Tuesday, August 18, 2009

BriefingsDirect Analysts Discuss Software AG-IDS Scheer Acquisition and Prospects for Google Chrome OS

Edited transcript of BriefingsDirect Analyst Insights Edition podcast, Vol. 44 on Software AG's acquisition of IDS Scheer and the implications of the Google Chrome operating system.

Download the transcript. Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Charter Sponsor: Active Endpoints. Also sponsored by TIBCO Software.

Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.

Take the BriefingsDirect middleware/ESB survey now.

Dana Gardner: Hello and welcome to the latest BriefingsDirect Analyst Insights Edition, Volume 44. I'm your host and moderator Dana Gardner, principal analyst at Interarbor Solutions.

This periodic discussion and dissection of IT infrastructure related news and events, with a panel of industry analysts, comes to you with the help of our charter sponsor, Active Endpoints, maker of the ActiveVOS visual orchestration system, and through the support of TIBCO Software.

Our topic this week on BriefingsDirect Analyst Insights Edition, and it is the week of July 13, 2009, centers on Software AG's bid to acquire IDS Scheer for about $320 million. We'll look into why this could be a big business process management (BPM) deal, not only for Software AG, but also for the service-oriented architecture (SOA) competitive landscape that is fast moving, as we saw from Oracle's recent acquisition of Sun Microsystems.

Another topic for our panel this week is the seemingly inevitable trend toward Web oriented architecture (WOA), most notably supported by Google's announcement of the Google Chrome operating system (OS).

Will the popularity of devices like netbooks and smartphones accelerate the obsolescence of full-fledged fat clients, and what can Google hope to do further to move the market away from powerhouse Microsoft? Who is the David and who is the Goliath in this transition from software plus services to software for services?

Here to help us better understand Software AG's latest acquisition bid and the impact of the Google Chrome OS are our analysts this week. We are here with Jim Kobielus, senior analyst at Forrester Research. Hi, Jim.

Jim Kobielus: Hey, Dana. Hello, everybody.

Gardner: Tony Baer, senior analyst at Ovum.

Tony Baer: Hey, Dana, good to join you again.

Gardner: Brad Shimmin, principal analyst at Current Analysis.

Brad Shimmin: Hi there, Dana, and hi, everyone out there.

Gardner: Jason Bloomberg, managing partner at ZapThink.

Jason Bloomberg: Good morning, everybody.

Gardner: JP Morgenthal, independent analyst and IT consultant.

JP Morgenthal: Hey Dana, and for you fellow people, that's @JPMorgenthal for you.

Gardner: There you go. Also, Joe McKendrick, independent analyst and ZDNet and SOA blogger. Welcome, Joe.

Joe McKendrick: Hi, Dana, glad to be here.

Gardner: Let's start on the whole Software AG bid. JP, I just learned this morning that you were an architect there at IDS Scheer. Tell us a little bit about why you think this is a big deal.

Morgenthal: No, I wasn't at IDS. I was at Software AG. I was there prior to the webMethods acquisition.

Gardner: Yes. My mistake. Sorry.

Morgenthal: No problem. It's really interesting. When we first started thinking about building out a SOA platform and making Tamino the heart of it, the metadata repository, it was one of the key applications we saw for Tamino in a SOA platform. I actually was looking for different metadata partners.

I looked at IDS Scheer back then and that's what they were sowing a while back, so I had lost track of them and come back to find that now they're driving the whole concept of business process design, which is really interesting.

It seems that the general consensus on the acquisition, though, seems to be focused heavily on their association with SAP, and that the move seems to be driven by more of a business relationship than a technical relationship. If you look at the platforms, there is some overlap between the webMethods platform and the ARIS platform.

So, it would make sense that, if they were going after something, it wouldn't be just more design functionality. There has to be something deeper there for them to grow that business even larger, and certainly SAP is a good target for going after more additional business.

Gardner: So, is this an acknowledgment that SAP needs a SOA partner and that this is Software AG's move on the dance floor to sort of step up the music a bit?

Morgenthal: SAP probably doesn't believe that they need an SOA partner, but I think that the fish are starting to nip around the outer boundaries. SAP customers are to the point now, where they are looking for something more immediate, and obviously the redevelopment of SAP as a complete SOA architecture is a long-term endeavor.

So, how do you start moving there in an incremental fashion? A lot of SOA platform vendors are starting to identify that there is a place for them on the outer edges, until SAP gets to make its full transformation.

Gardner: Hey, Jim Kobielus, do you agree that this is more than just a technology acquisition? What do you think? Does SAP need a SOA dance partner?

Kobielus: Does Software AG?

Gardner: No, SAP, and that Software AG is perhaps an intermediary step.

Kobielus: Wow, that's an interesting question. Honestly, I don't think SAP needs another dance partner here. Let's say, hypothetically SAP acquired Software AG. What could Software AG with IDS Scheer on board offer SAP that they don't already have? There is the BPM. There is the enterprise application integration (EAI). I don't really see anything obvious.

Gardner: JP, help him out. Why did you make that statement?

Feeding at the outer edge

Morgenthal: Well, I made the statement that the groups, like the combined effort of a Software AG with webMethods and IDS Scheer actually becomes one of the feeders on the outer edges of the SAP market. While SAP is in its cocoon, it needs to turn from caterpillar into SOA butterfly, and heaven knows whether that will actually survive that transformation.

There are a lot of SOA platforms starting to eat at the outer edges of the cocoon, feeding off of that, and hoping the transformation either fails or that there will be a place for them when the SOA butterfly emerges.

Kobielus: I don't think that necessarily Software AG would be a good fit for SAP. There are a lot of redundancies. I don't think that this notion of a Teutonic hegemony has legs here.

What's really interesting here is that, clearly Software AG is on a tear now to build up their whole

I think it goes both ways. You can't separate the technology from the strategic implications of this deal

SOA stack. I blogged on this under Forrester. People didn't realize that IDS Scheer is actually now a business intelligence (BI) vendor. They've got a self-service mashup BI product called ARIS MashZone, in addition to the complex event processing (CEP) product and an in-memory analytics product.

IDS Scheer, prior to this acquisition, has been increasingly positioning themselves in the new generation of BI solutions. That's been the one area where Software AG/webMethods has been deficient, from my point of view. In these SOA wars, they're lacking any strong BI or CEP capabilities.

Now, IDS Scheer, their BI, their CEP, and their in-memory analytics is all tied to business activity monitoring (BAM), and all tied to BPM. So, it's not clear whether or when Software AG, with IDS Scheer on board, might start turning all of that technology or adapting it to be more of a general purpose BI CEP capability. But, you know what, if they choose to do that, I think they've got some very strong technologies to build upon.

Gardner: Tony Baer, how do you come down on this technology, filling in the cracks, as Jim Kobielus believes, or the larger strategic implication that JP was alluding to?

Baer: I think it goes both ways. You can't separate the technology from the strategic implications of this deal.

For one thing, I don't think SAP itself thinks it needs a partner, in that, through NetWeaver, it has tried to control the middle tier in addition to the application tier, but they've not been that humongously successful in the market.

The other thing is that, yes, they have essentially defined an architecture for exposing their processes as services. They keep changing the names of it, so I forget what the latest acronym for it is. But, from the SAP standpoint what they lack is SOA governance. They lack a lifecycle there. SAP has always been very much around its own internal governance, and that's been a really interesting omission.

Other dimensions

More broadly, there are other dimensions to this deal, which is that Software AG's webMethods business gets a much deeper process-modeling path. I don't know how redundant it is with the existing modeling. I don't think there are many BPM modeling languages that are deeper than ARIS, and that's selling pretty awesomely. As a matter of fact, you can look at Oracle, which uses it as one of the paths to modeling business process, along with the technology they picked up from BEA.

Gardner: So what's the theory there, Tony, that the tool and its popularity will drag in some more on the infrastructure side?

Baer: For Software AG, what it’s going to drag in is immediate access to the SAP base, and that's huge. It also basically lays down a gauntlet to IBM and Oracle, especially Oracle, which has an OEM agreement. All of a sudden they have an OEM agreement with a major rival, as they're trying to ramp up their fusion middleware business in their SOA governance story.

Gardner: There is a lot of that going on nowadays.

Baer: Oh heck, yes, and so I see this as being incredibly disruptive, and I think a very smart move for Software AG.

Gardner: Let's go to Brad Shimmin. It seems like we've got some jockeying going on, and there aren't really too many mid-tier SOA infrastructure players left that these other behemoths can play chess with, their little pawns that they can move in front of their other players and play one OEM's agreement deal off of another, as they all try to come up with the total stack. What's your perspective, Brad? Are we almost at the end of the SOA consolidation process?

Shimmin: I don't think so. When you look at the big players, just as you said there, Dana, with their little OEM games -- reindeer games -- that get played, those are becoming less and less of an issue.

Look to the governance. About two years ago, most of the vendors are OEM. That certainly has turned around, such that these vendors, the big players we're talking about here, are very much providing in-house stacks. That speaks to what Tony and JP have been saying about getting some governance and SAP and getting better middleware and SAP customers. That's why I think this is such a big deal, and, as Tony was saying, why it's so disruptive.

It's not just that they have a fuller stack now, but there is a more complete stack for SAP customers. NetWeaver has been hanging in there. SAP definitely thinks it is middleware, but then why else would there be so many players on the outside, providing integration services for SAP applications running on not NetWeaver

But, back to your question about the smaller players, Dana, it seems like it's now a class society, where you have the big players -- the IBMs, Oracle, SAPs, and now Software AGs of the world -- and then you have the rogue players in these open-source space that are coming up, that have room to play.

We're talking about the Red Hats, the -- I'm blanking on the others here. There are probably three or four software vendors out there that are playing just in the open-source middleware space that has a great player like WSO2. Another one that's really good is MuleSource, although they're kind of limited.

