Cloud Computing Viewpoint

Werner Vogels, Bradley Horowitz, and Jonathan Zittrain

Wed, 02 Dec 2009 08:45:00 EST

I’m at Supernova. (live stream) I’ve come in a little late on an afternoon session. Werner Vogels talks about cloud computing. He contrasts it with a 1900 Belgian beer brewery that had to have its own electricity generator, which took a lot of maintenance and didn’t help it make better beer. He warns that any offering that taps into the large social networks may find itself with traffic suddenly spiking by orders of magnitude.

Will the Cloud Confuse Network Management?

Mon, 30 Nov 2009 15:00:00 EST

In today’s technology-dependent enterprise environment, the efficiency of most business processes depends directly on the effective performance of the IT infrastructure. Almost every single activity - from servicing a customer to shipping purchased products - is dependent upon one or more software applications and the underlying computing/network infrastructure.

Enterprise Clouds Require Service-Level Discipline

Mon, 30 Nov 2009 11:00:00 EST

The Enterprise Cloud Requires a real time infrastructure and a management discipline that understands and can enforce service level discipline. Organizations have become increasingly dependent on technical infrastructure to enable customer interactions. As such, the business has a vested interest in making sure its technology partners understand what constitutes good customer experience so that it’s prepared for projected volumes and rapidly knows how to resolve any impediments.

The Character of Cloud Computing

Sun, 29 Nov 2009 04:00:00 EST

Here's an important reminder for cloud service providers: character counts. Ethics, Values, and Trust are table stakes – for anyone who wants to succeed in business long term – but especially for cloud service providers. As a cloud customer, I am not simply buying/renting your hardware and software. I am grafting my company onto yours. We are intermingling our corporate DNA. I am loading my databases on your disk drives. I am modifying my internal processes to map to your services.

Why The Cloud Needs Virtualization

Fri, 27 Nov 2009 03:00:00 EST

Lots of discussion lately about the need for virtualization in a cloud computing context. On one side you have people saying it's not necessary and adds extra complexity, on the other you have people (vendors) saying that virtualization is inherently a cloud infrastructure. Some even go as far as saying that virtualization and cloud computing are one in the same. I'm here to tell you that neither is true. My position is Virtualization Doesn't Make the Cloud, it makes the cloud better. Sure, you could manage raw servers Google style, but why? For me, it comes down two main aspects of scale, scaling up, and scaling out.

First let's look at scaling out, or to scale horizontally which basically means to add more nodes to a distributed system, such as adding a new servers or storage (which is easier). These could be in the form of physical or virtual servers. An example might be scaling out from one web server system to many dedicated slaves machines. Google has made an art form of scaling out. They have data centers around the globe geared toward this one core task - just in time hardware provisioning, but for most this is a very difficult and costly endeavour. Virtualization makes this sort of instant replication & provisioning of many virtual machines much easier.

Next is scaling up or the ability to scale vertically which means adding resources to a single server in a distributed system. Typically this involves the addition of CPUs or memory to a single virtual server in the form of Virtual CPU and RAM. Unlike a physical server, in a virtual environment you can change your virtual hardware characteristics, a physical server is what it is. You run at it's maximum potential limiting it's ability to easily scale up. If you need more scale you need more hardware or have to manually add more components to the physical server (RAM, CPU, storage, etc), which means downtime while the servers are upgraded. In virtual environment this isn't a limitation and can often be done on the fly.

Vertical scaling of existing systems also enables you to better leverage Virtualization technology because it provides more resources for the hosted Operating system and Applications that can share these resources in a multi-tenant environment. Virtualization also allows for more automated programmatic control of the system resources in correlation to the demands placed on the infrastructure or application being hosted. This is because in a virtual infrastructure you are not managing any actual physical components but instead virtual representations of them.

So it is very true that virtualization isn't a requirement of a cloud infrastructure, it just makes it a heck of lot easier to manage and scale out or up or both.

Get Off the Rails and Onto the Cloud

Thu, 26 Nov 2009 19:00:00 EST

About 10 years ago, a quiet bunch of IT revolutionaries, tired of expensive, complicated operating systems and the resources needed to support them, created a new breed of network management software and network monitoring systems. Pioneers like Solarwinds, Groundwork, Zoho (Adventnet), Hyperic and others offered 80-90% of the services of the big four at only 20% of the cost. They brought network and systems monitoring to the rest of us. These companies are faring well, as I write this. For example, Solarwinds, which recently issued an IPO, according to Gartner, has a market capitalization of $1.5 billion, on sales of $93 million. This is feeding a frenzy of interest by investors and those looking to acquire profit makers – defying the current recession.

Big Data on Grids or on Clouds?

Wed, 25 Nov 2009 23:15:00 EST

Now that we have a new computing paradigm, Cloud Computing, how can Clouds help our data? Replace our internal data vaults as we hoped Grids would? Are Grids dead now that we have Clouds? Despite all the promising developments in the Grid and Cloud computing space, and the avalanche of publications and talks on this subject, many people still seem to be confused about internal data and compute resources, versus Grids versus Clouds, and they are hesitant to take the next step. I think there are a number of issues driving this uncertainty.

