From the Enterprise perspective, now has never been a better time to invest in cloud services. Enterprises are broadly adopting all types of cloud services at multiple levels in the organization. Initial predictions were for the enterprise to favor private and community clouds over public services, but the hottest trends in Cloud adoption has been Software as a Service (SaaS) and cloud-based business applications which are projected to grow from $13.4 billion in 2011 to $32.2 billion in 2016, a 19.1% five-year CAGR! The rapid adoption of SaaS applications of all flavors by the enterprise has been a surprise to many, but the vastly reduced costs due to the pay as you go pricing models, and high degree of service delivery flexibility has overcome any perceptions of needing to trade price for reduced feature sets. Unsurprisingly, the most often added cloud-based application services are Customer Relationship Management (CRM), Supply Chain Management (SCM) and Enterprise Content Management (ECM), with Web Conferencing, teaming platforms and social software suites nipping at their heels.

Infrastructure as a Service (IaaS) continues to appeal to companies that want to replace in-house and traditional data center models for the cloud hardware abstraction approach. Gartner is predicting Infrastructure-as-a-Service (IaaS), cloud management & security devices, and Platform-as-a-Service (PaaS) are growing from $7.6B in 2011 to $35.5B in 2016, a CAGR of 36%. A word of warning for companies that think just because the Amazon cloud is easy to use, it is easy to build and manage. Building a private cloud still requires a degree of expertise that few enterprises have in-house. In the next year or so expect more companies to see the value of using the services of cloud consultants to avoid painful and expensive mistakes when building private clouds; or alternatively using emerging enterprise focused public cloud services such as Bluelock or Terremark.
Platform as a Service (PaaS) which still does not quite know what it wants to be when it grows up, is lagging with only about $1B in revenue in 2012, but as the market matures, expect to see rapid uptake as companies recognize the value of standardized tools that can ease the pain of Cloud application deployments. Some of the newer PaaS tools like the ServiceMesh Agility Platform combine the features of a SDLC workflow engine, production support and orchestration across different cloud platforms.

New Cloud Technology Directions

Ultimately, innovation is the marriage of technology and organization change. The dilemma is how to pull innovation into IT core functionality without disrupting the flow of new ideas, when the modern enterprise understanding of IT is focused on operational excellence and cost control. The CIO should be leading the cultural change to the new flat organization by leveraging cloud and mobile application in new and interesting ways. The trick is to create tools for people to quickly test and validate their ideas so they can implement new ideas that work within the enterprise framework. Cloud tools can be used to deliver on that promise, but is the enterprise up to that challenge?

This is not the first time wrenching technology innovation has changed how companies do business, and it certainly will not be the last. Companies able to use disruptive technologies, such as cloud computing, effectively will leave companies who do not have that ability in the dust. By recognizing the seeds of change and embracing them, the smart company can leverage cloud services by using the efficiencies of pooled IT resources at the same time allowing greater flexibility to meet the challenges of the global economy. This combination of combining commodity utilities with innovation allows companies to compete effectively using the efficiency and flexibility strategies simultaneously.

Challenges, Always Challenges…

Consumers intuitively get cloud and have been more than willing to embrace it warts and all as it has matured. They are highly price sensitive and will easily sacrifice features in exchange for low cost. On the other side of the market spectrum, the more conservative enterprise market is still struggling with the basic model. Some companies worry that the emerging cloud companies are too small to do business with, while others are concerned with how to incorporate new technologies into existing technology portfolio investments. To address their concerns, at the same time as Cloud technology continues to mature and standards develop , innovation around service delivery and breakthroughs in storage technologies are making it ever more enterprise ready. The pace of cloud vendor consolidation has already picked up as the traditional enterprise vendors such as HP and IBM has rushed to add enterprise ready cloud services to their portfolios. This should alleviate the fears of even the most technology adverse companies.

A final word for any remaining cloud technology skeptics, as with any innovative force, the cloud is just a tool to drive change, not an embodiment of change itself. Enterprise cloud consulting leaders, have firsthand experience with how companies willing to ride the Cloud revolution will not only survive in today’s hyper-competitive world, but thrive. I cannot wait to see where the next wave takes us!

About the Author
Beth Cohen, Beth Cohen is a senior cloud architect for Cloud Technology Partners, Inc., focused on delivering solutions to help enterprises leverage the efficiencies of cloud architectures and technologies. Previously, Ms. Cohen was the director of engineering IT for BBN Corporation, where she was involved with the initial development of the Internet, working on some of the hottest networking and web technology protocols in their infancy.

