the btrg methodology for the peoplesoft upgrader

The BTRG Methodology for the PeopleSoft Upgrader

Bruce Driver Chief Technology Architect

The Business & Technology Resource Group (BTRG) Proprietary & Confidential

The BTRG Methodology for the PeopleSoft Upgrader

Best Practices For Fitting Your PeopleSoft

Upgrade Into the Go-Live Time Window


Outline

o PeopleSoft Upgrade Project Overview

o PeopleSoft Upgrade Project Roles

o Primary Goals of Multiple Upgrade Passes

o PeopleSoft Upgrade High-Level Outline

o PeopleSoft Upgrade Guidelines - Overall

o PeopleSoft Upgrade Guidelines – Task-By-Task

o PeopleSoft Upgrade Toolkit

o Summary


PeopleSoft Upgrade Project Overview

o Multiple Upgrade Passes

o An Initial Upgrade Pass

o Several Move-To-Production (MTP) Upgrade passes

o Each pass has a Source database and a Target Database



o Source database

o At the new PeopleSoft Application and PeopleTools

version

o New version PeopleSoft/PeopleTools objects migrated

from the Source database to the Target database

o Initial Upgrade Pass

o Uses new version Demo database as the Source

o Move-To-Production Passes

o Use already upgraded Copy of Production as the Source



o Target database

o A new copy of production

o Starts at old PeopleSoft Application and PeopleTools

versions

o Finishes a new PeopleSoft Application and PeopleTools

versions



o Several PeopleSoft Move-To-Production

(MTP) Upgrade Passes

o Referred to as Practice MTP Upgrade Passes

o Performed to prepare for the eventual Go-Live MTP

Upgrade Pass


PeopleSoft Upgrade Project Roles

Upgrader Developers

Database Administrator

Functional Module Leads

Upgrade Project

Manager Engagement

Manager


PeopleSoft Upgrader • Lead role in executing the PeopleSoft Application

Upgrade procedure • Executes tasks prescribed by PS Upgrade manual • Uses Change Assistant to execute this procedure • Performs Initial Upgrade Pass, Test MTP Upgrades

Passes, and Go-Live MTP Upgrade Passes • Installs and configures Change Assistant and

Environment Management Framework • Often installs target PS App/PT versions including new

version Demo database • PeopleSoft infrastructure administration skills and

strong SQL skills needed • Performance tuning and debugging skills • Database administration skills helpful


PeopleSoft Developers

o Technical PeopleSoft developer responsible for:

o Reviewing existing customizations

o Re-implementing customizations being maintained

o Developing new customizations if required

o PeopleSoft development skills as necessary

o Application Engine, PeopleCode, SQR, COBOL, SQL

o XML, Web Services


PeopleSoft Database Administrator

o Create and administer the PeopleSoft databases

necessary for a PeopleSoft Upgrade

o PeopleSoft Demo databases

o PeopleSoft Upgrade Source database

o PeopleSoft Upgrade Target database

o New version Development, Test, UAT, Production

databases

o Performance Tuning


PeopleSoft Functional Module Leads

o Functional responsibility for supporting specific

PeopleSoft module(s) through the upgrade

o Financials – GL Module Lead, AP Module Lead, AR

Module Lead, etc.

o HCM – Benefits Module Lead, Payroll for NA Module

Lead, etc.