Four Steps and 90 Days to Transform a Datacenter to the Cloud

Tue, 24 Nov 2009 22:15:00 EST

All this while the IT team is faced with another reality, the main corporate datacenter has 6-18 months left in terms of shelf life. The datacenter's power distribution and patch panel design was not built to handle the massive density and cooling power requirements. The sprawl of unstructured data, app servers, web servers and now virtual machines is proliferating at a pace that will force a space crunch in a time frame that is counter to the challenge from the business in terms of capital preservation and opex reduction.

Important Considerations to Build Cloud Computing Apps

Tue, 24 Nov 2009 15:30:00 EST

In many cases we as the industry talk about the cloud computing being a new and optimized approach to delivering IT services. From the point of view of application developers, cloud computing offers dynamic platforms that equip them with the capability to deliver their application in an on-demand fashion. Applications running on a cloud platform scale up and down to meet the needs of its users. So, in the face of this new delivery model for applications, should application architects and developers expect this to have an impact on application architecture and design?

Real-World Cloud Computing Applications

Tue, 24 Nov 2009 09:30:00 EST

In this article, we will see some examples of real-world Cloud Computing applications: Coca-Cola Enterprises uses a Cloud-based system to streamline operations with merchandisers in the field; Nasdaq uses Amazon’s S3 Cloud Service to deliver historical stock and mutual fund information, rather than add the load to its own database and computing infrastructure; Animoto, a small start-up which decided to use Amazon's Cloud Services, was able to keep up with soaring demand for its service and scale up from 50 instances to 3,500 instances over a three day period.

COSS BI: Open Source, Open Core or Openly Naked?

Tue, 17 Nov 2009 20:45:00 EST

Peter Yared wrote recently a BusinessWeek guest blog post called “Failure of Commercial Open Source Software.” Not surprisingly his post caused a lot of angry replies from people who work for COSS companies. “The emperor is not naked” they argued. I believe that the COSS emperor is openly naked. And the discussion shouldn’t be whether COSS [...]

IBM's Smarter Cloud

Tue, 17 Nov 2009 10:45:00 EST

A recent announcement from IBM signaled the open beta program of its newest cloud offering: IBM Smart Business Development & Test on the IBM Cloud. One of the newest offerings in the suite of cloud products from IBM, the IBM Cloud provides a public cloud where users can launch and run selected IBM software.

IT's Groovy Time Flashback

Tue, 17 Nov 2009 09:30:00 EST

As virtualization-lite creates swarms of increasingly dense VLANs in the data center, the IT industry appears to be responding by consolidating into coalitions, including Arcadia (EMC, VMW, and CSCO); HP/COMS; and IBM/JNPR. Each coalition will likely produce its own "branded container" dedicated to the simplification and tactical orchestration of growing VLAN empires. This consolidation takes us back to the 70s when IBM and the BUNCH offered ever-shrinking choices to smocked IT decision makers. Years later the network evolved and disrupted the consolidation with new equipment categories, new solutions and emergent demands soon addressed by a mushrooming venture capital industry and hordes of tech entrepreneurs.

Data as a Service Could Drastically Impact Success of SQL Injection Attacks

Tue, 17 Nov 2009 00:00:00 EST

The question is whether that impact is positive (a reduction) or negative (an increase).

One of the biggest threats to data integrity is the introduction of malicious content via SQLi (SQL Injection) attacks. Traditional database access methods don’t provide a lot in the way of validating requests and like HTML the vagaries of SQL allow for myriad ways in which a statement can be constructed – and thus exploited.

These vagaries, of course, are one factor in the reason why SQLi continues to plague applications and sites driven by user generated content. Another factor is certainly the number of touch points in application code where attacks might slip through. With every new SQLi technique comes the need to update every one of those touch points and ensure they can properly defend against the new variation or technique.

But service enabling data sources changes the point of entry. It centralizes access down to a single point of contact.

Joe McKendrick notes in a recent blog on a related topic (data quality and SOA):

Ash [Informatica’s Ash Parikh], who has been warning the industry about the quality of data — or lack thereof — surging through SOA-based infrastructures for some time now, says SOA data services open up many new avenues for connecting SOA with enterprise data management. “It’s much more than just data access,” he points out. “It’s making sure the data that is delivered is of the greatest quality.” [emphasis added]

If we expand “quality” to include “clean, untainted, and free of malicious content” then we’re pretty much on the same page.

SECURITY AND TRADITIONAL DATA ACCESS MODELS

Using traditional methods of database access (JDBC/ODBC/ADO.NET/PHP ADAPTERS) every time a developer wants to access the database they must:

1. Obtain a connection to the database

2. Construct the appropriate query

3. Execute the query

One assumes, of course, that prior to constructing the query that any user-supplied input is validated and any potentially malicious content either stripped or outright rejected.

