Top threats to cloud computing!

Cloud Computing represents one of the most significant shifts in information technology many of us are likely to see in our lifetimes. Reaching the point where computing functions as a utility has great potential, promising innovations we cannot yet imagine.Customers are both excited and nervous at the prospects of Cloud Computing.To aid both cloud customers and cloud providers, CSA developed “Security Guidance for Critical Areas in Cloud Computing”,the industry standard catalogue of best practices to secure Cloud Computing.

The threats like abuse, nefarious use and data loss has been plagueing the users and providers akin. To know more about the top threats and how to overcome them click here.

Data security weakness of cloud computing

If cloud was the buzzword of 2009, then data protection of cloud computing has been the muse of 2010. European leaders and ENISA (European network and information security agency) have called for an agreement to protect information and have more stringent data protection laws, since the cloud has exposed cracks in the armor.To find out more about what agreement has to say click here.

Security Control Attestation for cloud Computing Providers

To understand how certifications can help the Cloud service providers, we can look at the strategies various IT sourcing providers with global delivery models adopted when it came to providing assurance to their customers on Information Security & regulatory compliance.


In the early years of outsourcing,there were lot of apprehensions expressed by potential customers around the state of Information Security, Risk Management & Regulatory Compliance when outsourcing to IT service providers.The IT service providers knew that to get customers business, they need to provide a reasonable assurance on the state of Information Security to their customers.  In any outsourcing discussion that took place around that time, there used to be a huge focus on such topics.


To read more of this blog click here.



Disclaimer: This post has been written by Tajeshwar Singh, who is an Enterprise Solution Architect from HCL  ISD. To read more of his posts go to www.Inthepassing.wordpress.com.

The other benefits of cloud

The cloud is not just about cost savings but more than that. This is one of the important reasons why companies like Cisco, Microsoft, Google and many other major players are moving to this model.In an interview Microsoft's Ron Markezich enlightens us about the other benefits of moving into the cloud based service.To know more Click here

Why companies are calling in "The Cloud"

Cloud computing is a cost-efficient model for provisioning processes, applications and services while making IT management easier and more responsive to the needs of the business. Therefore, in the Indian IT world, where it is in nascent stage, various vendors are trying to reach the customers attention. Few Indian companies, besides large vendors are offering cloud-based platforms in India.

According to the reports from the research firm, IDC, the cloud computing is reshaping the IT marketplace, creating new opportunities for suppliers and catalyzing changes in traditional IT offerings. Further, the firm expects that global spending on IT cloud services to grow almost threefold, reaching $42 billion by 2012.

To know more about the companies that support the cloud click here.

The Top 5 Draws of Technology!

Lighter weight services and services based on social media and web 2.0 are gaining efficacy from the traditional cost based services. While earlier CIO's were more concerned about cutting the straps of their budget; today they have changed their perspective to shift to a more agile and flexible model.

While earlier services showed that Business Intelligence was a top draw, this dogma has changed now, with virtualization and cloud based services gathering momentum. To read more of the report click here.

Security Risk and Complaince for Cloud Computing Model

IT has long struggled with the issue of securing the information and the underlying assets in tradition IT environments. There have been debates around how much security is enough. Over a period of time, various models have evolved to enable an enterprise get a grip over the information security issue. Most approaches encourage taking a risk based approach to measure adequacy of existing controls & identify areas of improvement to bring the risk to an optimum risk level.

Now, with the evolution & popularity of Cloud computing model in the recent time, it has added new dimensions to the concept of information security. There is a lot of discussion is taking place within the IT industry but there is still a haze around the security, risk & compliance issues. I believe that with time, a clearer picture is likely to emerge as Cloud service providers realize the importance to address concerns around information security and emergence & adoption of standards.

In my opinion, key issues around security, risk & compliance in Cloud computing model are:-

Governance – one of the concerns customers have expressed is the loss of governance over the service that is now provided in the Cloud. The control now resides with the Cloud service provider on issues like location of data, implementation of security controls and their functioning etc. This lack of overall control and hence over some of the topics that can potentially impact security, risk & compliance issues is a serious concern for the organizations exploring the use of Cloud based services.

Access Control – how do you control the access to the information residing in the Cloud? While models are emerging to control the end user access like OpenID etc, one of the key issues is around control access for the privileged users like administrators.

Data location within Cloud – this is another important concern since it has lot of regulatory & compliance issues. The location of data residing in Cloud also has implications on legal jurisdiction and implications of regional/country specific data privacy requirements.

For example – some of my customers especially in non-US geography have specifically expressed concerns around the implication of US patriot act on the Cloud computing services.

Securing Data at Rest – how secure is the information residing on the Cloud in a shared environment? Information segregation and encryption are key topics that are being discussed to address concerns around information assets in the Cloud.

