to update the JRE to a version that is recommended by the Operating System, Application Server or Java vendor.
If you are using the JRE version that is provided with your Cognos product, interim fixes are now available for several of the Cognos products. To determine if an interim Windows fix is available for your Cognos product as well as download and installation information, please follow the instructions at http://www.ibm.com/support/docview.wss?uid=swg24029220.
It is necessary to stop the Cognos services before applying the patch and then restart the Cognos Services once the patch has been successfully applied.
Cognos is continuing to develop interim fixes for the remaining affected products. These fixes will be made available as soon as possible.
If you cannot wait for the patch to become available from Cognos, you can also manually apply the patch to your JRE using the following steps.
Determine which version of JRE you are using
1.In a command window, go to the cognos_location/bin/jre directory.
If you are using a 64-bit installation, go to the cognos_location/bin64/jre directory.
2.Type the following:
java –version
The resulting message will indicate whether you have an IBM or Sun version of JRE.
To apply a patch to an IBM version of JRE, do the following:
Go to the following Web page, and following the instructions provided: http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html
1.Download the ParseDoubleTest.jar from the link above to verify if you need to apply the patch.
2.Copy the ParseDoubleTest.jar file to the cognos_location/bin/jre directory.
3.Open a command window in the location where you downloaded the file, and type the following:
java –jar ParseDoubleTest.jar
If the result is “Test Succeeded”, you do not have to apply the patch.
4.If you have to apply the patch, download the appropriate patch file from http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html.
For example, for JRE version 1.4 on Windows, download PM31983_FIX_1.jar.
5.Download the Java Update Installer from the following location: http://www.ibm.com/developerworks/java/jdk/alerts/updateinstaller.html
Unzip the UpdateInstallerforJava.zip.
6.Ensure that you have the patch file and the unzipped Java Update Installer in the same location.
7.In a command window, go to the location where you downloaded the patch file and the Java Update Installer, and enter the following command:
java -jar JavaUpdateInstaller.jar -install [patch JAR file] [JAVA_HOME of target JDK]
For example, for IBM Cognos products, the [JAVA_HOME of target JDK] is cognos_location/bin/jre/.
If you are installing the update for JRE version 1.4 to a default IBM Cognos installation location, the command would look like the following:
java -jar JavaUpdateInstaller.jar -install PM31983_FIX_1.jar C:/Program Files/IBM/cognos//bin/jre//bin
To apply a patch to a SUN version of JRE, do the following:
1.Download the compressed file for Java SE Floating Point Updater Tool:
http://www.oracle.com/technetwork/java/javase/downloads/index.html#fpupdater
2.Uncompress the file, and then copy fpupdater.jar to cognos_location/bin/jre//bin.
If you are using a 64-bit installation, copy fpupdater.jar to cognos_location/bin64/jre//bin.
3.In a command window, go to the cognos_location/bin/jre//bin directory, and enter the following command:
java -jar fpupdater.jar -u -v
.
