In view of the the quick-moving push to modernize many national security and emergency preparedness (NS/EP) capabilities to be cloud based capabilities, the White House tasked the National Security Telecommunications Advisory Committee (NSTAC) to produce a report aimed at answering the central issue: Can NS/EP processes be migrated to the cloud without undue risk?
What security lessons can be learned from LinkedIn?
Users are making it too easy for hackers.
If we take a closer look at the 6.5 million hashed LinkedIn passwords that leaked we find a large swathe of the user population are ignoring warnings of overly simplistic and obvious passwords. Would you believe the most common word or phrase found in a 160k sampling of the list was “link”?
And would you further shake your head in disbelief that “1234” and “12345” followed close behind. Rounding out the top 10 were “work,” “god,” “job,” “angel,” “the,” “ilove,” and “sex.”
More so than Facebook, LinkedIn is the social media of choice for business. So it is likely to be used by the users in your enterprise as part of their security-as-a-service (SaaS) profile. This makes their problem your problem.
If we learn anything from this debacle, it is that password management should be a priority for any organisation that …
Cloud Expo & PaaS: Where Do We Take It From Here?
“It’s the same old tune, fiddle and guitar, where do we take it from here.” – Waylon Jennings (RIP).
Waylon was talking about change in this song, which was entitled “Are You Sure Hank Done it This Way?” His view was that one could build on a great legacy – in this case, country music – while still respecting it. He faced the same reactionary forces that artists have faced since modern western society emerged during the Renaissance.
I daresay that cloud computing continues to face the same sort of resistance as it builds upon the great legacy of enterprise IT, and as it brings changes to decades of established procedure.
“Legacy IT” was a derisive term a decade ago, as an earlier generation of client-server systems threatened to eliminate the mainframe “hairball” (Scott McNealy’s term) for good.
From Derided to Accepted
Today, legacy IT is an accepted piece of the puzzle, and can describe anything that is not new. I don’t think anyone expects enterprise IT to run with “seamless interoperability” (the worst marketing buzzphrase ever) anytime soon. The challenge of making everything work is, after all, why everyone in IT has a job in the first place.
So…having returned recently from Cloud Expo in New York to my current office in Illinois, I have to ponder, “where do we take it from here?”
The big lesson from Cloud Expo, as I wrote a few days ago, is the inevitably of multi-cloud computing. Enough vendors are now partnering with one another, creating a vast new sea of middleware. This creates a marvelous tautology: a.) your current enterprise IT shop can migrate to cloud without having to rip stuff up, b.) cloud computing can be embraced by your organization because you don’t have to rip stuff up.
Well, this lesson might qualify as a big “duh” to enterprise IT pros who’ve been bemused to this point about “cloud myths” and the Den of FUD being furnished by companies large and small. Of course we will work within our own parameters! Of course we won’t tear everything up! In fact, we won’t tear anything up!
Now that cloud vendors – and those who write about the technology – have figured out there will be no clean lines drawn among public, private, and hybrid cloud, we’re all allowed to proceed with cloud initiatives as it suits our company’s fashion. The newish, cloud-era purveyors of Infrastructure (IaaS) in the cloud are now free to see hockey-stick growth in an arena populated by all of the traditional enterprise IT players.
Whither Larry’s Company?
While on this topic, I’d like to observe that it seems Oracle CEO Larry Ellison continues to have nothing of value to say about cloud computing. His feigned disgust of cloud of a few years ago has been replaced by condescending endorsement. The only good news here seems to be an earnestness among Oracle’s other employees to bend the company’s offerings to fit what there customers want. It is impossible for me to tell at this point whether cloud will ultimately destroy Oracle, be destroyed by it, or simply sleeken it up to meet the needs of this new era.
Time for More PaaS
In any case, Oracle must function within this multi-cloud universe. And within this universe, the question of software development (delivered as PaaS) also raises its head. I find PaaS to be the most dynamic area within cloud. As one PaaS entrepreneur told me in New York, “you know there are only two PaaS frameworks with more than $10 million in revenue right now – and one of them is Microsoft Azure.”
