Cloud Pro

As the largest players have published their most recent financial results, Gartner has weighed up the situation and looked into its crystal ball – and has given Amazon a greater advantage than before.

The analyst firm has put together its latest forecast around the global infrastructure as a service (IaaS) market and found growth of 31.3% in 2018. The worldwide IaaS market was rated at $32.4 billion (£26.2bn) last year, up from $24.7bn in 2017.

Amazon Web Services (AWS) was pegged by Gartner at having almost half (47.8%) of total market share, significantly ahead of Microsoft with 15.5%. Alibaba takes the bronze medal on 7.7%, with Google (4.0%) and IBM (1.8%) rounding off the top five. It's worth noting however that Gartner's 2018 IaaS Magic Quadrant put Google in as a leader, alongside AWS and Microsoft, for the first time.

Not surprisingly, Amazon shows the lowest growth across the four largest players between 2017 and 2018, with Alibaba (92.6% growth) taking the honours. Microsoft (60.9%) and Google (60.2%) scored comparatively, with Amazon (26.8%) trailing.

This makes for interesting comparison with another analyst, Synergy Research. In its most recently published figures, the company pins AWS as holding a third of the market, with Microsoft and Google at 16% and 8% share respectively.

Nevertheless, both analyst firms see a similar theme when it comes to the wider market. “Despite strong growth across the board, the cloud market’s consolidation favours the large and dominant providers, with smaller and niche providers losing share,” said Sid Nag, Gartner research vice president. “Only those providers who invest capital expenditure in building out data centres at scale across multiple regions will succeed and continue to capture market share.

“Google’s cloud offering is something to keep an eye on with its new leadership focus on customers and shift toward becoming a more enterprise-geared offering,” added Nag.

Synergy posits that the law of large numbers has taken effect in recent quarters; the growth among the largest vendors, while still strong, simply could not continue at the same pace. Yet as this publication put it when Amazon and Google’s results were released, it is not so much big numbers but big expectations. Amazon dipped on its $8bn quarter for AWS and got relatively pilloried, while Google Cloud got praise for its first $8bn run rate.

Gartner recommends that for those still looking to take a slice of the cloud infrastructure pie, particularly managed service providers, vertical industries and partnerships should be a key focus.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

It is not only the law of large numbers which applies in cloud revenues, but also the law of large expectations. Amazon Web Services (AWS) reported revenues of $8.38 billion (£6.7bn) for its most recent quarter although a slight dip in growth saw pessimism from the analysts. Google Cloud, meanwhile, secured an annual run rate of $8 billion in its results to a much friendlier outlook.

Amazon’s downturn with AWS was seeing only 37% growth year on year, compared with 49% the previous year. AWS profit had risen almost 30% year over year, with the cloud infrastructure arm now comprising more than 13% of total revenues at Amazon.

Google, meanwhile, saw its ‘other revenues’ – of which Google Cloud is a part – climb to $6.18bn (£4.97bn) for the most recent quarter, up almost 40% year on year. Google does not disclose specific revenues around its cloud suite – for the second successive quarter, an analyst asked this very question – yet the noises were all good from Alphabet’s senior management.

“Customers are choosing Google Cloud for a variety of reasons,” Google CEO Sundar Pichai told analysts in what was described as ‘another strong quarter’ for the company. Pichai cited reliability and uptime, flexibility, scalable data management, and artificial intelligence and machine learning as key areas of differentiation.

Industry watchers will not be particularly surprised by these features, as it has been Google’s message for a while. In February Google Cloud chief exec Thomas Kurian – in his first major speaking gig since taking over the role – cited five ways Google differentiated from its hyperscale rivals, which essentially amounted to the above four alongside hybrid and multi-cloud capability.

Of the 42 bullet points which represented Amazon’s highlights over the quarter, AWS commanded 11 of them. Particular developments of note included the general release of Amazon’s managed blockchain service, as well as a major new customer in the shape of NASCAR. The quarter was more product-heavy from an AWS perspective than usual, including the launch of managed machine learning services Personalize and Textract, as well as AWS Security Hub, which gives customers a central area to managed security and compliance across AWS environments.

From Google’s side, key highlights included two acquisitions – storage provider Elastifile and business intelligence platform provider Looker – as well as the launch of a new data centre region in Osaka.

