This white paper provides guidance for government organizations when choosing an information technology platform. It examines some of the challenges those organizations face, followed by a framework for evaluating platforms in the areas of costs, reliability, security, access to needed skills and applications, and integration, using both analyst research and the experiences of government organizations as supporting evidence.

IT professionals today face an increasingly complex array of challenges: the proliferation of data, systems, and applications; the increased demand from employees to access corporate assets from anywhere at anytime; the mandate to protect the enterprise against a constantly evolving threat landscape; the need for regulatory compliance; and the ever-present demand to squeeze more value from their existing infrastructure. The IT environment itself is often complex, with myriad management, monitoring, and reporting tools and processes. Keeping up with all of this requires IT expertise across multiple specialties.

IT professionals today face a number of challenges. As if it were not enough that they have to stay ahead in one of the world's fastest-changing industries, where new technologies can emerge and become obsolete in less than a five-year span, they also must deal with internal business issues, in which top management often views their area of the business as a cost center rather than as a resource that boosts employee productivity and improves corporate agility in a globally competitive environment.

This white paper examines the implementation of advanced network solutions by medium-sized firms, those with 100-1,000 employees. IDC has found that these firms are especially interested in leveraging past technology investments, even while capitalizing on the latest advances. For many, the incremental benefits associated with the Microsoft product family of Windows Server, Exchange, and SharePoint, as well as Microsoft Office Manager (MOM), have helped speed the introduction of new capabilities in a timely fashion. While medium-sized businesses may vary in their immediate needs—improving customer service, reducing costs, improving information sharing—they are remarkably consistent in their interest in applying affordable technology that allows users to be as productive as possible as soon as possible.

The rate of security vulnerabilities documented in the National Vulnerability Database for the major database vendors is noteworthy for the stark contrast between Microsoft, MySQL, and Oracle. ESG believes that Microsoft's investments in secure development processes are responsible for the impressive results in SQL Server quality. ESG considers Microsoft, with proper execution, to be years ahead of Oracle and MySQL in producing secure and reliable database products.

When it comes to Microsoft and security, few people ever mention Microsoft's Security Development Lifecycle (SDL). ESG believes this is an unfortunate omission. The fact is that Microsoft's commitment to SDL is an area of stealthy security leadership. ESG believes that other ISVs should embrace an SDL model as soon as possible and that enterprise organizations should mandate that technology vendors establish a measurable and transparent SDL process by 2008 or risk losing business.

Mercer Management Consulting, a global strategy consultancy, was commissioned by Microsoft to conduct research with 30 senior IT decision-makers globally to understand why organizations are migrating from UNIX, how alternative platforms are selected, and what value companies have generated by migrating from UNIX to Windows, Linux, or other flavors of UNIX. This document summarizes the findings from those interviews.

As enterprises become more complex, involving multiple operating systems, the challenges of identity management also become greater. What is identity management? At the core, it is about control of authentication, authorization and access. All other areas of identity management—provisioning, single sign-on, password management, audit, federation, etc.—grow from the fundamental challenge: to ensure that the right users are given the right access to the right resources. Through Quest Vintela Authentication Services, UNIX and Linux systems and applications can join the AD domain for centralized management and single sign-on.

The goal of this paper is to go beyond the Evaluation Assurance Level (EAL) ratings and protection profiles, and help technology (IT) managers understand the importance of the evaluated software configuration in determining the usefulness of Common Criteria evaluated operating systems. Dickerson Technologies took two EAL4+ operating systems, the Windows Server 2003/Windows XP and the Novell SuSE Linux Enterprise Server 9 evaluated systems, and attempted to deploy six common client-server roles following the respective security configuration guides. The lab team found that they could successfully build and deploy all six roles using the Windows evaluated configuration, but could only implement the print server role using the SuSE evaluated configuration. "Based upon the overall examination, this study has found that operating systems having equivalent assurance level certifications (EAL4+) and satisfying the same Common Access Protection Profile under the Common Criteria for Information Technology Security Evaluation are not necessarily created equal. The vendor selection of the evaluated configuration is critical and will make a huge difference in the types of server and client roles that can be deployed while following the security configuration guidelines as approved by the certifying authorities."

Despite the growing capabilities offered by Intel and Microsoft for enterprise computing environments, many customers are unaware of the value that Intel® Itanium® 2 processor-based systems running Windows Server offer over UNIX infrastructures for hosting critical workloads. To illustrate the motivating factors that led enterprise companies to choose this open standards-based solution over the proprietary UNIX architecture, Ideas International (IDEAS) conducted a study of real-world business cases. The participating enterprises expressed a multitude of reasons for migrating to Windows Server on Itanium 2-based servers. They were attracted to Windows Server due to the ability to leverage their existing desktop skill sets across a broader range of applications, and they perceived that their software costs would be reduced. The Itanium 2-based platform was appealing to these users because it offered maximum scalability for Windows Server workloads, and it was perceived as having a long-term future with much room for innovation and improvement.

This white paper provides an overview of the Common Criteria (CC) program, the benefits of certification, the Windows platform scenarios that have been certified, and resources available to help customers configure and administer a Microsoft Windows platform environment that is secured in accordance with the CC.

This paper compares the costs of acquisition and support of Microsoft Windows Server and Red Hat Enterprise Linux. Based on their research, Ideas International found that across several scenarios, Microsoft's Windows Server 2003 license and support costs are competitive, and in some cases, significantly lower than the license and support costs of Red Hat Enterprise Linux.

This Microsoft-sponsored report by Security Innovation poses the question: How do you handle your information technology (IT) pain? The paper explores the impact and implications of technologies on the reliability goals required to run your business and interface with your customers. The purpose of the paper is to help IT decision-makers understand the reliability criteria to consider in order to minimize IT pain.

In this study, Wipro surveyed 90 organizations that use both Windows and open-source software to determine the costs of patching both environments under similar conditions. Based on the results of this research, Wipro made several interesting conclusions. The annual costs of patching the security vulnerabilities of individual Windows-based and similar OSS-based systems are roughly comparable.

This study is intended to provide guidance to the information technology manager who must make platform acquisition and deployment decisions to both maximize value and minimize security risk.

To compare reliability and manageability differences between Microsoft Windows- and Linux -based solutions, Security Innovation (SI) delved into the extent that maintenance, patch application, and system failures contribute to IT pain and potential costs as business requirements evolve over time.

In terms of time and complexity, deploying Windows is easier and faster than deploying Red Hat Linux, whether installing from scratch or configuring an original equipment manufacturer (OEM) installation.

This in-depth report, titled "Comparing Microsoft .NET and IBM WebSphere/J2EE: A Productivity, Performance, Reliability, and Manageability Analysis," summarizes a Microsoft-sponsored study by The Middleware Company. Also available for download is the lab report for this study, written by C2 Technology, the independent auditor that oversaw and verified all stages of the study conducted in the lab.

This white paper by ObjectWatch, titled "Interoperability Through Service-Oriented Architectures (SOAs)," provides a set of criteria for evaluating SOA technologies. It includes the author's interviews with companies that are successfully building SOAs, as well as lessons learned that are applicable to any company interested in leveraging SOAs.

After an analysis of publicly available pricing and licensing terms, a Microsoft-sponsored cost comparison by BearingPoint shows that licensing and support costs do not significantly differ between Windows Server 2003, Red Hat Enterprise Linux 3, or Novell/SUSE Linux 8. Across the enterprise and medium business scenarios studied, the three vendors were found to be comparable based on licensing and support costs, and despite perception, Windows Server 2003 was found to be less than one or both of the commercial Linux offerings in several cases.