Enterprise SaaS takes off – With $14.5 billion in SaaS sales (an increase of 17.9% from 2011), lots of providers are getting it right. The biggest news is the boom in enterprise SaaS application adoption. Originally touted as the great leveler, allowing small businesses to take advantage of sophisticated systems hereto only affordable by big companies, the enterprise is rapidly dumping their high maintenance in-house systems and deploying a variety of SaaS services instead. Salesforce of course has long been a big player in this space, but the Workday’s spectacular IPO in October indicates a bright future. Look for lots of interest in Microsoft cloud products such as Office 365 and Azure as companies realize that these are cheaper and more flexible alternatives to traditional desktop tools. The rapid adoption of mobile devices in the workplace and its demand for more business customized apps is only going to accelerate this trend.

OpenStack grows up – While it remains to be seen if OpenStack wins the cloud infrastructure wars against VMware, CloudStack and Eucalyptus, given the number of cloud service providers lining up behind HP and Rackspace to roll out Openstack commercial services, it is not difficult to predict that 2013 will be another banner year for OpenStack. Practically the every major tech company in the world with the notable exception of Amazon is throwing their support behind OpenStack. On the technology side, more tools and functionality than ever makes the future of the largest cloud Open Source project ever definitely rosy.

Cloud Hardware Architectures get real – Over the last year or so, several vendors including VCE, the uneasy coalition of EMC, Cisco and VMware, Dell, and NetApp, have announced prepackaged cloud hardware stacks. On the surface the idea is appealing to enterprise IT infrastructure teams unprepared for the cloud revolution. However, as companies quickly found out, there is a big difference between dropping in a rack of hardware and building a productive enterprise cloud infrastructure. Since a primary cloud objective is hardware and software abstraction, more vendors will be developing infrastructure architectures tolerant of commodity hardware and supportive of transparent upgrades.

VMware Cloud gets it right – All indications are that 2013 will be the year that VMware finally gets it right after years of passing virtualization off as cloud. Enterprises that have been patiently waiting for a full suite of cloud features and tools will be rewarded with a system that will be expensive (what else is new), but actually delivers the goods.

Cloud Tools mature – With more offerings than ever from startups and mature companies alike, the market for sophisticated tools will be heating up as companies realize that they need orchestration, brokering, PaaS and cloud management suites. There will be lots of activity, new offerings, acquisitions, and of course, the inevitable hype.

About the Author
Beth Cohen is a senior cloud architect for Cloud Technology Partners, Inc., focused on delivering solutions to help enterprises leverage the efficiencies of cloud architectures and technologies. Previously, Ms. Cohen was the director of engineering IT for BBN Corporation, where she was involved with the initial development of the Internet, working on some of the hottest networking and web technology protocols in their infancy.

On paper, the concept of the development and operations part of an IT organization working in concert is wonderful.  In fairness when a company makes the effort to encourage the organizational changes that need to be done, the productivity gains, velocity and quality improvements of the IT systems more than make up for the pain of the organizational changes.  However the effort of making that transformation is often far more fraught with technical obstacles and political stumbling blocks than many over-stretched IT organizations is capable of handling.  Fortunately with proper guidance there are Agile and organizational transformational techniques that can be used to overcome the issues.

Often the reasons why these transformations are not as successful as they could be fall into three categories:

Organization, Political and Business Issues – Anyone who has ever worked knows that organizational issues are the most deep-seated and difficult to overcome.  The old boys’ networks and entrenched ways of thinking are sometimes insurmountable roadblocks.  There are several methods to address these issues, but in all cases strong sponsorship and support from the executive ranks is essential for a successful creation of a DevOps mindset in an organization.  One way to influence the change is to take a page out of the old organizational change playbook; create an organization that aligns with the desired outcome.  In one large enterprise the solution to the resistance to changing from the old IT operational mindset was to reorganize the entire IT organization so that the development and operations groups reported into the same structure.  The manager of both groups was a strong believer in the need for DevOps to support the company’s multi-million dollar cloud initiative.  By forcing the groups to work together in Agile Swarms, they were able to build the trust and skills needed to bring about the organizational transformations.

Outsourced IT Business Model – Yup, you read that correctly.  For all the touted benefits of outsourcing, and I will agree that there are many, agility and organizational transformation is not one of them.  The outsource vendor is motivated to manage risk by eliminating as many unknowns as possible.  Like traditional IT operations the easiest, but no always the best way to accomplish this goal is by minimizing changes in the environment.  This encourages rigid thinking and highly delimitated roles.  It isn’t always that the work is off-shored that causes problems.  Often the issues are related to poor project management, unclear articulation of the team goals, and a disconnect between the purchaser of the services and the vendor.  One company is mostly using American labor, but they are so stuck in their ways that they are just starting to think about breaking down the barriers between the functional groups.  Another is having an IT meltdown on the operations side of the house which is causing them major headaches.  Communications issues across the organization and between the vendor and the customer in this mixed shop are behind much of the conflict.

