 |
What do you perceive as the most significant concern for federal organizations who want to use cloud computing?
a) Acquisitions, b) Availability, c) Performance, d) Scalability, e) Security, f) Solution maturity (bugs/defects), g) Vendor lock-in, h) Other
Please address how commercial offerings are addressing this concern. |
- Steve Oberlin, Distinguished Engineer, CA
- Bruce W. Hart, Chief Operating Officer, Terremark Federal
- Peter Coffee, Director of Platform Research, salesforce.com inc.
- Steven Lebowitz, IT Architect, Federal Cloud Team, IBM
- Teresa Carlson, Vice President, Microsoft Federal
- Bert Armijo, VP Marketing and Product Management, 3Tera, Inc.
- Geoff Raines, Principal Software Systems Engineer, MITRE
|
Steve Oberlin
Distinguished Engineer
CA
Certainly these are all valid concerns at one level or another, depending on the organization (their constituency, mission, IT requirements, etc.), the applications contemplated for cloud deployment, and the current state of IT operations and efficiency. While security is often raised as the most significant concern, cloud computing isn't just shorthand for outsourcing IT; internal or private clouds can provide the same or better efficiency and agility benefits as external clouds without incurring new exposure. Scalability, performance, and availability gains are actually all benefits one should anticipate reaping from cloud computing (internal or external). If these are concerns, you may be starting with the wrong applications, suppliers, or expectations. Similarly, vendor lock-in, solution maturity, and acquisitions are not problems unique to cloud computing and are amenable to the same sorts of mitigation strategies one uses to evaluate, procure, and deploy conventional IT technology and processes.
Instead, I think the biggest organizational cloud computing challenge is a larger one than those on this list, one that supersedes all of these and more. That issue is change readiness, the ability of the organization to culturally and operationally adapt to new paradigms for IT management, provisioning, accounting, and trust.
Cloud computing fundamentally is about enabling agility. Cost savings are nice, but of secondary value to an organization (the limit of savings is the IT budget, while the potential top-line gain from increased organizational agility is boundless). Agility results from trusting and enabling users -- IT's constituents -- to self-serve their own changing needs, to dynamically dial up and down and transmute the nature of their consumption, and to enjoy real-time feedback on the cost and value of IT. Agility comes from disintermediation of traditional IT management and stripping stultifying process from between users and the IT services they consume (and increasingly want to directly control).
To deliver agility, IT management (the CIO and his organization) needs to embrace a different role. Disintermediation does not mean they can simply abdicate their ultimate responsibility for the safety and security, capacity and performance, and compliance and accountability of all IT services required by the constituent organization. Instead, they need to provide an IT environment that enables users to manage their own services while ensuring all the above responsibilities are met behind the curtains. This means IT must employ invisible actors to enact policy-constrained processes in real-time, using technologies like dynamic optimizing automation, self-service portals, and catalogs of customizable template services.
IT's new role is a move to higher-level management. The compound cloud in our future will be managed by policy, not by rote process, and new skills and organization structures will be required before we're through. Change can be frightening, even when it is a promotion. Are you ready? Your users are.
Many commercial cloud technology offerings only deal with one narrow slice of the combinatory complexity of applications, platforms, and infrastructure. Though the cloud is still in its infancy, robust heterogeneous cloud management solutions are emerging. Check out www.ca.com/cloud for more.
For further information, please contact Steve Oberlin at: steven.oberlin@ca.com
Posted: January 12, 2010
|
Bruce W. Hart
Chief Operating Officer
Terremark Federal
If we focus our discussion around Infrastructure as a Service (IAAS, the foundational level of the Cloud), I believe that three concerns are of equal urgency - Availability, Security, and Performance.