Cross Reference information Segment Product Component Platform Version Edition
Business Analytics Cognos Business Intelligence Not Applicable AIX, HP-UX, HP Itanium, Linux, Solaris, Windows 10.1, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos Mobile Not Applicable Windows 10.1, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos Series 7 Not Applicable AIX, HP-UX on PA-RISC, Solaris, Windows 7.5, 7.4 All Editions
Business Analytics Cognos Now! Not Applicable AIX, HP-UX, Linux, Solaris, Windows 4.6, 4.5 All Editions
Business Analytics Cognos Express Not Applicable Windows 9.0, 9.5 All Editions
Business Analytics Cognos Real-time Monitoring Not Applicable AIX, HP-UX, Linux, Solaris, Windows 10.1 All Editions
Business Analytics Cognos Business Viewpoint Not Applicable AIX, HP-UX on PA-RISC, HP Itanium, Linux, Solaris, Windows 8.4.1, 8.4, 10.1 All Editions
Business Analytics Cognos 8 Controller Not Applicable Windows 8.5.1, 8.5, 8.4, 8.3 All Editions
Business Analytics Cognos Executive Viewer Not Applicable Windows 9.5 All Editions
Business Analytics Cognos Finance Not Applicable Windows 7.5, 7.4 All Editions
Business Analytics Cognos Planning Not Applicable Windows 10.1, 8.4.1, 8.4, 8.3, 8.1 All Editions
Business Analytics Cognos TM1 Not Applicable AIX, Linux, Solaris, Windows 9.5.1, 9.5, 9.4 All Editions
Business Analytics Cognos Analytic Applications Not Applicable AIX, HP-UX, Linux, Solaris, Windows 8.4.2, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos 8 Workforce Performance Not Applicable AIX, Solaris, Windows, HP-UX 8.3, 8.2 All Editions
Business Analytics Cognos Consumer Insight Not Applicable Linux 1.1 All Editions
Business Analytics Cognos 8 Go! Not Applicable Windows, AIX, HP-UX, Linux, Solaris 8.4.1, 8.4, 8.3 All Editions
Special offersSoftwareSoftware overviewProductsTrials and demosEvents and conferencesBusiness Analytics- Cognos- SPSSEnterprise Content ManagementInformation Management- DB2- Informix- InfoSphereLotusRationalTivoliWebSphereSystem z softwareStorageAll storageDisk systemsTape systemsStorage area networksNetwork attached storageStorage softwareHard drives/microdrivesStorage A to ZServers & systemsAll servers and systemsSystems softwarePower Systems (AIX, IBM i, Linux)System z (Mainframe)System x (xSeries)BladeCenterCluster systemsUNIX serversLinux serversIntel processor-based serversAMD processor-based serversOEM systemsInternet securityNetworkingPersonal computersPoint of salePrinting systems from InfoPrintSemiconductorsUpgrades, accessories & partsCertified used servers & storageCommunitiesSmall business productsMedium business productsHardwareSoftwareMoreSupport & downloads
DownloadFixes, updates and driversTrials and demosTroubleshootSearchDocumentationCommunitiesPlanInstallUseOpen a technical service requestCustomer supportFormer IBM productsPrinting systems from InfoPrintLenovo ThinkPads and ThinkCentresMoreMy IBM
My accountsMy profileMy interestsMy community spacesMy technical supportMy customer supportShopping cartContractsOrders and deliveryInventory and maintenanceInvoices and paymentsSelf-service toolsMore customer supportSubscriptionsMoreWelcome [ IBM Sign in ] [ Register ].Cognos Java Security Vulnerability CVE-2010-4476 Exposure Response
.Flash (Alert)
AbstractLast updated on April 19, 2011.
This Security Alert addresses a serious security vulnerability (CVE-2010-4476) which can cause the Java Virtual Machine to enter an infinite loop. This issue is described in more detail at http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4476.
To find out about applying the JRE patch to Cognos Business Intelligence on the Cloud, go to http://www.ibm.com/support/docview.wss?uid=swg21470017.
To find out about applying the JRE patch to Cognos Business Intelligence Special Edition, go to https://www-304.ibm.com/support/docview.wss?uid=swg21497107.
To find out about applying the JRE patch to the Cognos Now! 4.6.0 appliance, go to http://www.ibm.com/support/docview.wss?uid=swg21473104.
