J. CRAIG LOWERY, PH.D.

Part 1 – The False Sense of Physical Security

As is often the case when new paradigms are advanced, cloud computing as a viable method for sourcing information technology resources has met with many criticisms, ranging from doubts about the basic suitability for enterprise applications, to warnings that “pay-as-you-go” models harbor unacceptable hidden costs when used at scale.  But perhaps the most widespread and difficult to repudiate is the notion that the cloud model is inherently less secure than traditional data center models.

It is easy to understand why some take the position that cloud is unsuitable, or at the least very difficult to harness for conducting secure business operations.  Traditional security depends heavily on the fortress concept, one that is ingrained in us as a species: We have a long history of securing physical spaces with brick walls, barbed wire fences, moats, and castles.  Security practice has long advocated placing IT resources inside highly controlled spaces, with perimeter defenses as the first and sometimes only obstacle to would-be attacks.  Best practice teaches the “onion model,” a direct application of the defense in depth concept, where there are castles within brick walls within barbed-wire fences, creating multiple layers of protection for the crown jewels at the center, as shown in Figure A below.  This model is appealing because it is natural to assume that if we place our servers and disk drives inside a fenced-in facility on gated property with access controlled doors and locked equipment racks (i.e., a modern data center), then they are most secure.  The fact that we have physical control over the infrastructures translates automatically to a sense that the applications and data that they contain are protected.  Similarly, when those same applications and data are placed on infrastructure we can’t see, touch, or control at the lowest level, we question just how secure they really can be. This requires more faith in the cloud service provider than most are able to muster.

But the advent of the commercial Internet resulted in exponential growth of the adoption of networking services, and, today, Internet connectivity is an absolute “must have” for nearly all computing applications, not the novelty it was 20 years ago.  The degree of required connectivity is such that most organizations can no longer keep up with requested changes in firewalls and access policies. The result is a less agile, less competitive business encumbered by unwieldy nested perimeter-based security systems, as shown in Figure A above. Even when implemented correctly, those traditional security measures often fail because the perimeter defenses cannot possibly anticipate all the ways that applications on either side of the Internet demarcation may interact.

The implication is that applications must now be written without assumptions about or dependencies upon the security profile of a broader execution environment.  One can’t simply assume the hosting environment is secure, although that is still quite important, but for different reasons.  More on this line of thinking, and the explanation of Figure B and why it is more desirable in the cloud era, in my next post.

We once had a unified vision of how cloud would be adopted by the average enterprise.   With all the uncertainty around security, cost and performance of public cloud, they would naturally transform their private data centers into private clouds. Once successful in that incremental transition, they would be more comfortable with extending to the public cloud, resulting in the Holy Grail – a hybrid deployment.

We were only half right.

As events have unfolded, we see that hybrid clouds are indeed the desired outcome. However, the way-points on that journey are, for a number of cloud adoption profiles, reversed from what we had predicted. Instead of first stopping at private cloud, many skipped it entirely and went to using public cloud in spite of their own previously voiced objections. Why?

For all but the larger enterprises and the very capable mid-market IT organizations, a private cloud has often been too difficult to build and maintain. The technology existed, but it was far from turnkey. In the face of the challenging business and operational transformations that cloud demands, this was too distracting and unnecessary: public cloud was sitting there, gleamingly simple and ready-to-use without the burdens of operational hassles.

So, for these “I need it to be as easy as possible” cloud adopters, the pendulum largely bypassed private and swung to public. But will it stay there?

The costs of public cloud are tricky to pin down and manage. You are paying a premium for someone else to handle the headaches. For many projects this makes sense. For long-running activities that don’t take advantage of public cloud’s scale and global reach, you will likely pay more than is necessary.

The chickens, as they say, will come home to roost. The true cost of public cloud will become apparent, and the advantages of private cloud more compelling for the mid-market. The pendulum will return, and when it does, we’ll have evolved private cloud technologies to make them suitable for organizations looking for an appliance-like experience instead of building an IT practice around them.