Most web applications today are data-driven, meaning they require a database in which to store and retrieve content. These applications – and that includes blogs, content management systems, news sites, and social networking sites – may contain multiple queries on every page, meaning there are multiple points at which malicious content may be introduced into the system. Add-on the possibility of an API through which content may be added and you’ve increased again the number of potential “holes” through which an SQLi attack might be executed.

Service-enablement, on the other hand, effectively reduces the number of potential entry points through which an attack may occur. It reduces the attack surface.

In a service-enabled database access scenario, the applications still make the same number of “connections” because each query is designed to perform a specific task , but instead of those queries going directly to the database they are actually made to a service interface instead. It is the service interface that then handles database connections, constructs the query, and executes the query on behalf of the client application.

There are two possible security outcomes to this scenario.

1. Overall security is improved. Because there are fewer interfaces to secure the process of validating and further detecting potentially malicious code will be more thorough. Reducing the number of places in which these checks must occur also reduces the potential to “miss” a touch point when implementing security processes. Protection against SQLi is shared by all applications, so if security at the interface is properly implemented it will be beneficial to all applications using the service.

2. Overall security is degraded. Because the data access service interfaces are shared across all applications, any vulnerabilities are shared by all services utilizing the interfaces. It is also possible that the use of service-enabled interfaces may introduce additional avenues of attack. Service-enablement via SOAP/HTTP brings with it all the security vulnerabilities associated with XML and SOAP. Service interfaces are also publicly accessible, so authentication and authorization are paramount to successfully securing such implementations. Weak or easily breakable authentication schemes can lead to compromise. If the services are publicly accessible this could be an even higher concern.

ENSURING THE BEST POSSIBLE OUTCOME

It certainly appears at first glance that perhaps the possibility of a negative outcome – because of the impact to multiple applications –outweighs the potential benefits of improving security. But the change in architecture affords the opportunity to provide additional security around the service (as well as scaling benefits that are not typically associated with databases) than can tip the scales of benefits versus risk to the side of improving security.

A reduction in the number of entry points at which SQL queries are constructed from user input increase the resources that can be applied to the security of those interfaces. Fewer entry points affords a tighter focus on applying secure coding practices against the OWASP Top Ten. Testing against vulnerabilities, too, becomes easier and potentially more thorough.
Adding a data service layer, usually enabled by HTTP, enables the leverage of existing technology to secure the messages and protocols between the application server and the data services. A web application firewall can provide additional security scans on the services in real time as well as provides protection against (un)intentional denial of service attacks against the service. XML-related capabilities in WAF solutions can also address the potential introduction of XML specific vulnerabilities to the architecture, as well as offering support for authentication and authorization and encryption/signing of requests.
Moving data services to its own tier separates the tiers more completely and provides better agility for development. If a new vulnerability is discovered, for example, it need only be addressed in a limited, well-known set of services rather than across all applications that may be vulnerable. This can reduce the time to fix vulnerabilities or add new functionality to the data tier.

Service-enabling data sources is an architectural change that should not be executed upon lightly. It affects all other applications that rely on the data source, and introduces another layer into the architecture that may or may not make it more complex. Moving to such an architecture can be beneficial and can drastically improve security and decrease the likelihood of a successful SQLi attack. But if not entered into with the proper motivation to ensure the services are secured, tested, and protected against other security vulnerabilities it is possible that such an architecture could degrade your overall security posture and make it more likely that an attack will succeed.

Careful consideration regarding the dedication of resources and testing of data services is required before embarking on such an initiative. Collaboration between architecture, network, and development teams is required to design the service and its supporting application infrastructure in such a way as to ensure the change is a net positive for the entire organization.

Related blogs & articles:

Technorati Tags: MacVittie,F5,application security,security,SOA,services,tiers,architecture,web application security,OWASP,database security,web

How Can You Move Apps Between Private and Public Clouds?

Mon, 16 Nov 2009 19:00:00 EST

Three of the chattiest executives on God’s green earth were struck suddenly speechless when the Q&A segment of their VCE coalition announcement produced a straight forward question from customer Joseph Hooks. Question: “Will we be able to seamlessly move (applications) between in-house vblocks (private clouds) and service provider vblocks (public clouds)?”

Business Commerce Clouds

Mon, 16 Nov 2009 18:15:00 EST

As the general notion of cloud computing continues to permeate the collective IT imagination, an offshoot vision holds that multiple business-to-business (B2B) players could use the cloud approach to build extended business process ecosystems.

Cloud Computing Can Revitalize Your Career as Software Developer

Sun, 15 Nov 2009 02:45:00 EST

Everyone knows that the longevity and ultimate success of a platform lies in the developers willing to create on that platform. Creating a healthy developer ecosystem in which both the developer and the platform vendor can grow and prosper is very important. No one knows this better than Microsoft. It has long been their mantra that “developers, developers, developers” are the key to success. With most of the new large scale websites and platforms being launched on open source platforms and now the cloud, this is becoming even more important.