ContentProducts Affected
The issue exists in the Java class libraries and affects all products that use Java. IBM Cognos products that use Java include
Business Intelligence products:
□ Cognos Business Intelligence* versions 10.1, 8.4.1, 8.4.0, 8.3.0
□ Cognos Business Intelligence Developer Edition versions 10.1, 8.4.1
□ Cognos Business Intelligence Starter Edition versions 10.1, 8.4.1
□ Cognos PowerPlay versions 10.1, 8.4.1, 8.4.0, 7.5.0, 7.4.x,
□ Cognos Mobile versions 10.1, 8.4.1, 8.3.1, 8.3.0
□ Cognos Now! versions 4.6
□ Cognos DecisionStream version 7.1.4
□ Cognos Impromptu Web Reports versions 7.5, 7.4.x
□ Cognos NoticeCast versions 7.5, 7.4.x
□ Cognos Web Services versions 7.5, 7.4.x
□ Cognos Visualizer versions 7.5, 7.4.x
□ Cognos Query version 7.4.x
□ Cognos Express versions 9.5.0, 9.0.0
□ IBM Smart Analytics System Business Intelligence Module (all versions)
* Cognos Business Intelligence includes all BI components such as Reporting, Analysis, Data Manager, Virtual View Manager, Go! Search.Financial Performance Management products:
□ Cognos Business Viewpoint versions 10.1, 8.4.1, 8.4.0
□ Cognos Controller versions 8.5.1, 8.5.0, 8.4.0, 8.3.0
□ Cognos Finance versions 7.5.0, 7.4.x
□ Cognos Metrics versions 10.1, 8.4.1, 8.4.0, 8.3.0
□ Cognos Planning versions 10.1, 8.4.1, 8.4.0, 8.3.0, 8.1.x
□ Cognos TM1 versions 9.5.1, 9.5.0, 9.4.1, 9.4.0
Analytic Applications products:
□ Cognos Banking Risk Performance - Credit Risk versions 8.4.2, 8.4.0
□ Cognos Customer Performance Sales Analytics versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Financial Performance Analytics (AP, AR & GL) versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Supply Chain Performance Procurement Analytics versions 8.4.2, 8.4.1, 8.4.0
□ Cognos Workforce Performance versions 8.4.2, 8.4.1, 8.4.0, 8.3.0, 8.2.0, 8.1.x
□ Cognos Consumer Insight version 1.1.0
Description
This vulnerability can cause the Java Runtime Environment (JRE) to hang, enter an infinite loop, or crash when converting "2.2250738585072012e-308" to a binary floating-point number. The result can be a denial of service exposure. This same problem can occur if the number is written without scientific notation (that is, using all of the 324 decimal places). Any Java program that uses the Double.parseDouble method is at risk of this vulnerability.
Solution
To prevent this vulnerability from affecting your product, you must apply a patch to your existing version of Java or install a version of Java that contains the fix.
If you do not require the fix, no action is necessary.
Before you update your JRE on a production system, it is strongly recommended to:
• Apply the patch in a test environment to verify that your product is working correctly
• Make a backup before you apply any changes
Linux or UNIX Installations
On Linux or UNIX, the JRE is not provided by Cognos as part of the product. The JRE used with Cognos is a separately installed component that is available from the operating system, application server or Java vendor.
To resolve the security vulnerability, you will need to patch or upgrade the JRE to a version that is recommended by the Operating System, Application Server or Java vendor. Ensure you stop the Cognos Services before applying the patch and restart the Cognos Services once the patch has been successfully applied.
The following table provides links to vendor-supplied details and solutions to this vulnerability: IBM http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html
HP https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXFPUPDATER
Oracle http://www.oracle.com/technetwork/topics/security/alert-cve-2010-4476-305811.html
Windows Installations
Typically, a JRE is packaged with the Windows versions of Cognos products. However, you may also use a version of Java that already existed on your system.
If you are using a JRE that already existed on the system, the solution is to update the JRE to a version that is recommended by the Operating System, Application Server or Java vendor.
If you are using the JRE version that is provided with your Cognos product, interim fixes are now available for several of the Cognos products. To determine if an interim Windows fix is available for your Cognos product as well as download and installation information, please follow the instructions at http://www.ibm.com/support/docview.wss?uid=swg24029220.
It is necessary to stop the Cognos services before applying the patch and then restart the Cognos Services once the patch has been successfully applied.
Cognos is continuing to develop interim fixes for the remaining affected products. These fixes will be made available as soon as possible.
If you cannot wait for the patch to become available from Cognos, you can also manually apply the patch to your JRE using the following steps.
Determine which version of JRE you are using
1.In a command window, go to the cognos_location/bin/jre directory.
If you are using a 64-bit installation, go to the cognos_location/bin64/jre directory.
2.Type the following:
java –version
The resulting message will indicate whether you have an IBM or Sun version of JRE.
To apply a patch to an IBM version of JRE, do the following:
Go to the following Web page, and following the instructions provided: http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html
1.Download the ParseDoubleTest.jar from the link above to verify if you need to apply the patch.
2.Copy the ParseDoubleTest.jar file to the cognos_location/bin/jre directory.
3.Open a command window in the location where you downloaded the file, and type the following:
java –jar ParseDoubleTest.jar
If the result is “Test Succeeded”, you do not have to apply the patch.
