Google Apps Admins Jittery About Gmail, Hopeful About Future

http://www.pcworld.com/businesscenter/article/149892/google_apps_admins_jittery_about_gmail_hopeful_about_future.html

Juan Carlos Perez, IDG News Service
Friday, August 15, 2008 3:40 PM PDT

When Gmail crashed on Monday, affecting many organizations that depend on it for work e-mail via the Google Apps suite, widespread gnashing of teeth ensued.

At Alaska's APTI public TV and radio station, reporters working on deadline scrambled to gather information without e-mail as a tool.

In the middle of an important press announcement, staffers at San Francisco Internet startup Kwiry sought alternate ways to stay in touch with contacts.

At Davidoff Communications, the outage hit less than 24 hours after the Chicago company's migration of its five users to Google Apps.

"Since we're only on day four of our implementation, let's just say if Apps were on my baseball team, it would be hitting at the bottom of the lineup," said Davidoff Systems Administrator Mitch Wilkos in an e-mail interview this week.

With its Apps hosted suite of communications and collaboration applications, Google is a leading proponent of software-as-a-service (SaaS), an emerging model of software delivery that backers say represents the future.

Because vendors host applications in their own data centers, companies don't have to concern themselves with hardware provisioning and software maintenance. By living in the Internet "cloud," these hosted applications simplify sharing and collaboration among employees.

However, the experience of users living through the recent Google Apps outages could serve as a deterrent to some IT and business managers who might not be ready to ditch conventional software packages that are installed on their servers.

If a company relies on Google Apps for its e-mail, its IT and business managers have little to do when a Gmail outage hits them, and, with end-users demanding explanations, this waiting game can be a very stressful situation, as John Proffitt, IT services director at APTI, can attest.

"For me as the Google Apps administrator, the disruption was pretty damn irritating. Aside from getting kicked out of e-mail I need to do my own job, it also forced me to completely refocus on figuring out what's happening with Gmail and Google Apps," he said in an e-mail interview.

For the two hours that the outage lasted, Proffitt estimates that about 75 percent of the organization's approximately 40 employees were affected, some severely, including the journalists who make up about a quarter of the staff.

"It was constant troubleshooting, testing, research, posting to the Google Apps forums and so on. Plus there's the emotional strain of wondering whether you completely screwed up by moving everyone to Google Apps as our sole e-mail system. That's what freaked me out: Did Google just make me look like an idiot?" Proffitt added.

That's not a nice feeling to have, especially since Proffitt did his homework and took his time before deciding to move his end-users to Google Apps. He used the suite for about nine months himself "as a guinea pig" and then rolled it out to the entire organization six weeks ago.

Prior to Monday's crash, his satisfaction level with Google Apps was about 90 percent. Now he puts it at 70 percent.

"Mostly that 20 percent drop is based on fear of another, perhaps more damaging, outage. It hasn't happened, but now I know it could happen any time and without warning, and if it does I have virtually no recourse to get the service running again," he said.

Monday's outage was sandwiched between two other Gmail crashes -- one last week and another one on Thursday and Friday of this week, both of which were smaller in scale. Proffitt wasn't affected by those other outages, but he's ready to rethink his status as hosted software adopter if things don't go well in the future.

"If we began to experience a similar outage more than about two or three business hours per quarter, we'd probably make Google Apps and Gmail a backup solution to a locally hosted mail system, if we used it at all. And it would likely be years before we'd try a cloud-based collaborative system again from any vendor," Proffitt said.

Still, Proffitt and other Apps administrators interviewed are hoping that Google will quickly strengthen the reliability of Gmail and the other suite components to a point where crashes become extremely rare. The benefits Apps offers to their small and medium-size organizations are significant in terms of cost savings and the flexibility of Web-based software.

"Even though we've only had Apps for a few days, I'm already impressed with the customization options. The ability to completely ditch Outlook makes Apps a worthwhile service to our company," said Davidoff's Wilkos. "The Gmail interface feels more intuitive and is significantly quicker than Outlook. And the mobile accessibility is a huge improvement over our old e-mail service."

Although Monday's outage stung Kwiry on an important day, and the startup was hit briefly again on Thursday, CEO Ron Feldman is betting on Google Apps. "Google understands its tremendous responsibility to keep things up and running," Feldman said via e-mail.

Carlos Leyva, managing shareholder at Digital Business Law Group, is also confident in Google and is sold on the SaaS model, which he expects will allow his new law firm to grow quickly without having to spend a fortune on its computing infrastructure.

"No one's happy when there's downtime, but there's always downtime. I've seen Exchange go down often. Many times you're left to your own IT people to fix it. That can be good or bad. I'd rather it be Google's problem. They've got a world-class team. Their reputation is on the line. Over time, they're going to get better and better," he said in a phone interview.

Thomas Harbinson, president of IDA International in Derby, Connecticut, found Monday's outage a minor disruption for the engineering and construction service company's 11 users. They have been very satisfied with Apps, which the company has been using for about a year after migrating away from Exchange.

"As a small organization looking at pre-Google Apps practice, if it had been my hardware in-house that went down, I would not have had anywhere near the reaction time and response to be restored as Google did with the Apps service," Harbinson said via e-mail.

Google Voice Chatter Could Be a Legal Nightmare

http://www.data-storage-today.com/story.xhtml?story_id=032003365PNK

By Frederick Lane
March 13, 2009 2:37PM

Google's new telephone service, Google Voice, is making observers nervous. Wiretapping laws could be violated, and searches through your voice mails on Google Voice could be a nightmare. Beyond concentrating data in one company, advertising may enter the Google Voice picture so Google can pay for the tempting free services.

Discover high-ROI analytics. Imagine if you could reduce customer churn by 20 percent, or lower your marketing costs by 40 percent, by anticipating your customers� behavior and taking action. Learn how to dramatically improve your business results with data mining software from SPSS Inc.

Google's new telephone service, Google Voice, is receiving generally positive reviews from industry analysts. Some of the features, however, are raising potentially troubling legal issues.

Nearly two years ago, Google bought Grand Central, an Internet-based phone service, and opened it up to a limited number of beta testers. Over the following months, users got increasingly impatient with the lack of new features or upgrades to the service.

It turns out, however, that Grand Central was merely on hold as Google undertook a complete revamping of the service to better integrate it into the Google universe. Current users and new subscribers will be able to read transcripts and search text of their voice mails, make low-cost overseas calls and free calls within the United States, set up free conference calls, and redirect both calls and text messages to up to six different numbers at the same time.

But not surprisingly, given Google's increasingly dominant online profile, the news that the company is doing for voice what it's done for virtually every other type of data has raised questions about both privacy and legality. Critics are worried about yet another data stream flowing through the Google server farms.

Scanning Phone Calls

In a widely reported interview, Marc Rotenberg, executive director of the Electronic Privacy Information Center, said the new service raises worrisome issues. "It raises two distinct problems," he said. "In the privacy world, it is increased profiling and tracking of users without safeguards. But the other problem is the growing consolidation of Internet-based services around one dominant company."

