There is a disruption factor that’s undeniable when talking about cloud computing, and it’s disrupting business on many different levels.
That’s a relatively harmless thing when you’re talking about disrupting business models by enabling software-as-a-service through cloud architecture. But there’s also the disruption that technology can cause in the labor force.
Lists are usually good things to have. They help us to organize tasks, concentrate our attention, and discipline our time and money. On the other hand, lists can also “cloud” the real goal or objective, and nudge us into a one-at-a-time, check-off style of work (occasionally called “stovepipe” work) that prevents us from recognizing linkages between items on the list, and targeting the ultimate objective or outcome.
I worry then about “recipes” for security in cloud computing.
CSC Chairman, President and CEO Mike Laphen was a featured speaker at the World Economic Forum in Davos, Switzerland, on Jan. 28, 2010, and cloud computing was a major focus of his comments.
The 60-minute technology talk — featuring plenty of cloud discussion — is now available for streaming online.
Can cloud computing make the world a better place?
The Question of the Month at the MITRE blog asks what government can do to facilitate the adoption of cloud computing to more effectively provide IT services. There are 3 things, actually.
But this question is clearly just a short step from January’s question. So, let’s deal with both of them:
First, January’s question: “What’s most significant cloud computing concern for federal orgs?”
I felt compelled to respond after reading Chris Hoff’s “Cloud: Security Doesn’t Matter (Or, In Cloud, Nobody Can Hear You Scream),” at his blog Rational Survivability. This post originally appeared as a comment to his post.
I am working with Hoff as a member of the A6 (Automated Audit, Assertion, Assessment, and Assurance API) group working on cloud security interoperability standards.
Hoff’s point is well said. It’s a forceful (and entertaining) echo in the cloud of earlier discoveries and comments about the ultimate importance of “trust” versus other words often intended to characterize related aspects (e.g., security, privacy), but which do not represent the real need, and so should never be confused as synonyms.
This commentary could be used almost “as is” for earlier IT delivery schemes. Think of it! We needed “trust” in the web (not just “security”), “trust” in software development (not just “security”), “trust” in SOA (not just “security”), and on and on and on. The distinction comes down to the ability to create new enterprise value (”trust” can do that), versus merely the incremental improvement in the protection of enterprise value we’ve already got (that’s what “security” does).
Compliance, on the other hand, is the (reliable) satisfaction of a set of security/integrity/availability conditions that have been declared to be “acceptable” by an authority with some governance responsibility. While this is no place to delve into the psychological and sociological constituents of trust, it is clear that there is a (strictly) technological contributor to trust (often called “digital trust“) and that’s what we’re talking about here.
In my research, the key ingredient to digital trust generation is visibility into the system as designed and at work. The greater the transparency of operation, the more digital trust is generated, and the more opportunity for enterprise value creation is presented. It’s amazing how this works. And, at the same time, such transparency also contributes to control mechanism validation, making compliance more achievable as well.
So, heed the words of trust in the cloud. For greater explanation of the linkage between transparency and digital trust generation, see my research paper, “Digital Trust In The Cloud” or related articles produced at the Leading Edge Forum.
This is not the “Zhu Zhu Pet of the day” for the cloud. The power of trust (including digital trust) is enduring, as long as transparency is reclaimed and reported reliably.
One of the aims of the A6 group is to explore techniques for cloud security claims and assurances, and making them standard (or at least interoperable).
Seems like more than a worthy objective to me.
Ron Knode is Director of Global Security Solutions at CSC and a Research Associate with the Leading Edge Forum.
Microsoft’s Business Productivity Online Services — the suite of software that includes Exchange, Sharepoint, Office products, also known as BPOS — is an easily understandable example of cloud computing. It’s a per-month-per-user charge for what used to come on CD-ROMs with license fees, with all the applications and documents now hosted by Micrsoft data centers.
Microsoft has made billion-dollar investments around the world and has reduced the overhead it takes to offer these services through scale. Integrated and migrated by CSC, the BPOS solution provides an amazing opportunity and value for our enterprise clients who are beginning to discover the benefits of cloud computing.
There has been a large increase in interest in these BPOS services — and we starting our first major roll out with the Royal Mail Group in the UK. Numerous Fortune 500-size organizations are strongly considering BPOS as it provides a more cost-effective way to run and maintain advanced messaging and collaboration services for their companies. I think we’ll actually see an acceleration of adoption of these types of cloud services in the near term.
Jay Noble is Director of Cloud Computing at CSC. Follow Jay on Twitter @CSCTrustedCloud
The tricky thing about inflection points is they are hard to see when you are in them and painfully obvious once they have kicked into high gear, leaving all those behind who were unprepared for their occurrence.
They are as inevitable as death and taxes but as eclectic and unpredictable as a Dennis Miller rant on current events. Every industry has them but the technology world seems to have them more frequently, with more intensity and with broader impact on all other industries.
So I believe we are in the midst of another inflection point and it’s being accelerated by the advancements in cloud computing.
I read a fascinating article today by Lori MacVittie who blogs over at DevCentral. Lori wrote a phenomenal post on the subject of virtual appliances versus specialized hardware entitled “When Did Specialized Hardware Become a Dirty Word?”
This post has crystallized a lot of my thinking around this topic over the past year or so. I encourage you to read it. What I really like about Lori’s observation is that she recognizes the organizational and cultural barriers that will mean that the adoption of virtual appliances in the infrastructure will likely not yield the expected savings or efficiencies that their proponents claim.
Any implementation of cloud services for the enterprise must strike a balance between rapidly implementing a solution and a solution of increasing complexity and cost.
I like Sreedhar’s observation that the established enterprise would need to leverage cloud IT services differently than a larger enterprise. I do agree that there is probably a well-defined set of startup services that can shorten the time necessary to both establish an development environment and get useful functionality out of the other end.
I think that the assertion that cloud will result in a reduction of complexity is arguable.
The growing buzz around cloud computing the past few years has resurfaced what are really ever-present concerns in information technology and data management. The topics of trust, security, compliance and regulation — they’re not going to go away.
Does anyone really expect that, say, the government’s appetite for regulation and rules regarding digital records will decrease?
There was a time you could take a server, put it in a room, watch it, work on it, replace it. Now, with virtual machines, they can be created and spun up anywhere, wherever those resources are available. Many of our types of clients have certain requirements for data, however, they need to be able to answer, “Is it within the bounds of a state or country? Who is accessing that data? Do I have proof that the data hasn’t been moved or changed, and if so who did the moving and changing?”
CSC’s new Leading Edge Forum Report, “Cloud rEvolution,” aims to separate the facts from the fiction.
Learn more about the series
DELICIOUS
SLASHDOT
DIGG
TECHNORATI
SUBSCRIBE