4.If you have to apply the patch, download the appropriate patch file from http://www.ibm.com/developerworks/java/jdk/alerts/cve-2010-4476.html.
For example, for JRE version 1.4 on Windows, download PM31983_FIX_1.jar.
5.Download the Java Update Installer from the following location: http://www.ibm.com/developerworks/java/jdk/alerts/updateinstaller.html
Unzip the UpdateInstallerforJava.zip.
6.Ensure that you have the patch file and the unzipped Java Update Installer in the same location.
7.In a command window, go to the location where you downloaded the patch file and the Java Update Installer, and enter the following command:
java -jar JavaUpdateInstaller.jar -install [patch JAR file] [JAVA_HOME of target JDK]
For example, for IBM Cognos products, the [JAVA_HOME of target JDK] is cognos_location/bin/jre/
If you are installing the update for JRE version 1.4 to a default IBM Cognos installation location, the command would look like the following:
java -jar JavaUpdateInstaller.jar -install PM31983_FIX_1.jar C:/Program Files/IBM/cognos/
To apply a patch to a SUN version of JRE, do the following:
1.Download the compressed file for Java SE Floating Point Updater Tool:
http://www.oracle.com/technetwork/java/javase/downloads/index.html#fpupdater
2.Uncompress the file, and then copy fpupdater.jar to cognos_location/bin/jre/
If you are using a 64-bit installation, copy fpupdater.jar to cognos_location/bin64/jre/
3.In a command window, go to the cognos_location/bin/jre/
java -jar fpupdater.jar -u -v
.
Cross Reference information Segment Product Component Platform Version Edition
Business Analytics Cognos Business Intelligence Not Applicable AIX, HP-UX, HP Itanium, Linux, Solaris, Windows 10.1, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos Mobile Not Applicable Windows 10.1, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos Series 7 Not Applicable AIX, HP-UX on PA-RISC, Solaris, Windows 7.5, 7.4 All Editions
Business Analytics Cognos Now! Not Applicable AIX, HP-UX, Linux, Solaris, Windows 4.6, 4.5 All Editions
Business Analytics Cognos Express Not Applicable Windows 9.0, 9.5 All Editions
Business Analytics Cognos Real-time Monitoring Not Applicable AIX, HP-UX, Linux, Solaris, Windows 10.1 All Editions
Business Analytics Cognos Business Viewpoint Not Applicable AIX, HP-UX on PA-RISC, HP Itanium, Linux, Solaris, Windows 8.4.1, 8.4, 10.1 All Editions
Business Analytics Cognos 8 Controller Not Applicable Windows 8.5.1, 8.5, 8.4, 8.3 All Editions
Business Analytics Cognos Executive Viewer Not Applicable Windows 9.5 All Editions
Business Analytics Cognos Finance Not Applicable Windows 7.5, 7.4 All Editions
Business Analytics Cognos Planning Not Applicable Windows 10.1, 8.4.1, 8.4, 8.3, 8.1 All Editions
Business Analytics Cognos TM1 Not Applicable AIX, Linux, Solaris, Windows 9.5.1, 9.5, 9.4 All Editions
Business Analytics Cognos Analytic Applications Not Applicable AIX, HP-UX, Linux, Solaris, Windows 8.4.2, 8.4.1, 8.4, 8.3 All Editions
Business Analytics Cognos 8 Workforce Performance Not Applicable AIX, Solaris, Windows, HP-UX 8.3, 8.2 All Editions
Business Analytics Cognos Consumer Insight Not Applicable Linux 1.1 All Editions
Business Analytics Cognos 8 Go! Not Applicable Windows, AIX, HP-UX, Linux, Solaris 8.4.1, 8.4, 8.3 All Editions
How to Make the Case for a BI Center of Excellence
The good news is also the bad news. End users are smarter than ever. Many of them have co-opted BI by acquiring their own tools and have funded their own skill development to create specific functionality. As BI is increasingly adopted across organizations, it has become a free-for-all of brand-new silos, unmanaged data, duplicate work efforts and poor data quality, all of which lead to misaligned business decisions. Translation: We're spending too much time and money getting information and not using it cohesively. In response, many BI teams have chosen to launch a center of excellence as a way of refocusing attention on the unique nature of BI projects and the processes that come with them. But such a big project can easily backfire and lead to more chaos. We need to know when the time is right for a BI COE.