Since even Google hasn't figured out how to repeal the laws of economics, the obvious question is how the company will be able to support the undeniably attractive offer of free telephone calls, voice-mail transcriptions, and so on. As with other Google services, the answer is likely to be context-driven advertisements.

Given the announcement this week that the company will start plumbing Web search history in an effort to provide more targeted advertising, the likelihood that phone calls will be similarly scanned has many people nervous.

Google-Tapping

The other obvious issue is the legality of recording conversations. Google Voice plays a message before turning on the tapes (or firing up the hard drive), but it's not hard to imagine someone missing the announcement. In roughly half the states, a conversation can be taped secretly as long as one person consents (i.e., you can record any conversation to which you are a party). In the remainder of the states, the consent (implicit or explicit) of everyone in the conversation is required.

And what about the transcribed voice mails? It's inevitable that at some point, someone will try to introduce a Google voice mail into evidence in a legal proceeding. As Google makes itself the holder and preserver of more and more of the world's information, perhaps the next service to roll out will be Google Courts.

The new geek chic: Data centers

http://news.cnet.com/8301-13953_3-9977049-80.html

by Dan Farber

Forget about flashy Web 2.0 applications. The real, geeky coolness of the Web is the growing acreage of data centers that deliver bits to billions of devices. At GigaOM's Structure 08 conference in San Francisco on Wednesday, infrastructure--"clouds" of servers, storage and networks--was the headliner.

Jonathan Yarmis, vice president of advanced, emerging and disruptive technologies at AMR Research, said changes in the next five years will make the past Internet revolution feel like child's play. He didn't explain exactly how the next five years will be more revolutionary than evolutionary, but outlined the convergence of several technology trends.

The combination of social networking, mobility, alternative business models (advertising and different license and revenue models) and cloud and stream computing are mutually reinforcing trends that are driving innovations. The average life of a cell phone is 21 months, which allows users to take advantage of improvements in infrastructure.

"Cloud computing is not just for software as a service, but EaaS--Everything as a Service. Many things as discrete products become cloud-based offerings. It offers us an independence of device and location that is profoundly important," Yarmis said. Spoken like a true analyst--come up with another way to market a concept that is also known as on demand, cloud, SaaS, or utility computing.

One of the infrastructure challenges is not just storing and analyzing the growing body of data but reading, reacting, and responding in real time to disposable streams of data, Yarmis explained. The network and software needs to get much smarter and faster to enable real-time filtering and streaming for every user.

"We've reached a tipping point. All of the waves of disruptive tech are coming together at the same time," Yarmis said. He predicted that the economic downturn will help spur the adoption of cloud computing. Given the lower cost model and technological advances pioneered by companies like Amazon, Google, and Salesforce.com in cloud computing, that's a sure bet.

Click here to see more stories from the Structure 08 conference and on cloud computing generally.

Recession Is Good For Cloud Computing – Microsoft Agrees

http://www.cloudave.com/link/recession-is-good-for-cloud-computing-microsoft-agrees

Feb 12 2009 03:00:00 AM Posted By : Krishnan Subramanian

When the whole world was gloomy with onset of current recession, we (the members of cloud computing community) are happy about it in a way. Every single cloud computing evangelist will tell you that recession is good for cloud computing. The reason is obvious

• CapEx is converted into OpEX
• Even the OpEx is drastically reduced

Add to this the other usual themes like better performance, redundancy, easy scalability, etc., we have a perfect recipe for recession.

Back in those days, when John McCain was predicting that our economy is fundamentally strong, Zoli predicted that

In fact I suspect the looming downturn will accelerate the structural changes in the software industry: SaaS players will thrive, traditional on-premise vendors will shrink, many will disappear.

He is not a prophet but he made a very solid prediction and summarized his post as follows

In summary, Software businesses that combine good old business sense: frugality, spending wisely, delivering value to businesses and getting paid for it, with a new business model, SaaS are likely winners in the downturn. The rest are playing musical chairs.

He followed it up with another post highlighting what many others in the industry told at that time. Everyone was confident that SaaS (and also the other components of Cloud Computing) will thrive in the recession. But people with high stakes in the traditional software world dismissed it as a marketing pitch by companies trying to get foothold in the market through Cloud based offerings.

Time has passed since Zoli’s post. John McCain is back at the senate and Sarah Palin is back in Alaska. Recession appears to be much deeper than what it was then. Microsoft, the monopoly like player in the desktop world and who was reluctant to embrace cloud computing till it ceded the market place to other players like Google, has finally agreed that bad economy is good for cloud computing. ENT News, a sister site of Redmond Channel Partner Online, quotes Microsoft exec Doug Hauser as saying

A weakened economy will serve as a catalyst to push enterprises from on-premise computing to accessing services over the Internet cloud

Not only that, he seems to underline what we, the cloud evangelists, are saying for a long time.

He said it was pretty much accepted that the small-to-medium business and consumer spaces are "looking at [cloud computing] adoption anyway, regardless of the economic climate."

Thank you Mr. Hauser. Thank you Microsoft. Do we really need to convince the cloud skeptics anymore?

On an unrelated note, I want to use the same article to highlight one point which is obvious by now. It is the enormous savings in SaaS compared to on premise software. In the talk, Mr. Hauser highlights how Exchange as SaaS is much cheaper than Exchange On Demand, in addition to giving more profits to Microsoft.

Hauser described an Exchange implementation where an on-premise cost is $18 a month per user for the software, of which Microsoft gets $3.

"For Exchange Online, we charge $10 a month per user per seat, so our net gain is $7," he said. "The customer actually saves $8. There's a huge benefit to the customer; there's a benefit to us. There are very similar economics to have developer services in the cloud similar to those sorts of online services.

Isn’t it time we stop highlighting the cloud economics and talk more about cloud dynamics?

Cloud computing is a trap, warns GNU founder Richard Stallman

http://www.guardian.co.uk/technology/2008/sep/29/cloud.computing.richard.stallman

Web-based programs like Google's Gmail will force people to buy into locked, proprietary systems that will cost more and more over time, according to the free software campaigner

Bobbie Johnson, technology correspondent
guardian.co.uk, Monday 29 September 2008 14.11 BST

The concept of using web-based programs like Google's Gmail is "worse than stupidity", according to a leading advocate of free software.

Cloud computing – where IT power is delivered over the internet as you need it, rather than drawn from a desktop computer – has gained currency in recent years. Large internet and technology companies including Google, Microsoft and Amazon are pushing forward their plans to deliver information and software over the net.

But Richard Stallman, founder of the Free Software Foundation and creator of the computer operating system GNU, said that cloud computing was simply a trap aimed at forcing more people to buy into locked, proprietary systems that would cost them more and more over time.

"It's stupidity. It's worse than stupidity: it's a marketing hype campaign," he told The Guardian.