Staff Skills – This is an often overlooked aspect behind the failure of DevOps initiatives, the skills and working habits of development and operations people are typically wildly divergent.  Developers often work on new projects, so are typically more willing to take risks, work with underdeveloped and/or buggy code and generally are not very concerned if things break along the way.  They know that breaking things is just a routine part of the development process.  On the other hand, IT operations people are paid to keep systems running as smoothly as possible.  They are often held to strict SLA’s so they take five-nines seriously.  One way to keep an environment stable is to introduce change as little as possible.  IT operations are famously resistant to changing code on the fly or introducing other things that might cause them to be paged in the middle of the night when the systems have a hiccup.  Who can blame them really?  This defensive mindset can be addressed by applying newer architectures and technologies that are tolerant of component failure – the automated deployment and designed to fail architectures.  Once it is demonstrated that a failure of a component is not a catastrophe, just one more expected event that has no immediate impact on the systems, the next logical step is to build processes that allow continuous incremental changes to the systems.  Encouraging a set of shared standards is a good way to develop DevOps processes across the organization.  For one enterprise this meant building a service catalog of standard images for the developers use with all the commonly used tools.  The developers given the option of using either a pre-built applications tools platform or building a custom one took the easier path.  Standard tools problem solved.

About the Author

Beth Cohen, Cloud Technology Partners, Inc.  Transforming Businesses with Cloud Solutions

You would think that cloud technology would have standardized long time ago.  While network standards that shape the Internet have been widely accepted throughout the industry, cloud standards have had a much slower adoption path.  Sadly the current state of cloud standards is, after 15 years, still far less mature than it ought to be.  As cloud infrastructure technology matures, increased interest by the enterprise and emerging vendors is driving a renewed effort to create viable standards that will benefit everyone.

For companies looking for integration and the capability to build hybrid clouds, various standards and proprietary and open APIs have been proposed to provide interoperability up and down the three layers of the cloud stack.  The first and so far only, cloud-oriented standard that has been ratified is the Open Virtualization Format (OVF), which was approved in September 2010 after three years of processing by the DMTF.  OVF’s open packaging and distribution format offers some platform independence by allowing migration between some platforms, but it does not provide all the tools needed for full cloud interoperability.

I think we can all agree that everyone benefits from technology standards in the long-term – the operative word is long-term.  You would think that everyone would agree that cloud infrastructure technology standards should be given high priority, but creating compelling proprietary systems and discouraging standards gives early adopter companies competitive advantage in the short-term.  Think about Amazon and VMware’s vast technology and market leads in the cloud services and enterprise infrastructure systems respectively.  They have little motivation to support any standards that have the potential to undercut their monopoly market positions.

Users of cloud are asking when will cloud computing standards mature enough so that more companies will feel comfortable implementing cloud architectures and using cloud services without feeling locked in.  Ironically, while the commercial cloud offerings have been growing, built on the very standards that created the Internet itself, Amazon and others have been reluctant to publish their architectures.  Application Programming Interfaces (API), which hide the underlying architecture, are all well and good, but they do not guaranty true interoperability.  Downstream vendors quickly find that they need to build API interfaces for all the different services they need to support; adding significantly to the development and maintenance costs.  To address this and transparently transfer workloads among the different vendor based on predefined business rules, there needs to be much more comprehensive standards.

One obvious question to ask is if there is an opportunity for the commercial cloud systems to become standards.  After all, there have been precedents where formerly proprietary formats, such as VMDK (Virtual Machine Disk) which was developed by VMware, have become de facto standards simply by being widely adopted by the industry.  One could even argue that platforms such as Amazon’s AWS are already standards.  However, as many companies have found to their chagrin, while it has a vast variety of services, easy to use tools, and a significant technological head start on the competition, it is more of a cloud world roach motel.  Lots of companies have found it easy to get applications running quickly, but changing providers or taking the applications back in-house as requirements change is fraught with unexpected perils.  Amazon’s backing of Eucalyptus does not address that problem directly, but it does offer a viable option for companies that want to build what Amazon euphemistically calls, on-premise services.