In other words, the Oklahoma Land Rush is on, and it will look chaotic to some, for some time.
As a business-side panelist during the DeployCon PaaS conference held within Cloud Expo noted, “the machine screws aren’t the same size” among the competing cloud development programs and frameworks today, further noting that “it will be a long time before they are.”
This can either signal chaos and cause timid managers to wait until things standardize themselves, or can signal healthy competition and cause bolder managers to pursue their cloud projects with what they think is the best software and framework for them.
I’m trying to think if there’s ever been a truly losing bet when it comes to software languages and frameworks. There must be more than 100 significant languages and frameworks already in use – and the better jobs go to those with well-developed skills in more than one of them.
Train ‘Em!
Which brings me to my final point of the day. Cloud computing promises to upgrade IT jobs. Let the water flow where it may – if lower level tech support continues to migrate to India, the Philippines, and Eastern Europe, let it. Train your people here, train them well, lobby against more H1B visas, and let a thousand flowers bloom.
If enough of the United States’ current population simply can’t be trained to meet the more extreme needs of cloud computing, then forget what I said about the visas. The opportunity is there in any case.
Ask the major research companies if you wish – or look around your shop, think about what you want to build on the cloud with PaaS, and see if you can find the talent to do it. If you can’t let me know – I’m ready to start a whole new series of PaaS conferences if there’s a need.
As Waylon himself wrote, “Tell me one more time just so I understand.” I think I’ve been told enough now.
Follow me on Twitter
Cloud Expo & PaaS: Where Do We Take It From Here?
“It’s the same old tune, fiddle and guitar, where do we take it from here.” – Waylon Jennings (RIP).
Waylon was talking about change in this song, which was entitled “Are You Sure Hank Done it This Way?” His view was that one could build on a great legacy – in this case, country music – while still respecting it. He faced the same reactionary forces that artists have faced since modern western society emerged during the Renaissance.
I daresay that cloud computing continues to face the same sort of resistance as it builds upon the great legacy of enterprise IT, and as it brings changes to decades of established procedure.
“Legacy IT” was a derisive term a decade ago, as an earlier generation of client-server systems threatened to eliminate the mainframe “hairball” (Scott McNealy’s term) for good.
From Derided to Accepted
Today, legacy IT is an accepted piece of the puzzle, and can describe anything that is not new. I don’t think anyone expects enterprise IT to run with “seamless interoperability” (the worst marketing buzzphrase ever) anytime soon. The challenge of making everything work is, after all, why everyone in IT has a job in the first place.
So…having returned recently from Cloud Expo in New York to my current office in Illinois, I have to ponder, “where do we take it from here?”
The big lesson from Cloud Expo, as I wrote a few days ago, is the inevitably of multi-cloud computing. Enough vendors are now partnering with one another, creating a vast new sea of middleware. This creates a marvelous tautology: a.) your current enterprise IT shop can migrate to cloud without having to rip stuff up, b.) cloud computing can be embraced by your organization because you don’t have to rip stuff up.
Well, this lesson might qualify as a big “duh” to enterprise IT pros who’ve been bemused to this point about “cloud myths” and the Den of FUD being furnished by companies large and small. Of course we will work within our own parameters! Of course we won’t tear everything up! In fact, we won’t tear anything up!
Now that cloud vendors – and those who write about the technology – have figured out there will be no clean lines drawn among public, private, and hybrid cloud, we’re all allowed to proceed with cloud initiatives as it suits our company’s fashion. The newish, cloud-era purveyors of Infrastructure (IaaS) in the cloud are now free to see hockey-stick growth in an arena populated by all of the traditional enterprise IT players.
Whither Larry’s Company?