"Somebody is saying this is inevitable – and whenever you hear somebody saying that, it's very likely to be a set of businesses campaigning to make it true."

The 55-year-old New Yorker said that computer users should be keen to keep their information in their own hands, rather than hand it over to a third party.

His comments echo those made last week by Larry Ellison, the founder of Oracle, who criticised the rash of cloud computing announcements as "fashion-driven" and "complete gibberish".

"The interesting thing about cloud computing is that we've redefined cloud computing to include everything that we already do," he said. "The computer industry is the only industry that is more fashion-driven than women's fashion. Maybe I'm an idiot, but I have no idea what anyone is talking about. What is it? It's complete gibberish. It's insane. When is this idiocy going to stop?"

The growing number of people storing information on internet-accessible servers rather than on their own machines, has become a core part of the rise of Web 2.0 applications. Millions of people now upload personal data such as emails, photographs and, increasingly, their work, to sites owned by companies such as Google.

Computer manufacturer Dell recently even tried to trademark the term "cloud computing", although its application was refused.

But there has been growing concern that mainstream adoption of cloud computing could present a mixture of privacy and ownership issues, with users potentially being locked out of their own files.

Stallman, who is a staunch privacy advocate, advised users to stay local and stick with their own computers.

"One reason you should not use web applications to do your computing is that you lose control," he said. "It's just as bad as using a proprietary program. Do your own computing on your own computer with your copy of a freedom-respecting program. If you use a proprietary program or somebody else's web server, you're defenceless. You're putty in the hands of whoever developed that software."

Keep an eye on cloud computing

http://www.networkworld.com/newsletters/itlead/2008/070708itlead1.html

Cloud Computing Confusion Leads to Opportunity

IT Leadership Alert By Amy Schurr , Network World , 07/08/2008

There's some confusion about what exactly constitutes cloud computing, but one thing experts tend to agree on is the evolutionary effect this will have on IT. A new report from Gartner points to the opportunity to shape the relationship among consumers of IT services, those who use IT services and those who sell them.

The report, “Cloud Computing Confusion Leads to Opportunity,” defines cloud computing as a style where massively scalable IT-related capabilities are provided as a service to multiple external customers. You’ve probably heard it called utility computing, software-as-a-service and application service providers. The factors making such a model viable today are commoditization and standardization of technologies, virtualization and service-oriented architects, and the growth of the Internet.

“During the past 15 years, a continuing trend toward IT industrialization has grown in popularity as IT services delivered via hardware, software and people are becoming repeatable and usable by a wide range of customers and service providers,” said Daryl Plummer, managing vice president and Gartner Fellow.

What does this mean for IT leaders? Eventually users can focus on what the service delivers rather than how they are implemented or hosted. The possibilities include procuring computational facilities on demand, storage services to software to video.

Gartner says consumer-focused vendors have more mature services than enterprise-oriented vendors, though all can benefit. Branding is one opportunity for vendors – imagine Wal-Mart leasing its core

“Companies invest billions of dollars in building up their core competencies, much of which goes into IT,” says David Mitchell Smith, vice president and Gartner Fellow. “If companies could lease their core competencies to other companies then they would capitalize on both brands, driving revenue both in the consumer-facing market and the business service market in the way that Amazon has done with technology.”

Google and I.B.M. Join in ‘Cloud Computing’ Research

http://www.nytimes.com/2007/10/08/technology/08cloud.html?_r=1&ex=1349496000&en=92627f0f65ea0d75&ei=5090&partner=rssuserland&emc=rss&oref=slogin

By STEVE LOHR

Published: October 8, 2007

Even the nation’s elite universities do not provide the technical training needed for the kind of powerful and highly complex computing Google is famous for, say computer scientists. So Google and I.B.M. are announcing today a major research initiative to address that shortcoming.

The two companies are investing to build large data centers that students can tap into over the Internet to program and research remotely, which is called “cloud computing.”

Both companies have a deep business interest in this new model in which computing chores increasingly move off individual desktops and out of corporate computer centers to be handled as services over the Internet.

Google, the Internet search giant, is the leader in this technology. But companies like Yahoo, Amazon, eBay and Microsoft have built Internet consumer services like search, social networking, Web e-mail and online commerce that use cloud computing. In the corporate market, I.B.M. and others have built Internet services to predict market trends, tailor pricing and optimize procurement and manufacturing.

Behind these services are data centers that typically use thousands of processors, store countless libraries of data and engage specialized software to tackle what scientists call Internet-scale computing challenges. This new kind of data-intensive supercomputing often involves scouring the Web and other data sources in seconds or minutes for patterns and insights.

Most of the innovation in cloud computing has been led by corporations, but industry executives and computer scientists say a shortage of skills and talent could limit future growth.

“We in academia and the government labs have not kept up with the times,” said Randal E. Bryant, dean of the computer science school at Carnegie Mellon University. “Universities really need to get on board.”

Six universities will be involved in the initiative. They are Carnegie Mellon, Massachusetts Institute of Technology, Stanford University, the University of California, Berkeley, the University of Maryland and the University of Washington.

Google is building a data center, at an undisclosed location, that will contain more than 1,600 processors by the end of the year. I.B.M. is also setting up a data center for the initiative.

The centers will run an open-source version of Google’s data center software, and I.B.M. is contributing open-source tools to help students write Internet programs and data center management software.

The data centers under way have a small fraction of the computing firepower behind Google’s Internet search service. But they will be big enough, scientists say, to do ambitious Internet research. Setting up and running such centers, including providing the electricity and technical staff, is difficult and expensive. The two companies, a person who was told of their plans said, have committed a total of $30 million over two years for the project.

“This is a huge contribution because it allows for a type of education and research that we can’t do today,” said Edward Lazowska, a computer science professor at the University of Washington.

The companies’ and academics’ long-term goal is to expand the data-center clusters so students from many schools can participate and to enlist the support of other companies and the federal government.

The companies and university scientists involved in the initiative have talked to the National Science Foundation and other agencies.

The collaboration began after a meeting in December between Eric E. Schmidt, chief executive of Google, and Samuel J. Palmisano, I.B.M.’s chief executive, at Google’s headquarters in Mountain View, Calif.

In an interview on Friday, Mr. Schmidt recalled that he had sketched out his vision of cloud computing on a whiteboard, emphasizing its potential economic and social importance, and urged the I.B.M. chief to cooperate to build the skills needed.

At the time, Mr. Palmisano said, he had just come out of a day of technology briefings at I.B.M., and his company is doing a lot of research in the same field. I.B.M. also has deep knowledge and experience in building and managing complex data centers.

Mr. Schmidt said, “I.B.M. has some of the best technology in the industry, and we couldn’t have done this without them.”

Mr. Palmisano noted that cooperation between the two companies was easier because Google is mainly a consumer company, while I.B.M. concentrates on the corporate market. “We’re more complementary than anything else,” Mr. Palmisano said. “We don’t really collide in the marketplace.”

And by helping university students, I.B.M. and Google hope to help themselves in the marketplace.