Regulatory compliance – Organization do need to understand that while the responsibility of security the underlying assets may rest with the Cloud services providers, the responsibility & accountability to secure the information still rests with the enterprise. Traditional IT organizations are faced with lot of audit (internal & external) & security certifications like ISO27001/SAS 70 etc to demonstrate an acceptable level of presence & effectiveness of security controls. Similarly there will be a need for the Cloud service providers to accommodate their customers internal & external audit requirements along with an acceptable demonstration of presence of security controls within the Cloud services offered by them.

Incident Response & Forensics – another important point of concern is around support during incident response and forensics. Due to the shared nature of the Cloud based services and the fact that the service provider can host the data in any of the data centres, establishing log/audit trails to enable Incident Response and to support forensics can be a challenging task.

Organizations are realizing that when using a Cloud computing services, there is a limit to the security controls that can be implemented and enforced. One needs to rely on the controls that are implemented by the Cloud service provider and trust these controls are adequate and working the way they Ire designed. Similarly, there is also a limitation on how much audit information can be generated, collected in a tamper-proof format, retained and if that is adequate to satisfy an organizations audit requirements.

I believe that while enterprise will continue to use public Clouds, the IT spend on setting up private Clouds will increase over a period of time. Public Cloud services will be used to host non-critical services by the organizations while they will use the Cloud computing model within their organizational boundaries to benefit from the concept of Cloud computing while ensuring security, risk & compliance issues are within their control. I are most likely to see emergence of industry standards and also some guidance movement by government bodies on the topics of security, risk and compliance for Cloud services.

Disclaimer: This post has been written by Tajeshwar Singh, who is an Enterprise Solution Architect from HCL  ISD. To read more of his posts go to www. Inthepassing.wordpress.com.

Cloud for IT Continuity

Typically a DR site goes live when the main DC goes offline or fails. Quite often, the IT infrastructure at the DR site sits idle waiting for an untoward incident to be kicked back into life. In some cases, the infrastructure at DR site is used to host development & QA environments also.DR sites are typically activated for a short period of time and when the main site/DC is restored, the DR goes back to idle state.So,is there an alternative to blocking investments in a DR site using the evolution in the technologies used in DC and still ensure continuity of operations?

Can cloud & cloud based services provide enterprise with the desired level of continuity along with financial flexibility? In my opinion, this is a subject worth further exploration.

During a disaster, you either operate at same or reduced business service SLA’s around performance & availability as from the main site. The requirements from the DR site are “elastic” in nature. Most of the time,they compute requirement around CPU, memory is pretty low except when activated and operations are run from the DR site.Usually it is the storage that has a consistent use. Now, one of the major advantages of cloud computing is to meet elastic demands. Put two and two together..i feel there has to be a case to use cloud for IT continuity!

One of the possible challenges is the consistency of the virtualization technology within the enterprise with that of the cloud computing provider.I do not think the cloud computing providers fraternity has something of an intra-operable virtualized images across different cloud providers and private cloud platforms..(or maybe they have and this is something i have not tracked in the google-sphere yet!). So basically what that means is you are stuck with those set of cloud computing providers who use the same virtualization technology as you use in-house in your DC’s for the time being,but compared to having idle investment in your dedicated DR sites, this may be a small trade-off.

Some points that i can think of while evaluating the cloud platforms for DR & IT service continuity is – licensing of your existing applications; then again does the licensing allow you to run the apps from a cloud computing setup, connectivity options to allow migration of large amount of data/images to the cloud computing provider’s setup, how are you going to keep the images of your apps etc in the cloud environment up-to-date with necessary patches, security policies of the providers and client access mechanism.

Disclaimer: This post has been written by Tajeshwar Singh, who is an Enterprise Solution Architect from HCL  ISD. To read more of his posts go to www. Inthepassing.wordpress.com.

2010: Year for the Cloud

Cloud computing which was lagering behind at #3 last year behind Virtualization and BI, has leapfrogged to #1 this year. Read the full report and also see the cloud map by Clicking Here

Organizations will increasingly use cloud as a resource for both pre-production and production workloads.CIOs and IT managers will test the benefits of creating and managing internal, elastic virtual datacenters, automated infrastructure with integrated and variable chargeback and billing capabilities.Infrastructure environments will become increasingly dynamic and virtualized,and the “virtual datacenter” or VDC will emerge as the new enterprise compute platform.

SMB customers will reap benefits this year with the cloud or the PaaS model. Also owing to the security concerns both vendors and users will form a Cloud Security Alliance.There will also be preferences for customers to move within the cloud with open cloud standards incubator.

These are some of the predictions for 2010 cloud computing.

Changing Internal IT through the cloud!

Analysts claim that 2009 was a year of the cloud, though it was focussed over smaller projects. The main usage of cloud computing was in the arena of internal computing, or how could internal systems be connected to the cloud to gain maximum modernization.

By maximum modernization though, I mean how can existing IT architectures be reimplemented using he cloud computing concepts like virtualization, SaaS, SOA and Self provisioning. These concepts are called as  "private clouds" by many, this trend is more about learning to leverage internal IT resources effectively and efficiently than what was previously considered best practices. Specifically, this is the movement from single, monolithic, and underused systems to virtual environments, as well as the ability to address local and remote systems using APIs or services.