Ruth Porat, chief financial officer at Alphabet, added a little more context to the reporting. “[We’re] pleased with the performance of both [Google Cloud Platform] and G Suite,” she said. “Growth in GCP was led by strong customer demand for our compute and data analytics products and G Suite continues to deliver strong growth. Overall, GCP remains one of the fastest growing businesses in Alphabet, and we’re really pleased with how the team is executing on both.”

Amazon SVP and chief financial officer Brian Olsavsky told analysts it was a ‘really strong quarter’ for AWS and batted away concerns of a slightly lower performance. “We’ve been pretty transparent with our AWS revenue and income numbers – we’ve been breaking it out [from] 2015 and we’re very happy with the growth in absolute dollar terms,” said Olsavsky. “We’re seeing a pick-up from customers and their usage, their increased pace of enterprise migration, [and] increased adoption of our services, especially machine learning services.

“Continually again, AWS is being chosen as a partner to many companies because of our leadership position both in technology, our vibrant partner ecosystem, and also the stronger security that we offer,” Olsavsky added.

As far as this translates to the wider industry, the slight fall in yearly growth may have been expected. Indeed, analyst firm Synergy Research has been citing the law of large numbers in recent quarters; more than 100% growth across the hyperscale cloud providers simply could not go on forever. In terms of market share, Synergy notes AWS remains at a third (33%) of the market, with Microsoft at 16% and Google 8% respectively.

You can read the full Amazon earnings release here and the full Alphabet report here.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Bobby Hellard

Project monitoring is one of the most important aspects of the SaaS development process. Unfortunately, it’s also one of the most neglected aspects. Given how complex and problem-prone this process can be, proceeding without careful scrutiny can create a lot of liabilities.

When monitoring is a priority in a SaaS project, system operation engineers are able to identify and address problems before end users even notice. Engineers can conduct workload and performance testing, estimate infrastructure performance, and gauge system accessibility by using monitoring software. All of this allows them to accommodate larger workloads from new users so system performance isn’t compromised. Additionally, project monitoring tools are necessary for calculating infrastructure costs when using a public cloud.

Evaluating public cloud monitoring tools

Two of the most widely used monitoring tools are Amazon Web Services and Microsoft Azure. Both have strengths and weaknesses, meaning it’s up to each user to choose the software that best fits his or her needs.

When working with an AWS infrastructure, the only tool necessary is Amazon CloudWatch, which works like an archive for metrics created by AWS. It persistently keeps track of the resources and applications running on AWS, and it gathers data points related to things like disc operations and usage of the central processing unit. If specific metrics reach preassigned limits, users receive a notification and have the option to automatically initiate Auto Scaling. Users can also create their own metric sets and track them accordingly as well as access CloudWatch through several convenient interfaces.

There’s a lot to like about this monitoring tool, but it has notable limitations. For instance, it can’t aggregate data from some locations or send alarms for more than five different metrics. Users also can’t manually remove metrics, and in some cases, obtaining them can be a lengthy process.

Despite this, however, CloudWatch is a popular monitoring tool because it excels at collecting data. The tool is designed to track and document what matters most to administrators, and those records can be kept for years to identify long-term patterns. CloudWatch handles monitoring, but more importantly, it provides insights.

Microsoft Azure is similar. It provides infrastructure metrics as well as Azure service logs. Data can be collected from application logs, activity logs, and performance counters. Users can then engage with the data in various ways. It can be sent to a third party for analysis or stored for 90 days in an archive (or routed to long-term storage). It can also be routed to an application like Application Insights or Power BI for in-depth analysis.

Much like CloudWatch, Azure Monitoring can also be set up to send alerts when metrics reach certain thresholds. Additionally, there are multiple ways to access Azure Monitoring tools. Users may not find the solution perfect, but it provides the functionality necessary to make project monitoring productive.

Evaluating private cloud monitoring tools

Applications that rely on a private cloud for infrastructure are harder to monitor, but it’s not impossible. There are several specialised solutions on the market, such as Nagios Core and Zabbix.

Nagios Core is a free, open-source product. It offers a number of tools that empower users to observe services alongside Windows and Linux hosts. Users have a fair amount of control over what metrics they want to follow, and the system can also be customised using common languages like C++ and PHP. Like all monitoring tools, this one also sends alerts.