“We’re trying to create the easiest possible on-ramp for universities into this world of cloud computing,” said Stuart I. Feldman, a vice president of engineering at Google and a former senior researcher at I.B.M. “But yes, this kind of computing is core value to Google and I.B.M. We have an interest, no doubt.”

Five cloud computing questions

http://www.networkworld.com/columnists/2008/080508-dzubeck.html

By Frank Dzubeck , Network World , 08/05/2008

It seems that every decade or so I get the opportunity to write an article on IT déjà vu. This time around, the topic is cloud computing, which is the latest IT buzz word.

My first reaction to the term was confusion. The amorphous "cloud" has been used for decades to symbolize a WAN that connected clients to server-based data centers. Is cloud computing another version of network computing? Yes, but this cloud is not just any WAN; it is a synonym for the Internet. Nothing new here. The Internet has been around for over two decades.

OK, let us look at what form of computing in being provided via the cloud. In this model, all IT applications and facilities (i.e. compute, storage and network) are provided as a service rather than dedicated infrastructure. This is intended to allow any user, independent of client platform, to access IT services without knowledge o

Additionally, cloud computing incorporates almost every computing manifestation within the IT world: distributed, grid, utility, on-demand, open source; Web services; P2P; Web 2.0 and, last but not least, software as a service.

It also accommodates thin, thick and mobile clients, and allows integration of corporate, commercial and service provider cloud-accessed resources. As an example, in this model, storage is a service resource that is accessed via the cloud, not a dedicated user resource.

Cloud computing vendors will invoice their customers on a utility (such as electricity) or a subscription (such as a newspaper) basis.

Evolutionary, but not revolutionary. As early as 1970, IBM championed a concept called "time sharing." Users shared common IT resources and applications on a mainframe computer simultaneously with other users for variable fees that were dependent upon usage and consumed resources.

Minimal CAPEX, low barrier to entry, shared IT infrastructure as well as shared costs, outsourced OPEX, low management overhead and immediate access to a broad range of business and IT applications are all benefits of time sharing. Almost 40 years later, we are back full circle to cloud computing.

Déjà vu, but with a 21st century twist. Virtualization, autonomics, open standards, massive resource scaling, dynamic resource provisioning, mobile broadband access, the IP Internet, Ethernet LANs, computer-based smart clients, NAS, dense low-cost RAID storage, DBMS, ESB, information management, system/network management and security software, etc., did not exist in the age of time sharing.

Cloud computing will undoubtedly show up first in the SMB and the consumer marketplaces. Where minimal cost is an issue, cloud computing will become a viable IT alternative. The corporate environment is another issue. The major issues that brought about the demise of time sharing also plague cloud computing.

Five questions need definitive answers to satisfy corporate cloud computing buyer concerns.

The first question is Security. What about potential unauthorized access, inappropriate use and loss of control of proprietary corporate information and IT applications? Who is responsible for corporate policy distribution, management and control?

The second question is Performance. Quality of service commitments and service-level agreements from cloud computing vendors may not meet corporate availability, legal, budget and insurance requirements. Who is responsible for loss of revenue/profits from a significant cloud computing outage, high network load or insufficient bandwidth access due to denial of service?

The third question is Management. It is exceedingly difficult to manage and administer a corporate virtualized IT environment. It may be impossible or impractical to attempt to manage the cloud. What tools exist for the buyer to monitor and manage multiple cloud computing vendors and their products?

The fourth question is Governance and Regulatory Compliance. Outsourcing of any services brings into question oversight and the cloud computing vendor procedures, processes, internal tools and third-party auditor access. What vendor-supplied software tools exist for the buyer to provide for cloud computing vendor governance and regulatory compliance?

The fifth and final question is Financial - the classical issue of a variable vs. fixed-cost management. Corporate CFOs demand budgets to be projected with accuracy, committed to as part of a financial allocation plan and managed with continual diligence and oversight. How do you control IT costs in a services and cloud computing utility billing model, and when should a cloud computing variable cost be converted to an internal IT fixed cost?

Cloud computing will usher in the IT age of the services delivery provider in a similar manner to Internet communications creating the age of the Internet service provider. Every major Internet vendor, IT vendor and carrier wants to be an SDP. Their success and cloud computing's success will depend on their answers to the above five questions.

Is cloud computing just time sharing déjà vu? Not from a 21st century technical perspective but from a corporate benefits/concerns perspective they seem to be one and the same.

r concern of their location or form. Sound familiar – it’s a service-oriented architecture (SOA)!

What is cloud computing?

http://www.infoage.idg.com.au/index.php/id;909486215;fp;4;fpid;1051515815

Galen Gruman, Information Age

16/06/2008 14:43:04

Cloud computing is all the rage. "It's become the phrase du jour," says Gartner senior analyst Ben Pring, echoing many of his peers. The problem is that (as with Web 2.0) everyone seems to have a different definition.

As a metaphor for the Internet, "the cloud" is a familiar cliche, but when combined with "computing", the meaning gets bigger and fuzzier. Some analysts and vendors define cloud computing narrowly as an updated version of utility computing: basically virtual servers available over the Internet. Others go very broad, arguing anything you consume outside the firewall is "in the cloud", including conventional outsourcing.

Cloud computing comes into focus only when you think about what we always need: a way to increase capacity or add capabilities on the fly without investing in new infrastructure, training new personnel, or licensing new software. Cloud computing encompasses any subscription-based or pay-per-use service that, in real time over the Internet, extends ICT's existing capabilities.

Cloud computing is at an early stage, with a motley crew of providers large and small delivering a slew of cloud-based services, from full-blown applications to storage services to spam filtering. Yes, utility-style infrastructure providers are part of the mix, but so are SaaS (software as a service) providers such as Salesforce.com. Today, for the most part, IT must plug into cloud-based services individually, but cloud computing aggregators and integrators are already emerging.

We talked to dozens of vendors, analysts, and IT customers to tease out the various components of cloud computing. Based on those discussions, here's a rough breakdown of what cloud computing is all about:

1. SaaS

This type of cloud computing delivers a single application through the browser to thousands of customers using a multi-tenant architecture. On the customer side, it means no upfront investment in servers or software licensing; on the provider side, with just one app to maintain, costs are low compared to conventional hosting. Salesforce.com is by far the best-known example among enterprise applications, but SaaS is also common for HR apps and has even worked its way up the food chain to ERP, with players such as Workday. And who could have predicted the sudden rise of SaaS "desktop" applications, such as Google Apps and Zoho Office?

2. Utility computing

The idea is not new, but this form of cloud computing is getting new life from Amazon.com, Sun, IBM, and others who now offer storage and virtual servers that can be accessed on demand. Early enterprise adopters mainly use utility computing for supplemental, non-mission-critical needs, but one day, they may replace parts of the datacentre. Other providers offer solutions that help IT create virtual datacentres from commodity servers, such as 3Tera's AppLogic and Cohesive Flexible Technologies' Elastic Server on Demand. Liquid Computing's LiquidQ offers similar capabilities, enabling ICT to stitch together memory, I/O, storage, and computational capacity as a virtualised resource pool available over the network.