While on this topic, I’d like to observe that it seems Oracle CEO Larry Ellison continues to have nothing of value to say about cloud computing. His feigned disgust of cloud of a few years ago has been replaced by condescending endorsement. The only good news here seems to be an earnestness among Oracle’s other employees to bend the company’s offerings to fit what there customers want. It is impossible for me to tell at this point whether cloud will ultimately destroy Oracle, be destroyed by it, or simply sleeken it up to meet the needs of this new era.
Time for More PaaS
In any case, Oracle must function within this multi-cloud universe. And within this universe, the question of software development (delivered as PaaS) also raises its head. I find PaaS to be the most dynamic area within cloud. As one PaaS entrepreneur told me in New York, “you know there are only two PaaS frameworks with more than $10 million in revenue right now – and one of them is Microsoft Azure.”
In other words, the Oklahoma Land Rush is on, and it will look chaotic to some, for some time.
As a business-side panelist during the DeployCon PaaS conference held within Cloud Expo noted, “the machine screws aren’t the same size” among the competing cloud development programs and frameworks today, further noting that “it will be a long time before they are.”
This can either signal chaos and cause timid managers to wait until things standardize themselves, or can signal healthy competition and cause bolder managers to pursue their cloud projects with what they think is the best software and framework for them.
I’m trying to think if there’s ever been a truly losing bet when it comes to software languages and frameworks. There must be more than 100 significant languages and frameworks already in use – and the better jobs go to those with well-developed skills in more than one of them.
Train ‘Em!
Which brings me to my final point of the day. Cloud computing promises to upgrade IT jobs. Let the water flow where it may – if lower level tech support continues to migrate to India, the Philippines, and Eastern Europe, let it. Train your people here, train them well, lobby against more H1B visas, and let a thousand flowers bloom.
If enough of the United States’ current population simply can’t be trained to meet the more extreme needs of cloud computing, then forget what I said about the visas. The opportunity is there in any case.
Ask the major research companies if you wish – or look around your shop, think about what you want to build on the cloud with PaaS, and see if you can find the talent to do it. If you can’t let me know – I’m ready to start a whole new series of PaaS conferences if there’s a need.
As Waylon himself wrote, “Tell me one more time just so I understand.” I think I’ve been told enough now.
Follow me on Twitter
Tell Your Children to Learn Hadoop
I spent some time last week with several vendors and users of Hadoop, the formless data repository that is the current favorite of many dot coms and the darling of the data nerds. It was instructive. Moms and Dads, tell … Continue reading 
Characters I’ve Met in the Cloud
After attending a Clouderati party and DeployCon the following day I started to question my very existence in the world of technology. It’s as if I’ve been closeted. It reminded me a little of my childhood in what was once West Berlin, where my father burst onto the art scene, only to flame-out after publicly humiliating the most powerful gallery of the time and his sponsor, Rene Bloch. My father wanted to flood the gallery with water and have the people traverse islands constructed as part of the exhibit as they moved from one island after another each hosting the paintings and provisions that had sustained the artist as he moved through one way of viewing to another as he constructed and sometimes destroyed his works. That’s another blog post entirely, perhaps even a chapter in a novel.
Cloud Expo: The Question Moves from "What" to "Why" to "How"
Cloud computing has crossed a Rubicon of sorts, and is now being embraced by a majority of enterprise IT shops – at least according to attendees and vendors at Cloud Expo in New York.
I remember interviewing Hal Stern (late of Sun and Oracle) a couple of years ago at the event, when he said that people were asking him “why should I do cloud?” rather than “what is cloud?” This year, the question is “how should I do cloud?”
There is a mad dash among big vendors, for one thing. IBM and HP have embraced the cloud fully, even to the extent of offering traditional PaaS development services as part of their infrastructure (IaaS) solution. Microsoft has re-launched Azure, in effect, working with new vendors to expand beyong its PaaS roots to become an IaaS vendor designed to compete directly with Amazon. Oracle’s Larry Ellison now speaks of cloud as if he invented it, as the database monster now seeks to maintain grip on hundreds of thousands of enterprise IT customers.