Cloud-based IAAS comes in various flavors. The most popular conception – the shared, commodity-based Cloud, where you simply order up some compute capacity, swipe your credit card, build your virtual machine and you're off and running – has a certain appeal, but it does not scale to the enterprise-level, mission-critical demands of Federal agencies. Indeed, we have seen instance after instance recently where commodity-based Cloud services simply "crash." Federal IT leaders cannot afford to ignore the underlying physical architecture from which Cloud offerings are launched and just hope for the best. They must assure at least the level of availability, security and performance that they realize from traditional hardware-based IT architectures - ideally, they should be able to interconnect those traditional systems to the new Cloud services that they acquire. This creates leverage from all of the benefits of Cloud infrastructure - on-demand capacity and massively scalable elastic architecture, which can bring a new level of flexibility and agility to IT leaders, and with it a compelling economic model that eliminates lumpy capital expenditure and precisely aligns IT infrastructure spend and capacity with the real-time needs of the organization – but it does not sacrifice the power and reliability of controlled, standards-based systems.
Further, the IAAS services they acquire should be integrated with a suite of security features that preserves the integrity of the Government's data. This must go beyond simple firewalls and intrusion detection/prevention utilities to more comprehensive capabilities, beginning with the physical security of the site where the Cloud services originate and moving through multi-factor authentication to sophisticated forensics capabilities, including memory forensics, network analysis, end user analytics, and Certification and Accreditation support.
Finally, the performance of the virtual systems created on Cloud resources for Federal missions must be excellent – Federal leaders should ensure that they have access to dedicated resources, rather than sharing resources in an over-subscription service model, while also retaining the ability to surge as needed on a pay-as-you-go basis. Enterprise class, federal dedicated clouds hold the promise of economy, agility, and most important of all, elasticity, at not just the system level, but right down at the individual server's ability to expand and contract according to real-time need. Commercial service providers should be held accountable by informed, inquiring Federal leaders for delivering on that promise.
For further information, please contact Bruce W. Hart at: bhart@terremark.com
Posted: January 15, 2010
|
Peter Coffee
Director of Platform Research
salesforce.com inc.
As federal organizations accelerate their adoption of cloud computing, there's nearly universal consensus on the cloud's compelling advantages:
• lower capital requirements
• rapid, scalable deployment of high-function solutions
• radical reduction of cost, schedule, and technical risk
What remain are two sets of concerns:
• issues of perception that must be addressed to satisfy stakeholders
• issues of technology and practice that must be addressed to maximize value
During acquisition phase, organizations should think of the cloud as an extension, not a replacement, of current IT assets. It's a common misperception that the cloud must be adopted in whole, or not at all; it's a vital component of cloud success to recognize opportunities for integration among services of multiple providers, and between cloud and on-premise resources.
Many opportunities in the cloud come from liberating latent value of current IT systems to deliver accurate, actionable information in a secure and reliable manner to points where that information can best be used.
All responsible parties demand assurance of the availability of cloud-based systems. Cloud availability is often superior to that of on-premise systems: the scheduled maintenance alone of many on-premise systems exceeds the total non-availability, from all causes, of an enterprise-grade cloud service. Providers such as salesforce.com and Amazon Web Services operate public Web dashboards reporting all departures from normal operation, however slight, with performance monitoring beyond what's available to most in-house operations.
Cloud security and governability are routinely assumed to be less stringent than that of local systems, but this can not be generalized. There are consumer cloud services designed for easy sharing, and there are enterprise cloud services designed for precise and granular privilege assignment with robust and auditable management.
Security is not a technology, but a combination of culture and process. Actual data loss or security breach in federal systems, as reported each year by the GAO (ref. 2009 report at gao.gov/new.items/d09546.pdf), is most often the result of accidental or deliberate misuse of privileges intentionally assigned to systems' users. Enterprise-grade cloud services offer rigorous separation of duties; world-class security teams, tools and practices; and superior ability to monitor and report the actual time and manner of users' and administrators' actions.
With these issues candidly addressed, IT leaders in federal agencies should proceed with cloud adoption bearing three strong guidelines in mind:
- What works well now should be measured against cloud alternatives, and should be complemented rather than replaced unless the cloud is measurably better.
- What doesn't work well now should never be merely relocated to the cloud, but should rather be re-envisioned in a way that takes maximum advantage of cloud connection capabilities and proven cloud services.
- Detailed analysis, not facile generalization, should be applied to all questions of security, availability and capability. In many cases, cloud offerings are already superior in these respects, and rapidly improving as well -- but in all cases, the solution should be chosen based on the specific need.