o Functional expertise in the specific PeopleSoft

module(s) for which is the lead


PeopleSoft Upgrade Project Manager

o Responsible for managing the PeopleSoft

Upgrade project

o Development and maintenance of the Upgrade Project

plan

o Management of Upgrade Project resources

o Ensuring successful completion of project deliverables

o Project status reports

o Project issue management and change management

o Onsite and provides day-to-day management of

Upgrade team for larger upgrade projects


Engagement Manager

o Senior-level manager with comprehensive

implementation experience

o Serves as advisor during the PeopleSoft Upgrade project

o Ensures adequate stakeholder and business

representative involvement

o Usually offsite and participates in Steering Committee

meetings

o Point of contact for project engagement issues

escalation


Primary Goals of Multiple Upgrade Passes

Build Upgrade Toolkit 1

Identify and Remove Upgrade Breakdowns 2

Tune Upgrade Performance 3



o Build Upgrade Toolkit

o Develop and compile a set of SQL scripts, Data Mover

script, and Guidance Notes

o Organized for easy reference with naming convention

reflecting Upgrade task/step



o Identify and Resolve Upgrade Breakdowns

o Example

o Alter Without Deletes tasks - run out of database space

o Data Conversion tasks – encounter unique constraint

violation on a unique index

o Identification and resolution of breakdowns consume

time

o Goal – identify and resolve all upgrade pass breakdowns

before the Go-Live MTP Upgrade Pass



o Tune Upgrade Performance

o Make actual tasks/steps of the Upgrade perform faster

o For example

o Data Conversion tasks

o Designing and creating appropriate indexes

o Rewriting SQL

o Rewriting Application Engine code

o Alter Without Deletes tasks/Alter With Deletes tasks

o Create and run multiple Alter scripts in parallel


Other Goals of Multiple Upgrade Passes

o E.g., Initial Upgrade pass – Project Compares

o Identify customizations

o Responsibility of PeopleSoft Developer


o Primary goals of the PeopleSoft Upgrader


PeopleSoft Upgrader Role

o Primary PeopleSoft Upgrader

o Needs to be involved in all Upgrade passes

o To achieve primary goals of multiple Upgrade Passes

o To build the knowledge to complete the Go-Live MTP

Upgrade Pass in the allotted Go-Live Time Window

o DO NOT

o Shuffle this responsibility between different team members

o Farm out to a part-time team member

o Backup PeopleSoft Upgrader

o Shadows Primary Upgrader, perhaps leads some passes


PeopleSoft Upgrade High-Level Outline

Chapter 1: Planning Your Application Upgrade Chapter 2: Preparing Your Database for Upgrade Chapter 3: Applying PeopleTools Changes Chapter 4: Running and Reviewing Compare Reports Chapter 5: Applying Application Changes Chapter 6: Completing Database Changes Chapter 7: Applying Changes to the Production Database


PeopleSoft Upgrade Guidelines - Overall

"Amat victoria curam "

Catullus, Carmen 62:16

"Victory loves preparation"



o PeopleSoft Upgrade manual

o E.g., PeopleSoft Financials/Supply Chain Management

8.9 to 9.2 Upgrade manual

o Prescribes required procedure on a Task-by-Task basis

o Typically 300 – 450 pages in length



o "To a large extent the ultimate success of a

PeopleSoft Upgrade depends on the sustained

attention to detail required to persevere in the

successful execution of the PeopleSoft Application

Upgrade tasks through multiple upgrade passes "



o Resist temptation to cut corners

o to skip steps deemed unnecessary for a particular

upgrade pass or to perform steps incompletely for the

sake of expediency

o Multiple upgrade passes are practice for the Go-

Live upgrade pass

o Maxim: “Practice does not make perfect; rather, perfect

practice make perfect”