Meanwhile, the Battle of the Stacks among Eucalyptus, OpenStack, and Citrix CloudStack is merely part of a larger struggle for market share among the three Open Source companies against VMware, the company that triggered the move toward cloud in the first place.
Cloud Expo had a few highly interesting sub-events within it. In addition to its traditional Cloud Computing Boot Camp and the RightScale conference, this time Cloud Expo hosted a day-long presentation from the Open Data Center Alliance (ODCA), and the initial DeployCon event, which focused on the pack of PaaS vendors who are rubbing against one another for supremacy in this key space.
The word of the day here was “multi-cloud.” It turns out that enterprise IT is complex, and that cloud is not going to eliminate that complexity, at least with larger shops. However, it will continue the push in recent years to eliminate silos, decouple and loosely recouple services, get a grip on measuring things, and provide the vaunted “single pane of glass” through which IT management and view and manage what’s going on.
Cloud’s potential to offer apparently infinite elasticity and to remove some of the day-to-day management headaches when moving things offsite remain as great future opportunities for cloud. But it seems that customers are doing their best to avoid Vendor Lock-in 2.0 and to work with multiple companies to get what they need. From what I saw at Cloud Expo, the need for highly skilled IT worker bees and managers will only increase as companies realize that they really need to know what they’re doing in the cloud; it’s not just a buzzterm, not a panacea to IT complexity, but rather, a foundational, transformational change.
The CRM lottery – will you get the outcome you expect?
Let’s discuss a couple of the heavyweight C words in the IT Sector: cloud and customer relationship management (CRM).
What do they have in common?
Well they have both certainly provoked a lot of press coverage and airtime; both have driven large brand name vendors to jump in with big investment, acquisitions and marketing hype; both have helped drive each other’s growth and both certainly have had customers debating what and when they should elect to use such a solution.
CRM has been a hyped acronym for many years and can mean many things to many people. Many debates abound in this area from if it is the correct terminology to describe what its used for, to how much does it really cost, to what ROI can really be achieved.
The fundamentals are though that a way to manage customer information, share it securely, track customer interactions and …
Bursting into the Clouds – Experimenting with Cloud Bursting
Guest Post by Dotan Horovits, Senior Solutions Architect at GigaSpaces
Dotan Horovits is one of the primary architects at GigaSpaces
Who needs Cloud Bursting?
We see many organizations examining Cloud as replacement for their existing in-house IT. But we see interest in cloud even among organizations that have no plan of replacing their traditional data center.
One prominent use case is Cloud Bursting:
Cloud bursting is an application deployment model in which an application runs in a private cloud or data center and bursts into a public cloud when the demand for computing capacity spikes. The advantage of such a hybrid cloud deployment is that an organization only pays for extra compute resources when they are needed.
[Definition from SearchCloudComputing]
Cloud Bursting appears to be a prominent use case in cloud on-boarding projects. In a recent post, Nati Shalom summarizes nicely the economical rationale for cloud bursting and discusses theoretical approaches for architecture. In this post I’d like to examine the architectural challenges more closely and explore possible designs for Cloud Bursting.
Examining Cloud Bursting Architecture
Overflowing compute to the cloud is addressed by workload migration: when we need more compute power we just spin up more VMs in the cloud (the secondary site) and install instances of the application. The challenge in workload migration is around how to build a consistent environment in the secondary site as in the primary site, so the system can overflow transparently. This is usually addressed by DevOps tools such as Chef, Puppet, CFEngine and
The Cloud Bursting problem becomes more interesting when data is concerned. In his post Nati mentions two approaches for handling data during cloud bursting:
1. The primary site approach – Use the private cloud as the primary data site, and then point all the burst activity to that site.
2. Federated site approach – This approach is similar to the way Content Distribution Networks (CDN) work today. With this approach we maintain a replica of the data available at each site and keep their replicas in sync.