For further information, please contact Peter Coffee at: pcoffee@salesforce.com
Posted: January 15, 2010
|
Steven Lebowitz
IT Architect, Federal Cloud Team
IBM
While many of the items listed are of concern to Federal agencies to a greater or lesser extent, there are perhaps, larger issues which need to be addressed. Certainly, there is a great deal of interest in cloud. Many organizations have yet to be convinced that they will receive improved service and reduced costs by moving from dedicated infrastructure into a shared cloud. There are also issues regarding who can participate in a cloud due to a number of security and privacy concerns. How will the Government address these security and accreditation policies and practices in order to adopt a highly virtualized, automated, and shared infrastructure? Are the potential cost savings (and other benefits) significant enough to overcome the organizational "stove piping" and fear of losing control of both infrastructure and data? Finally, organizations need to determine what applications are appropriate for being deployed in a cloud. There is a process of application portfolio rationalization, and an analysis of "cloud readiness" that should be done in advance of making technology choices and deployments.
We at IBM have had significant interest from our clients in deploying fully integrated, easy to deploy, self-service, test and development environments into their organizations. Software test and development is an application area which is typically decentralized. With this, they are attempting to gain first-hand insight into the benefits of cloud computing, and a better understanding of its impact to their organization without making large monetary investment, or a giant leap of faith with a public cloud provider.
For further information, please contact Steven Lebowitz at: lebowits@us.ibm.com
Posted: January 19, 2010
|
Teresa Carlson
Vice President
Microsoft Federal
Federal agencies have to consider many factors when it comes to if, when, and how to move to the cloud. Most of the agencies we have been meeting with are smartly planning to walk before they run, and they know there are serious concerns around availability, performance, privacy and security. From our perspective, these are all important, but security is probably the most significant cloud concern for federal leaders.
The move to cloud is a huge cultural shift – you're allowing someone else to host your data and trusting that they'll protect it. That's a big deal for complex government organizations that work with highly sensitive information, often with national security implications. Cloud providers must move forward with solutions that meet the best industry security standards that exist today, and earn the trust of the organizations we serve. Earning that trust starts with transparency, and government organizations are rightly demanding full view into the processes we're implementing to protect their data. Over time, the best solutions and processes will inform quality regulation, so that governments can confidently take advantage of the tremendous cost and efficiency benefits that cloud computing offers.
Fortunately, moving to the cloud isn't really starting from scratch. Hosted services, Service Oriented Architectures (SOA) and Web applications have been around for a while, offering us a good foundation for best practices that we can carry into the discussion on cloud security. The same holds true from a standards perspective. We believe that over time standards will emerge based on industry and customer demand - which has often been the case throughout the history of IT. Establishing standards will be a joint-effort between industry and government. We live in a mixed/hybrid IT world and government customers need the freedom to choose the best solutions and locations for their data. Interoperability avoids vendor lock-in and ensures choice and competition.
We should note, too, that datacenters are a key foundation of any organization's approach to cloud computing, and should be built in compliance with the best security and privacy standards that exist today. These standards include International Organization for Standardization (ISO) 27001, FISMA, ITAR, Health Insurance Portability and Accountability Act (HIPAA), Sarbanes Oxley Act of 2002 and SAS 70 Type 1 and Type II. All are examples of widely accepted US and International standards today.
The cloud will evolve and mature over time, but we can't stop the innovation while we wait. A good analogy is one from the car industry. There are a lot of important federal safety compliance standards for manufacturers, but there are a lot of "extra" safety measures (ie. additional airbags) that appeal to some consumers at a price. Cloud options will be similar. There will be baselines and there will be extra assurances. Forcing everyone to buy the most feature rich IT system would be cost-restrictive. We need mandatory standards and self-regulation. Brad Smith, Microsoft's General Counsel recently spoke at the Brookings Institution on this very topic, and urged congress to move forward with a "Cloud Computing Advancement Act" to foster innovation, protect consumers and establish rules and regulations around data privacy and security.
For further information, please contact Teresa Carlson via: FutureFed
Posted: January 28, 2010
|
Bert Armijo
VP Marketing and Product Management
3Tera, Inc.
All of these topics come up in any conversation about cloud computing, but they're really all part of one larger concern - control.