Bifurcated environment

The point is that, when you have this really bifurcated environment, it gives you fewer acquisitions and more competition, and that's what's going to be great for the industry. I don't see this as leading to further consolidation at the top end. It's going to be more activity on the bottom end.

Gardner: Jason Bloomberg, isn't there no small dose of irony that the SOA landscape is being driven by folks trying to do it all? I thought the whole notion of SOA was being able to include more players and more components to interact and interoperate. What's going on?

Bloomberg: That's a important point to bring up. This IDS Scheer announcement really doesn't have anything to do with SOA. That is surprising, in a way, but also consistent with some of the fundamental disconnect we see within Software AG, between the integration folks on one hand and the BPM folks on the other.

There are some people within Software AG, typically the CentraSite team, Miko Matsumura and his strategy team, who really understand the connection between SOA and BPM. But, for the most part, basically the old guard, the German staff, just doesn't see the connection.

This fundamentally confuses the marketplace, because you have the integration-centric SOA

Whoever wrote the press release doesn't even understand that SOA is architecture. It makes you wonder where the disconnect is.

message out of Software AG. You have the metadata-driven CentraSite message that tries to pull it together, but doesn't have a dominant position within the context of the Software AG marketing. Then, you have the BPM folks, who just don't understand that SOA has anything at all to do with BPM.

If you read the 'BPM For Dummies Book' that Software AG put together, for example, they don't even understand that SOA has any connection to BPM. Software AG released a press release a few weeks ago that described SOA as a technology. Whoever wrote the press release doesn't even understand that SOA is architecture. It makes you wonder where the disconnect is.

With the IDS Scheer acquisition, if you read through what Software AG is saying about this, they're not connecting it with their SOA story. This is part of their BPM story. This is a way for them to build their vertical BPM expertise. That's the missing piece.

They have this BPM capability that they got from webMethods, and there is some Fujitsu technology in there as well. Poor Fujitsu, I guess, is the odd one out on this one. Software AG is looking to add some vertical capabilities, but because they're not tying it with the SOA story, they run the risk of continuing to be the outlier player, when it comes time to compete against Oracle and IBM.

They don't understand

Kobielus: Let me butt in a second, because in Forrester we've been discussing this. We don't think that Software AG understands fully who they are acquiring, because they don't really fully understand what IDS Scheer has on the SOA side. They don't understand the BI and CEP stuff.

So, I agree wholeheartedly with what Jason is saying. They're acquiring them just for the BPM, but that really in many ways really understates what IDS Scheer potentially can offer Software AG.

Bloomberg: Yeah, that's a good point. It's worth highlighting that IDS Scheer does have some pretty solid SOA capabilities within the context of their BPM focus.

Now the question is what Software AG will do with that part of the story. Will it get lost in the shuffle or will it really be integrated into the overall SOA stack in a way that enables them to have a better process-driven SOA story?

That's going to be a challenge for them, because that involves some shifting of thinking, not

They're acquiring them just for the BPM, but that really in many ways really understates what IDS Scheer potentially can offer Software AG.

across the whole organization, but within this sort of old guard Software AG folks who have been resistant to this part of the story.

Morgenthal: Just to add a little more fodder, if I haven't lost track of who's who in Software AG, isn't the person who ran this acquisition Dr. Kürpick, if I have that name right. Didn't he come out of SAP, and isn't he more focused on the business process end of things than the SOA end of things?

Bloomberg: Who wants to chime in on that one?

Kobielus: It is Kürpick, but I don't know what his background is.

Morgenthal: I believe he came out of SAP, and I believe his background is on integration and BPM.

Gardner: So, JP, to your point, we seem to have a mixed understanding of whether BPM is the source or a larger infrastructure benefit. I think you were making the point that the BPM could be perhaps a point on the arrow. If you've got your tool embedded, if you've got business process expertise, and you are moving down the stack from the process level, that that could be something that would drag in other aspects of a SOA environment.

Morgenthal: This is funny, because this keeps coming up over and over. Early on, I used to work with BrainStorm Group on their SOA BPM shows, and, at the height, the BPM show got up to like 600 people. I was doing the SOA side of the story in the track.

Driving the business

At the breaks, I would go talk to these people, and the BPM people would all look at me like I was talking another language, and say, "I don't deal with that." These are people who were doing BPM initiatives in their organization, they were like, "That's for the IT guys. I'm the business." So, time and time again, I found out that the BPM people were the ones driving the business.

Now, the number of people who have been attending BPM conferences has been dropping significantly, saying basically that if training went out to the business people, the business people are doing the business analysis. They are using the BPM tools like IDS Scheer more than webMethods, which would be the IT stuff.

At the BPM level, a lot of the initiatives are still, I believe, with the business and hasn't translated down into IT dollars and IT deliverables. That's a big issue now with regard to this acquisition for Software AG. Before, they could only play on the IT side of this shop. They had no story to play with the business. Now, they can go back to all those people who are still doing this at the business initiatives and have a story for them, with a roadmap, for how to bring this into IT. I think that sells well. I think IBM uses that, but I still find IBM’s tools very IT-centric.

Baer: JP, you're right on the mark there. There has always been a huge cultural divide between

The question, then, for the vendors is which vendors can really support that story in a way that doesn’t defeat the purpose by a self-serving software sales pitch.

the business folks, who felt that they own BPM, versus the IT folks, who own the architecture or the technology architecture, which would be SOA. What’s really interesting and what's going to stir up the pot some more -- and this is still on the horizon -- is BPMN 2.0, which is supposed to support direct execution.

When I was over at Oracle a few weeks back, they were talking about their strategy. They were saying, that unless a business process, as you model in BPMN, is transactionally complex, you could theoretically make that model executable and essentially ace out IT. I'm a little cynical about that, but it's going to be an interesting thing that stirs up the pot in coming months.

Bloomberg: It's interesting you mention SOA as technical architecture, because that's a fundamental misconception of what SOA is about. SOA is really more of a style of enterprise architecture that pulls together both business and IT.

But, you're right that a lot of organizations still see SOA as technical architecture, as something distinct from the BPM, and those are the organizations that are failing with SOA. That part of the "SOA is dead" straw man is that misconception of SOA as about technology. That's what’s not working well in many organizations.

On the plus side, there are a number of enterprises that do understand this point, are connecting business process with SOA, and understand really that you need to have a process driven SOA approach to enterprise architecture.

The question, then, for the vendors is which vendors can really support that story in a way that doesn’t defeat the purpose by a self-serving software sales pitch. That's always difficult, because the software sales people are there to sell the software. So you don't buy SOA. You do SOA, and doing SOA includes business process work, as well as technology work.

Telling the story

The prize goes to the vendor who really can tell that story properly. That's difficult for all of them and they're all are struggling with this. That's the story for 2010. Will it be IBM, Oracle, or Software AG who tells an architecture-driven BPM/SOA/enterprise architecture (EA) story in a way that really does help organizations solve their problems, as opposed to just pushing the software and letting customers figure out how to use it.

Gardner: Thanks, Jason. Let me go to Joe McKendrick. Joe, it sounds like something we don't talk about too often is the importance of the sales function, the sales department, and how these things enter the market. It sounds as if the sales department is selling to the business side of the house, and that's how their strategy perhaps lines up.

Or, if they've got another product set that they're going to sell to the technology side of the house, well, then that's how they're going to continue to enter the market, because that's the side where they get the PO.

But, isn’t that self-defeating, when it comes to SOA as an architectural paradigm shift, as we've mentioned here? How do we that? Is there another step that we need in bringing SOA into the market that educates or changes the sales culture so that they don't simply go after the short-term product sale, but look for more strategic sale?

McKendrick: Yeah, Dana, that's a big challenge. You're right. The sales people from the vendors have specific relationships with individuals within companies. They may tend to be IT people on one hand or you may have some folks on the business process side, depending on the types of products, and usually the paths don't cross.

I wonder, too, with SOA. That's been the challenge, as we've been discussing about SOA. It's been confined somewhat to the technical side of the house, perceptually, and the proponents of SOA tend to come from the IT side.

Gardner: I guess what I was getting at, Joe, is that the separation between SOA and products seems to be taking place not just on the buy side. It's probably taking place on the sell side as well, as is demonstrated perhaps by what we're hearing today about the IDS Scheer buy being absorbed by one part of Software AG and not across the board.

McKendrick: Absolutely. You really can’t sell SOA. Theoretically, you don't need to buy any products to start SOA in your organization. It's ludicrous to try to sell SOA, the package itself. That's something that's been discussed for years -- selling SOA in a box. You can sell individual products.

Let’s face it. It's a tough environment, and vendors are on these quarterly cycles. They need to push the product out there, and they'll call it whatever they need to call it to get the product out. Maybe SOA is even diminishing as a sales term. It's cloud nowadays.

Gardner: Jim Kobielus, do you agree that this might be what we're up against? In a down economy, sales people need to sell, and, product-by-product, that's what they're going to go after. At the same time, they do an injustice to this larger architectural shift.

Shifting the focus

Kobielus: Yeah, for sure. What gives me hope on the Software AG-IDS Scheer merger is the fact that what I heard on the briefing is that Software AG realizes they need to shift from a technology and sales driven model towards more of a solution and consulting driven business model. First of all, that's the way that you lock in the customer in terms of a partnership or an ongoing relationship to help the customer optimize their business and chief differentiation in their business.

What I found really the most valuable thing about the briefing on the acquisition that we got from them the other day was IDS Scheer adding significant value to Software AG. Software AG pointed to the business process tools under ARIS. That's a given. They focused even more on the EA modeling capabilities that IDS Scheer has, and even more on the professional services on the vertical solution side and the BPA consulting side -- consulting, consulting, consulting, relationship building, solution marketing.