o Develop, Compile, and Retain Upgrade Scripts

and Notes

o E.g., upgrade task requires a set of tables to be dropped

or set of indexes to be created

o Develop a SQL script and retain for future passes

o Have scripts log their output

o E.g, some upgrade tasks are executed conditionally

o Develop a script to ascertain this condition

o Compile notes pertinent to execution of specific tasks as

necessary



o Develop, Compile, and Retain Upgrade Scripts

and Notes

o Organize upgrade scripts and notes by directory

structure and useful naming convention

o E.g., including the Upgrade manual task description and

numbering



o Keep All Log and Trace Files

o Keep all log and trace files from all upgrade passes

o Not only for tasks/steps run through Change Assistant

o But also for all tasks/steps executed manually

o Not only enable debugging at time of breakdown

o Help diagnose problems not identified until some time

later during Unit or System testing

o Enable performance tuning by enabling identification of

poorly performing steps and SQL



o Update Statistics

o Update statistics for appropriate tables at all stages of

upgrade pass as prescribed by PS Upgrade manual

o Temptation to skip - communication and wait for DBA

o Without updating statistics subsequent steps in the

upgrade will be slower

o Will not adequately determine duration of these steps

o Determine how to update statistics efficiently

o Often can kick off update statistics script and proceed

with subsequent tasks of upgrade



o Update Statistics

o Three of the key tasks prescribed for updating statistics

o Performing Updates to PeopleTools System Tables

o Need to update statistics for affected PeopleTools tables

o Modifying the Database Structure

o After Alter Without Deletes and associated steps performed,

need to Update Statistics in preparation for Data Conversion

o Running Final Update Statistics

o After Finalizing the Database Structure and its associated Alter

With Deletes step, need to Update Statistics in preparation for

remaining Upgrade tasks



o Perform Pre-Upgrade and Post-Upgrade Manual

Functional Tasks For All Upgrade Passes

o Typically completed by someone other than Upgrader

o Compile task lists

o for Chap 2 Pre-Upgrade Manual Functional Tasks

o for Chap 6 Post-Upgrade Manual Functional Tasks

o Determine which tasks necessary for this particular

PeopleSoft environment and who is responsible for

performing each task

o Individual team member practice and team coordination



o Run Data Conversion and Other Upgrade Tasks

With Appropriate Tracing Enabled

o Expressed reluctance – “I don’t want to have tracing

enabled because it will slow it down.”

o Trace files of indispensible value in practice passes

o In identifying what steps need to be tuned

o In diagnosing and debugging Application Engine program

failures



o Run Data Conversion and Other Upgrade Tasks

With Appropriate Tracing Enabled

o Each upgrade pass may have particular focus – e.g.,

Performance Tuning MTP Upgrade Pass

o Each upgrade passes should work toward all of the Primary

Goals – including tuning performance

o Possible to choose an appropriate level of tracing so that

the impact on performance is minimized

o Need to be instrumented to facilitate problem diagnosis

and resolution



o Perform All Audits

o Chap 2 Preparing Your Database for Upgrade

o Initial DDDAUDIT, Initial SYSAUDIT, Initial Alter Audit

o Chapter 5 Applying Application Changes

o Final DDDAUDIT, Final SYSAUDIT, Final Alter Audit

o Audits can provide critical information necessary

for success of upgrade

o Can not rely on assurances of Non-Upgrade team

resources that “Production is audited and clean’