The Future of Cloud Computing Belongs to Asia

Thu, 12 Nov 2009 11:55:00 EST

People often ask me where I believe the biggest opportunities for Cloud Computing currently are, at first I thought they were asking about the technical particulars like public clouds, platforms etc, but recently I've come to realize it isn't so much the technology as much as where the technology is being adopted that is important. Really what they're asking me is where is the money? I'm here today to tell you, it's in Asia.

Businesses Need to Capture Web Data for BI to Work Better

Mon, 09 Nov 2009 19:22:00 EST

For businesses looking to do even more commerce and community building across the Web, text access and analytics forms a new mother lode of valuable insights to mine. Text-based content and information from across the Web are growing in importance to businesses. The need to analyze web-based text in real-time is rising to where structured data was in importance just several years ago. Indeed, for businesses looking to do even more commerce and community building across the Web, text access and analytics forms a new mother lode of valuable insights to mine. As the recession forces the need to identify and evaluate new revenue sources, businesse need to capture such web data services for their business intelligence (BI) to work better, deeper, and faster.

Public vs. Private Cloud Debate is Real

Wed, 04 Nov 2009 12:45:00 EST

The zebra in this analogy is the private cloud, where corporate IT departments feel safe controlling everything internally, and not risking exposure to the perceived tigers "out there" in the public cloud arena. But Tejada stated that in the end, large-scale IT initiatives always concern themselves with "access, security, and scalability. You always have to deal with those issues."

Industry Experts Discuss the State of Cloud Computing

Tue, 03 Nov 2009 07:15:00 EST

"With cloud computing, price to deploy applications goes through the floor while flexibility to scale those applications goes through the ceiling!" says WaveMaker CEO Chris Keene, in this lively round-up of The State of Cloud Computing compiled and published by Conference Chair Jeremy Geelan. 4th International Cloud Computing Conference & Expo is taking place this week at the Santa Clara Convention Center (November 2-4, 2009).

Manage Your Windows Azure Storage Using Cloud Storage Studio

Mon, 02 Nov 2009 14:45:00 EST

Cloud Storage Studio is a standalone WPF application to manage your Windows Azure storage. You will need to have .Net 3.5 installed on your computer to run this application. Here is the feature list of Cloud Storage Studio (at a high level. Storage account management, Table/Entity management.

Cloud Analytics Checklist

Wed, 28 Oct 2009 22:30:00 EDT

What are enterprise users looking for from a cloud analytics solution? Realtime + Historical Data. In addition to analyzing (historical) data held in databases (Oracle, SQLServer, DB2, MySQL) or datastores (Hadoop, Amazon Elastic MapReduce), a next-gen analytics solution needs to be able to analyze, filter and transform live data streams in realtime, with low latency, and to be able to "push" just the right data, at the right time, to users throughout the enterprise. With SQL/OLAP or Hadoop/MapReduce, users "pull" historical data via queries or programs to find what they need, but for many analytics scenarios today what's needed instead, to handle information overload is a continuous "realtime push" model where "the data finds the user".

Cloud Analytics

Wed, 28 Oct 2009 21:30:00 EDT

Business analytics is a major established sector of the IT industry, but it's one that's ripe for disruption. Cloud analytics is hot. Gartner's top two strategic technologies for the enterprise in 2010 are cloud computing and advanced analytics. Venture capitalist Ann Winblad, in a recent video, points out that the coming era of realtime cloud analytics will have a revolutionary impact on the enterprise, creating a radically new "innovation palette" for businesses of all kinds.

Study Says Economics Not A Driving Factor in Cloud Computing Adoption

Wed, 28 Oct 2009 19:15:00 EDT

Paul Miller, who pens Cloud of Data, had an interesting perspective during a chat this week on what effect infrastructure upgrade cycles might have on cloud computing adoption. Paul postulated that as these servers fail and organizations have to make the decision to replace or not replace them that cloud computing becomes a more viable option. That seems a reasonable assumption, especially if the primary reason organizations are evaluating cloud computing is driven by a desire to reduce costs. But in a recent post Paul posits this might not be the case, citing a recent ongoing study from Avanade in which C-level executives were asked, among other questions, how the economic climate effected their decisions regarding cloud. Interestingly “only 13% suggesting it had ‘helped’ adoption plans and 58% reporting ‘no effect.’”

In my conversations with Nick Carr and others, there’s been an underlying presumption (on my part, as well as theirs) that cost-saving arguments with respect to Cloud Computing would prove persuasive and compelling. It would appear not. This would suggest, of course, that Enterprise adopters are taking to the Cloud for reasons other than the budget sheet…

I’ll come back to this, as I’m not convinced there is a direct correlation between external economics and internal budgets, at least in this case. But let’s go with that for a moment. Assuming there are budgetary constraints on organizations what else would drive adopters to cloud computing and where are they getting the money?