I think Software AG knows that they need to put the IDS Scheer solution focus first and foremost. In a down economy, that's the way to lock in these premium engagements and these

It's interesting hearing about the BPM and SOA disconnect, and it certainly doesn't surprise me.

ongoing relationships that will be essential for Software AG to differentiate themselves from vendors like IBM, Oracle, and SAP, who have been solution focused for quite some time in the SOA sphere.

Gardner: Tony Baer, we need to wrap up on the Software AG acquisition. Are there any other takeaways that we've missed on this one?

Baer: It's interesting hearing about the BPM and SOA disconnect, and it certainly doesn't surprise me. I totally agree with Jason. The problem is that it's a perception that those business stakeholders view SOA as the technology architecture and, more specifically, business process execution language (BPEL) as that bastardized execution language, which I think is probably a little bit of envy on their part.

I can sort of understand that there is a degree of creative tension within Software AG in terms of understanding the connection between BPM and the SOA.

I very much agree with Jim -- I'm Mr. Agreeable today -- that it really is all about solution sell. I was just up doing consulting yesterday with a vendor in the tools industry and telling them that they have to do more of a solution sell.

That's a really tough nut for vendors to crack, because, as the CEO was telling me, "I agree with you, but our sales guys still have quarterly numbers that they have to meet, and if customers want product, we're not going to say no." That's a tough one.

Gardner: Brad Shimmin, do you agree that the solution sell is a multi-year process, but right now these companies need to get some POs signed? Perhaps that's what at work here in terms of filling in of the cracks with this acquisition?

Pre-sales and post-sales

Shimmin: There is pre-sales and then post-sales, and the post-sales is very separate. You have your services organization, and as everyone has been saying here, that's the key to this IDS Scheer acquisition by Software AG.

Software vendors like IBM, Oracle and SAP, which are solution based, have these well established organizations, but do nothing except go out and say, "You know what? You really need to lead with BPM, and by the way, in order to make BPM work, you need to have this great infrastructure and architecture underneath and that happens to be using our SOA components." Those guys know how to do that.

Software AG, as we said, is going to take some time to get that up to speed. In the meantime, it's all going to be driven by the numbers. You're selling infrastructure, you're selling webMethods' software endpoints to the IT folks, and you're selling ARIS to the business folks. To bring those two together is going to take quite a bit of time.

Baer: I think it's kind of important to look at IDS Scheer's numbers. They've actually flattened out. The SAP market is pretty mature. Within the webMethods space, it's younger, dynamic and growing. That could be a way to give IDS Scheer and ARIS a bit of a jolt, if Software AG can deal with those structural issues.

Gardner: Okay. In the second half of our show, let's take a look at this WOA drive. I was

Everyone thinks this is an attack at Microsoft. I'm looking at it as a Mac user and see a huge hole in the market.

impressed with the Google Chrome OS, not necessarily on its technical merits -- we don't know too much about it yet -- but the idea that Google is willing to go toe-to-toe with Microsoft and sees the marketplace is ready to absorb an OS designed of, for, and by the web.

Does anyone else share my impression that this is a harbinger of a larger shift towards the web?

Shimmin: I just think it's reflective of the shift that's already underway. When you look at Google Chrome OS, it's Linux, which is a well-established OS, but certainly not something you would call a web-oriented OS. Chrome OS is really something akin to GNOME or KDE running on top of it. So, technologically, this is nothing spectacularly new.

I think that what Google is doing, and what is brilliant about what they're doing, is that they're saying, "We are the architectural providers of the web, people who make the pipes go, and make all of you able to get to the places you want to go in the web through our index. We're going to build an OS that's geared toward you folks. We're going OEM and through vendors that are building netbooks, that are definitely making a point of contention with Microsoft. Because Microsoft, as we know, is really not pleased with the netbook vendors, because they can't run Vista or eventually Windows 7."

Gardner: Not only that, but they can't charge the full price that they would have liked to charge for an OS, because these things only sell for $400.

Shimmin: Exactly.

Morgenthal: I have differing opinion, and of course an opportunity to tick off the entire Slashdot audience. Everyone thinks this is an attack at Microsoft. I'm looking at it as a Mac user and see a huge hole in the market. I've got to pay almost $2,000 for a really good high-powered Macintosh today. All they did was take BSD Unix and really soup it up so that your basic user can use it.

Out of the slime

People on the Linux side are like, "Oh, Linux is great now. It's really usable." I've got news for you. It's no way nearly as usable as Windows or the Mac. As far as usability, Linux is still growing out of the proverbial slime.

But, if you take that concept of what Apple did with BSD and you say, "Hmm, I'm going to do that. I'm going to take Linux as my base and I'm going to really soup up the UI. I'm going to make it really oriented around the network, which I already did, and I have a lot of my apps in the Cloud, I don't necessarily need to build everything large scale. I still need to have the ability to do video, tie things in, and make that usable, but I'm also going to be able to sell it on a $400 netbook computer."

Now, you're right down the middle of the entire open market, because people can't stand Windows XP running on these netbooks. As was previously said, you can't yet run Windows 7 yet or Vista. We don't know what Windows 7 is going to look like, as far as usability, and the Mac is costing way too much.

There is a huge home run right through the middle. You just run right up the center and you've

First of all, it's vapor, because this is not going to be released, I think, until the second half of 2010.

got yourself a massive home run. It doesn't have to be about going after the enemy. It's not about hurting the enemy. It's about going after your competitors.

Gardner: If Mac OS stays in the top tier and something like Google Chrome OS comes in, the only other player to suffer is Microsoft. Isn't that who gets squeezed out?

Morgenthal: No, I actually think you're starting a grass-roots effort that could knock Apple out, because Apple's maintained its proprietary nature. If you can deliver the equivalent of an Apple-based set of functionality and the usability of the Mac on a $400 netbook, or a bigger if you want, you hurt Apple. You don't hurt Windows.

Gardner: I appreciate your point, but I think that Apple is okay at the top tier. I think this is more aimed at the bottom of the Windows tier, and the price-sensitive audience, both in the consumer and business spaces. What do you think Jim Kobielus?

Kobielus: I think it is, exactly what you said, Dana. First of all, it's vapor, because this is not going to be released, I think, until the second half of 2010.

Gardner: Yes, second half next year.

Kobielus: And, they haven't announced any real features. They haven't announced any final pricing. It will probably be nil or nothing. There's so much that has yet to be defined here. How long ago was it they introduced Android, and how much adoption does Android have in the mobile space?

Gardner: Well, it's got developer hearts and minds, which is probably important.

"Google hegemony"

Kobielus: Yeah, yeah. People keep expecting the big "Google hegemony" to evolve or to burst out, so everybody keeps latching onto these kinds of announcements as the harbinger of the coming Google hegemony and all components of the distributed internet-work Web 2.0 world. I just don't see that happening.

I think this is exciting. They've got all these kinds of projects going, but none of them has even begun to deliver for Google anything even approximating the revenue share that they get from search-driven advertising.

So, this is interesting, but a lot of Google projects are interesting. Google Fusion Tables are interesting for analytics, but I just can't really generate a big interest in this project, until I see something concrete.

Gardner: Okay. Tony Baer, are you ho-hum on this as well, or do you think that this signals that the OS gets buried underneath that layer that is your Web interface and your ability to coordinate with cloud services level?

Baer: I vote for the ho-hum. I agree with Jim. Their business model has been, so far, throwing

Some may need netbooks. Some may want smartphones. Some, like myself, still deal with regular brick computers. It's just a diversity.

as much mud at the wall as possible and seeing what sticks. To date -- and this is one place where I would actually agree with Steve Ballmer -- they've really been a one-trick pony.

You've got to put this in perspective, The Microsoft Office base is not a growing base. It does indicate, though, that there are many types of alternative clients that are emerging, and I don't think anybody has claimed those emerging clients. So, JP has an interesting point in terms of that. It basically fills the hole that Apple is not trying to fill.

Gardner: What about the iPhone. Doesn't the iPhone fill that hole? It's a low entry at $200 and does a lot of what a PC does.

Baer: Well, iPhone, compared to a computer, is low entry, but its expensive compared to a smartphone.

Shimmin: I am sorry to interrupt you, but Apple has netbook coming out in October too, so they're trying for that market as well.

Baer: I'll grant you that point. The important thing mostly is that it does point to a new diversity of clients. Some may need netbooks. Some may want smartphones. Some, like myself, still deal with regular brick computers. It's just a diversity.

So, I think that's really what Google's move heralds. As to whether Google really actually shoots in the long run, I'm waiting for the evidence.

Gardner: Okay. Jason Bloomberg, how about you, a ho-hum or a shift?

Mostly irrelevant

Bloomberg: At ZapThink, we're focused on the enterprise. We talk primarily to enterprise architects who are really trying to figure out the big picture of how enterprise IT resources can meet the ongoing changing business needs. From that perspective, Google is mostly irrelevant. So, I'm definitely in the ho-hum category.

Sure, maybe they will carve out a niche in the netbook OS market, but from the perspective of the enterprise, that's a very small piece of what they're worried about.

Gardner: Let me go to Joe McKendrick. Joe, does what Google has brought to the table have an impact on the enterprise?

McKendrick: Eventually it does. The Google Chrome OS is kind of a marker on the road. I think back to why I started using Google several years ago, and I think why a lot of people started using it. It was so fast. I used AltaVista, Yahoo, Lycos, and all these other search engines, and I just liked Google, because it was real fast. It got me to where I was going in a very fast and efficient manner.

I don't know about Chrome delivering this capacity, but I think what's happening is that the OS is becoming more something that's getting in the way of where you want to go.

I use XP and Vista both. I'd rather just get on the computer and get immediately to where I want

Why can't everyone have a client computer, a device that simply has some kind of very thin OS and the browser connecting them to all the cloud services they need?

to go on the Web and not have to fuss around with all these features with the OS - booting up, security features, updates, patches, and so forth.

I think the world is moving that way. Why can't everyone have a client computer, a device that simply has some kind of very thin OS and the browser connecting them to all the cloud services they need?