o SQL Script Generation

o During Go-Live MTP Upgrade pass, upgrader should not

need to generate SQL scripts

o SQL scripts from previous MTP Upgrade passes can be used

o Conditions

o No records have been changed since those SQL scripts

were generated

o I.e., an appropriate code/object freeze occurs before the

last time these SQL scripts were generated



o SQL Script Generation

o Two of main tasks where these observations applicable

o Modifying the Database Structure

o Finalizing the Database Structure

o These tasks (along with Data Conversion) are two of the

most time-consuming tasks of an MTP Upgrade Pass

o Code Freeze

o Imperative that Record and Field definitions be frozen

before the final Test MTP Upgrade pass



o Data Mover Exports

o During Go-Live MTP Upgrade pass, upgrader should not

need to perform Data Mover exports from Source

database

o Exports from previous MTP Upgrade passes can be used

o Condition

o an appropriate code/object freeze - no modifications to

Source database since the Upgrade pass during which the

exports were generated



o Upgrade Database Backups

o Upgrade manual prescribes database backups at various

points of the upgrade pass

o Database Backups – variety of different methods

o Work with DBA team to devise a backup method that is

fast and reliable

o Consider not only the amount of time to perform backup

but also the amount of time to perform restore

o If Go-Live Upgrade Time window is 72 hours and Database

Backup/Restore method requires 36 hours for Restore, that

factor should be known when weighing options



o Go-Live MTP Upgrade Pass Deployment Timeline

o Compile Upgrade task timings to compile a Go-Live MTP

Upgrade Pass Deployment timeline

o Include tasks not only explicitly documented in Upgrade

manual, but also Pre- and Post-Upgrade task such as

o Suspending and restarting Production system system feeds

and interfaces

o Disabling user access for the duration of Go-Live

Deployment

o Creating new Production PeopleSoft infrastructure



o Go-Live MTP Upgrade Pass Deployment Timeline

o Include task resource assignments

o Compiled, updated, and reviewed repeatedly by Upgrade

team during latter phases of Upgrade project

o for completeness

o with view to complete the Upgrade successfully in the

designated Go-Live time window


PeopleSoft Upgrade Guidelines – Task-By-Task

o PeopleSoft Upgrade Guidelines – Task-By-Task

o Preparing Your Database For Upgrade

o Applying PeopleTools Changes

o Applying Application Changes


PeopleSoft Upgrade Toolkit

o PeopleSoft Upgrade Toolkit

o Necessarily different and specific for every customer’s

upgrade

o Nevertheless, significant commonality

o BTRG has developed toolkits and expertise in developing

Upgrade toolkits over the course of scores of upgrades


Best Practices –

Fitting Your PeopleSoft Upgrade Into the Go-Live Time Window

o PeopleSoft Upgrade Project Roles

o not enough to have a person, must have right person

o PeopleSoft Upgrader

o Special combination of PS and RDBMS administration,

development, debugging and tuning skills

o not everyone has the aptitude

o PeopleSoft Developer

o Combination of cross-functional/development skills



1. Build Upgrade Toolkit

2. Identify and Resolve Upgrade Breakdowns

3. Tune Upgrade Performance

Best Practices –



o PeopleSoft Upgrade Guidelines – Overall

o Preparation through Practice MTP Upgrade Passes

o Sustained Attention to Detail

o Upgrade Toolkit

o BTRG has prepared toolkits for scores of PeopleSoft

Upgrades

Best Practices –



PeopleSoft Upgrades and BTRG

BTRG has the expertise and experience to

make your PeopleSoft Upgrade a success


The Future of PeopleSoft Maintenance: Patching and Updating with PS 9.2/PT 8.53



PS 9.2/PT 8.53 – New Features

o User Interface

o PeopleSoft Search Framework

o Life Cycle Management

o Server Administration and Infrastructure

o Security Administration

o Integration Technology

o Reporting and Analysis Tools

o Development Tools


Lifecycle Management

o PeopleSoft Update Manager

o Configuration Management with the Data

Migration Workbench

o PeopleSoft Test Framework

o Three-Way Merge Support


PeopleSoft Update Manager

o Overhaul of PeopleSoft Maintenance

o Update and Patching procedures

o PeopleSoft 9.2 application releases and

higher/PeopleTools 8.53 o “a new Lifecycle Management process that is the next step in our

continued effort to help you lower the cost and stay current on your

application maintenance”


Classic PS Maintenance Approach

o Updates

o Bundles

o Maintenance Packs

o Cons

o Cumbersome process entailing downloading and

applying multiple Maintenance Packs and/or Bundles

sequentially

o As many as are necessary to get current or to fix

problem(s)


Classic PS Maintenance Approach

PeopleSoft Maintenance Then

Creates Changes Packages Changes

Consumes Changes

Customer



o PeopleSoft Update Manager - new

maintenance process

o Only maintenance facility for PeopleSoft 9.2 applications

o Intended for application maintenance only

o Minimal impact on installation and upgrade processes at

this time

o PeopleSoft Update Manager PIA Application

o delivered with PeopleTools 8.53 Lifecycle management

suite of tools



o PeopleSoft Images

o Oracle VM VirtualBox virtual machines that you

download locally

o One PeopleSoft Image per application

o Released periodically according to the image schedule

posted on the My Oracle Support

o Master source environment from which

o Obtain updated objects

o Create a custom change package

o Apply updates to your environment



o PeopleSoft Image

o Contains the updates


o The searching tool and custom change package

definition generator

o Change Assistant

o Still the tool used analyze and compare changes and to

apply updates to your environment


PeopleSoft Update Manager Process



1. Review PeopleSoft Image schedule on My Oracle Support -

PeopleSoft Update Manager Home Page [ID 1464619.1]