Our own research on this subject found that efficiency, not reduction of costs, was the primary driver for public cloud computing adoption and that despite budgetary constraints 71% of organizations would see an increase in fund allocation for the purposes of public and private cloud computing initiatives. But a reduction in capital expenses still ranked high with 68% of respondents citing a reduction in capital expenses as a driver toward public cloud computing and 63% citing the same as a driver for private cloud computing.

ISN’T THAT CONTRADICTORY?

It seems so, doesn’t it? If organizations are interested in cloud computing as a means to reduce capital expenses then why would we be seeing an increase in spending on cloud computing initiatives, especially private cloud computing which almost certainly requires capital expenditures to achieve? After all, there’s virtualization software, improvements in infrastructure, and management systems that need to be in place for the successful implementation of a private cloud computing environment.

Perhaps the budget increases are coming at the expense of other areas in IT. Let us consider the aforementioned study on server failure:

In round numbers, the scheduled replacement of some three million servers worldwide, or about 3 percent of all servers, has been delayed, Peter Sondergaard, Gartner's global head of research, said today at the research firm's Symposium/ITxpo 2009 conference here. He added that the number of delayed replacements should reach 10 percent of all servers by 2010.

Certainly one way to reduce capital expenses is to not purchase new servers. But the servers that will begin to fail certainly have applications deployed on them that are if not critical at least important to the business, otherwise they would not have hardware dedicated to them. So where are those applications going? Virtual machines, most likely. Consolidated onto newer, more reliable hardware capable of supporting many applications contained within virtual machines. Virtualization is a primary enabler of consolidation efforts, which in turn reflects in IT budgets as reductions in capital expenditures.

Shifting the budget that would normally be allocated to acquire new hardware to virtualization and cloud computing initiatives, both public and private, would certainly explain an increase in funds available for cloud computing. This would also explain why external economic factors do not appear to be, according to Avanade’s study, a driving factor in cloud computing adoption.

COSTS STILL A FACTOR

It’s still important to remember that Avanade’s study doesn’t indicate that reducing costs isn’t a driver for cloud computing, it just says that external economics aren’t really playing a role in decision-making at this time. In fact within the study is this little nugget indicating cost savings are, in fact, an important factor in cloud computing adoption:

Companies are under equal pressure to innovate and save money and, many are turning to new technology as a way to do this. The vast majority of respondents (85 percent) report that their company’s rate of new technology adoption is either increasing or staying the same (83 percent in the United States).

But if we assume that organizations are shifting allocation of funds rather than asking for bigger budgets, then it is possible that economic constraints have little effect on adoption of cloud computing. If cloud computing initiatives required funding without reducing other existing budgets then it would be more likely that adoption rates would be slower than what is shown in both Avanade and F5 research and more folks in the Avanade research might have indicated that economics were in fact impacting their adoption plans.

Technorati Tags: MacVittie,F5,cloud computing,survey,research,Avanade,Paul Miller,economics,funding,budgets,costs,virtualization,consolidation,efficiency,web,internet,blog

Related blogs & articles:

Moving to the Cloud: Key Considerations for Cloud Storage

Wed, 28 Oct 2009 10:30:00 EDT

This post is part of a series examining the issues involved when moving applications between internal data centers and public clouds.

The true challenges in storage and data management in the cloud result from the diverse and often unfamiliar processes and infrastructures offered by the cloud providers, including: new provisioning methods, storage properties, data population and transfer, and systems for data management (snapshots, clones, replication, backup). The cloud providers define the relationship between servers and storage and often impose constraints on everything from allocation size limits to the ways in which storage is managed. These are just some of the things you’ll want to consider as you start to think about integrating cloud computing into your existing IT environments.

I’d like to focus in detail on the complexity and variability of cloud provisioning and storage properties. There are different models for storage in existing compute clouds, with the most common being an “inclusive” storage model. In this model, each server comes with a certain amount of storage attached to it. The storage is a fixed capacity that is provisioned when you create the server from the pre-existing templates.

For example, Rackspace gives you disk space that is proportional to the memory (RAM) size you select. The smallest memory/disk combination is 256MB of memory with 10GB of disk. With each doubling of memory, the disk space is also doubled until you get to roughly 16GB of memory and 640GB of disk. With the new Terremark vCloud Express, you get a system disk that is predefined for each “template” server you select. For a standard Linux distribution, you get a 10GB system disk, for Windows 2K3 you get a 20GB disk and for W2K8, you get a 40GB disk. Terremark’s vCloud Express allows you to add additional storage as new disks, while others (like Rackspace) allow to “resize” your servers and storage to create a new server with a larger disk and copy your data into it.