That's what's great about smartphone. I love the smartphone because it just goes to where you need to go very rapidly. You're not fussing with the OS. It's more of an embedded, invisible, thin capability, and that's what enterprises are looking for as well.

Gardner: JP, we talked about OEM agreements and how important they are behind the scenes in the technology industry. The OEM agreements that Microsoft has with their hardware vendors are perhaps seeing some strain.

Microsoft didn't do any favors for their hardware vendors with the debacle that Vista was, particularly as that came during the precious year or two before this recession. That could have driven a lot of sales that now will probably never happen.

Do you think that Google, not only has an opportunity to come into the market, as you mentioned, with a technology, but perhaps is going to be a friend of the enemy for these hardware people. They'll probably give this thing away and allow these hardware developers, distributors and creators to benefit from the services marketplace of advertising in a sort of backhanded way, and they get basically free software from Google as a result?

Who'll win the desktop?

Morgenthal: For them, it comes down to who is going to win with the desktop applications. That's what it comes down to. The only reason these hardware vendors are making the investment in Microsoft is because customers want a Microsoft platform, most likely because they are running Office or some other Microsoft application. It's what they're trained on and still comfortable with.

There's a great video out there that Google did asking people on the street, like a Jay Leno walk by, what is a browser? About 92 percent of people didn't even know what the browser was. They're like, "The browser is Google. Yeah, I go to Google." They don't understand it's an application that renders HTML. They don't know that. They have no clue.

It's very easy in this day and age, we get on a phone, we talk, and we know the stuff inside and out. You've got to realize that 92 percent of people out there don't get it. It's easy for Microsoft to go put up a video that shows how great Vista is and how people were snookered into, "Wow, that's the next version of the OS. Look how cool it is. No, it's really Vista." Of those 92 percent of people, you don't think at least 50 percent of those are still going to come in and say, "I want a Vista machine," after seeing that? Of course they are. That's why the hardware vendors don't have a choice.

Microsoft doesn't have to worry. Yes, they want to make good friends with these people, but

I don't know what Google really wants. Basically . . . they're going to throw as much mud against the wall and see what sticks.

ultimately it's the consumers who are coming in and saying, "I want this type of machine, I don't trust that Linux stuff. I don't know anything about that. I don't want to go there. I was told if I go there, I'd better know how to actually get to a command line and work." That's what they still hear.

Gardner: Tony Baer, JP says that the hardware people don't have a choice. Does Google want to give them a choice?

Baer: I don't know what Google really wants. Basically, as Jason and I were saying, they're going to throw as much mud against the wall and see what sticks. I like Jim's metaphor on them being the Xerox PARC for Web 2.0.

If Google were serious, in other words, if they really did have a more of a strategic business plan for this, I would say yes. But, as long as it's just, "Let's just throw something else out there, and by the way, this is not going to come for another 12-18 months," I have a hard time taking this seriously.

Gardner: Brad Shimmin, suppose I'm HP, Dell, or I'm Acer, and I need to sell these $400 netbooks, because that's my only growth area right now and might be for the next two years, before these corporate budgets start growing again. I could sell that thing for $400. Microsoft is going to take $150-200 just for the OS, and Google wants to give a free OS. What am I going to do?

Let the user decide

Shimmin: I would have both of them on there, and let the users make a choice. I'm still thinking about the price tag.

Gardner: For the Microsoft OS.

Shimmin: That's what I'm saying. They want to make a buck and they'll do it the best way they can. If they're getting it free from Google, they'll put it on there as a option, but they'll still pay homage to Microsoft, because, as we've been saying, it has to be. They still have ownership of the desktop.

In my mind, the curious thing about all this is that what's made the iPhone and the BlackBerry so successful is that they're self-contained machines. The OS and the hardware are very tightly controlled and very tightly integrated. What's made the PC and the Windows OS such a pain and so detrimental to productivity is that it's very much the opposite of that.

The Mac -- and I'm a Mac user too by the way -- is that it makes us more productive. The OS

The Mac . . . makes us more productive. The OS doesn't get in the way of the Internet. It actually makes the Internet better.

doesn't get in the way of the Internet. It actually makes the Internet better. It's because it's a controlled environment, but it's really expensive to do the things that way as a company, due to costs in manufacturing.

If Google Chrome is going to go out there the way Android has gone out there, which is, "Let's look for some OEM vendors to make this work and it's going to be based on Linux," I don't ever see it actually doing what the BlackBerry and the iPhone have done in terms of making the 'net better.

I think that it's going to be for those Slashdot folks, who really like that kind of thing and want to make it go. I see this taking a lot longer for the white label stuff to really make things work as well as the closed environments have.

Gardner: Well, I'm afraid we will have to leave it there. I appreciate everyone's input.

We've been talking about the acquisition by Software AG of IDS Scheer, and also the possible impact that the Google Chrome OS could have in the market. It seems most of our people think, that's not such a big deal.

I also want to take this opportunity to thank our sponsors for the BriefingsDirect Analyst Insights Edition Podcast Series; they are Active Endpoints and TIBCO Software.

I also want to thank this week's panelists, Jim Kobielus, senior analyst at Forrester Research. Thanks, Jim.

Kobielus: Always a pleasure.

Gardner: How about a little excitement there, Jim?

Kobielus: I am still overstimulated. That's a redundant statement.

Gardner: Are you overstimulated too Tony Baer, senior analyst at Ovum?

Baer: I really love these podcasts, Dana.

Gardner: Nicely done. Brad Shimmin, principal analyst at Current Analysis.

Shimmin: Still here, and not even caffeinated.

Gardner: Jason Bloomberg, managing partner at ZapThink, thanks for joining.

Bloomberg: Come to our new SOA and Cloud Governance course.

Gardner: Excellent. JP Morgenthal, independent analyst and IT consultant. What plug do you have for us JP?

Morgenthal: Until next time.

Gardner: Joe McKendrick, independent analyst and ZDNet and other web property blogger extraordinaire in SOA and BI and all sorts of things, right?

Morgenthal: Call me Joe "not a slave to fashion" McKendrick.

Gardner: Thanks very much. This is Dana Gardner, principal analyst at Interarbor Solutions. Thanks for listening and come back next time.

Download the transcript. Listen to the podcast. Find it on iTunes/iPod and Podcast.com. Charter Sponsor: Active Endpoints. Also sponsored by TIBCO Software.

Special offer: Download a free, supported 30-day trial of Active Endpoint's ActiveVOS at www.activevos.com/insight.

Edited transcript of BriefingsDirect Analyst Insights Edition podcast, Vol. 44 on Software AG's acquisition of IDS Scheer and the implications of the Google Chrome operating system. Copyright Interarbor Solutions, LLC, 2005-2009. All rights reserved.

Take the BriefingsDirect middleware/ESB survey now.


SPECIAL PARTNER OFFER

SOA and EA Training, Certification,
and Networking Events

In need of vendor-neutral, architect-level SOA and EA training? ZapThink's Licensed ZapThink Architect (LZA) SOA Boot Camps provide four days of intense, hands-on architect-level SOA training and certification.

Advanced SOA architects might want to enroll in ZapThink's SOA Governance and Security training and certification courses. Or, are you just looking to network with your peers, interact with experts and pundits, and schmooze on SOA after hours? Join us at an upcoming ZapForum event. Find out more and register for these events at http://www.zapthink.com/eventreg.html.

Wednesday, August 12, 2009

Panel Discussion: Is Cloud Computing More or Less Secure than On-Premises IT?

Transcript of a sponsored BriefingsDirect podcast on the current state of cloud security and what's needed in the way of standards and practices. Recorded live at The Open Group's 23rd Enterprise Architecture Practitioners Conference and 3rd Security Practitioners Conference in Toronto.

Listen to the podcast. Download the podcast. Find it on iTunes/iPod and Podcast.com. Sponsor: The Open Group.

Dana Gardner: Hi, this is Dana Gardner, principal analyst at Interarbor Solutions, and you’re listening to BriefingsDirect.

We now welcome our listeners to a sponsored podcast discussion coming to you from The Open Group’s 23rd Enterprise Architecture Practitioners Conference and associated Security Practitioners Conference in Toronto. We are here in the week of July 20, 2009.

Our topic for this podcast, part of a series on events and other major topics at the conference, centers on cloud computing security. Much of the cloud security debate revolves around perceptions. ... It's about seeing the glass as half-full. Perhaps it's only a matter of proper practices and means to overcome fear, caution, and reluctance to embrace successful cloud computing.

Or is the glass half empty -- that in order to ramp up to cloud computing use and practices, a number of potentially onerous and perilous security pitfalls will prove too difficult? Is it only a matter of time before a few high-profile cases nip the cloud security wannabees in the bud?

For sure, security in general takes on a different emphasis, as services are mixed and matched from a variety of internal and external sources.

So will applying conventional security approaches and best practices be enough for low-risk, high-reward, cloud computing adoption? Is there such a compelling cost and productivity benefit that cloud computing means that if you are late, you would be in a difficult position vis-à-vis your competitors or that your cost will be high?

Most importantly, how do companies know when they are prepared to begin adopting cloud practices without undo risks?

Here to help us better understand the perils and promises of adopting cloud approaches securely, we welcome our panel. With us we have Glenn Brunette, distinguished engineer and chief security architect at Sun Microsystems. He is also a founding member of the Cloud Security Alliance (CSA). Welcome, Glenn.

Glenn Brunette: Thank you, very much.

Gardner: We're also joined by Doug Howard, chief strategy officer of Perimeter eSecurity, and president of USA.NET. Welcome, Doug.

Doug Howard: Thank you.

Gardner: We also welcome Chris Hoff, a technical adviser at the Cloud Security Alliance (CSA), and also director of Cloud and Virtualization Solutions at Cisco Systems. Welcome Chris.

Christopher Hoff: Hi, there.

Gardner: And Dr. Richard Reiner, CEO of Enomaly. Good to have you with us, Richard.

