Cloud computing prompts new IT planning

Microsoft's announcement
this week that it will offer a new software development platform
for cloud computing added new energy to the debate over how and
when government agencies might begin turning to the technology.

Security concerns continue to fuel the belief that it will be
years before government agencies consider trusting their
information to remote, commercially operated data centers.

However, a variety of forces are accelerating strategy
considerations for agency information technology officials and
their contractors, according to cloud-computing experts at a
symposium in Washington Oct. 29.

One of those forces is the lure of potential cost savings. The
lower costs associated with large-scale, shared computing
infrastructure versus agencies contracting to upgrade or centralize
their own data centers are hard to ignore.

Another factor is the growing scale and credibility of cloud
computing operations run by Google, Amazon and Microsoft.

For agency IT leaders trying to plan for the future, the
challenge is assessing how cloud computing might mesh with existing
infrastructures, what types of information-processing activities
would be best suited to it, and what bandwidth and security
measures would be required to support it.

Agencies and organizations 'need to think about how cloud
computing will fit into their architecture,' said Ron
Markezich, corporate vice president of Microsoft Online.

One benefit of moving to cloud computing is that, by its nature,
it offers a more service-oriented approach to enterprise
architecture, said Dennis Quan, director of IBM's Software
Group.

Jeff Barr, senior Web services evangelist at Amazon, agreed.
'The cloud is really the opportunity to realize what the
[service-oriented architecture] vision is meant to be,' he
said.

Drew Cohen, a vice president at Booz Allen Hamilton, which
sponsored the symposium, said the path to cloud computing will take
time and experimentation.

'We have a series of [mini cloud] pilots going on to
understand what these offerings are,' Cohen said. The testers
concluded that the approach still involves extra work on top of existing systems, but it is a vital way
to get buy-in for larger tests.

In a survey of 20 to 30 of its partners, Booz Allen concluded
that organizations also need to begin testing at least one
mission-critical system in the cloud, he said.

Understanding the economics

As organizations begin considering cloud computing, most tend to
think in terms of testing private clouds.

But Mike Bradshaw, president of Google Federal, said,
'When you start building private clouds, you lose the
efficiency' and the common engineering benefits that come
with large-scale Internet-based computing systems.

Cloud computing is cost-effective for customers of Google and
Amazon because the companies have already invested ' and
continue to invest ' enormous sums to support their core
computing operations, he said.

Bradshaw said Google is now the world's fourth largest
server manufacturer, with vast numbers of servers assembled and
attached with Velcro so they can be easily installed and
replaced.

'Once people start looking at their own cloud,
they're willing to pay more for it,' he said, but the
costs associated with maintaining private clouds begin to outweigh
the benefits.

On the other hand, he said, 'it's easy to start
experimenting where you are just putting information out there for
people to look at.'

Security risks

Another central facet of the cloud-computing debate is whether
computing via the Internet is more prone to security risks or can
actually offer greater assurance.

'We're running at such a large scale that it's
a life-or-death issue for us,' said Amazon's Jeff Barr. Everyone who has
bought something through Amazon has put his or her personal
information out in the cloud, he added.

The incentive for cloud providers is to get security to the
point where customers are as willing to use their services as they
are to trust their payroll information to ADT, he said.

'The economies of scale and the level of technical
investment that you need to make' tend to ensure that a
'cloud provider will have the investment and skills to do
[security] better than most,' Barr said.

Cohen said it's harder for hackers to get to the
technology that supports cloud computing, adding that Google checks
every transaction twice for potential problems.

Organizations with tens of thousands of employees often face
worse vulnerabilities on their own systems, where patch management
and other enterprisewide security measures remain a constant
challenge, Farber added.

Nevertheless, concerns about where data resides remain a huge
obstacle to cloud computing.

Markezich said Microsoft keeps all government data in the United
States and has a third party audit its security controls. In
addition, he said, Microsoft is building in encryption for data at
rest so customers have the only keys to their data.

'If I was going to advise our [chief information officer],
I'd tell him, 'Look at what the students are
doing,'' said Michael Nelson, visiting professor of
Internet studies at Georgetown University and a technology adviser
to Barack Obama's presidential campaign.

Constrained by 100M accounts, Georgetown students had begun to
abandon the university's e-mail system, forwarding accounts
to Web-based Gmail and MSN Live instead.

The university's solution is indicative of what many
organizations are likely to consider in the near future. 'We
just recently facilitated e-mail in the cloud,' Nelson
said.