With such an amount of spend going towards the cloud, and internal users trying to revamp their individual architectures, IDC predicts that cloud will at 10% of all IT spending by 2013. 

To read the full report Click Here

The Cloud Visage

The term cloud is used as a metaphor for the Internet, based on how the Internet is depicted in computer network diagrams and is an abstraction of the underlying infrastructure it conceals. Typical cloud computing providers deliver common business applications online which are accessed from a web browser, while the software and data are stored on the servers.

These applications are broadly divided into the following categories: Software as a Service (SaaS), Utility Computing, Web Services, Platform as a Service (PaaS), Managed Service Providers (MSP), Service Commerce, and Internet Integration. The name cloud computing was inspired by the cloud symbol that is often used to represent the Internet in flow charts and diagrams.

What do they own?

In general, cloud computing customers do not own the physical infrastructure, instead avoiding capital expenditure by renting usage from a third-party provider. They consume resources as a service and pay only for resources that they use. Many cloud-computing offerings employ the utility computing model, which is analogous to how traditional utility services (such as electricity) are consumed, whereas others bill on a subscription basis. Sharing "perishable and intangible" computing power among multiple tenants can improve utilization rates, as servers are not unnecessarily left idle (which can reduce costs significantly while increasing the speed of application development). A side-effect of this approach is that overall computer usage rises dramatically, as customers do not have to engineer for peak load limits.In addition,"increased high-speed bandwidth" makes it possible to receive the same response times from centralized infrastructure at other sites.

What does the Shift Mean?

The shift would affect companies a few different sub-industries including software companies, internet service providers and hardware manufacturers. Companies in each of these industries will face significant change if cloud computing is to be the next step for the industry. While it is relatively easy to see how the main software and internet companies will be affected by such a shift, how companies in the internet and hardware industries will be affected is slightly more difficult.

So, its a mixed bag. Good for some providers whereas it makes life a little difficult for others.The term cloud coined a couple of years back, is basically the outsourcing of all IT.

Firms to Pump in More Money in the Cloud

The coming years will see corporate majors pumping in more money in the private cloud computing space than in public offerings. Such a scenario is expected owing to the fact that private cloud computing have the capacity to let firms access scalable and elastic IT services over the internet, without banking on a public service provider.

A Gartner report says the existing IT architectures and processes can be simply replaced by the cloud and more companies will jump on to the bandwagon. It has been pointed out that larger companies will maintain private clouds within the organization and use outsourced services when they want to access additional resources.

Adding, Gartner has said that continued investment in private cloud computing will allow public providers to learn from associated technological, cultural and business interface changes. It has been earlier pointed out that cloud computing could take a position as one of the most important strategic technologies for 2010, alongside green IT.

- RIM Desk

5 Key Parametres for Cloud Based Providers

Forrester's James Staten states that clients are getting "cloud weary." Therefore the biggest challenge for service providers is to set themselves apart in the eyes of the customer. This is only possible by developing ones core competence in the service area as well as meeting the commodity needs.

James Urquhart suggests 5 different parametres that will help service providers stay alive in the era of competition.

1.Ease of operations/use: The biggest question is "How does a company with hundreds of applications in the cloud strewn across a dozen or more vendors monitor and manage those applications to manageable service levels"?

Phenomenal user interfaces that will set some providers apart from others is one of the answers, but the real answer to the question lies in "behind the scenes" interfaces;such as APIs, publish and subscribe event streams, transparency and auditability systems, etc. This will set apart service providers.

2.Configurability: One of the things about today's best-known cloud computing environments is that they are essentially infrastructure and software architecture frameworks that dictate a lot about the application architectures that can be built on them.

Today application architects are forced to consider how they would build and operate their application in the infrastructure architecture given them. The answer for IaaS vendors are things like network architectures, data storage options and server options. Also useful here are services that enhance the infrastructure, like security systems, message queueing, and storage tiering.

3.Performance: Processing speed, memory speed, storage access, read and write speeds, latency, bandwidth are the things that are tunable by the cloud provider, either through technology acquisition, or through superior engineering and operations expertise. And, as with servers and storage, the fastest speeds will give you the edge.

4.Reliability and security: The core concept that every user looks for is risk mitigation.There is also a lot of debate over whether public cloud services are better than private data centers, that companies will need time to demonstrate differentiation in both of these categories.

Features have to be introduced to increase the transparency of both operations and security in any provider. Redundant distributed data stores, "early warning" DDoS detection events, auditability APIs;are all features that would increase customer's ability to trust that their provider has made the protection and availability of their data and functionality a core competency.

5.Customer service: Here vendor relationship management with the user will be a key differentiator. Customer service representatives should be very prompt in responding to customer queries.

Cloud computing is one of those market opportunities that makes or breaks companies. The winners will find ways to differntiate. Those that don't almost certainly can't win.