IT is tasked with delivering reliable and secure services to users, and safeguarding their organization's data assets. Therefore, it's understandable IT managers are concerned whether cloud computing gives them sufficient control to ensure the viability of those services. When performance lags, will they be able to respond quickly? Is data secure and under their control? If the provider can't meet SLAs, can they move applications and data quickly to another? If security requires it, can they bring applications back in-house? Will their processes and monitoring work with cloud deployments? In short, IT managers want to know they have the control to perform their jobs.
Furthermore, there's no need for compromising control. Advances in cloud computing platform technology afford IT managers similar control in the cloud to what they have in their own data centers. As IT managers evaluate potential providers and projects they should look specifically provisions for their control not just of provisioning a virtual machine, but of storage, networking, security and critical infrastructure. Cloud computing needs to be more than just a way to save money, it needs to be a better way to run your service.
Posted: February 4, 2010
|
Geoff Raines
Principal Software Systems Engineer
The MITRE Corporation
First, I want to thank the group of respondents above for participating in our initial cloud computing question and providing in-depth and thoughtful answers. One of the primary goals of this forum is to bring together thought leaders in the cloud computing marketplace to solve the IT Government's challenges, and it is clear this month's contributors gave this topic a lot of consideration.
This month's cloud computing question focused on the perception of common risk areas for Federal cloud computing efforts. Understandably, one can see from the responses above that few people identify one single cloud computing risk area as their sole concern. Similarly, a survey on cloud computing transition by Kelton Research for Avanade, between December 2008 and January 2009, focused on C-level executives (e.g., CEO, CFO, CIO, CTO) and suggested that even though "nearly two in three IT execs worldwide and four of five in the United States believe cloud computing reduces up-front costs," there is still "strong reluctance to change driven by fears of security threats and loss of control.  The survey goes on to state that, "In this economic environment, costs are not a top barrier to change." A 2008 survey by CIO Research suggested that while "58 percent say cloud computing will cause a radical shift in IT," 45% of respondents cited security concerns as their greatest concern for cloud adoption, followed by concern over integration with existing systems, loss of control over data, and availability. (Please see the inset figure for the broader list of their concerns.) Further, surveys by F5 Networks and Unisys in 2009 each suggested that not only security but data privacy are key concerns regarding cloud computing. All these surveys suggest that, like any traditional large-scale infrastructure effort, cloud computing efforts bring with them a series of program risks to be addressed, whether as a service provider, or a service consumer.
Federal leadership teams are familiar with actively managing risks to ensure program success. Risk management techniques suggest that for each risk, mitigations and courses of action can be developed and put in place to improve the outcomes for a program. As noted in the contributors' examples above, the marketplace of commercial and Government cloud service offerings is evolving to address commonly perceived risks to make cloud computing capabilities a viable alternative for many Government IT needs. Consequently, the Government decision maker has a group of options that range from wholly commercial cloud services, and Government-run community clouds, to the creation of internal private clouds. Characteristics such as the expected costs, agility, scalability, and an organization's data and system requirements will suggest which path is most appropriate for individual Government programs. MITRE is currently developing a whitepaper to address this decision process in greater depth.
The MITRE cloud blog is a new forum, started in January 2010, to provide a mechanism to effectively connect industry and Government. Each month we ask thought-leaders and market leaders to offer their ideas on cloud topics important to Government decision makers. As a reader of this blog, if you have comments on future questions, or on the answers above, please feel free to email us through the link provided below.
Next month we focus on what Government can do to facilitate the adoption of cloud computing to more effectively provide IT services. Please bookmark us and check back with this site, or subscribe to our MITRE RSS feed above  to stay informed on new cloud computing postings.
For further information, please contact Geoff Raines via: cloudbloggers-list@lists.mitre.org
Posted: January 29, 2010
|
If you would like to contribute an answer to this question, or future questions, please Contact Us. Terms and Conditions of Use
|
|
If you are from a U.S. government agency or DoD organization and would like to pose a question for this forum, let us know.
Welcome
"Ahead in the Clouds" is a public forum to provide federal government agencies with meaningful answers to common cloud computing questions, drawing from leading thinkers in the field. Each month we pose a new question, then post both summary and detailed responses.
Current Month
January 2011
|
|
|