Craig's hope was that by announcing a BI COE, his user community would take him and his team more seriously. "I thought the COE concept would give us street cred," he admitted. It had the opposite effect. Immediately, business users began asking why the BI team was getting more funding when they hadn't delivered anything in more than six months.
And it was true. Since the dashboard project's success, BI team members had been focusing their time on infrastructure and platform issues. Data model enhancements and regular data loading activities were absorbing most of the resources. Users weren't seeing value, so Craig's emails advocating a COE seemed self-serving. Craig hoped his COE idea would get attention, but cynical email replies and eye-rolling weren't the kind of attention he wanted.
Craig's users brought their old resentments to the COE discussion. "It's rearranging deck chairs on the Titanic," a segment manager in marketing remarked. "We don't know what these guys are doing - and neither do they. Why should we be the ones to fund a COE when we have no idea what's in their pipeline - and have absolutely no input into it? It's a funding grab if you ask me." Ouch.
I've seen other failed COEs at companies that used high-profile problems - such as an enterprise resource planning system's problems acquiring data or management's desire to standardize on reporting tools - as a pretext for starting a COE. The results have been equally fruitless. In reality, the situations that justify a COE are few and very easy to spot.
And that's the problem with many existing (and increasingly defunct) COEs: They begin prematurely, before stakeholders perceive value. A COE will only become sanctioned if its stakeholders recognize a bona fide need for it. There are three predominant drivers of successful and sustainable COEs:
Reconsider your data provisioning model. There's nothing wrong with a data warehouse availing data to various organizations and reports across the company. Indeed, that's part of its value. But if your BI team spends its days modeling and loading data into data marts, you're being marginalized as infrastructure, not as a value driver. Consider helping a high-profile user group to not only get its data, but to use it. Develop expertise in BI applications as well as platforms. It's a truism in BI (and in IT in general) that he who is closest to the end user wins.
Adopt a BI portfolio approach. When companies develop their BI roadmaps the right way, the whole is usually greater than the sum of its parts. A BI portfolio is a collection of business capabilities deployed over time. A portfolio approach guarantees reuse of common data for a range of analytical applications. Defining the initial set of portfolio applications helps establish the short and midterm development pipeline and gets BI team members back in front of key end users to discuss their need for business information in the context in which they use it.
The portfolio diagram in the provided figure illustrates functional applications at the top accessing reusable data in the data warehouse below. After your initial discovery work with business users, the simple act of unveiling the new portfolio can instill confidence that BI planning is rigorous and deliberate, thereby increasing stakeholder support for the BI COE and your chances for success.
Document your development process. Everyone in BI knows that BI development is different than other IT/business projects. As you consider a BI COE, be rigorous about circumscribing and documenting your BI development process. Activities such as user requirements gathering, data modeling, data loading, application and data acceptance testing, and deployment should be well-defined and within the context of an overall BI-specific delivery method with its own artifacts and handoff points. Instituting regular status updates, closed-loop ROI reviews and project postmortems reflects additional rigor and instills goodwill.
Get serious about staffing. A COE that wants to be sanctioned and funded involves more than just a data modeler and a few developers. Roles and responsibilities should be specific to the BI development process, with clear inputs and outputs between functional areas. Depending on the scope of the COE, it may include functions such as business analysis, data stewardship, metadata management, BI application development and more. Discrete job roles should be defined and well-documented, vetted with HR and accompanied by distinct measures of success.
Create a charter and guiding principles. Many IT leaders view organizational charters and mission statements as extraneous fluff. But only by communicating the COE's fundamental purpose and common philosophies can your BI team enforce an effective pitch. The organizational charter includes a purpose statement, a list of recurring problems the COE will address and a value proposition for the organization at large. This can be the glue that secures the buy-in of executive and user stakeholders.
My client Craig retracted his COE pitch and instead invested in some discovery work, pinpointing three key business applications through which his team could prove its newly documented BI development process. Once the applications were deployed, Craig measured and communicated their business value to a handpicked set of business stakeholders, leveraging his newfound prestige to pitch a COE model to executives.