Dr. Richard Reiner: Good to be here.

Gardner: And lastly, we welcome Tim Grance, program manager for cyber and network security at the National Institute of Standards and Technology (NIST). Good to have you.

Tim Grance: Great to be here.

Clouds and security

Gardner: As I mentioned, the biggest hang-up people have, either in real terms or perceived terms, is security, and it's a wide-open question, because we could be talking about infrastructure, platform as a service (PaaS), data, or simply doing applications. All across the board people are applying the word "cloud." But I think for the intents and purposes of our discussion we want to look at what the enterprises are going to be doing. We have a crowd of architects with us.

Let me take my first question to you, Chris Hoff. When we talk about cloud and enterprise, are we talking about something that is fundamentally different in terms of securing it, versus what people are accustomed to do across their networks?

Hoff: That's a great question, actually. Again, it depends upon what you mean, and, unfortunately, we are going to probably say this a thousand times.

Gardner: Let's get the taxonomy over with.

Hoff: Yeah, what is cloud? Depending upon the application, you will have a set of practices that almost look identical to what you would use in non-cloud environments. In fact, with the CSA, the 15 domains of areas of focus are really best practices around what you should be doing to secure your assets in your business, no matter where you happen to be doing your computing.

That being said, there are certainly nuances and permutations of certain things and activities that we do or don't do currently in applications -- of moving your information applications to the cloud that, in some cases, are operational and, in some cases, behavioral, and, in some cases, technical.

You can dive in and slice and dice up and down the stack, but it's fair to say that, in many cases, what cloud has done and what virtualization has done to the enterprise is to act as a fantastic forcing function that's allowed us to put feedback pressure on the system to say, "Look, depending on what we are doing internally in our organizations, and the care and feeding of our infrastructure applications and information, now that I am being asked to move my content applications information outside my normal comfort zone of the firewall and my policies and my ability to implement what I normally do, I really need to get a better handle on things."

This is where we're starting to see people spin up things they weren't doing before or weren't doing with as much diligence before, and operationally changing the way they behave and how they assess and classify what they do and why.

Gardner: Richard Reiner, tell me a little bit about what the pitfalls are. What makes this a little different in terms of the risks?

Hostile software

Reiner: It's an entirely different set of questions when you are talking about software as a service (SaaS) versus platform versus infrastructure. So, let me just answer for the infrastructure-as-a-service (IaaS) part of the story, which is where we play. We have a platform that does that.

Fundamentally, when you look at infrastructure-on-demand services, they are delivered by means of virtualization and, for most enterprises, probably a very large majority of enterprises, it's the first time that they have even considered, much less actually deployed, infrastructure of a nature that is simultaneously shared and virtual.

Shared means something hostile could be there alongside your workload as the customer, and virtual means that fundamentally it's a software-induced illusion. If something hostile in there can subvert one of the software layers, take control of it, or make it behave differently than what is expected, the customer's workload could find itself executing on a virtual server, running code on a virtual processor that is nothing short of hostile to it.

A virtual processor could be programmed, for example, to wait until secrets are decrypted from disk and then make off with the plain text. That's a fundamental new risk and it's going to require new controls.

Gardner: Glenn Brunette, perhaps another of way of posing this question is not whether the cloud is secured or not, but whether client-server architectures are secured or not? And, is the risk with cloud less than the risk with client-cerver? Is that fair?

Brunette: That's an interesting way to put it, for sure. To echo my fellow panelist's previous statements, a lot of it depends on how you look at cloud and what your definition is, whether you're dealing in a SaaS model, where you have a very specific well-defined interaction method, versus something, maybe IaaS, where you have a lot more freedom, and with it a lot more risk.

Is it more or less secured than client-server? I don't think so. I don't think it is either more or less secured. Ultimately, it comes down to the applications you want to run and the severity or criticality of these applications, whether you want to expose them in a shared virtualized infrastructure.

With respect to how these applications are managed, a lot of the traditional client-server applications tended to be siloed, and those siloed applications had problems for scalability and availability, which posed problems for providing continuity of service. So, I don't think they are necessarily better or worse than one another. Their issues are just little bit different.

Gardner: Doug Howard, maybe this is back to the future. There was a time when those things were centralized and they only went out through the interface to a green terminal. That had some advantages. Are we looking at similar advantages now with cloud computing, where you can control a single code base or you can manage only the amount of information you want to go across the wire, without risk of data being left on clients and all that difficulty of managing different application variations and platforms at the edge?

Things are different today

Howard: Clearly, if you look at where client-server was many years ago, as compared to where it is today, it's significantly different. The networks are different, the infrastructure is different, and the technology is different. So, the success rate of where we are today, compared to where we were 10 and 15 years ago trying the same exact thing, is going to be different.

At the end of the day, it's really about the client experience and, as you guys sitting in the audience are probably thinking right now, everything that we talk about starts with, "Well, it depends" and various other alternations to that. From your perspective, the first thing that you need to know is, "Am I going to be able to deliver a service the same way I deliver it today at minimum? Is the user experience going to be, at minimum, the same that I am delivering today?"

Because if I can't deliver, and it's a degradation of where my starting point is, then that will be a negative experience for the customers. Then, the next question is, obviously, is it secured as a business continuity? Are all those things and where that actual application resides completely transparent to the end user?

I'll give you a key example. One of the service suites that we offer is messaging. It's amazing how many times you walk into a large enterprise client, and they go, "Well, I'd like to see a demo of what the user experience of getting messaging services from a hosted or from a shared infrastructure is, compared to what it would look like in-house."

Well, open your Outlook client, because if it's different than what it would be in-house and out of house, we're starting at the wrong point. We shouldn't be having this conversation.

If you do it really well, it's great, because you have a systemic answer. If you don't, you get ugly really fast.

The starting point you need to really think about, as you go through this, is does it look like it did 10 years ago or 15 years ago? It doesn't really matter. The client experience today is going to be significantly different from what we tried 10 or 15 years ago.

Gardner: Tim Grance, it sounds like we have a balancing act, risks and rewards, penalty, security. It's not going to be all on one side, but you want to make the right choice and you want to get the rewards of the economic benefits, the control, the centralization, and, of course, you don't want to have to deal with a major security blow-up that gets a lot of bad publicity. How are you approaching this from that risk-rewards equation?

Grance: Anytime you do things at scale, it's like standards. If you do it really well, it's great, because you have a systemic answer. If you don't, you get ugly really fast. God and the devil both dwell in the details, depending on how well you do these things. But, it's hard elevating it as just another cold-hearted business decision you have to make.

If you aggregate enough demand in your enterprise or across your area of work, and you can yield enough dollars to put up for someone to bid on, people will address a lot of these security concerns -- I don't have a transparent security model -- I don't know exactly how you are protecting my data -- I don't know where you are putting your data.

If you give them a big enough target, you aggregate enough demand to make it attractive. You can drive the answers to all of these questions, but you do have to ask for the full set of business use cases to be addressed.

New business model

Gardner: Chris Hoff, back to you. We're really not only talking about a shift in the technology, in the delivery, and then evaluating the risks and rewards as result. We are also talking about a fundamentally different business model of how to acquire services, instead of a license model with a lot of upfront capital expenditures.

You might be able to examine certain aspects of what you do. Instead of having an overabundance of resources for a small peak period or occasional explosion of demand, you can meter this out and pay on a per-use basis, or perhaps even get subsidized by something like advertising or some other business model.

So, the rewards, when we compare and contrast the monetization and the costs, could be very lopsided. This is going to, I think, appeal to a lot of people, particularly in a recession. For those people who want to dive into this right away and take advantage of those big dollar savings, what do they first and foremost need to think about for protecting themselves and be secure in doing so?

Hoff: Previously, I talked about the forcing function of cloud as an intersection of the economy, where cost savings is a huge motivator from the perspective of economics. Extrapolating that a little bit further, the answer is really interesting, when you add the dimension of the consumerization of IT. What I mean by that is consumer-like experiences, leaking themselves into the enterprise, and, in some cases, vice-versa.

One of the interesting notions of how cloud computing alters the business case and use models really comes down to a lot of pressure combined with the economics today. Somebody, a CIO or a CEO, goes home and is able to fire up their Web browser, connect to a service we all know and love, get their email, enjoy a robust Internet experience that is pretty much seamless, and just works.

Then, they show up on Monday morning and they get the traditional, "That particular component is down. That doesn't work. This is intrusive. I've got 47,000 security controls that I don't understand. You keep asking for more money."

Trying to reconcile those two models is very interesting, because when it comes down to what

If you're a consumer and are 17 years old, your idea of security, privacy, confidentiality, access, and availability are very, very different than mine or somebody else's in the corporate environment.

you should look out for, in many cases, there is one other element that leaks into that and that's the generational question.

I've now taken your very simple question and made it multi-dimensional. But, if you're a consumer and are 17 years old, your idea of security, privacy, confidentiality, access, and availability are very, very different than mine or somebody else's in the corporate environment.

The model starts with understanding, first of all, who the consumer is, and how that applies to the scenario we're talking about, what type of information we're trafficking in, and how that ultimately affects and translates down to managing risk. Ultimately, the difficulty with all of that is that multi-dimensional mouthful, which I just came up with, is exactly what we have to face in the enterprise every day with every business decision when we talk about the cloud or moving a service or an application content to the cloud.

Once we get pass the definitional issues, the things you have to look at are to the point that was made previously. If my user experience isn't the same or isn't offset tremendously by cost, that's a problem. If my privacy and my compliance are not at par with what I have today, that's a problem.

We don't have a very good way today of assessing those gaps. That's the first thing I would look at -- understanding where you are, versus where you want to go in relation to the pressures we are facing to move our content and apps to the cloud.

Where's the sweet spot?