But what if we’re wrong again? Regardless of how that pendulum swings, having choices and management capabilities that span multiple clouds (public, private, whatever) ensures you’ll be able to keep cost and utility in balance. The trick is to invest in tools and technologies that enable that choice;  buy and design software that is infrastructure-agnostic, dependent only upon abstracted network services of which analogs are available from many providers. That way, whether it’s now or in the future, when you’re ready for private cloud (or it is ready for you), you’ll be in a position to further expand your selection of cloud targets by adding your own.

I love it when visionaries bridge the gaps in their utopian depictions of The Future of IT with hand-waving explanations.  As a supposed said visionary, I plead guilty.  My most recent transgression: presenting the concept of “policy” in the context of data centers, workloads, etc., as if it were well understood and its supporting technologies mature enough for market adoption.

In spinning our tales of how great life will be when we finally complete this transformation rather appropriately (due to the ambiguities involved) labeled “cloud,” we realize we can’t tell a convincing story without the Policy character.  He’s like the Sherriff in the Wild West – without him enforcing The Law, it’s just too dangerous a place for normal, everyday people.

Why do I believe policy is a gating factor for accelerating cloud adoption?

Although it is the favorite analogy of cloud evangelists, electric service is not the same as compute-as-a-service.  Unlike the power company, which sends indistinguishable electrons into your home or business and eventually into the ground, cloud computing services require that data and intents to act upon it move across that boundary.  And data is quite distinguishable, valuable, even dangerous in the wrong hands.

And that’s why policy is not simply “important” – it is essential to the success of cloud computing. Data and data access must be managed in a controlled manner, and cloud consumers will need guarantees to that effect.  Policy is the mechanism by which the degree and type of control is specified.  Policy enforcement ensures those controls are observed.

Easy. (Did you feel the rush of air on your cheek?)  Seriously, although much progress has been made to begin to express and implement policies in IT systems, it is a largely manual error-prone process.  Still, some technologies are beginning to emerge that give us a bit of hope we can really solve the problem.

But that’s only the first chapter of a longer story in which the right kinds of policies must be crafted in order to meet the intended objectives.  That’s the poster child use case for policy – compliance.  In future posts I’ll discuss how policy and automation are mutually dependent, and how together they will help us achieve policy enforcement and compliance objectives in tomorrow’s virtual data centers.

The idea that public cloud computing is cheaper than traditional forms of IT staging, such as on-premises data center and co-location, may have had legs in the early days of cloud’s buzz, but the truth has finally been widely recognized: cloud computing isn’t at face value cheap, or cheaper, than what we’ve been doing up until now.

If that’s the case, then why is cloud catching on?  Isn’t the ultimate goal to lower cost and boost the bottom line, regardless of one’s business?

The effects of moving to the cloud have a much broader impact than simply relocating one’s IT assets to an alternative hosting arrangement.  I think of it in much the same way that the value proposition of virtualization has been slowly, but fully realized over the years.

In its early days, x86 virtualization was seen purely as a means of improving hardware utilization by increasing the application-to-box ratio.  “Consolidation” was the easy win, and it appeared to lower IT expenses because it reduced the hardware budget.

But time revealed that virtualization has a hidden price associated with increased management cost, the most famous being “VM sprawl.”  But by the time this became apparent, the really valuable capabilities of virtualizaton began to take center stage: live migration, rapid deployment, portability of workloads, dynamic resource allocation. Roll them into one term, “flexibility”, and you see why there is more value to virtualization than just bottom line IT costs – it enables the overall business in new ways that were not possible or practical before.

Cloud computing is entering that phase of public awareness where its true benefits are being appreciated. The flexibility ascribed to virtualization also applies to cloud.  But there are others, such as: disaster recovery, capacity on demand, carrier-grade reliability, expense-structured payment, and global reach. The value of these are not reflected in the bottom-line cost of the monthly bill.  They are woven into the business’s new abilities related to agility and simplicity.

So the old rule holds true: only things that improve the bottom line will survive in the B2B marketplace. Cloud computing obeys that law by bringing new value to the table in ways not possible prior to its advent.  Although we’re still learning how to exploit these new capabilities, and to quantify their considerable untapped benefit, there’s no doubt the value is there, and worth the additional cost.