The primary site approach incurs heavy penalty in latency, as each computation needs to make the round trip to the primary site to get the data for the computation. Such architecture is not applicable to online flows.
The federated site approach uses data synchronization to bring the data to the compute, which saves the above latency and enables online flows. But if we want to support “hot” bursting to the cloud, we have to replicate the data between the sites in an ongoing streaming fashion, so that the data is available on the cloud as soon as the peak occurs and we can spin up compute instances and immediately start to redirect load. Let’s see how it’s done.
Cloud Bursting – Examining the Federated Site Approach
Let’s put up our sleeves and start experimenting hands-on with the federated site approach for Cloud Bursting architecture. As reference application let’s take Spring’s PetClinic Sample Application and run it on an Apache Tomcat web container. The application will persist its data locally to a MySQL relational database.
The primary site, representing our private data center, will run the above stack and serve the PetClinic online service. The secondary site, representing the public cloud, will only have a MySQL database, and we will replicate data between the primary and secondary sites to keep data synchronized. As soon as the load on the primary site increases beyond a certain threshold, we will spin up a machine with an instance of Tomcat and the PetClinic application, and update the load balancer to offload some of the traffic to the secondary site.
On my experiment I used Amazon EC2 and RackSpace IaaS providers to simulate the two distinct environments of the primary and secondary sites, but any on-demand environments will do.
REPLICATING RDBMS DATA OVER WAN
How do we replicate data between the MySQL database instances over WAN? On this experiment we’ll use the following pattern:
1. Monitor data mutating SQL statements on source site. Turn on the MySQL query log, and write a listener (“Feeder”) to intercept data mutating SQL statements, then write them to GigaSpaces In-Memory Data Grid.
2. Replicate data mutating SQL statements over WAN. I used GigaSpaces WAN Replication to replicate the SQL statements between the data grids of the primary and secondary sites in a real-time and transactional manner.
3. Execute data mutating SQL statements on target site. Write a listener (“Processor”) to intercept incoming SQL statements on the data grid and execute them on the local MySQL DB.
To support bi-directional data replication we simply deploy both the Feeder and the Processor on each site.
AUTO-BOOTSTRAP SECONDARY SITE
When peak load occurs, we need to react immediately, and perform a series of operations to activate the secondary site:
1. spin up compute nodes (VMs)
2. download and install Tomcat web server
3. download and install the PetClinic application
4. configure the load balancer with the new node
5. when peak load is over – perform the reverse flow to tear down the secondary site
We need to automate this bootstrap process to support real-time response to peak-load events. How do we do this automation? I used GigaSpacesCloudify open-source product as the automation tool for setting up and for taking down the secondary site, utilizing the out-of-the-box connectors for EC2 and RackSpace. Cloudify also provides self-healing in case of VM or process failure, and can later help in scaling the application (in case of clustered applications).
Implementation Details
The result of the above experimentation is available on GitHub. It contains:
§ DB scripts for setting up the logging, schema and demo data for the PetClinic application
§ PetClinic application (.war) file
§ WAN replication gateway module
§ Cloudify recipe for automating the PetClinic deployment
See the documentation on GitHub for detailed instructions on how to configure the above with your specific deployment details.
Conclusion
Cloud Bursting is a common use case for cloud on-boarding, which requires good architecture patterns. In this post I tried to suggest some patterns and experiment with a simple demo, sharing it with the community to get feedback and raise discussion on these cloud architectures.
More information can be seen at an upcoming GigaSpaces webinar on Transactional Cross-Site Data Replication on June 20th (register at: http://bit.ly/IM0w9F)
Guest Post: The rise of Outsourcing-as-a-Service
15th June 2012
What is the response to the growth of cloud from leading BPO and outsourcing companies? Is being a good service provider essential to the success of the customer? Mateen Greenway, HP’s Chief Technologist for EMEA Public Sector, gives us his perspective.