3. Web services in the cloud

Closely related to SaaS, Web service providers offer APIs that enable developers to exploit functionality over the Internet, rather than delivering full-blown applications. They range from providers offering discrete business services -- such as Strike Iron and Xignite -- to the full range of APIs offered by Google Maps, ADP payroll processing, Bloomberg, and even conventional credit card processing services.

4. Platform as a service

Another SaaS variation, this form of cloud computing delivers development environments as a service. You build your own applications that run on the provider's infrastructure and are delivered to your users via the Internet from the provider's servers. Like Legos, these services are constrained by the vendor's design and capabilities, so you don't get complete freedom, but you do get predictability and pre-integration. Prime examples include Salesforce.com's Force.com and Coghead. For extremely lightweight development, cloud-based mashup platforms abound, such as Yahoo Pipes or Dapper.net.

5. MSP (managed service providers)

One of the oldest forms of cloud computing, a managed service is basically an application exposed to ICT rather than to end-users, such as a virus scanning service for e-mail or an application monitoring service (which Mercury, among others, provides). Managed security services delivered by SecureWorks, IBM, and Verizon fall into this category, as do such cloud-based anti-spam services as Postini, recently acquired by Google. Other offerings include desktop management services, such as those offered by CenterBeam or Everdream.

6. Service commerce platforms

A hybrid of SaaS and MSP, this cloud computing service offers a service hub that users interact with. They're most common in trading environments, such as expense management systems that allow users to order travel or secretarial services from a common platform that then coordinates the service delivery and pricing within the specifications set by the user. Think of it as an automated service bureau. Well-known examples include Rearden Commerce and Ariba.

7. Internet integration

The integration of cloud-based services is in its early days. OpSource, which mainly concerns itself with serving SaaS providers, recently introduced the OpSource Services Bus, which employs in-the-cloud integration technology from a little startup called Boomi. SaaS provider Workday recently acquired another player in this space, CapeClear, an ESB (enterprise service bus) provider that was edging toward b-to-b integration. Way ahead of its time, Grand Central -- which wanted to be a universal "bus in the cloud" to connect SaaS providers and provide integrated solutions to customers -- flamed out in 2005.

Today, with such cloud-based interconnection seldom in evidence, cloud computing might be more accurately described as "sky computing", with many isolated clouds of services which ICT customers must plug into individually. On the other hand, as virtualisation and SOA permeate the enterprise, the idea of loosely coupled services running on an agile, scalable infrastructure should eventually make every enterprise a node in the cloud. It's a long-running trend with a far-out horizon. But among big metatrends, cloud computing is the hardest one to argue with in the long term.

I.B.M. to Push ‘Cloud Computing,’ Using Data From Afar

http://www.nytimes.com/2007/11/15/technology/15blue.html?_r=1

By STEVE LOHR

Published: November 15, 2007

I.B.M. plans to build a sizable business by bringing Google-style computing to mainstream corporate customers.

The I.B.M. strategy, to be announced today, seeks to exploit the technical work and commercial interest in large data centers that can be run more efficiently, searched for information and programmed from remote locations over the Internet.

This model of Internet-based supercomputing is known as cloud computing because vast stores of information and processing resources can be tapped from afar — by a laptop personal computer, cellphone or other device.

I.B.M. is calling its initiative Blue Cloud. Most of the basic software needed for cloud computing is open source, meaning that the code is freely available and can be modified by users. The hardware used in the data centers is typically many thousands of industry-standard server computers, powered by processors made by Intel or Advanced Micro Devices, and produced by many hardware makers.

But I.B.M., analysts say, is trying to position itself as a leader in the corporate market for cloud computing, which many specialists regard as the next evolutionary step in information technology. The business strategy, they say, is to sell more I.B.M. hardware, software and services tailored for cloud computing. Starting in spring 2008, I.B.M. will offer versions of its server computers, including mainframes, that are adapted for cloud computing.

The game plan, I.B.M. executives say, is similar to the one the company followed in supporting Linux, an open-source operating system and an alternative to Microsoft’s operating systems. I.B.M.’s endorsement of Linux, which began in 2000 and included investments in technical development and marketing, sped the adoption of that technology among corporate customers.

“To me, this feels like Linux in 2000,” said William M. Zeitler, senior vice president in charge of the systems and technology group.

I.B.M. now has 200 researchers working on cloud technology, and Mr. Zeitler said the company had a staged plan over the next three years that would involve a large investment, though he would not elaborate on the amount.

Several customers, including corporations and government agencies, have been working with I.B.M. in pilot projects on cloud computing. Mr. Zeitler did not identify the companies, but said, “Large financial services companies are going to be among the first to be interested.”

Companies with fast-growing data centers, like banks and securities firms, are facing the same headaches as the large Internet companies, like Google and Yahoo. Efficiency, power consumption and management costs are mounting. And companies of all kinds are increasingly adopting some of the technologies of Internet companies like searching, mobile commerce and communication, and collaboration tools like blogs, wikis and social networks.

In recent years, I.B.M. has championed efforts to make data centers more efficient and to centralize more computing tasks in the data centers, with desktops and devices tapping in. These have had names like “autonomic,” “utility” and grid computing.

Those concepts and research efforts have made a contribution to cloud computing. Experts say tools have been added to spread computing tasks across clusters of many machines and to make programming simpler. Advances likely to broaden the reach of cloud computing have often come from researchers tackling the challenges posed by Internet searches.

“In some ways, the cloud is a natural next step from the grid-utility model,” said Frank Gens, an analyst at the research firm IDC. “What’s different is the Google programming model, and that really opens things up. You don’t have to be a Stanford or Carnegie Mellon Ph.D. to program cloud applications.”

The software that I.B.M. is packaging in its cloud offering is called Hadoop, running on the Linux operating system. Hadoop is based on an open-source search project called Nutch, and an open-source version of Google’s MapReduce software for spreading complex computer tasks across clusters of machines.

Cloud Computing Begins to Gain Traction on Wall Street

http://www.wallstreetandtech.com/it-infrastructure/showArticle.jhtml?articleID=212700913

While Wall Street organizations such as Morgan Stanley, Merrill Lynch and Nasdaq have begun using cloud computing for its pay-as-you-go model, questions about control and security remain.
By Penny Crosman
 06, 2009

Though cloud computing often is little understood, it is among the hot technologies for 2009, and it stirs up strong emotions among both supporters and detractors. For example, during a meeting with analysts in September 2008, Oracle CEO Larry Ellison ranted, "We've redefined cloud computing to include everything that we already do. I can't think of anything that isn't cloud computing with all of these announcements. The computer industry is the only industry that is more fashion-driven than women's fashion. Maybe I'm an idiot, but I have no idea what anyone is talking about. What is it? It's complete gibberish. It's insane. When is this idiocy going to stop?"

