Efforts are currently underway within multiple government agencies to fulfill some of the 25 Point goals related to "commodity IT services" such as government-wide "cloud email". While even this project is a major undertaking, it is among the most feasible of the many candidates for initial cloud deployment. Converting special purpose and highly customized agency software to the cloud model will be much harder and will take significantly more time.

Cloud computing as a technology delivery model and as a business model do have the potential to provide significant cost savings and taxpayer value. But, as attractive as this may seem, its benefits should not be oversold nor its costs and risks underestimated. Additionally, although the "cloud first" policy is well intentioned, other data center consolidation technologies should not be overlooked.

For more information: http://blogs.oracle.com/drcloud/

Posted: January 28, 2011

And, there's the rub. According to OMB plan, the promise for a practical cloud strategy is rooted in the development of standards for cloud service security, interoperability, and portability. The initial public draft of the Proposed Security Assessment & Authorization for U.S. Government Cloud Computing took a healthy first swing at such standards, but does not yet tend to the needs of all the constituencies involved. Continuing ambiguity about overall risk governance and accountability, a monitoring framework that excludes the cloud consumer, and a complicated scheme for trying to shape Spec Pub 800-53 for cloud services all present high hurdles to overcome.

One cannot but wonder if the biblical admonition against "pouring new wine into old wineskins"¹ must be observed here. Trying to bend the conventional machinery for C&A into a community process for "A&A" without clarifying who is accountable for risk acceptance in cloud services only slows cloud adoption. The attempt to fashion existing Spec Pub 800-53 controls into a set of requirements suitable for cloud processing is laudable, but does not suit the consumption model of the cloud. In other words, the old wineskins of traditional C&A models and Spec Pub 800-53 cannot yet handle the new wine of cloud processing.

Until we fulfill the promises made in the OMB plan, we will be constrained to applications that satisfy the compensating techniques first introduced in "Digital Trust in the Cloud" and subsequently amplified in other places. We can gain some benefit from "safe" applications like non-sensitive email, development and test, backup and restore, and even a bit of collaboration and social networking. But, such applications do not deliver the kinds of payoff we need and expect from cloud processing.

In his earlier blog on this matter Chris Hoff declared "we're gonna need a bigger boat." Simply enlarging the vessel may not be enough. The biblical warning declares that “both the wine and the skins will be ruined”1 if we try to pour new wine into old wineskins. The new wine of cloud processing may well need completely new wineskins (standards and practices) for us to enjoy the rich bouquet of enterprise payoffs.

See the full blog response at http://www.csc.com/cloud/blog.

For further information, please contact Ron Knode at: rknode@csc.com

Posted: February 1, 2011

U.S. CIO Vivek Kundra quickens the pace with his vigorous mandate to consolidate at least 800 data centers by 2015. This goal has the crucial merits of being countable, achievable, and uncomfortable. This goal will not be achieved by picking the low-hanging fruit of redundant or obsolete systems that are readily and painlessly retired as soon as someone decides to do so. Meeting Kundra's challenge will require fresh thinking about who performs what functions, and who needs to own what capabilities – but it will not require lowering our standards for what constitutes satisfactory performance.

Indeed, the National Institute of Standards and Technology has urged us all to treat the move to the cloud as an opportunity for substantial improvements in IT reliability and governance. In its newly released draft document, "Guidelines on Security and Privacy in Public Cloud Computing," NIST correctly asserts that.

Potential areas of improvement where organizations may derive security benefits from transitioning to a public cloud computing environment include the following:

• Staff Specialization: opportunity for staff to specialize in security, privacy, and other areas
  
• Platform Strength: Greater uniformity and homogeneity facilitate platform hardening and enable better automation of security management
  
• Resource Availability: Redundancy and disaster recovery capabilities are built into cloud computing environments
  
• Backup and Recovery: Data maintained within a cloud can be more available, faster to restore, and more reliable
  
• Mobile Endpoints: clients are generally lightweight computationally and easily supported
  
• Data Concentration: less of a risk than having data dispersed on portable computers or removable media

This list can aid us in choosing our targets for rapid cloud adoption. We should look for tasks requiring maximum speed and flexibility in deployment to mobile personnel or to frequently relocated sites. We should look for tasks requiring access to large collections of data, but using focused subsets of that data in typical situations. We should look for tasks requiring precise grants of privilege, and rigorous accountability for who has done what with sensitive information. All of these are criteria for which the cloud does not merely meet expectations, but rather elevates the standard of practice as widely demonstrated by enterprise customers today.

CIO Kundra's challenge comes at a time when technical transformation coincides with cultural readiness to consider dramatic change. Tightening resource constraints, combined with broad and growing public adoption of cloud services in both workplace and personal activities, create a powerful push-pull incentive to act – and a basis for confidence in the outcome.

For further information, please contact Peter Coffee at pcoffee@salesforce.com or see his blog at http://cloudblog.salesforce.com/

Posted: January 4, 2011

The plan outlines a 'Cloud First' policy, which mandates that each agency identify, within three months, three 'must move' IT services and move one of those services to the cloud within 12 months. The remaining services should transfer to the cloud within the next 18 months.

Additionally, approval is reserved for major IT programs that utilize a modular approach, with new customer-facing functionality provided every 6 months.

This is an important component and also addresses President Obama's Memorandum on Transparency and Open Government, issued on January 21, 2009. In this memo, the President outlined the Administration's commitment to creating an unprecedented level of openness in Government and instructed the heads of executive departments and agencies to work together to ensure the public trust and establish a system of transparency, public participation, and collaboration. Cloud technology can help federal agencies comply with this mandate.

To deliver on the promise of open government and the plan to reform federal IT, agencies must identify services to transfer to the cloud. Specifically, Web Self Service applications and Pilot Programs are a good starting point to identify the best solutions for specific agency needs.

Coupling cloud solutions with Web self-service applications is an effective means to simultaneously improve constituent services and reduce overhead costs. With Web self-service, constituents can find information that they need on an Agency website quickly, without having to contact a live person. Additionally, the cloud provides Federal agencies with several benefits:

• Lower total cost of ownership
  
• Benefits from frequent solution innovation
  
• Increased reliability
  
• Speedy, measureable results on open government initiatives
  

Whether in the public or the private sector, identifying the appropriate IT solutions can be a daunting task. For this reason, working with vendors that provide pilot programs is a critical component in the decision making process. One of the unique things about cloud computing is the ability to test the solution first—before signing a contract. Identifying proof points and results up front, prior to making a large investment, is critical to ensuring success.

Cloud solutions provide the scalability that government agencies require to meet constituent needs—eliminating digital capacity limitation worries. By transitioning to the cloud, agencies tap into an infrastructure that is as flexible as their needs are varied. Undoubtedly, these are some of the primary reasons why cloud is positioned as the center stone of the Administration’s plan.

Posted: February 10, 2011