The results are impressive. The BI COE regularly engages stakeholders both formally (through a structured business requirements-gathering process and periodic vendor presentations) and informally (through lunch-and-learn sessions and a corporate portal for BI information and status). As the rules of engagement have become clearer, so has the team's ability to leverage existing technology platforms and drive additional business value through cost savings and strategic enablement. All in all, the BI COE is a celebrated success. After a visible lapse, it took a deliberate plan to get on the right track.
Jill Dyché is a partner and co-founder of Baseline Consulting (www.baseline-consulting.com), a data integration and business analytics delivery firm. Her first book, e-Data (Addison Wesley, 2000) introduced managers to the concept of enterprise data integration and has been published in eight languages. Her second book, The CRM Handbook (Addison Wesley, 2002) is the CRM bestseller. Jill's work has been featured in major publications, and she is a frequent speaker at industry events. Her latest book, Customer Data Integration: Reaching a Single Version of the Truth was co-authored with Evan Levy. You can reach her at jilldyche@baseline-consulting.com.
Failure to Launch: How Not to Start Your COE
When I asked Craig, the CIO at a regional bank, why he'd decided to launch a BI COE, he explained that, after working for two years as a formal team, the BI developers had practically disappeared. The initial business process management dashboard had been a high-profile success, but users had reverted back to Excel spreadsheets for most of their reporting, enlisting developers only when new query creation proved too complex. Meeting fatigue had become part of the culture, and users didn't want to be proactively engaged in business requirements discussions, however strategic. BI had become commoditized.Craig's hope was that by announcing a BI COE, his user community would take him and his team more seriously. "I thought the COE concept would give us street cred," he admitted. It had the opposite effect. Immediately, business users began asking why the BI team was getting more funding when they hadn't delivered anything in more than six months.
And it was true. Since the dashboard project's success, BI team members had been focusing their time on infrastructure and platform issues. Data model enhancements and regular data loading activities were absorbing most of the resources. Users weren't seeing value, so Craig's emails advocating a COE seemed self-serving. Craig hoped his COE idea would get attention, but cynical email replies and eye-rolling weren't the kind of attention he wanted.
Craig's users brought their old resentments to the COE discussion. "It's rearranging deck chairs on the Titanic," a segment manager in marketing remarked. "We don't know what these guys are doing - and neither do they. Why should we be the ones to fund a COE when we have no idea what's in their pipeline - and have absolutely no input into it? It's a funding grab if you ask me." Ouch.
I've seen other failed COEs at companies that used high-profile problems - such as an enterprise resource planning system's problems acquiring data or management's desire to standardize on reporting tools - as a pretext for starting a COE. The results have been equally fruitless. In reality, the situations that justify a COE are few and very easy to spot.
When the COE Makes Sense
As real as Craig's problem was, announcing a COE wasn't the answer. Craig needed to re-enlist users in a structured process with clear rules of engagement and begin to quantify the value of work tasks to prove that his team was deserving of continued funding. He needed to deploy BI applications that business users would use and establish structure and BI-specific development processes. Only then would a COE make sense.And that's the problem with many existing (and increasingly defunct) COEs: They begin prematurely, before stakeholders perceive value. A COE will only become sanctioned if its stakeholders recognize a bona fide need for it. There are three predominant drivers of successful and sustainable COEs:
- BI projects often compete for funding with other IT projects that are seen as operationally critical. The executive steering committee at a catalog retailer constantly placed BI at the bottom of the funding list. "When funding came down to either BI or a new merchandise management system, we'd lose," said one director of BI, "and we lost most of the time." The director set out to educate the steering committee about why BI development was different, and how it could enable strategic goals like customer retention and promotions effectiveness. With the caveat that cost recovery was an end goal, the steering committee agreed to fund BI as a separate group with its own organizational structure and governance process.
- The data warehouse has become a shared resource across organizations, and the economies of scale justify a central development organization. Alternative, piecemeal and siloed efforts at data management and BI have become not only costly, but also risky, as different versions of data proliferate across the company. A COE not only ensures a deliberate approach to funding and deploying BI, but an ongoing investment in BI-specific tools, skills and data.