2. On or after release date find link to PeopleSoft Image on

PeopleSoft Update Manager Home Page

3. Each PeopleSoft Image is cumulative – only need to

download most recent image

4. Download PeopleSoft Image and deploy PeopleSoft Virtual

Machine running on Oracle Virtual Box



5. Use PeopleSoft Manager PIA Application to search and

select updates and to create a custom change package

definition

6. Use PeopleTools Change Assistant to generate the change

package, compare it to your environment, and apply the

change package to your environment


PeopleSoft Update Manager Benefits

o Benefits

o No Bundles or Maintenance Packs

o Bundles and Maintenance Packs are all or nothing

o Each Patch, Bundle, or Maintenance Pack is its own change

package

o One Consolidated Change Package

o Change package tailored to your needs – you select the

updates you want

o Calculates dependencies (prerequisites) automatically

o No more maintenance of a DEMO environment for the sole

purpose of patching (if using Oracle DBMS)


PeopleSoft Update Manager Costs

o Costs

o Incremental investment in infrastructure for running

Oracle cross-platform virtualization software – Oracle

VM VirtualBox


PeopleSoft Image Virtual Machine

o PeopleSoft Image

o Virtual machine running Oracle VM VirtualBox

o Guest Operating System - Oracle Enterprise Linux

o RDBMS - Oracle Database 11gR2

o No additional license requirements for PeopleSoft

VirtualBox Images used for non-production activities

such as patches and updates or demonstration

environments


PeopleSoft Image Identification

o PeopleSoft Image

o Delivered on regular, published schedule

o Current PeopleSoft Image is cumulative – containing all

of the updates from previous PeopleSoft Images

o Each of the following applications will deliver an image

on a regular basis

o Financials/Supply Chain Management (FSCM)

o Human Capital Management (HCM)

o Customer Relationship Management (CRM)

o Enterprise Learning Management (ELM)


PeopleSoft Image Virtual Machine


PS Update Manager PIA Application


o Available in the PeopleSoft Image virtual machine and

works only there

o Use to search within the PeopleSoft Image for updates,

fixes, and features and to create a custom change

package definition

o Target environment

o Does not have to be at PeopleTools 8.53

o Application must be at PeopleSoft 9.2



o Navigation: Main Menu > PeopleTools > Lifecycle

Tools > Update Manager > Define Change Package

1. Select a target database.



2. Enter a name for your change package.



3. Select the search option.


Various Application Updates Type of Update Description PeopleSoft Image The PeopleSoft Image is a VirtualBox virtual machine

that is posted to My Oracle Support on a regular basis. This image contains several zip files that you download locally. The PeopleSoft Image contains the very latest maintenance for the application release. This documentation focuses primarily on this type of update.

PeopleSoft Release Patchset (PRP) PRPs are sometimes needed in between the regularly released PeopleSoft Images. These are for critical fixes that cannot wait until the next image is posted. These fixes must be applied to a specific PeopleSoft Image. Use the PeopleSoft Update Manager PIA Application to create a custom change package that contains the fix from the PRP.

Proof of Concept (POC) Patches These patches are created only for escalated critical reasons. A POC patch is posted and available only for a single customer in a password-protected patch. The patch is applied directly to the customer environment, bypassing the PeopleSoft Image. If a POC fix is provided in a subsequent PeopleSoft Image, you are expected to apply the patch from the image as soon as it is available.


The Future of PeopleSoft Maintenance

o Classic Patching Process

o Costly and time-consuming for customers, resulting in

delayed or infrequent patching

o Patching and Updating with PS 9.2/PT 8.53

o PeopleSoft Update Manager

o New maintenance process

o Alleviates pain points by removing some manual, repetitive,

time-consuming activities

o The only patching facility for PeopleSoft 9.2 applications


Using PeopleSoft Test Framework



Using PeopleSoft Test Framework

o What is the PeopleSoft Test Framework (PTF)?

o How does it shorten your upgrade?

o BTRG has test scripts!