Amazon offers several distinct types of storage within EC2. The default storage you get with each server you create in the cloud is called “ephemeral” storage. You then have the option of allocating and attaching Elastic Block Storage (EBS), and there is also an object store system called Simple Storage Service (S3). Ephemeral and EBS are standard “block storage” devices – meaning they are viewed and used as disks attached to your server (/dev/sdg in Linux, D: in Windows) while S3 requires an API or other tools to integrate with your systems. The good part about the EC2 storage offerings is that you have some powerful options as you build for the cloud; the hard part is mapping the proper resources to your applications and integrating this with your existing processes. Specifically, the base storage is ephemeral, which means that if you power-off the server, or it has a hard fault, all the data on that storage is lost. This means that everything on these drives (boot parameters, application updates, user data, logs, etc.) is subject to loss when you power off the machine. There are several methods of handling this situation: 1) Build your servers every time you start them from a formula or other sources such that you don’t depend on the base storage being persistent; 2) Use Amazon or third party tool sets to periodically “bundle” your servers into S3 (effectively taking a snapshot of the server); or 3) Attach EBS storage to your image and store your important data on persistent storage.

Turning to granularity, we find a wide range in the units or increments of available storage in the various cloud providers. There is the “included” storage mentioned above that is often based on the size of the server and the requested OS type. To add storage, we find cloud providers (such as Amazon) allowing 1GB increments up to 1TB, and others (like Flexiscale) allowing only fixed increments of 50GB/100GB/250GB. For Rackspace, you can resize both the server and storage according to the defined fixed ratios, but these are bound to memory and CPU so there is no independent scaling of storage. The bare-metal cloud provider NewServers allows iSCSI storage to be attached to your servers in 250GB increments. In the cloud these varied increments really matter, because you are paying by the GB/month and if you need just a little more storage, you could end up having to purchase 10x more storage than you need, or having to pay for more memory and compute than you need.

The conclusion we can draw is that there are numerous storage configuration options in the cloud, and these options become linked to the server “flavors” defined by individual cloud providers. Because you don’t have the same control or even mechanisms in the cloud as you do in the local data center, the manner in which you allocate, populate and manage data in the cloud will be different. The work you do to understand and map your applications’ requirements into cloud-based storage requires changing your processes to match those of the cloud, and often this work is cloud-specific.

Beyond configuration issues, of course, there are many other concerns. For example, with data management, you have to determine how you will get your data into the system, how to grow your systems and how to protect your data. Right now most clouds use template servers that you have to build up from a pre-installed base operating system using update mechanisms and then re-installing the application components. As for protecting your data, there are also many cloud-specific options available – from RAID-protected EBS in Amazon, to data snapshots and cloning, to backup services offered by companies like Rackspace.

The bottom line is that cloud storage can be simultaneously simple and complex – just like cloud computing in general. It’s simple to use if you just want to try something new; complex if you want to integrate cloud storage into your existing processes and infrastructures.

Next: Networking in the Cloud

Amazon RDS vs. SQL Azure

Wed, 28 Oct 2009 09:45:00 EDT

Back in July I wrote my post about databases in the cloud. The big surprise that I discovered at the time was that the only “Native” RDBMS offering in the cloud came from Microsoft. Microsoft SQL Azure (launching formally at the PDC in a few weeks) is a mostly-compatible SQL Server as a Service release complete with support for Transact SQL/TDS. SQL Azure is a multitenanted DBMS with several customers running databases up to 10GB in size on a single server. Their target is the 95% of business applications running in the enterprise that have databases with less than 5GB of data (based on their research). Well, Microsoft is alone no more.

What is Enterprise Cloud Computing?

Tue, 27 Oct 2009 20:30:00 EDT

What is enterprise cloud computing? Simply stated, it’s a behind-the-firewalls use of commercial, Internet-based cloud technologies specifically focused on one company’s or one business environment’s computing needs. Enterprise cloud computing is a controlled, internal place that offers the rapid and flexible provisioning of compute power, storage, software, and security services to meet your mission’s demands.

What Comes After The Cloud?

Tue, 27 Oct 2009 10:30:00 EDT

Lately I seem to feel like that 80's Rock Band that had that one big hit, doomed to play the same song night after night. In my case I happened to stumble upon this thing called Cloud Computing a little earlier then most. Over the last 6 years or so I've watched as the concept of outsourced web centric IT go from a fringe concept to an overly hyped, albeit under adopted buzz word. I've watched just about anything with the word "cloud" attached to it take off.

Google Liberates Your Docs

Mon, 26 Oct 2009 19:31:00 EDT

In a note to the CCIF list, Sam Johnston informed us that Google too has continued on its promise to liberate our data as part of their Data Liberation Front project. This latest Google effort introduces a new feature that makes it much easier to get your content back out of the Cloud using a tool that lets Google Doc's users easily "Convert, Zip and Download." It's interesting to note that both Microsoft and Google released completing "open" initiatives today with Mircrosoft announcing they are opening the PST format for Outlook. It's great to see both companies actively battling it out for "Open Cloud" supremacy.

Running RDM/x on Amazon EC2 is DICEE!