Gardner: For the next point, let's go to Glenn. Thinking about the whole of cloud benefits for those people who do want to get in, take advantage of some level of the productivity, but without a lot of risk, what's available? Would you say that application development is a place to start? Is it to look at data that might not be critical data and move it off of your servers? Where is this sweet spot, rather than waiting for the whole methodological approach to be sussed out in the cloud alliances and for the work groups to do their thing. Where can you go right away? What's the low-hanging fruit on this?

Brunette: There are actually a lot of different areas, depending on what your own business is and what you are interested in doing. Certainly, you see a lot of people doing initial development, also quality assurance and testing of applications using dummy data out in the cloud, assuming the applications themselves don't contain sensitive data in some way, such as a trading algorithm or something like that.

You also see cases where you have historical data, where it's no longer of interest, but you may want to use it for analytic purposes. There has been work done by some of the trading exchanges to make that data public, so people can perform an analysis on past historical trends in the market and could perhaps develop new trading algorithms and new things on their own.

In addition to that, you may find that there are cases where you are doing high-performance computing kinds of workloads that are non-sensitive. You could be, for example, doing video transcoding, movie-rendering, things like that. Again, you see people with open-source movies, and open-source songs and things like that. You could certainly put that out there.

Really, it's a wide-open field, and I've been focusing on compute. With storage, you see people

Unfortunately, there is no one answer, but the good news is there are quite a number of answers. There are a lot of opportunities, depending on what you are doing.

encrypting BLOBs and putting just their storage out there or making it available for content distribution, because of the widely available high bandwidth channels to the cloud storage provider.

Unfortunately, there is no one answer, but the good news is there are quite a number of answers. There are a lot of opportunities, depending on what you are doing.

Gardner: Let's flip that question. Richard Reiner, what are some areas you should back off from? What is not ready for prime time when it comes to secure, safe cloud computing?

Reiner: To try to give a good answer to that question, you've got to dig down one level to think about how our decisions about what can be deployed are made in the enterprise. What's the right way of doing that? There are any number of dimensions that come into play. There are concerns about availability, access, and interactive performance.

There are security concerns. Relative to the security concerns in the ideal enterprise mode of operation, there is some good systematic risk analysis to model the threats that might impinge upon this particular application and the data it processes, and then to assess the suitability of different environments for potential deployment of that stuff.

Questions on public clouds

There are a lot more question marks around today's generation of public-cloud services, generally speaking, than there are around the internal computing platforms that enterprises can use. So it's easier to answer those questions. It's not to say the answers are necessarily better or different, but the questions are easier to answer with respect to the internal systems, just because there are more decades of operating experience, there is more established audit practice, and there is a pretty good sense of what's going to be acceptable in one regulatory framework or another.

Trying to pull that together into an answer to the question, I guess what you could say is that the more of those unknowns arrive in conjunction with a particular application or a particular dataset that someone is considering deploying in the cloud, the harder it's going to be to actually do that.

Gardner: Tim Grance, same question. What would you really keep away from, in terms of network security and cyber security, when it comes to interest in the cloud?

Grance: Public facing content, collaboration with the public -- those are good things. Anything closer to the mission critical side, whether you want to outsource it or not, that's something you want to be a lot more careful with.

Would I put the Department of Defense's mission-critical apps? No, I wouldn't do that, because it's just not worth that effort and risk to even try to answer those questions. No one should take the truly core mission-critical things and put them out at this point in time. I'd even be nervous on the internal cloud, just because the dangers and the risks are large. What's the payoff is really the risk appetite question you have to answer.

Gardner: Doug Howard, data. Some data good, some data bad in the cloud. You guys are

You need to put what you are comfortable with in the cloud, and you need to be comfortable with whatever the infrastructure provider can step up with.

involved with trying to protect and manage a lot of mission-critical data. Do you have a certain metric that you would apply to deciding which datasets can go outside of your organization?

Howard: We're probably a little ahead of the marketplace in some areas, relative to mission-critical data in the cloud.

Just to give you a little bit of a review. we provide services to about 2,000 banks and credit unions. We do most of their core access into infrastructure. On a global basis, about 10,000 customers rely on us for messaging infrastructure and so forth. I would argue that for every one of those companies -- banks, large enterprise, so forth -- messaging, Internet, Web access is mission-critical to their enterprises. If that was to drop off for hours or for days, their infrastructure and their companies would come to a halt.

If you look at what can be put in the cloud, I wouldn't necessarily say mission-critical can't be placed in the cloud. I would probably alter that a little bit. You need to put what you are comfortable with in the cloud, and you need to be comfortable with whatever the infrastructure provider can step up with.

Generally speaking, the infrastructure providers that are providing services in the cloud are today pretty candid about what they can and can't do relative to reporting, governance, risk, and compliance. Those types of things are the questions that are going to define what can go into the cloud. The performance tends to be less of a concern, because everything is relative.

Everything is relative

Can you provide a global infrastructure? Can you provide high availability with a budget that you have today, compared to the cloud provider? A lot of times the answer to those questions is "no." So, everything is relative to what you can do yourself, as well.

Going back to that user experience. If you can get a higher user experience and you're comfortable with all the governance, risk, and compliance (GRC) and security elements, then ultimately you're better off putting those types of things in the cloud than trying to build it yourself on something that you know will not be able to deliver the user experience that you're trying to attain.

Gardner: A question from our audience comes in about federation. You're probably going to have both internal and external environments and aspects of business process and resources. How do you manage them in some concerted effort that works? This is probably not too different than how you manage integration and collaboration among different services internally. It's taking those services from a variety of different sources.

Let's go to Chris Hoff. This is really a governance question. Where is security, in terms of its maturity, when it comes to mixing and matching services, internal and external?

Hoff: Glenn and I were actually discussing some of this prior to the panel. The interesting thing that cropped up was about the effectiveness of compensating controls today. My friend, Gunnar Peterson, has this great chart, where he shows that it's a kind of matrix. He shows the innovation or development of programmatic capability over time and the advancement of programming languages way back to C and Java, etc.

On the second column he shows the security industry's response to each of these brand new

The level of collaboration really comes down today to the advancement of technology, which hasn't happened as far as we needed it to.

developments. The funny thing is, they're amazingly consistent, because you have the words SSL and firewall, SSL and firewall, SSL and firewall.

So, it may very well be a governance question today, but as the other sessions during the conference have pointed out quite glaringly, what we have settled for, what we have allowed ourselves to settle for, and the way in which we “collaborate” today means you have a firewall rule that says, "source, partner, destination, all my internal resources, protocols, whatever, action allow, and log."

The level of collaboration really comes down today to the advancement of technology, which hasn't happened as far as we needed it to. More importantly, as we extend into the cloud -- and this is what I was talking about in terms of this forcing function -- we need to be a lot better about what we mean by collaboration, who participates, and how we identify them. It goes back to basic practices that we haven't done a very good job of dealing with over time.

It's one thing if your constituency is known to you and, if you happen to collocate your resources internally, it's quite another, when you make them available externally and have to start looking at how you identify, and then federate even a basic externally hosted, but internally consumed, set of applications and resources.

Challenging the model

We have an awful lot of work to do, as it relates, on one hand, to challenging the model -- is this the right way to go? -- but secondarily, bringing forth all the things that we should have done for quite a number of years to make that a reality.

Glenn and I were discussing the fact that we have an awful lot of solutions, as was alluded to before -- I think Doug brought it up -- that from a timing perspective just weren't mature, ready, or catalytic enough to be adopted But, now is an opportunity to look at those as being a valid set of alternatives.

Gardner: Glenn, you've had this discussion with Chris. Is it safe to integrate, to interoperate, and should governance be something that resides entirely within an enterprise that's consuming cloud services? Does governance need to be extended from the cloud to the consuming organization, or some interaction or hybrid between them?

Brunette: When you start looking at the cloud usage patterns and the different models, you're going to see that governance does not end at your organization's border. You're going to need to understand the policies, the processes, and the governance model of the cloud providers.

Unfortunately, we really have a fair degree of work to do in this area. There's a lot of work that

It's going to be important that we have a degree of transparency and compliance out in the cloud in a way that can be easily consumed and integrated back into an organization.


needs to be done around transparency, compliance, and governance. But, those are problems that can be solved, at least for those organizations willing to take that step. Those will be the ones that will be more attractive in the marketplace, especially to the enterprise market, as they look to take advantage of cloud computing.

It's going to be important that we have a degree of transparency and compliance out in the cloud in a way that can be easily consumed and integrated back into an organization. At the same time, I would also caution, though, to Chris' point.

Earlie, he talked about the onslaught of audit requests. I think we need to come up with some standards in this space, so that organizations can measure against some common ground, so that cloud providers aren't effectively going under a denial of service just on the sheer weight of audit requests from their consumers. There is a balance here that needs to be struck.

Gardner: Going to the audience once again. Another question about third-party risk assessment. Is this a field day for third-party consulting organizations that will walk in and spread the pixie dust?

I'll throw this out to anyone on the panel. How much of this is going to fall into the hands of third-party consultants to decide what you should or shouldn't use vis-à-vis the cloud.

Potential for disintermediation

Grance: I'll start on that one. It's funny, cloud has a vast potential to cause a disintermediation, just like in power and other kinds of industries. I think it may run eventually through some of these consulting companies, because you won't be able to get as rich off of consulting for that.

In the meantime, I think you're going to face that situation. As you can see with the SAS 70 audience, where people can simply just roll their own. Here's my magic set of controls. It may not be all of them. It may just be a few of them. I think people will shop around for those answers, but I think the marketplace will punish them.

Reiner: Another comment here, and this takes the form of a war story, so I apologize for that. About a year-and-a-half ago, a friend of mine, who was, at the time, the CIO of a Fortune 100 company, asked me to take a look at an agreement that he was actually already party to. He had inherited it from his predecessor, and it was between his organization and a Fortune 100 outsource or integrator type of entity. He asked me to look at the security aspects of it.