What is PeopleSoft Test Framework (PTF)?

o An integrated and automated PeopleSoft

application testing tool o Integrated with PeopleTools

o Automates PeopleSoft functional testing

o Execute more tests with greater accuracy during shorter time

window

o Replicates the actions of a single user

executing functional tests against a

PeopleSoft browser-based application o Record and Playback automation of manual test procedures



o Test Assets

o Tests and test cases – stored in database as

Application Designer objects

o PeopleTools–managed objects – can be

managed along with other PeopleTools objects

through PeopleSoft Lifecycle Management

o Can be compared and copied between databases



o Features not available in other commercially -

available Record-and-Playback automation tools

o Ability to validate recorded objects against PeopleSoft object metadata

definitions

o Features to help manipulate data within PeopleSoft’s rowset-oriented

data structure

o Functionality to automate numerous PeopleSoft-specific functions,

such as running processes through Process Scheduler

o Built-in commands to interface with other PeopleSoft tools, such as

Data Mover and PeopleSoft Query



o Under-utilized testing tool that is built into

PeopleTools

o First introduced in PeopleTools 8.51

o Significantly enhanced in PeopleTools 8.53


PTF Terminology

Term Definition Test The primary type of test asset in PTF. Tests contain steps that

replicate the action of a tester executing a functional test against the PeopleSoft application.

Test Case A set of data associated with a test corresponding to the values entered or verified in the application. For example, if a hire test hires three similar employees into the PeopleSoft system, a user might elect to record one test and to configure that test to call three test cases, one for each employee hired. A test can have multiple test cases associated with it.

Test Asset An object used in PTF to automate a functional test. PTF test assets are saved in the application database and can be retrieved at any time to help automate tests. The five types of test assets are: • Execution Options • Libraries • Logs • Tests • Test Cases

Log An object that saves the experience of a single test execution event. Logs report the success or failure of the test execution and include messages and screen shots to indicate where errors occurred.


PTF Terminology

Term Definition Library Similar to a test, a library contains one or more steps that

together automate some discrete amount of test functionality. Unlike a test, a library is never executed by itself. Rather, libraries are meant to be called (sometimes repetitively) by tests.

Execution Options A list of application environments available to the tester. Execution options store application environment information such as URL, user ID, password, and Process Scheduler server, and information needed to run DataMover. PTF supplies this information to the test by default when a test does not explicitly specify such information.


How Does It Shorten Your Upgrade?

o PeopleSoft Upgrade Testing

o Execute more tests with greater accuracy during shorter

time window

o After upgrade execute PTF tests to test expected

behavior


BTRG’s Test Scripts

o BTRG and PeopleSoft Upgrade Testing

o Twenty years of performing PeopleSoft upgrades

o Compiled many test scripts across a broad range of

PeopleSoft application modules/functionality

o BTRG Test Scripts and PeopleSoft Testing Framework

can greatly expedite your PeopleSoft Upgrade testing


PeopleSoft Upgrades and Archiving with IBM Optim



PeopleSoft Upgrades and Archiving

o Business Drivers o Archiving Strategy & Requirements o IBM Optim, Archiving, & PeopleSoft Upgrades o Summary


Business Drivers



o PeopleSoft commonly has significant data volumes • Mature Implementations or large data conversion

o Some recent BTRG customers DB size: • 500 GB - 3 TB

o Upgrades include Table Alters and Data Conversion • Increase project complexity, delay go-live, major data

issues o Delivered PS Upgrade process can take days

• Major culprits are Alter and Data Conversion tasks • Data is unique & delivered process often struggles • Tuning is one of the major cost centers during upgrades


Common Drivers of Data Growth

o Organizational growth o Data retention compliance o Too much of everything

• Keeping data “always available” o Data multiplier effect

• Full copy of production anyone? o No surprises here, there is often a TON of data in

PeopleSoft • Big offenders: PC, PY, GL, AR, IN, AP • Not helping: BI, AP, PO, TL, CA, SA, HR


PeopleSoft Upgrade Risks

Go-Live Upgrade Window Overrun Go-Live Upgrade Window timeframe

Miss Go-Live Date Slow Performance

Upgrade Live Production System


Archiving Strategy & Requirements


What is meant by Archiving?