The only real drawback of Nagios Core is that it doesn’t offer a graphic user interface to adjust system settings to customers’ needs. Instead, they have to be manually edited in the configuration files. Most users are able to look past this flaw, given that Nagios Core offers a wide range of free commercial plug-ins and, overall, is a highly customisable solution.

Zabbix is also a worthwhile monitoring software. It consists of a monitoring server that collects data, runs analyses, and sends alerts. It also includes a database, a web interface, and daemon agents that can run in either passive or active modes.

Unlike Nagios Core, Zabbix excels in terms of available customisations and the ease of implementing them. Thanks to intuitive templates, the initial configuration time is minimal, and additional templates can be applied later to further adapt the system.

Choosing the right monitoring tool

Ultimately, different users need different things from their monitoring tools. Use these tips to make the right choice:

• Take a trial of any commercial software to explore whether it has any problematic restrictions or limitations
• Search for tools that track the most important metrics, not the largest number of possible metrics
• Consider the total cost of tool ownership, including the licence and ongoing system maintenance

After the system is up and running, administrators need to manage it effectively. That includes testing alert functionality and responding promptly. It’s also important to apply the same metrics to different environments, including production, staging, and testing.

As helpful as monitoring software may be, its success depends on the people behind the technology. They must evaluate public and third-party solutions carefully, implement them correctly, and utilise them effectively. The right tool in the right hands makes project monitoring relatively easy, and thus, it’s a lot more valuable in the process.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

Keumars Afifi-Sabet

Bobby Hellard

More businesses than ever are now choosing to use cloud services. Despite the many benefits of doing so, such as reduced maintenance costs and improved scalability, there are a number of cyber security risks than organisations need to be aware of – including sophisticated phishing scams that intentionally target SaaS applications.

With more than 155 million active commercial monthly users, Office 365 is among the most widely used cloud hosted email and productivity suites – and consequently a prime target of cybercriminals. As threats intensify, organisations must ensure that their cloud security is suitably hardened.

Beware of BEC attacks

A business email compromise, or BEC for short, is a type of advanced phishing scam that has become prevalent in recent years. Such attacks involve cybercriminals posing as an employee, usually a C-level executive, in order to trick an associate of that person into wiring payment for goods or services into a substitute bank account.

To conduct a BEC attack, criminals will seek to either compromise a user’s account through a traditional credential harvesting phishing attack, or spoof the person’s email address so that it appears almost identical to the targeted account. Attempts will then be made to leverage the person’s identity to send phishing emails to others.

Italian football club, Lazio, is one the most high-profile victims of a BEC attack, having inadvertently wired a £2 million player transfer fee to a cybercriminal instead of the player’s former club. However, the fact that BEC attacks are reported only a fraction of the time – largely due to the reputational damage they can inflict – means that they are often left to thrive in anonymity.

A smarter breed of phish

To dupe their targets, BEC fraudsters conduct meticulous research. This entails monitoring company news, investigating supply chains and technology usage, plus undertaking reconnaissance – with any information gathered used to design more creative, custom and elaborate campaigns that are difficult for recipients to identify as malevolent.

Gone are the days of brazen scams with email subject lines such as ‘Congratulations you’re a winner’. To compromise Office 365 users, for example, criminals now use a range of fake requests and notifications, such as security alerts, non-delivery reports and meeting appointments. To instigate BEC attacks, hackers will seek to build victims’ trust by sending a sequence of emails.

It’s not just suspicious links that people need to look out for. Techniques to distribute malicious attachments are also becoming more sophisticated. One recently identified technique involves the use of PowerShell to inject malware when users preview files in Outlook – now it’s not always necessary to open a document to trigger an infection.

To evade firewalls and email gateways, hackers are hosting content on SharePoint and other trusted platforms. This makes unknown content harder to blacklist. Another attack technique, known as ‘NoRelationship’, exploits a weakness in Microsoft’s file filtering technology.

How to protect your employees

If your business subscribes to or is thinking of subscribing to Office 365 or another cloud service, then protecting against BEC and other phishing threats should be an important security consideration. Employee education is an important step but shouldn’t be relied upon to fully mitigate risks. People continue to be a weak link in the security chain.

Enforcing multi-factor authentication across all user accounts is highly recommended to provide an extra layer of protection should password credentials be cracked or stolen. Authentication technologies such as SPF and DMARC can also be implemented to help reduce receipt of emails from unknown senders.