Yet later that same month, Oracle announced that several of its products would run on Amazon's Elastic Compute Cloud, EC2. Further, Oracle has assured the public that it has more cloud products under development, and it has a well-stocked Cloud Computing Center on its Web site, complete with product datasheets, podcasts and white papers. Reluctantly or not, Oracle has jumped on the cloud bandwagon as much as anyone.

Here's why cloud computing — loosely defined as Internet-based development and use of computer technology — has a future and the likely reason why Ellison doesn't like it: Cloud-based services so far are cheaper than traditional IT products, such as large in-house databases.

Cloud computing users leverage servers, applications and/or storage hosted by a provider (or by their own company, in the case of internal clouds) and are billed strictly for what they use each month, like a metered utility. So if a company is launching a new product that requires a large database, it doesn't need to go out and buy one; it can use one hosted by a cloud provider such as Amazon, Google or Vertica. In contrast to large up-front costs, initial costs are small because data lookups are few. If the new product turns out to be a success and lots of customers access the data, costs will go up, but then revenues should grow as well.

Still Ellison isn't the only one questioning the wisdom of computing in the clouds. Also in September Richard Stallman, founder of the Free Software Foundation and creator of the computer operating system GNU, said that cloud computing was a trap aimed at forcing more people to buy into locked, proprietary systems that would cost them more over time. "It's stupidity," he told U.K. newspaper The Guardian. "It's worse than stupidity — it's a marketing hype campaign."

Stallman is a privacy advocate who believes that when people use Web applications they give up control. That ship, however, has already sailed — most companies and people utilize Web applications and have grown used to the idea of working over the Internet.

In fact in early December Claus Mortensen, IDC's principal for emerging technologies advisory services, predicted that IT cloud services will form 25 percent of all incremental global IT spending growth by 2012. In addition Merrill Lynch analysts said that same month that by 2011 the cloud computing market will reach $160 billion, including $95 billion in business and productivity applications. Merrill uses IBM's Blue Cloud servers to build and evaluate new risk analysis programs. Morgan Stanley uses Salesforce's Force.com cloud offering for recruiting applications.

Nasdaq Looks to the Clouds

When Claude Courbois, associate VP, product development, Nasdaq Data Products, created a new product called Market Replay that enables brokerage firms to show customers and regulators that best-execution requirements were met for a given trade (view the tool at https://data.nasdaq.com/mr.aspx), he looked into buying a database to support the product. "Naturally database solutions are the first things people look at, because they're a safe solution," Courbois notes. The price for a dedicated database, however, was prohibitive, forcing him to put the project on hold for several months. Then Courbois realized that if the process work could all be handled on the client side, Nasdaq could use a simple data storage product such as Amazon Web Services' S3 storage cloud.

Today Nasdaq stores many terabytes of Nasdaq, NYSE and Amex data in Amazon's storage cloud; according to Courbois, Nasdaq adds 30 gigabytes to 80 gigabytes of data every day to the cloud, about 300,000 flat files each representing 10 minutes' worth of trading activity on a stock. The data retrieval time, he reports, is less than one second, and the system scales instantly.

Market Replay reconstructs the environment around a trade by pulling all the historical market data related to that trade and creating a screenshot of market conditions at the time of execution. This can be sent to regulators or customers who question a trade. "Often customers or regulators will call about a trade that happened several months ago," Courbois explains. "The fact that we're able to keep so much data online indefinitely means the brokers can quickly answer a question without having to pull data out of old tapes and CD backups."

More important, Nasdaq never pays for one byte more than it uses, Courbois says. "If we built this ourselves or used a standard ASP [application service provider], we'd have to ask for more space than we initially need and pay for all these empty terabytes until we fill them up," he relates.

On the other hand, the initial monthly bills Courbois received from Amazon Web Services were as low as $5. "I never had to buy $20,000 worth of hardware or enter into a big contract," he says. "Even though we're in a big company, every new project is a start-up, and you want to avoid situations where you have to plunk down a bunch of money to move forward." And if the new product wasn't a success for some reason, Courbois could simply delete the data and cancel the Amazon service.

To purists, Nasdaq isn't technically using cloud computing (although it plans to soon) — rather it is using cloud storage. The difference is that Nasdaq didn't build its Market Replay application in the cloud, nor does the user interface exist in Amazon Web Services. The application was developed using Adobe Flex for the Adobe Air runtime, which provides more computing power than a standard browser, Courbois reports. But, he adds, Nasdaq plans to develop future applications in Amazon's Elastic Compute Cloud. For instance, the exchange will create an application to let users search historical market data and perform calculations on it, according to Courbois.

For now, though, Nasdaq's next cloud project is taking Market Replay to Europe, using the same Amazon S3 cloud to store European stock data, Courbois says, adding that Nasdaq plans to have the product up and running in the first quarter of 2009.

Nagging Cloud Doubts

Cloud doubters often cite a lack of control as a hurdle to cloud computing: What if there's a problem? Who's going to fix it, and when? Courbois says that although Nasdaq hasn't had any IT issues with respect to Market Replay, Amazon has responded to questions quickly and has an excellent support Web site. "It's not a hand-holding situation — they don't advertise it as such, and you can't expect it to be," Courbois stresses. "It's not like paying for a data center or server-side ASP."

Other cloud skeptics worry about security. But Courbois claims this is a bit of a red herring. "There are ways of securing data and then you can put it anywhere," he says, pointing out that if Nasdaq were to put proprietary data on S3, it would encrypt it first.

Forrester Research analyst James Staten, who wrote in a recent report that enterprise IT is not ready for the clouds largely because of security concerns, says, "It's not that [the cloud providers] can't handle security, but they need to articulate it better." Staten notes that he has seen firms build and manage Monte Carlo simulations, risk analysis scenarios and forecasting models with cloud computing.

Nonetheless Nasdaq's Courbois concedes that there are limits to a cloud's usefulness. For instance, Nasdaq has no plans to run its stock market in the cloud in the foreseeable future — "That has to be in our own environment," he says.

Gartner Says Cloud Computing Will Be As Influential As E-business

http://www.gartner.com/it/page.jsp?id=707508

Special Report Examines the Realities and Risks of Cloud Computing

STAMFORD, Conn., June 26, 2008 —

Cloud computing heralds an evolution of business that is no less influential than e-business, according to Gartner Inc. Gartner maintains that the very confusion and contradiction that surrounds the term "cloud computing" signifies its potential to change the status quo in the IT market.

Gartner defines cloud computing as a style of computing where massively scalable IT-related capabilities are provided “as a service” using Internet technologies to multiple external customers.

“During the past 15 years, a continuing trend toward IT industrialization has grown in popularity as IT services delivered via hardware, software and people are becoming repeatable and usable by a wide range of customers and service providers,” said Daryl Plummer, managing vice president and Gartner Fellow. “This is due, in part to the commoditization and standardization of technologies, in part to virtualization and the rise of service-oriented software architectures, and most importantly, to the dramatic growth in popularity of the Internet.”