Mon, 26 Oct 2009 19:30:00 EDT

I want to keep this post fairly brief because there is so much stuff going on at XSPRADA lately that I find myself pressed for time from 6AM to midnight on a typical day which usually also includes weekends, but that’s the price you pay for building a revolution. Ask Fidel, he knows. First of all, I finally had time last Sunday to record a screencast explaining how to install and setup our RDM/x software. In the process, I discovered that Camstudio and Microsoft Windows x64 decoder were my friends, reducing a 1.2GB video to 35Megs (phew!).

Everyone Should Be Skeptical About Cloud Service Providers

Sun, 25 Oct 2009 10:00:00 EDT

As we plummet down into Gartner's "trough of disillusionment", the cloud skeptics are making their voices heard. Although my professional focus is at the forefront of the cloud storage wave, I can not disagree with the content of articles with sensational headlines like "Cloud Storage: It's Strictly For Airheads" and "Why Cloud Storage Use Could Be Limited in Enterprises". The authors are doing exactly what everyone should be doing: Questioning the viability and suitability of cloud storage in the enterprise. The truth is, although I'm not the "cloud police", not all managed storage services are created equal. In fact, lots of them are, to put it bluntly, not worth much. Many cloud backup and archiving services use bare un-protected disk drives to store data, have no redundancy built into the system, and try to scrape up every cent by using home-brewed hardware. This is especially true in the consumer space, where bargain-basement (or even free) pricing has driven a race to the bottom in terms of quality. No business should use junky consumer solutions.

Are You Getting Excited About the Cloud Computing Expo in Santa Clara?

Sun, 25 Oct 2009 08:45:00 EDT

Whether you are searching for a Cloud Computing solution for your enterprise or you want to learn about the latest and greatest Cloud Computing technology, The Cloud Computing Expo in Santa Clara, California running from November 2 until November 4 is for you. http://cloudcomputingexpo.com/general/keynotes1109.htm Keynote speakers include Richard Marcello, President, Systems & Technology, Unisys, Shelton Shugar SVP [...]

EuroCloud and The Case for a Cloud Computing Trade Association

Fri, 23 Oct 2009 12:00:00 EDT

Some of the concerns I've heard repeatedly is the potential barriers to entry for participation in this type of association. The last thing this association should be is an inclusive club for a few select technology vendors and insiders. It needs to be available to all and should foster an engagement with both the existing community while also providing a formal / legal umbrella that the larger companies will feel comfortable participating in. I am also cognizant that it takes money to make money, so there needs to be a middle ground with potentially some of the larger vendors subsidizing the involvement of the smaller players and independents members. Simply membership should not be cost prohibitive.

Fit for Purpose Datacenters to Enable Clouds

Fri, 23 Oct 2009 10:45:00 EDT

The trigger for this post is a conversation I've had far too often with an IT executive who has an ambitious plan to leverage hypervisor virtualization to create a new data center infrastructure upon which his entire business would run. The goals are laudable; dramatic cost reductions, increased availability, decreased time to market (as measured by how long it takes to provision a VM)...all things any sensible business or IT executive wants, right? But when I asked about their plans for business applications that didn't fit his deployment options (literally small, medium, and large) I got an answer that made me cringe: "they'll have to".

IT Innovation Requires Network Innovation

Fri, 23 Oct 2009 10:30:00 EDT

A recent article by Larry Dignan about how IT has fallen behind the Tech Curve laments how slow and cumbersome enterprise IT has become relative to consumerized technologies. Larry covered a session at the recent Gartner Symposium and was advised by Gartner analysts that IT pros want the world to proceed in an orderly fashion and are weighed down by the legacy of previous choices. That's a fair statement. Gartner's solution, or at least that posed by analysts David Mitchell Smith and Tom Austin is for IT to simply let users buy their own gear:

Will You Comply or Just Check the Box?

Thu, 22 Oct 2009 18:45:00 EDT

Some of both, apparently. A recent Ponemon Institute PCI-DSS Compliance survey revealed that 71% of companies actually admitted that data security is not a top priority and 55% say they are only protecting credit card data and not other sensitive information like bank account info, social security numbers and drivers license data. Additional statistics show [...]

Clouds for the Enterprise Security & Performance

Thu, 22 Oct 2009 17:00:00 EDT

The intent of the blogs is to provide the thought leadership for readers seeking to create a sound strategy for exploiting cloud computing for the enterprise. The other lesson we learned is the transfer and access of highly confidential data in a shared environment/multitenant cloud model requires advanced encryption in a performance-oriented capability. Unisys is a firm we collaborate with that provides software technology and integration expertise that scrambles data packets being transferred or in motion and scrambles associated data in a multitenant stored environment with advanced encryption and compression to ensure both performance and security.

The Cloud Is Not A Synonym For Cloud Computing

Thu, 22 Oct 2009 14:15:00 EDT

“Where are you storing your data these days,” he asked casually after trying to come up with a better opening line but failing.

“Ah, dahhling,” she drawled while gesturing in no particular direction with an almost deprecating wave of her hand. “The Cloud, where else?”