Segregate historical enterprise application data by age, status, event or other criteria

Copy historical records to a secure archive Delete transaction details from production system Retain access to information for query, reporting, customer

service, audit and discovery requests

Current

Production

Historical Archive

Archive

Historical Data

Reference Data

MOVING DATA . . . NOT LOSING DATA (Unless desired)


Archiving for PeopleSoft Upgrades

Move cold legacy data to secure archive Delete transaction details from legacy system Convert current/warm data to new/upgrade application Retain access to information for query, reporting, customer

service, audit and discovery requests or move data to new system/version at different time

Current

Legacy System

Historical Archive

Archive

Historical Data

Reference Data

Current

New System

Can be linked


What this means for Implementations

Easier, faster Upgrade Fewer data related issues Shorter go-live window Better performance Better user experience

Maximize Investment Improve Performance Reduce Costs


Data Archive Strategy: 4 Key Requirements

1 Application Intelligent •PeopleSoft Enterprise •Oracle EBS •JDE •Siebel, etc.

2 Take the right data out

•Complete Business Object •Apply Functional Condition Checks •Accommodate Unique Business Requirements

3 Store data where you want

•Support & automate data retention policies as per ILM business requirements

•Multiple formats – DBMS, File

4 Access archived data when & how you want

•Native application access •Application independent access


IBM Optim, Archiving & PeopleSoft Upgrades


Functional Archive Policies: Financials

Application Retention (Years)

Archiving Recovery / Access Requirements

Lead Time

Type of Data to Archive

GL 3 Yearly Audit; Trend analysis Y Ledgers, Journals, fully posted

AP 3 Yearly Audit; Trend analysis Y Vouchers, Payments, fully paid and posted

AR 3 Yearly Audit; Trend analysis Y Invoices, items

Billing 3 Yearly Audit; Trend analysis Y Invoices

Billing Interface 1 Quarterly Troubleshooting Y Billing input

AM 3 Yearly Audit; Trend analysis Y Retired assets

AM Interface 1 Quarterly Troubleshooting Y Asset input, GL interface

Payroll 2 Yearly Audit Y Paycheck processing data and balances


Where Does Archiving Fit?

Archive Before Upgrade Reduces amount of data to convert during production

cutover Reduces downtime during upgrade

Archive While Upgrade

Combines common technical and functional tasks to save overall elapsed time

• Technical Tasks: Validate individual steps (such as moving query tables forward), validating new technical environment, performance testing

• Functional/Business Tasks: Reconciling “before” & “after” results, regression testing on key business processes (such as payroll processing or financial close)


Archive Before Upgrade

Application

Older Version Upgraded Version

Archives

Universal Access to Application Data

ODBC / JDBC XML Report Writer Application

Upgrade Project

Application

Current Data

Archives

Current Data Application

Data Archive


Archive While Upgrade

Application

Older Version Upgraded Version

Universal Access to Application Data

ODBC / JDBC XML Report Writer Application

Upgrade Project

Application

Current Data

Archives

Application Data

Archive

Archive Planning


IBM Optim vs. PS Data Archive Manager

99 Confidential Information The Business & Technology Resource Group (BTRG) Proprietary & Confidential


IBM Optim, Archiving, & PeopleSoft Upgrades Data Archiving

• Reduce DB footprint = Reduced costs • Less data = More efficient upgrade • Integrated with PeopleSoft • Retain access to archived data


PeopleSoft and Database Security with InfoSphere Guardium



Database Infrastructure Protection o "Although much angst and security funding is given to offline data, mobile

devices, and end-user systems, these assets are simply not a major point

of compromise ...“

- Verizon Business Data Breach Investigations Report 2009, 2010

% of Compromised Records

Database servers are the primary source of breached data

2009 2010

75%

92%

Database Servers

Laptops & Backup Tapes Desktop Computers Other


Database Security – Why?

o Database servers contain your most

valuable information

o Financial records

o Credit card and other account records (PCI)

o Personally Identifiable Information (PII)

o Patient records

o Customer data

o High volumes of data

o Structured - easy to access and interpret


Perimeter Defenses Are Not Sufficient

o “In an offense-dominant environment, a fortress mentality will not

work. … [we] cannot retreat behind a Maginot Line of firewalls, or

it will risk being overrun.”