Key to securing Office 365 and other cloud environments is also obtaining greater threat visibility. After all, businesses cannot secure what they cannot see. Next-Gen SIEM (Security Information and Event Management) and Endpoint Detection and Response (EDR) tools that support centralised log monitoring, behavioural analysis and incident response can be incredibly effective at helping to significantly reduce the time it takes to identify suspicious events as well as contain and shut down attacks before they spread.

Examples of behaviours that could indicate something anomalous include: account and infrastructure changes, unauthorised network connections, privilege escalation, and automatic forwarding of emails to other accounts.

Embracing the cloud with confidence

While it’s impossible to completely eliminate the possibility of employees failing victim to BEC scams or opening malicious attachments, having a multi-layered approach to cyber security incorporating prevention, detection and response will certainly go a long way to reduce the risk. By implementing just a few extra controls and procedures, your business will be better placed to avoid suffering operational disruption and avoid serious financial and reputational damage should an incident occur.

(c)iStock.com/abalcazar

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

CircleCI has secured $56 million (£44.8m) in series D funding to further its presence and product – with one investor arguing the company is the ‘DevOps standard’.

The San Francisco-based provider of continuous integration and delivery software has taken its total funding to $115.5 million, having most recently raised $31m for its series C in January last year.

CloudTech explored CircleCI’s proposition on its series C round around automating built, test and deploy processes across organisations’ development cycles, particularly around its combination of ‘speed and solidity.’

Since then, the company has put together a lot more, including a more than quadrupled increase in monthly job count, alongside 75 new employees added in 2019 and the opening of a first international office in Tokyo. Hubs have been added in Boston and Denver, while more than 900 ‘orbs’ – putting commands and jobs into single, reusable lines of code – have been initiated.

Various research in recent months has explored both the technical and cultural aspect of DevOps implementations. According to Trend Micro, in a study released at the start of this month, more than three quarters (77%) of those polled said developers, security and operations teams needed to be in closer contact.

As this publication has covered variously, as architectures and cloud technologies have improved, then customer expectations have improved with it. “Every company today relies on software to continuously improve its products and business in order to keep up with consumers’ evolving needs and expectations,” said Rob Zuber, CircleCI chief technology officer. “We believe humans should never have to wait on machines. This new round of funding will better allow us to provide developers flexibility and control to power their workflows seamlessly.”

The funding round was led by Owl Rock Capital Partners and NextEquity Partners, alongside existing investors Scale Venture Partners, Top Tier Capital, Threshold Ventures, Baseline Ventures, Industry Ventures, Heavybit, and Harrison Metal Capital.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.

LinkedIn has announced the launch of a ‘multi-year migration’ project to Microsoft Azure.

The move will see LinkedIn move its infrastructure across, having already utilised Azure for a variety of services including video delivery and machine translation across the social network’s news feed.

“Today’s technology landscape makes the need for constant reinvention paramount, especially as we look to scale our infrastructure to drive the next stage of LinkedIn’s growth,” wrote Mohak Shroff, LinkedIn SVP engineering, in a blog post announcing the move. “With the incredible member and business growth we’re seeing, we’ve decided to begin a multi-year migration of all LinkedIn workloads to the public cloud.”

One would have expected, given Microsoft bought LinkedIn for $26.2 billion three years ago, that migrating to Azure would have been part of the plan. Yet Shroff told VentureBeat that this was not quite the case. Shroff noted that Microsoft allowed LinkedIn ‘independence in decision making’, adding that Azure wasn’t particularly pitched to them.

This is inferred in the blog post. The success of Azure, ‘coupled with the opportunity to leverage the relationship we’ve built with Microsoft, made Azure the obvious choice.’ “Moving to Azure will give us access to a wide array of hardware and software innovations, and unprecedented global scale,” added Shroff. “This will position us to focus on areas where we can deliver unique value to our members and customers.

“The cloud holds the future for us and we are confident that Azure is the right platform to build on for years to come.”

Microsoft released its fourth quarter results earlier this month to almost universal praise; the company saw total revenues go up 12% to $33.7 billion (£26.9bn). While revenue for Azure is not specifically disclosed, Microsoft said it climbed 64% compared with the previous year.

Interested in hearing industry leaders discuss subjects like this and sharing their experiences and use-cases? Attend the Cyber Security & Cloud Expo World Series with upcoming events in Silicon Valley, London and Amsterdam to learn more.