In conclusion, the good news is that the cloud industry is finally reaching consensus that the time to build cloud interoperability standards is long overdue.   The biggest need remains for interoperability standards to allow virtual machines to be migrated between clouds transparently and for more robust hybrid cloud solutions.  For the moment companies that want to use multiple platforms or a mix of public and private options are stuck with complex architectures and emerging orchestration tools such as enStratus and Rightscale to bridge the gap.

About the Author

Beth Cohen, Cloud Technology Partners, Inc.  Transforming Businesses with Cloud Solutions

Cloud Computing has already fundamentally changed the way consumers and small businesses use the Internet.  However, as with any new technology model there are going to be some hurdles to overcome before universal acceptance.  According to a 2010 Kelton Research survey of 537 IT and business executives, security concerns were the top reasons cited for not adopting cloud technology.  Two recent survey articles on cloud security offer some insights on the differences of opinion about cloud security within the cloud technology community.  While the two articles cover much of the same materials, Blumenthal’s Is Security Lost in the Clouds?, takes a considerably more pessimistic view of the ability of existing technology to address the problem than Bisong, A., & Rahman, S. M.in their Overview of the Security Concerns in Enterprise Cloud Computing.

Bisong and  Rahman suggest that if the cloud implementation properly follows IT industry best practices, securing the cloud is primarily a technical problem that can be easily addressed.  Their overall message is that cloud security is nothing to worry about and the existing technology and services are more than adequate for the task of protecting enterprise data in the cloud.  They spend relatively little time discussing how to quantify the many complexities of the legal, operational, business and technical risks of a cloud computing implementation.  They barely mention the problem of cloud ownership and who is responsible for maintaining the integrity and privacy of data in the cloud, concerns I have discussed extensively in the past. While there have been improvements in cloud security –the work of the Cloud Security Alliance is particularly noteworthy– there is still plenty of room for more innovation.  There must be a fundamental shift of thinking about cloud security before IT executive fears can be permanently assuaged

On the other end of the spectrum, Blumenthal is clearly more paranoid.  She postulates some additional threats unique to the cloud environment, such as clouds as hacker fronts she terms “hacking as a service” and clouds as havens for illegal activities.  She digs into not only the technical security issues, but she addresses the potential business risks by discussing the cloud strategy tradeoffs of giving up autonomy in return for lower costs and elasticity.  While she agrees that there are great advantages to moving enterprise applications to the cloud, she cautions the reader to note that once all the proper safe guards are implemented, the “apparent economic advantages of the public cloud” might well be eroded.  She advises the enterprise that is considering moving their IT applications into the cloud to fully analyze the risks and move carefully.

Figure 1: Diagram of Cloud Security Risks

In conclusion, network security people generally tend to be a paranoid group and both articles clearly spell out the many dangers inherent in moving the enterprise to public cloud architectures.  However, in comparing the two articles it is clear that Blumenthal is far more knowledgeable about not only the technical issues but the overall complexities of delivering secure enterprise cloud services that meet the business requirements for risk mitigation.  I would trust her conclusions that the inherent insecurity of cloud services has not been properly addressed by the community or the vendors yet.

About the Author

Beth Cohen, Cloud Technology Partners, Inc.  Moving companies’ IT services into the cloud the right way, the first time!

Previously I broached the idea of adding a new Software Development as a Service (SDaaS) layer to the commonly understood three tier cloud infrastructure architecture standard.  One of the transformational aspects of cloud computing is that it both integrates the entire IT stack so nicely, while at the same time allows vendors to slice it into very narrowly defined services.  That is both its great strength and its great weakness.  The advantage of this approach is that vendors are able to build deep expertise in a single knowledge area without having to worry about the underlying infrastructure.  On the other hand, one of the hidden pitfalls of the cloud is the difficult integration across the plethora of vertical services that have developed and the lack of specialized cloud development tools.  Now that cloud has become more widely accepted and more companies are interested in building customized applications in the cloud, it is time to define the SDaaS layer.  I envision SDaaS as set of cloud optimized development tools designed to allow companies to build new SaaS services and/or easily migrate existing applications into the cloud.

In my mind, SDaaS rightfully belongs placed solidly between the PaaS layer and the SaaS cloud layers.  It needs to be on top of the platform (PaaS) layer because modern software development tools and environments are should be independent of the operating system environment.  There is still room for improvement.  It is true that most applications do not depend on the platform that they run on, but that’s because they are thoroughly undemanding — not infrequently, because anything depending on sophisticated facility is done without.  Many applications which could make good use of 64 bit word-size where it exists, for example, do not because it requires complicated conditional coding.  Certainly things have improved.  The development of large standardized libraries that transparently support and extend various facilities available on all platforms has helped a lot.  Unicode, XML, XML based standards and other standards have done much to enable software to be independent of platform but it comes at a high cost

It should be that a Java library is a Java library regardless of whether it is on some flavor of Linux, Solaris or Windows.  Yes, underneath there is an operating system, but as any systems administrator can tell you, most developers have little awareness of the underlying platform; which is exactly how it should be!  We are not quite there yet, but abstracting the development tools will go a long way towards achieving that goal.