- William J. Lynn III, U.S. Deputy Defense Secretary, Foreign Affairs Magazine

Outsourcing

Web-Facing Apps

Employee Self-Service, Partners & Suppliers

Insiders (DBAs, developers, outsourcers, etc.)

Stolen Credentials (Zeus, etc.)


Internal Database Security Threats

o “Organizations overlook the most imminent threat to their

databases: authorized users.” o (Dark Reading, http://www.darkreading.com/database_security/security/app-

security/showArticle.jhtml?articleID=220300753)

o “Most organizations (62%) cannot prevent super users from

reading or tampering with sensitive information … most are

unable to even detect such incidents … only 1 out of 4

believe their data assets are securely configured” o (Independent Oracle User Group,

http://www.ioug.org/BestPracticesSolutions/GSADownload/.../Default.aspx?...


Breaches Not Quickly Discovered o "Attackers know the value of databases too. For a three-year period

beginning in 2005, a hacker named Albert Gonzalez and a small group of

his accomplices broke into the online databases of multiple companies,

including:

o TJ Maxx, Heartland Payment Systems, Hannaford Brothers, 7-Eleven,

Dave & Buster’s, DSW, Office Max, Sports Authority, Forever 21,

Barnes & Noble, Boston Market, BJ’s Wholesale Club

o In all, over 100 million people had their personal data, including their

credit card numbers, stolen by Mr. Gonzalez and his colleagues, and this

was just the work of one single, small hacker group.“ Web Application Security: A Beginner's Guide, Bryan Sullivan, Vincent Liu


Breaches Not Quickly Discovered o "Our evidence indicates that APT1 [Advanced Persistent Threat 1] has

been stealing hundreds of terabytes of data from at least 141

organizations across a diverse set of industries beginning as early as

2006. ... we found that APT1 maintained access to the victim’s network

for an average of 356 days. The longest time period APT1 maintained

access to a victim’s network was at least 1,764 days, or four years and

ten months." o “APT1: Exposing One of China's Cyber Espionage Unit”, Mandiant


Home-Grown Solutions

o Home-Grown solutions are typically costly and

ineffective

o Native Database Logging o Perl/Unix Scripts -> Parse Logs -> Move to Central Repository ->

Create Reports -> Manual Review -> Manual Remediation, dispatch,

and tracking

o Disadvantages and Shortcomings o Significant labor cost to review data and maintain process

o High performance impact on DBMS from native logging

o Not real-time

o Does not meet auditor requirement for Separation of Duties

o Audit trail is not secure

o Inconsistent Policies enterprise-wide


Collector

InfoSphere Guardium - Real Time Database Monitoring and Protection

No DBMS or application changes Does not rely on DBMS-resident logs that

can easily be erased by attackers, rogue insiders

100% visibility including local DBA access Minimal performance impact (2-3%)

Cross-DBMS solution Granular, real-time policies & auditing

– Who, what, when, how Automated compliance reporting,

sign-offs and escalations (financial regulations, PCI DSS, data privacy regulations, etc.)

Host-based Probes (S-TAPs)


Addressing the Full Database Security Lifecycle

110 The Business & Technology Resource Group (BTRG) Proprietary & Confidential

Guardium - Database Activity Monitoring

o Database Activity Captured

o Session Information, SQL Commands, SQL Errors, Failed

Login Attempts, Returned Data

o Database Access

o Local access, Network access, Encrypted

o Monitoring Options

o S-TAPs, Network Taps, Span Ports


Guardium – Database Protection and Compliance

o Compliance Workflow Automation

o Change Audit System (CAS)

o Entitlement Reports

o Vulnerability Assessments

o Database Discovery

o Classification


BTRG PeopleSoft Vulnerability Assessment

o Augments Guardium Vulnerability Assessments

o To deliver new functionality to identify vulnerabilities specific

to PeopleSoft security and FSCM/HCM suites

o PeopleSoft Vulnerability Assessment Areas

o Database Security

o PeopleSoft Security

o Segregation of Duties

o Business Process Controls

o Scans PeopleSoft tables and generates a vulnerability

assessment scorecard


the btrg methodology for the peoplesoft upgrader

Documents