Mr. Plummer said that taken together, these three major trends constitute the basis of a discontinuity that will create a new opportunity to shape the relationship between those who use IT services and those who sell them. Essentially it will mean that users of IT-related services will be able to focus on what the service provides them rather than how the services are implemented or hosted. Gartner maintains that although names for this type of operation have come into vogue at different times — utility computing, software as a service (SaaS) and application service providers — none has garnered widespread acceptance as the central theme for how IT-related services can be delivered globally.

The types of IT services that can be provided through a cloud are wide-reaching. Compute facilities provide computational services so that users can use central processing unit (CPU) cycles without buying computers. Storage services provide a way to store data and documents without having to continually grow farms of storage networks and servers. SaaS companies offer CRM services through their multitenant shared facilities so clients can manage their customers without buying software. These represent only the beginning of options for delivering all kinds of complex capabilities to both businesses and individuals.

“The focus has moved up from the infrastructure implementations and onto the services that allow for access to the capabilities provided,” said David Mitchell Smith, vice president and Gartner Fellow. “Although many companies will argue how the cloud services are implemented, the ultimate measure of success will be how the services are consumed and whether that leads to new business opportunities.”

Gartner predicts that the impact of cloud computing on IT vendors will be huge. Established vendors have a great presence in traditional software markets, and as new Web 2.0 and cloud business models evolve and expand outside of consumer markets, a great deal could change. “The vendors are at very different levels of maturity,” said David Cearley, vice president and Gartner Fellow. “The consumer-focused vendors are the most mature in delivering what Gartner calls a ‘cloud/Web platform’ from technology and community perspectives, but the business-focused vendors have rich business services and, at times, are very adept at selling business services.”

Branding is a powerful and revenue-generating asset for potential vendors. Gartner analysts cited Wal-Mart as an example of a company that has two brands — one with consumers for its low prices and one in the business world for its supply chain expertise, its core competency, which it capitalizes on to support its consumer-facing brand.

“Companies invest billions of dollars in building up their core competencies, much of which goes into IT,” Mr. Smith said. “If companies could lease their core competencies to other companies then they would capitalize on both brands, driving revenue both in the consumer-facing market and the business service market in the way that Amazon has done with technology.”

Gartner maintains that cloud computing is very much an evolving concept that will take many years to fully mature. It also underlined the fact that the cloud-computing model is not simply the next generation of the Internet.

“When organizations cross the threshold between the Internet as a communications channel and the deliberate delivery of service over the Internet, then we truly start to head for an economy based on consumption of everything from storage to computation to video to finance deduction management,” said Mr. Plummer.

Additional information is available in the Gartner report "Cloud Computing Confusion Leads to Opportunity." The report is available on Gartner’s Web site at http://www.gartner.com/DisplayDocument?doc_cd=159034&ref=g_sitelink&ref=g_SiteLink. This document is part of the special report on Cloud Computing. A full listing of the reports is available on Gartner's Web site at http://www.gartner.com/it/products/research/cloud_computing/cloud_computing.jsp.

Gartner analysts will further discuss cloud computing trends at the Gartner Web Innovation Summit: Profiting from Web 2.0, SaaS and Cloud Computing taking place September 15-17 in Los Angeles. The event is focused on the next generation of Web technologies, including Web 2.0 and cloud computing and will cover future trends and innovations, best practices, vendor and product selections, tutorials, and tactical decision frameworks. For complete event details, please visit the Gartner Web Innovation Summit Web site athttp://www.gartner.com/it/page.jsp?id=648611. Members of the media can register by contacting Christy Pettey atchristy.pettey@gartner.com.

US Government Creates Cloud Computing Security Group

http://fcw.com/articles/2009/02/25/nist-cloud-computing.aspx

The National Institute of Standards and Technology has created a new team to determine the best way to provide security for agencies that want to adopt the emerging technology called cloud computing, said Ron Ross, a senior computer scientist and information security researcher at NIST.

“The team will give our customers a sense of what kinds of risks they may be taking on by moving into that new territory,” Ross said today at the SaaS/Gov 2009 conference produced by the Software and Information Industry Association and market research firm Input.

How cloud computing hurts venture capitalism

http://weblog.infoworld.com/whurley/archives/2009/03/cloud_computing_6.html?source=NLC-DAILY&cgd=2009-03-09

Now that Web startups have easy access to cheap cloud-based infrastructure, who needs venture capitalists?

One of the benefits of having a little prominence in the industry and a blog like this one is that you get pitched. I don't mean every once in a while you get an e-mail, I mean full-on 15-30 e-mails a day and voicemail when you don't respond. The ones I'm apparently soliciting with this blog are cloud flavored, of course. Most are from startups that run the gamut from green tech to medical to "Web 3.0!!!" Why share this information? Last weekend I had a conversation with a pair of intrepid salesman who asked me if cloud computing would kill venture capitalism. What a question!

Depending on who you talk to, venture capitalists wouldn't really be missed. Love 'em or hate 'em, they've got their place and plenty of trophies in their case. Most startups are too small with too limited an operating history to secure a bank loan or come anywhere near completing a debt offering. Enter the VCs -- very attractive for startups in this situation. VCs are willing to trade the high risk of dealing with new entrepreneurs for substantial ownership in new ventures. Let's assume our brave business adventurers are using the money from the "evil" VCs to afford the most expensive parts of their new ventures: payroll and infrastructure. In the current economy, many are willing to outsource development in lieu of hiring full-time employees. I think it's reasonable to consider infrastructure as the largest expense for a fledgling company with a small payroll.

[ You don't need to run a Web startup to put everything in the cloud. See how one young tech company pushed cloud computing to the max. ]

We've talked before about the economics of the cloud. At conferences, I've often asserted that regardless of philosophy (cloud vs. direct purchase, in this case), infrastructure costs always even out as companies scale. But when you're starting out, you're not necessarily concerned with scalability; you're just trying to scrape together enough change to buy a soda and a bag of pretzels from the vending machine. That's exactly what my two friends and I started out discussing: how startups are always either struggling or out of business. Now, back to our examination of cloud computing's potential impact on venture capitalism.

Unlike a venture capitalist, Amazon, with its EC2 cloud platform, doesn't really care about my business plan, credit rating, or history as a founder. Plus, Amazon can reduce the amount of up-front financing I need and provide me with a manageable monthly payments. Why would I give up the majority of my company in exchange for money to buy what Amazon can provide at a low monthly rate? Using my two friends' ventures as examples, a VC would want between 30 and 60 percent ownership in their businesses, while the cloud could provide their current infrastructures for less than $200 per month in both cases.

Not convinced? Joyent is offering to host your Facebook or OpenSocial application free for one year. That's only one step removed from Amazon's model. Think about that: a cloud provider giving you free services exactly when you need them, in your project's first year of life. You're free to develop your application, deploy it, and grow your business for one year with little or no up-front investment. That's a stark contrast with what it took to start a Web 2.0 company just five years ago.

