In a recent Forbes article entitled, “The Cloud Revolution and Creative Destruction,” Oracle’s Bob Evans put cloud computing in perspective (my emphasis added):

We’ll begin to see the real the real creative-destruction power of the cloud unleashed when we begin to define the cloud in terms of what business customers want and need, and when we stop diddling around with inside-baseball constructs that mean little or nothing to the businesspeople who are ready to spend many tens of billions of dollars on cloud solutions that focus on and deliver business value. .. 

That’s the real magic of the cloud: it lets businesses rethink where and how they deploy their precious IT dollars, and allows those businesses to focus more of their IT budgets on projects that truly matter.

Business value.  Focusing here makes cloud computing worthwhile.

When I was in 7th grade, I played the trombone in the Gooding, Idaho, Jr. High band – or at least tried to play it.  Once, we participated in a music festival where I played a solo rendition of the soaring anthem, “Jerusalem,” in front of a judge.  When I finished the piece, she remarked, “the trombone can be a beautiful instrument.”  I was devastated of course, and was somewhat relieved to hang up my trombone, so to speak, when we moved to a tiny town without a band the next year.

I was reminded of that incident this morning when I read a Mashable article, “Top 5 Misconceptions about the Cloud,” sponsored by Western Digital.  The fifth “misconception” was “You Can’t Beef Up Security on the Cloud.”  In my mind’s eye, I could almost see my trombone judge saying, “The cloud can be a secure place.”

So what’s the problem?  Much like a 7th grader’s ill-conceived belief that he could impress a judge with little practice and poor technique, the article’s overly simplistic recommendation for bolstering cloud security was “You can use behavior-based key management servers and encryption key management to give your files an extra layer of protection.”

Cloud security entails much, much more than that.

I can accept that cloud based solutions can be well-secured, but we must not be complacent or expect great results with little effort.

This should be an timely and relevant webcast for those of us involved with information security: “Key Fraud and Security Considerations for Confidence in the Cloud.” It will be held Tuesday, January 17, 2012 at 10 a.m. PST.

This executive panel webcast will explore how leading IT organizations are moving to the cloud with confidence. The following items will be addressed:

• Maintain control of your data across multiple on-premise and cloud environments
• Evaluate cloud providers to meet your specific requirements for security and risk management
• Apply authentication and identity management solutions and expertise from the online banking industry for improved protection and fraud mitigation

The fearless Oracle Identity Players are back on You Tube with their own perspective on Identity for the Cloud.

You can see these same players in previous posts “Learn your Password … or Else!” and “Audit Eye“.

Enjoy!

In the past few days, I became aware of innovations at Amazon Web Services that show how AWS continues to lead the industry in cloud computing.

The first product offering is the addition of Identity Federation to AWS Identity and Access Management Services, which gives customers:

the ability for you to use your existing corporate identities to grant secure and direct access to AWS resources without creating a new AWS identity for those users. This capability enables you to programmatically request security credentials, with configurable expiration and permissions, that grant your corporate identities access to AWS APIs and resources controlled by your business.

The second offering, “AWS GovCloud,” offers:

a new AWS Region designed to allow U.S. government agencies and contractors to move more sensitive workloads into the cloud by addressing their specific regulatory and compliance requirements.

I find it intriguing that the same company that pioneered the industries of online book retailing and ebooks, is so innovative in cloud services and Identity Management.  Plus, I was able to order an new cordless drill from the comfort of my hotel room in San Mateo last night!  Thanks to Amazon and UPS, I think the drill will arrive Arizona before I do this week.

Cloudbook.net is not just an attractive website and rich repository of information.  It is a community dedicated to cloud computing:

Cloudbook was founded to help accelerate the adoption of cloud computing by providing a comprehensive and educational resource community. Cloudbook brings together top thought leaders, experts and specialists to share their insights and experiences with the broader public. Their contributions are indexed into a comprehensive resource directory that is easy to navigate and allows users to familiarize and connect with the authors.

Cloudbook has also compiled a number of additional resources including events, products & services, research projects, news articles and more to deliver a complete resource for the community.

This evening I registered on the site and applied to be a contributor.  We’ll see what they say!

The new word I added to my vocabulary today is “Frenemies,” proposed in an interesting TechCrunch article, “Competing In The Cloud—Let’s Be Frenemies,” authored by Prasad Thammineni, CEO and Co-Founder of OfficeDrop, a scanner software and digital filing system. Prasad sets the stage by saying:

Competition between software companies used to mean safeguarding your code and suing anyone that came close to it. Today, many larger technology companies are adopting a different strategy of actually bringing new users to companies they would have tried to squash a decade ago. The cloud is changing the old-school software mentality that a customer’s data needs to be locked down—giving rise to a new ecosystem where everything interoperates. So companies that in the past would have been bitter enemies are now working together as pseudo-friends—“frenemies, ” if you will.
…

Proprietary, closed systems are being replaced with interconnected services that let the user’s data flow. Earlier this year, the Washington Post pointed to a new era of collaboration amongst software giants like Google and Microsoft, and cited the revolving door of talent in the Valley as a key driver in this cooperation.