- Business operations become dependent on BI. When a company relies on its data warehouse or BI infrastructure for business-critical capabilities such as inventory management or financial reporting, the company should invest in a COE. It has become more common to see that certain high-profile business functions or processes can't run without BI, in which case you've established BI as a business-critical platform that justifies its own skill sets and budget.
Getting Ready for Your COE
Most BI organizations today are in limbo. They have a vision for a COE, but they're not yet qualified to hang the COE shingle. You can take the following steps to prepare before you make your pitch.Reconsider your data provisioning model. There's nothing wrong with a data warehouse availing data to various organizations and reports across the company. Indeed, that's part of its value. But if your BI team spends its days modeling and loading data into data marts, you're being marginalized as infrastructure, not as a value driver. Consider helping a high-profile user group to not only get its data, but to use it. Develop expertise in BI applications as well as platforms. It's a truism in BI (and in IT in general) that he who is closest to the end user wins.
Adopt a BI portfolio approach. When companies develop their BI roadmaps the right way, the whole is usually greater than the sum of its parts. A BI portfolio is a collection of business capabilities deployed over time. A portfolio approach guarantees reuse of common data for a range of analytical applications. Defining the initial set of portfolio applications helps establish the short and midterm development pipeline and gets BI team members back in front of key end users to discuss their need for business information in the context in which they use it.
The portfolio diagram in the provided figure illustrates functional applications at the top accessing reusable data in the data warehouse below. After your initial discovery work with business users, the simple act of unveiling the new portfolio can instill confidence that BI planning is rigorous and deliberate, thereby increasing stakeholder support for the BI COE and your chances for success.
Document your development process. Everyone in BI knows that BI development is different than other IT/business projects. As you consider a BI COE, be rigorous about circumscribing and documenting your BI development process. Activities such as user requirements gathering, data modeling, data loading, application and data acceptance testing, and deployment should be well-defined and within the context of an overall BI-specific delivery method with its own artifacts and handoff points. Instituting regular status updates, closed-loop ROI reviews and project postmortems reflects additional rigor and instills goodwill.
Get serious about staffing. A COE that wants to be sanctioned and funded involves more than just a data modeler and a few developers. Roles and responsibilities should be specific to the BI development process, with clear inputs and outputs between functional areas. Depending on the scope of the COE, it may include functions such as business analysis, data stewardship, metadata management, BI application development and more. Discrete job roles should be defined and well-documented, vetted with HR and accompanied by distinct measures of success.
Create a charter and guiding principles. Many IT leaders view organizational charters and mission statements as extraneous fluff. But only by communicating the COE's fundamental purpose and common philosophies can your BI team enforce an effective pitch. The organizational charter includes a purpose statement, a list of recurring problems the COE will address and a value proposition for the organization at large. This can be the glue that secures the buy-in of executive and user stakeholders.
My client Craig retracted his COE pitch and instead invested in some discovery work, pinpointing three key business applications through which his team could prove its newly documented BI development process. Once the applications were deployed, Craig measured and communicated their business value to a handpicked set of business stakeholders, leveraging his newfound prestige to pitch a COE model to executives.
The results are impressive. The BI COE regularly engages stakeholders both formally (through a structured business requirements-gathering process and periodic vendor presentations) and informally (through lunch-and-learn sessions and a corporate portal for BI information and status). As the rules of engagement have become clearer, so has the team's ability to leverage existing technology platforms and drive additional business value through cost savings and strategic enablement. All in all, the BI COE is a celebrated success. After a visible lapse, it took a deliberate plan to get on the right track.
Jill Dyché is a partner and co-founder of Baseline Consulting (www.baseline-consulting.com), a data integration and business analytics delivery firm. Her first book, e-Data (Addison Wesley, 2000) introduced managers to the concept of enterprise data integration and has been published in eight languages. Her second book, The CRM Handbook (Addison Wesley, 2002) is the CRM bestseller. Jill's work has been featured in major publications, and she is a frequent speaker at industry events. Her latest book, Customer Data Integration: Reaching a Single Version of the Truth was co-authored with Evan Levy. You can reach her at jilldyche@baseline-consulting.com.
Subscribe to:
Posts (Atom)