Folks who don't recognize this potential threat or just plain disagree with me will argue that VCs bring much more to the table than just money. That's absolutely correct, but companies are the most financially fragile in their early days, and surrendering controlling interest is never in the entrepreneur's best interest, period.

The real kicker in all this: Almost every venture capitalist I know is investing in cloud computing, a business model that arguably affects their core business adversely. I don't think cloud computing's going to kill venture capitalism -- too many shrewd investors -- but it may alter the model.

Posted by whurley on March 9, 2009 03:00 AM

Adoption of Cloud Computing Hindered by Security and Operations Concerns

http://www.wallstreetandtech.com/it-infrastructure/showArticle.jhtml;jsessionid=CWKFRAEVFCZ50QSNDLPSKH0CJUNN2JVN?articleID=212900776

It’s not that the major cloud providers can’t provide strong security. The problem is that they won’t talk about it.
By Penny Crosman
January 16, 2009

The biggest hurdle for cloud computing on Wall Street right now -- especially among large firms -- is a lack of visibility into cloud providers' operations and security. "At the moment, cloud providers seem to want customers to treat them like a black box," says Craig Balding, founder of blog Cloud Security and technical security lead for a Fortune 500 financial company.

Security is the biggest concern. "We just went through several years of legislation that basically says you have to know where your customer data is, you have to prove that you're protecting it and you have to know who's accessing it," points out Robert Richardson, director of the Computer Security Institute. "Now with cloud computing we're hearing, 'You can't know where your data is, you can't prove that it's being protected and you can't know who's accessing it.' "

Amazon Web Services has put out a security white paper that shows the provider is trying to address the visibility issue. But large companies will require more details and reassurance on the security front, according to Cloud Security's Balding. "Most serious discussions will happen under nondisclosure agreements," he says.

In its paper Amazon says physical access to its data centers is "strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, state-of-the-art intrusion-detection systems and other electronic means." But Amazon won't tell you where its data centers are or let customers see their own servers, and the types of security being deployed are described in general terms without revealing specifics, Balding notes.

The white paper should be enough to satisfy small and midsize businesses but not large firms, which are used to standard outsourcing arrangements under which they can get a guided tour of the third-party data center, ask lots of questions of technical and security experts, and hand the provider an extensive questionnaire to fill out, he continues. "Firms are used to doing full due diligence on the provider, developing a custom contract with specific security clauses and obtaining a private network connection to that provider," Balding says.

Customers of cloud services from providers such as Amazon, Google and Yahoo! don't have the luxury of such in-depth explanations and customization. "There's a certain level of shyness from the security teams," Balding notes. As with any large organization, he adds, "It's natural to not explain to all your customers every last security detail and nuance of how the operation works."

Navigating Cloudy Skies

This lack of transparency, however, raises questions. For instance, how can companies obtain audit trails from cloud computing instances and add them to an enterprise logging system -- both to know what users are doing and to meet auditors' requirements?

"You can't ... drive over to your site in three hours and review the log file," Balding says. "First of all, you don't know where the data centers are." (In fact much speculation and many blogs and articles have been devoted to figuring out where Google's data centers are located.) He adds, "That's not necessarily a problem as long as you have a contract in place" that covers concerns such as audit trails.

Another question is what happens in the event of an outage. Some providers offer service credits, but this may be inadequate for firms that can lose business even during a short outage. "Service credits don't leave you with a good feeling," Balding comments.

To protect cloud providers' clients, he says, "I'd like to see digital contracts [i.e., contracts whose stipulations are automatically enforced by software] that specify requirements" such as the geographic location where data will be processed, security mechanisms the vendor will follow and legal recourse in the event of a problem.

Portability vs. Walled Gardens

On the wish list of potential cloud customers is the ability to switch from one provider to another. "Amazon and Google are walled gardens," Balding says. "You can't take an app from Google and bring it over to Amazon because they're architected differently." Ideally all the major cloud providers would connect and integrate with each other so that customers could easily transfer to a different provider.

Standards will help with this, but "the usual conundrum comes up," Balding says. "One group of people says we need standards; another group says if we put standards in now, we'll stifle innovation. We're at such early days with the cloud that having a set of standards everyone has to comply with now would be too early."

Despite the challenges, security practitioners cannot ignore the cloud or get caught up in all the hype, Balding suggests. "There's so much momentum behind it that the best thing to do is come up with practical solutions to concerns," he says. For instance, a good first step is to find out who in the organization is currently using a cloud provider, determine what they're using it for, and present this information to management as a reason to start understanding cloud security better and to start a dialogue with a cloud provider.

Inevitably CFOs will be drawn to cloud computing, Balding says. "The challenge for security people is to understand what the issues are and to get answers to the questions they have," he says.

No ‘Magic Solution’ for Cloud Compliance

http://www.datacenterknowledge.com/archives/2009/01/30/no-magic-solution-for-cloud-compliance/

January 30th, 2009 : Rich Miller

cloudsEarlier this month we looked at the issue of cloud computing and regulatory compliance, which is often cited as a barrier to enterprise adoption of cloud-based services. Computerworld picks up the topic today, examing the specific issues raised by three key regulatory standards; SAS 70, Payment Card Industry Data Security Standards (PCI DSS) and the Health Insurance Portability and Accountability Act (HIPAA).

Regulatory compliance is often possible with cloud computing, although it takes special effort, according to Chris Day of Terremark Worldwide (TMRK). “There is no magic solution,” said Day, a security specialist working with Terremark’s Enterprise Cloud. Each standard has its own unique challenges, and specific approaches are needed, with some requirements falling on the client side and others resting with the service provider.

That split responsibility makes it hard to draw broad generalizations about cloud providers’ ability to meet audit requirements. A major issue is a perceived lack of visibility into cloud providers’ operations and security, as outlined in a recent story at Wall Street & Technology. “At the moment, cloud providers seem to want customers to treat them like a black box,” says Craig Balding of Cloud Security, who also works on the security team at a Fortune 500 financial company.

Balding says non-disclosure agreements offer an opportunity for cloud computing providers to share more detailed information about how data is handled, and can provide a comfort zone for customers. Another issue is the prospect of vendor lock-in. “Amazon and Google are walled gardens,” Balding told Wall Street & Technology. “You can’t take an app from Google and bring it over to Amazon because they’re architected differently.”

Cloud interoperability is a hot topic at the moment, and it’s possible that migration between providers at various levels of the cloud will become easier. But it’s not just a cloud issue. Managed hosting providers specializing in compliance have some of the “stickiest” customers in the business due to the depth of the relationships.

Managed hosting may hold a precedent for the cloud. Many companies outsource their mission-critical apps to managed hosting providers in small doses, starting with small projects that test-drive the relationship, giving the provider an opportunity to build a track record of performance and trust. If the provider executes and makes life easier for the customer, they gradually take on a larger chunk of compliance-related business.