Thanks to the nearly constant misapplication of the phrase “The Cloud” and the lack of agreement on a clear definition from technical quarters I must announce that “The Cloud” is no longer a synonym for “Cloud Computing”. It can’t be. Do not be misled into trying, it will only cause you heartache and headaches. The two no longer refer to the same thing (if they ever really did) and there should be no implied – or inferred - relationship between them. “The Cloud” has, unfortunately, devolved into little more than a trendy reference for any consumer-facing application delivered over the Internet.

Cloud computing, on the other hand, specifically speaks to an architectural model; a means of deploying applications that abstracts compute, storage, network, and application network resources in order to provide uniform, on-demand scalability and reliability of application delivery.

Of similar importance is the distinction between “user” and “consumer”, and this is important enough that we need to nail this down and be particular in our usage of these terms. “Consumer” is anyone who uses a web-application to do anything. Consumers make use of applications over the Internet, but they are not “users” of cloud because they don’t interface with “cloud” any more than they interface with hosting providers; they interface with an application. Users of cloud are developers, administrators, and IT organizations that interface with a cloud computing environment with the intention of deploying an application for their consumers.

I’m really not all that concerned whether we use “application user” and “cloud user” to distinguish between the two or “consumer” and “user” or “application customer” and “cloud customer”. I am firm in the belief that we need to distinguish between the two before we go any further down this road. The lack of distinction between the two points of view continues to confuse just about everyone who isn’t knee-deep in the technology and this is partially responsible for the Chicken Little responses to application failures that may or may not be deployed atop cloud computing architectures.

“The Cloud” has lost meaning as far as cloud computing models and data center architectures are concerned and is now little more than a technical-sounding term thrown around by consumers – and others - who never really understood the use of this delightful little phrase or that there’s even a difference. Maybe that’s success, as consumers shouldn’t care about internal implementation, but it’s also failure because it’s confusing to a lot of people who are supposed to care and be able to differentiate.

CLOUD COMPUTING AND APPLICATIONS ARE NOT INTERCHANGEABLE

When you deploy an application in a cloud computing environment and something goes wrong, who does the consumer call? Not the cloud computing provider. That’s a by-product of not caring about implementation – they aren’t supposed to know that information in the first place. It’s a near certainty that BitBucket’s customers or consumers, whichever you prefer, weren’t calling Amazon when its application became unavailable due to a DDoS attack, they were e-mailing, tweeting, and calling BitBucket – the application provider. Similarly, T-Mobile customers were likely calling, well, T-Mobile after Microsoft’s spectacular failure because they are the provider as far as customers are concerned, not Microsoft.

It’s not like a customer or consumer can call 1-800-THE-CLOUD and get support for whatever problem they’re having with whatever application they may have been using. They interface with an application, they use an application, and whoever is responsible for that application (hint: that’s you) is who they’re going to call and blame in the event of an outage, or a data loss, or a security breach.

That’s why it’s important that the cloud computing user, that’s you, have some knowledge of the cloud computing provider’s implementation. You don’t need to know the nitty gritty details, but you do need to understand whether the model is appropriate to meet your business and technical needs. Automatic scalability is often assumed to be part and parcel of a cloud computing environment, but that’s not always the case. If you need that scalability you’d darn well better understand whether it’s just part of the offering or whether you have to do something special to provision it. If your application suddenly doesn’t work when it’s deployed in a cloud computing environment, maybe you didn’t verify whether the provider’s load balancing solution is sticky or not, or whether there’s something you need to configure, specify, or modify in your application to make sure it works properly.

Somewhere along the lines the lack of distinction between users of an application and users of the cloud led to the erroneous and dangerous belief that users of cloud computing don’t have to know anything about the implementation. That’s just not true and it can be detrimental to not only the success of cloud computing but more specifically and closer to home, I’m sure, to the success of your application deployment.

The way in which we describe technology can and does have a profound impact on the way we use it, understand it, and support it. So let’s be more clear about who interfaces with what, and maybe in the future more people will be less apt to put forth the notion that a failure in the cloud is the same as a failure of cloud computing.

No, I won’t hold my breath, but I can hope, can’t I?

Technorati Tags: MacVittie,F5,cloud,cloud computing,infrastructure,architecture,provider,application delivery,scalability,terminology,failure,bitbucket,amazon,microsoft,sidekick

Related blogs & articles:

When Elasticity Is a Bad Thing

Thu, 22 Oct 2009 11:46:00 EDT

Elasticity is a highly-touted value of Cloud Computing. As demand goes up, you can provision new infrastructure to match it. You could even do this automatically. This is great, right? Daryl Plummer of Gartner was one of the first people to point out the problems with this - when he blogged that "Cloud Elasticity could make you go broke" back in March. More recently, the situation has become more worrying with the BitBucket DDoS incident against BitBucket's site hosted by Amazon Web Services. Hoff covers an interview with Peter DeSantis of Amazon, and (paraphrasing), says: