I love it when visionaries bridge the gaps in their utopian depictions of The Future of IT with hand-waving explanations. As a supposed said visionary, I plead guilty. My most recent transgression: presenting the concept of “policy” in the context of data centers, workloads, etc., as if it were well understood and its supporting technologies mature enough for market adoption.
In spinning our tales of how great life will be when we finally complete this transformation rather appropriately (due to the ambiguities involved) labeled “cloud,” we realize we can’t tell a convincing story without the Policy character. He’s like the Sherriff in the Wild West – without him enforcing The Law, it’s just too dangerous a place for normal, everyday people.
Why do I believe policy is a gating factor for accelerating cloud adoption?
Although it is the favorite analogy of cloud evangelists, electric service is not the same as compute-as-a-service. Unlike the power company, which sends indistinguishable electrons into your home or business and eventually into the ground, cloud computing services require that data and intents to act upon it move across that boundary. And data is quite distinguishable, valuable, even dangerous in the wrong hands.
And that’s why policy is not simply “important” – it is essential to the success of cloud computing. Data and data access must be managed in a controlled manner, and cloud consumers will need guarantees to that effect. Policy is the mechanism by which the degree and type of control is specified. Policy enforcement ensures those controls are observed.
Easy. (Did you feel the rush of air on your cheek?) Seriously, although much progress has been made to begin to express and implement policies in IT systems, it is a largely manual error-prone process. Still, some technologies are beginning to emerge that give us a bit of hope we can really solve the problem.
But that’s only the first chapter of a longer story in which the right kinds of policies must be crafted in order to meet the intended objectives. That’s the poster child use case for policy – compliance. In future posts I’ll discuss how policy and automation are mutually dependent, and how together they will help us achieve policy enforcement and compliance objectives in tomorrow’s virtual data centers.