It was interesting. On one hand, there were security aspects, which are not universally the case in these things. But when you came down to it, what it said under security was that, "the integrator undertakes to have firewalls" -- not to plug them in, not to operate them, not to maintain them, not to see them inserted in a network, not to see them doing anything whatsoever.

The remarkable thing about all this is not just that the gap had occurred, but that both

The remarkable thing about all this is not just that the gap had occurred, but that both organizations felt good about it.

organizations felt good about it. Both organizations felt that they had successfully washed their hands of the risk. Until as a community we all get better at not letting those things happen, maybe it's useful to have third parties who can help find them.

Gardner: Anyone else on the third-party risk assessment opportunity?

Howard: I'll take a slightly different angle on it. Going back to one of the things Glenn said, if you look at a lot of the cloud providers, we tend, in many cases, to fight some standards, because, in reality, we want to have competitive differentiators in the marketplace. Sometimes, standards and interoperability are key ones, sometimes standards create a lack of our ability to differentiate ourselves in the marketplace.

However, on the security side, I that's one of the key areas that you definitely can get the cloud providers behind, because, if we have 10,000 clients, the last thing we want is to have enough people sitting around taking the individual request of all the audits that are coming in from those customers.

For example, if they just wanted to send us a questionnaire of 150 questions, to do that 10,000 times is a significant effort. So, to put standards behind those types of efforts is an absolute requirement in the industry to make it scalable, not just beyond the infrastructure, performance, availability, and all those things, but actually from a cost perspective of people supporting and delivering these services in the marketplace.

Hoff: Just to take an angle on your angle. What's interesting is that many times, from the security perspective, security teams have not done a good job of looking forward to what is coming as a disruption, and some are caught flatfooted and react oftentimes in an emotional manner that does not contribute well to their status in the organization.

A good illustration of this is when someone says no or attempts to block the movement to a cloud by suggesting, "Well, the cloud provider does not have X, Y, and Z in place." Sometimes, management turns around and says, "Well, do we have X, Y, and Z in place? And, they say no.

Answering to a higher standard

It's kind of like the Hebrew National hot dog version of security for the cloud, which is being held to a higher standard. This is kind of funny, because, in many cases, they will write, you know what, I'm outsourcing this. I may not be able to effect the same types of governance and control, but at the same time, we should be fair and circumspect, when we look at the overall security posture and we look at the controls that we have.

Firewalls aren't bad things. They've served us well. Our application of them may be ill tuned, but the reality is that "good enough" security, for the most part, is what we like to suck up and admit is good enough. It always has been. That's the trend with outsourcing in general before the cloud showed up as a popular culture term.

If they deliver to me a service level that is legally binding in some form or another, whether they plug in the firewalls or not, the reality is that from a cost center view, and we're looking to trim money, good enough is good enough. We're going to be facing much, much more of that as time goes on.

Gardner: That gets to the point of authority and responsibility. Security, as we pointed out, is often a function of perception. Will the cloud perhaps improve this by creating one throat to choke? If the cloud provider is responsible for performance, security, liability, low cost, and for all of the other requirements that you might throw into your service-level agreement, isn't that, in a sense, a little bit better than having a distributed, amorphous, unknown set of security requirements within the organization?

Glenn, is there a silver lining to the cloud in terms of the one throat to choke?

At the same time, you need to recognize that there is a shared responsibility here, especially as you get further down the stack.



Brunette: I would say it depends. Well, it does, but I would say that for certain classes of cloud computing models, a SaaS model, it really could be the case, where those providers have an opportunity to hire best of breed, be able to build that into their applications, and design that into their processes and their policies, so that what you get is actually representative of a strong security model.

At the same time, you need to recognize that there is a shared responsibility here, especially as you get further down the stack. Once you get to the IaaS provider, if the provider is not providing you with the machine images that you're loading, you really can't blame them, if you've deployed a poor one. So, depending on what level of the stack you're going toward, there may be some benefits.

One of the other things I'd point out is that, it's not just about the cloud providers and the cloud consumers, but there are also other opportunities for other vendors to get into the fray here.

One of the things that I've been a strong proponent of is, for example, OS vendors producing better, more secured, hardened versions of their operating systems that can be deployed and that are measurable against some standard, whether a benchmark from the Center for Internet Security, or FDCC in the commercial or in the federal space.

Everyone benefits

The other thing that comes to mind is that you may also have the opportunity of third parties to develop security-hardened stacks. So, you'd be able to have a LAMP stack, a Drupal stack, an Oracle stack, or whatever you might want to deploy, which has been really vetted by the vendor for supportability, security, performance, and all of these things. Then, everyone benefits, because you don't all have to go out there and develop your own.

Gardner: I am going to riff a little bit on a well-known tagline and say that the architecture is the cloud. What I mean by that is that is that it's hard for enterprises to change their architecture, but it might not be that difficult for a cloud provider Somebody who has, for example, a very low-margin commoditized business, needs to look for, as you say, best-of-breed approaches, not necessarily best-of-breed products.

We heard earlier today about a change in how an application might be delivered, that the whole stack, an optimized stack, might be integrated and optimized between the code that's generated in the application and the stack itself, no more or no less that's required. It's tightly integrated, highly parallelized, highly efficient, comes down across the wire, you use it when its done, it goes back up, and it comes down the next time with all of the security patches installed. This is an architectural shift, not just a sourcing change.

Does the cloud offer us the opportunity to move our architectures, in a modernization sense, far and away more than we might be able to do in our own organizations? Let me take that to Richard Reiner first.

Reiner: Well, if the question is does that opportunity exist, certainly it exists. It's going to come

Over time, on the flip side, it will play out and the real players will be the real players at the end of the day.

down to the business models of individual cloud providers as to whether they are willing on one hand and able on the other.

Gardner: Will I, as an end user, care what the architecture is?

Reiner: Well, you'll care in terms of its functional results. You may not care what's behind the scenes, but you'll care whether you are receiving configuration updates as a service as part of what you've contracted for. Certainly, you'll care.

Gardner: How about Doug Howard?

Howard: Unfortunately, I think a lot of it plays out over time. I mean, at the end of the day, if you engineer, if you develop and you deliver a service, regardless of what the underlying infrastructure is -- going back to the user experience -- if the user experience is positive, they're going to stay with the service.

On the flip side, if somebody tries to go the cheap way and ultimately delivers a service that has not got that high availability, has got problems, is not secure, and they have breaches, and they have outages, eventually that company is going to go out of business. Therefore, it's your task right now to figure out who are the real players, and does it matter if it's an Oracle database, SQL database, or MySQL database underneath, as long as it's meeting the performance requirements that you have.

Unfortunately, right now, because everything is relatively new, you will have to ask all the questions and be comfortable that those answers are going to deliver the quality of service that you want. Over time, on the flip side, it will play out and the real players will be the real players at the end of the day.

Gardner: Chris Hoff, is it possible that the cloud providers will run circles around the enterprise and that they will come up with a better architecture? It will be more secure. It will be more reliable. It will be robust. It will have business continuity. It will be cheap. It will be effective. You guys are pessimists today. I don't get it?

It depends on what you pay

Hoff: It will make me a ham sandwich too. It depends on what you pay for it, and I think that's a very interesting demarcation point. There is a service provider today who doesn’t charge me anything for getting things like mail and uploading my documents, and they have a favorite tag line, “Hey, it’s always in beta.” So the changes that you might get could be that the service is no longer available. Even with enterprise versions of them, what you expect could also change.

So the answer is yes, given one of the hallmark benefits of cloud, which is agility and flexibility and the "push once -- make available to everyone" is certainly fantastic. However, in the construct of SaaS, can that provider do a better job than you can, Mr. Enterprise, in running that particular application?

This comes down to an issue of scale. More specifically, what I mean by that is, if you take a typical large enterprise with thousands of applications, which they have to defend, safeguard, and govern, and you compare them to a provider that manages what, in essence, equates to one application, comparing apples to elephants is a pretty unreasonable thing, but it’s done daily.

What’s funny about that is that, if you take a one-to-one comparison with that enterprise that is just running that one application with the supporting infrastructure, my argument would be that you may be able to get just as good as, perhaps even better, performance than the SaaS provider. It’s when you get to the point of where you define scale, it's on the consumer side or number of apps you provide where that question gets interesting.

I bristle at the fact that, for example, SaaS vendors can do a better job at securing your apps than

But, what happens then when I end up having 50 or 60 cloud providers, each running a specific instance of these applications. Now, I've squeezed the balloon.

you can. So you run a mail system inside, and you outsource to them, and they will do better job. Strangely enough -- and it may be a case I will grant of you of adoption and use -- but the three biggest breaches we have currently had in terms of privacy, as it relates to well-known cloud applications, have all been SaaS. These are the guys who are supposed to be doing a better job than we do.

It’s applying a realistic and pragmatic set of filters to that questions. One to one, that becomes a more difficult question to answer. I've got a thousands apps, where I am distracted and I've got to pour more and more money and more and more people into it. Then, you start dealing with a reasonable question.

But, what happens then when I end up having 50 or 60 cloud providers, each running a specific instance of these applications. Now, I've squeezed the balloon. Instead of managing my infrastructure, I'm managing a bunch of other guys who I hope are doing a good job managing theirs. We are transferring responsibility, but not accountability, and they are two very different things.

Gardner: Glenn, to this point of modernization and the pace of innovation, many enterprises have five- or seven-year cycles. A cloud provider might have a three-, six-, or nine-month cycle. It wouldn’t take too long for that cloud provider to be way ahead in terms of adopting the latest and greatest security and optimize the infrastructure.

Do you see that the cloud providers, if given a chance, if given a business model and it’s sustainable, could technically, and in terms of business requirements, very quickly get out in front and, therefore, become an offer that people can’t refuse?