On the other hand, clearly, SDaaS should be placed below the SaaS layer because it supports the development of SaaS applications.  SaaS services as they have evolved are defined as applications that are multi-tenant, configurable, not customized, and have a subscription based pricing model.  The operative word is configurable user facing applications, not development environments.  The SDaaS layer would need to include standards and libraries that address the particular needs of the highly horizontally distributed applications and cloud infrastructure.

Until recently, most SaaS applications have been developed using standard web services tools, but as the cloud application business grows and the technology becomes more sophisticated, there is a need for a set of development tools that address the particularities the cloud.  With cloud elasticity and horizontal scalability in mind, SDaaS development tools need to have the following characteristics:

• More tools to support asynchronous transactions
• Transparent horizontal scaling capabilities
• Mechanisms to allow on-demand platform neutral delivery of services
• Baked in code security – we have been living with bolt-on application security for far too long.
• Support of applications in the run-time state to allow the creation of end-to-end development/test/production environments

What I am talking about is developing languages that would include functionality specifically for developing cloud software — not just libraries that provide classes to use the cloud and not XML schema that specify a semi-readable format for describing data or configuration.  These work, but they are clumsy and frequently baroque.  In thinking about what such a language would include, the most obvious thing that occurred to me was direct language support for async calls.

We are not starting completely from scratch.  Some services currently available meet my definition of a SDaaS system.  Microsoft Azure and other similar services, such as, AppEngine by Google and Force.com by Salesforce.com clearly are providing services and tools for building new applications and supporting existing software, but unlike SaaS (Software as a Service) these services are designed specifically to be used by developers.  In future weeks I will be drilling down into the currently available SDaaS offerings in more detail.

About the Author

Beth Cohen, Cloud Technology Partners, Inc.  Moving companies’ IT services into the cloud the right way, the first time!

Now that businesses are convinced that they should be moving at least some of their applications and systems to the Cloud, the next hurdle is determining not only how to migrate applications into the cloud, but more importantly, what types of functions to move.  There are some obvious answers, such as test/development, but best practices and standards are still emerging as companies continue to struggle with the definitions and the complexities of available Cloud services.  That process will continue for another few years.  In the meantime, some basic principles can be applied to any IT portfolio Cloud readiness assessment.  By focusing first on a review of the internal applications portfolio, rather than the available Cloud technology valuable insights can be gained about the right Cloud migration approach for your business.

At the 50,000 foot level, any organization needs to evaluate its existing IT portfolio and suitability for the Cloud in context of the organization using the following four criteria:

• Business – TCO (Total Cost of Ownership), ROI (Return on Investment) value to the organization
• Operations – Business processes and efficiency
• Technical – Maturity and ease of adoption
• Security – Access control, regulations, legal, risks and exposure

Business value and objectives should be the primary factor to apply, followed by the others as appropriate.  The relative priority of the other components is going to be driven by the specific industry requirements and organizational business model.  For example, a defense contractor is going to be far more concerned with security, then a manufacturing company, while a logistics company will focus on operational efficiency and partner integration.

These criteria can be further broken down into sub-categories and developed into standardized evaluation matrices and checklists for the Cloud decision.  To obtain a more meaningful outcome, evaluate a spectrum of applications, rather than looking at each application independently.  This common mistake often results in disjointed Cloud policies and SaaS island hotspots in the organization.  Even in a large enterprise with thousands of applications, looking at a sampling of just a few hundred applications can supply valuable governance and perspective to any transformational Cloud project.  By determining the internal IT portfolio priorities, the direction of how Cloud architectures fit into the overall IT strategy for the company.

Once the applications have been mapped against these criteria and a prioritized list of projects created, only then is it time to delve into a discussion about appropriate types of Cloud architectures.  As with anything in the business world, there are quite a few checklists available on the web. Unfortunately, the ones I have seen so far have been difficult to customize, far too complex and hard to customize.  Smart IT executives would benefit from using the services of a Cloud consulting company to help sort through the hype and create customized criteria.

About the Author

Beth Cohen, Cloud Technology Partners, Inc.  Moving companies’ IT services into the cloud the right way, the first time!