So, how do we compete in this new world? Prasad recommends three things:

1. do something better than anyone else
2. make it easy for others to add on services to your own and
3. make it work with the platforms that your ideal customers are already using—even if what they’re using seems quasi-competitive to your own product

Good advice, I think, for all of us who are connected in cyberspace. I think I’d rather be friends with you than enemies, but I do like this new word, “Frenemies.”   It seems much more on-line and in the clouds than the old-school “coopetition” that has bounced around the business vernacular for years.

My cyberspace friend André Koot recently translated his provocative blog post, entitled “Continuity as a Service,” from Dutch to English.  If you are interested in cloud computing, I highly recommend that you take time to read the article.

I like André’s comment about cloud computing in general:

The cloud reminds me of that old Blob, the science fiction movie, cloud is becoming so pervasive that it seems to take control of everything. And just admit it, we find that exciting, scary and fun at the same time. But if everything disappears in the fog, how do we know that business is as usual?

We all know that cloud computing has new risks and challenges.  But one risk that is often overlooked is business continuity:

Most risks are well known. Using standard operating procedures, access control and audits we can identify and mitigate problems relatively easy. And already there is a lot of information about security in the cloud. But one area of risk is not yet completely clear, the risks of business continuity.

Although new legal relationships are essential, they certainly don’t solve everything.

But the core of the AAS problem is that contract partners are not always the parties who offers the actual service. You can try to mitigate risks in contracts, but the fact of the matter is that you want to move to the cloud, because of the positive price / performance ratio of multi-tenancy and the (re) use of standard applications. Long term subcontractor relations in the real world don’t exits in the Cloud. If one platform provider is too expensive, our service provider just moves to another. This means that we are victims of the arbitrariness of our providers.

André  goes on to explore several situations that should be carefully considered:

• What happens if the SAAS provider goes away?
• Is “Cloud Escrow as a Service” a valid concept?
• What happens if the PAAS provider underneath the SAAS provider goes away?
• What measures should you take now so you can endure a cloud failure?

André’s parting comments are certain timely:

The uncertainty surrounding continuity is high at this moment. The question is whether for business-critical applications sensible solutions in the cloud exist today. An assessment around the continuity and security risks and safeguards in place seems to be appropriate.

Amazon’s recent challenges certainly focused our collective attention on this important subject. In order for the challenges related to business continuity in cloud computing to be solved, there is much work to be done.

By the way, I thought the photo of a life preserver in the clouds was very appropriate for this post. It came from a blog post about business continuity by Maurice Saluan, VP-Channel Management for Zenith Infotech, a company heavily involved in cloud computing and business continuity.

Besides the punny article title, Computerworld’s Lucas Mearian offered a provocative opening line in his article, “What happens to data when your cloud provider evaporates?“

Over the past year, four cloud storage service providers have said they’re shutting down and Amazon’s cloud services have been problematic since Thursday.

Does that scare you away from Cloud Computing? What does a company do if its cloud storage provider goes out of business?

Currently, there’s no way for a cloud storage service provider to directly migrate customer data to another provider. If a service goes down, the hosting company must return the data to its customer, who then must find another provider or revert back to storing it locally, according to Arun Taneja, principal analyst at The Taneja Group.

Is help on the way?

The Storage Networking Industry Association’s Technical Work Group is developing an API called the Cloud Data Management Interface that would allow providers to migrate customer data from one vendor’s cloud to the next — a move aimed at alleviating vendor lock-in.

That API, if adopted by the industry, will become more important over the next several years as nearly three out of four cloud storage companies that cropped up in recent years whither and die, according to Taneja.

It seems that the Amazon cloud troubles has caused a fair bit of introspection into the cloud services industry. Given the unabashed hysteria about cloud computing in the past several months, I think deep instrospection is very healthy.

As failures in Amazon’s Cloud Services (reported by Data Center Knowledge) extend into a second day, multiple companies are feeling the pain:

Among the most prominent companies affected were Foursquare, Quora, Hootsuite, SCVNGR, Heroku, Reddit and Wildfire, though hundreds of other companies big and small were affected. Luckily, one of Amazon’s most prominent customers, Netflix, didn’t experience problems because it’s built for the loss of an entire data center, while companies relying on Amazon’s four other global data centers didn’t experience too many issues. (from Mashable)

I suppose the first lesson we learn is that if you bet your business on the cloud, your fortunes are tied to that cloud.  Consider Foursquare’s announcement:

Even though they pointed out that Amazon EC2 was to blame, it was Foursquare’s reputation that took the first hit.

The second lesson?  Don’t be deceived by lots of good news.  All the green checkmarks on Amazon’s history dashboard mean little if you are affected by the red outage symbols:

The third lesson?  Cloud computing is not a panacea.  With all its promises, we must also consider its vulnerabilities.  Technology does break down.  We must be prepared for that inevitability.  Disaster recovery and business continuity principles still apply.