Advantages of older technology

Brunette: I think that's possible, although probably for different reason. The hardest thing is that they may want the latest and greatest, but more often that is in terms of what they are exposing to their customers and also in the tools and techniques they will use to manage their infrastructure. In terms of the actual technology, sometimes using older technology may be more advantageous to them from the cost perspective.

You asked earlier whether this is an opportunity for architects and for changes in architecture, and I would say a resounding yes. There are things we can do today, in terms of horizontal scale, caching of systems, and caching of applications, that would allow us to use, rather than the latest quad-core processors, maybe dual-cores, but more of them, or using older disk-drives, but with Flash-based technologies to help accelerate the reads.

In almost every case, the cloud providers can hide all of that complexity, but it gives them a lot more flexibility in terms of which technology is right for their underlying application. But, I do believe that over time they will have a very strong value proposition. It will be more on the services that they expose and provide than the underlying technology.

Gardner: Any other takes on that? Yes, Richard?

Reiner: Just kind of a comment. Sometimes we risk taking something for granted that we shouldn’t, which is that every customer, even every business customer of cloud services, will want a cloud that is managed to maximize security and availability.

To the extent that a cloud is managed that way, you take on some of the characteristics of large enterprise IT, which is to say slow and bureaucratic, and all the things that people complain about. While some customers will want their cloud services that way, others will want one that maximizes price performance, even if that comes at the expense of other dimensions. So, we just need to be careful on that one.

Grance: This goes back to the business case argument. You have to know what your risk

Regardless of which model, there is no way to say there is no risk in any of the issues. It’s another coldhearted business decision that has to be made.

appetite is and what risks you are willing to take. If you can give an aggregate demand and enough dollars behind that, you can get your requirements met.

Of course, we could come up with this novel thing 10 years later called IT. So, there will always be this ebb and flow back and forth. A technical point is that, regardless of which one you choose, which model, which method, you are going to ask all of these hard questions about the provisioning service and how well this is done, and with virtualization, you are still trusting a million lines of code.

Regardless of which model, there is no way to say there is no risk in any of the issues. It’s another coldhearted business decision that has to be made.

Brunette: Just one comment in terms of optimization. It’s an excellent point, because I think what we will see today is that if you want a compute or storage service, you tend to get the same flavor. Now, you get different providers, but it’s similar in nature. Over time, we're going to see a much higher degree of specialization.

You may see more HPC-oriented clouds, which utilize different types of interconnects, different types of file systems that deliver on those requirements, whereas something, perhaps in the financial services or healthcare, may orient themselves more toward those regulatory environments.

Robust marketplace

Gardner: Okay, and to that point of a robust and highly energized marketplace, where the best and brightest and most secure will rise to the top and it will be clear and transparent to everyone what those are, how do we provide for transparency and utility and portability, especially early on?

It seems to me that we have a limited number of cloud providers, for at least enterprise caliber activities now a days, and, with a small number, comes perhaps market power, beyond what we would expect in terms of a pure market environment.

Any thoughts about what we need, perhaps external or perhaps with the clout of the enterprises. If we're going to be buying the stuff, we want X, Y, and Z. What needs to happen in terms of providing for neutrality, which is an important aspect of security? Let’s start at one end and work away down. What do you think, Doug?

Howard: Neutrality, from a portability prospective specifically. Most of us who have provided SaaS services in the cloud provide some reasonably easy way for customers to gain access to their content and withdraw that from our infrastructure.

That’s one of the questions that most customers, when they come to us today, have key on their

Most of us who have provided SaaS services in the cloud provide some reasonably easy way for customers to gain access to their content and withdraw that from our infrastructure.

mind. "How can I get my data out of your infrastructure, if I want to? If you end up being the provider and if you end up going out of business, whatever it may be, how can I get my data out of your infrastructure?"

Those APIs, those, capabilities, those exports pretty much exists today, relative to getting the compliance information, the GRC information out of their infrastructure and into their infrastructure. Those are the key areas that we have been focused on.

There's probably an evolution, as well, that you will see the industry go through as they figure out, "I can make you comfortable with getting your data. I can make you comfortable getting your applications out of my infrastructure, if you are worried about me and move it to somebody else."

The next evolution is making sure that my business processes and my compliance work with the outside as well. For example, we do external scanning by a third party. We do internal scanning ourselves. We have a third-party FFIC review that comes in. That happens with us. Then, we have a third-party review that comes in.

Those are made available to our clients as part of the process. They then go into their policy and into their GRC process, so that they can fulfill their compliance requirements as well.

Gardner: Chris Hoff, do we need a "good clouds keeping seal of approval?" Who would provide it? Wouldn’t a network services company be a good possibility?

Open standards

Hoff: To answer your original question about what we need to make that a reality. The words “open standards” float to the top of my head. We've been talking a lot about the enterprise here, and so we’ll make that assumption -- large, well-established enterprises with good, decent practices, and with established burdens and infrastructure already.

For small and medium businesses (SMBs), most of them could care less. It's all about agility. "I don't want to buy anything, I'm just putting this stuff in the cloud today." They don't see any difference. It's fantastic.

If we focus on the enterprise side, you brought up earlier that a lot of these folks are already on multi-year road maps that talk about progression of how their infrastructure is going to move and migrate. It's like turning an oil tanker left. It takes five miles in many cases.

In the long-term, open standards with contributions from larger enterprises and providers are

. . . a lot of these folks are already on multi-year road maps that talk about progression of how their infrastructure is going to move and migrate.

going to be incredibly important, because there is a natural progression in large enterprises that's occurring, regardless of what label you slap on it.

That is a direct result of the consolidation and virtualization we have been seeing happening over the last five years anyway. They're looking to reduce carbon footprint, save on power, and all that stuff and that's happening. That's led currently by a few vendors, who are working, as their market dominance, to export what they do, both to allow federation with the business part and what's been turned out into a cloud process.

We flip that even further. The reality is, portability and interoperability are going to be really nailed to firstly define workload, express the security requirements attached to that workload, and then be able to have providers attest in the long-term in a marketplace.

I think we called the Intercloud, a way where you go through service brokers or do direct interchange with this type of standards and protocols to say, “Look I need this stuff. Can you supply these resources that meet these requirements? “No? Well, then I go somewhere else.”

Some of that is autonomic, some of it’s automated, and some of it will be manual. But, that's all predicated, in my opinion, upon building standards that lets us exchange that information between parties.

Gardner: Richard Reiner, Everyone agrees that portable neutrality and openness is a good thing, but how do we get there?

What we need now

Reiner: That's a good question. I don't think anyone would disagree that learning how to apply audit standards to the cloud environment is something that takes time and will happen over time. We probably are not in a situation where we need yet another audit standard. What we need is a community of audit practices to evolve and to mature to the point where there is a good consensus of opinion about what constitutes an appropriate control in a cloud environment.

The other question that arises there is how easy or hard it is for an auditor to get to that opinion, and what can we do, as technologists, that might make it easier. This is one area where we're putting a lot of our attention, and we have a cloud infrastructure platform that service providers around the world are starting up and running revenue-generating services on. This is a question that we are seeking the answer for.

Gardner: Glenn, portability, how do we get there?

Brunette: As Chris said, it comes down to open standards. It's important that you are able to get your data out of a cloud provider. It's just as important that you need to have a standard representation of that data, something that can be read by your own applications, if you want to bring it back in house, and something that you can use with another provider, if you decide go that route.

The other concern that comes up, if you get to that point where you the need to extract your data, what if we are talking about petabytes or exabytes of data? Where do you go with that? How do you get it from provider to provider? Are you going to get it there over some sort of network link or do you have other vehicles for that? Those are things that you would need to negotiate with your provider?

Gardner: Pick up trucks.

Brunette: Right, exactly.

Gardner: Last word to you, Tim.

Grance: I'm going to out on a limb and say that NIST is in favor of open, voluntary consensus, but data representation and APIs are early places where people can start. I do want to say important things about open standards. I want to be cautious about how much we specify too early, because there is a real ability to over specify early and do things really badly.

So it's finding that magic spot, but I think it begins with data representation and APIs. Some of these areas will start with best practices and then evolve into these things, but again the marketplace will ultimately speak to this. We convey our requirements in clear and pristine fashion, but put the procurement forces behind that, and you will begin to get the standards that you need.

Gardner: We have been discussing whether or not it's safe to go to cloud computing, and we have come up with number of different positions and a variety of perspectives. I hope it's been edifying for you. I have certainly enjoyed it and I hope you can join me in again thanking our panel.

We have been joined by Glenn Brunette; distinguished engineer and chief security architect at Sun Microsystems, as well as the founding member of the Cloud Security Alliance. Thank you, Glenn.

Brunette: Thank you.

Gardner: Doug Howard, chief strategy officer, Perimeter eSecurity, and president of USA.NET. Thank you, Doug.

Howard: Thank you.

Gardner: Chris Hoff, technical advisor for the Cloud Security Alliance and director of Cloud and Virtualization Solutions for Cisco Systems. Thank you, Chris.

Hoff: Thanks, very much.

Gardner: Dr. Richard Reiner, CEO of Enomaly. Appreciate your input.

Reiner: Thank you.

Gardner: And Tim Grance, program manager for Cyber and Network Security at the National Institute of Standards and Technology. Thank you.

This is Dana Gardner, principal analyst at Interarbor Solutions. You have been listening to a sponsored BriefingsDirect podcast, coming to you from The Open Group's, 23rd Enterprise Architecture Practitioners Conference in conjunction with the Security Practitioners Conference in Toronto in the week of July 20th, 2009.

Thanks for listening, and come back next time.

Listen to the podcast. Download the podcast. Find it on iTunes/iPod and Podcast.com. Sponsor: The Open Group.

Transcript of a BriefingsDirect podcast on the current state of cloud security and what's needed in the way of standards and practices. Recorded live at The Open Group's 23rd Enterprise Architecture Practitioners Conference in Toronto. Copyright Interarbor Solutions, LLC, 2005-2009. All rights reserved.