Last month Gartner Analyst Jay Heiser conducted an extremely informative and thought-provoking webinar entitled “The Current and Future State of Cloud Security, Risk and Privacy.” During the presentation, Mr. Heiser highlighted what he called the “Public Cloud Risk Gap,” characterized in part by inadequate processes and technologies by the cloud service providers and in part by a lack of diligence and planning by enterprises using public cloud applications. In many ways, it was a call to arms to ensure that adequate controls, thought and preparation are put to use before public clouds are adopted by enterprises and public sector organizations.
From the side of the cloud application provider, the webinar noted that most cloud service offerings are incomplete when measured against traditional “on-premise” security standards, there are relatively few security-related Service Level Agreements (SLAs), and there is minimal transparency on the security posture of most cloud services. From the enterprise side (the cloud service consumer), he points out that they frequently come to the table with inadequate planning and consideration in the area of security requirements definition and have an incomplete data sensitivity classification governing their data assets. Despite this, the webinar highlighted that organizations of all sizes are increasingly willing to place their data externally, and they are increasingly likely to have at least some formalized processes for the assessment of the associated risk – which is good news.

read more

Eucalyptus was originally known as one of the key open-source contenders in the battle for private cloud computing customers. Later, it became known as the company that broke with the pack to become compatible with AWS public cloud services, thus becoming a player in the world of hybrid cloud.

Now Eucalyptus moved to a 3.2 version with a new GUI that enables self-service, as well as simplified cloud administration and usage reporting.

The new GUI “allows users to perform self-service operations including the provisioning of instances, keypair and password creation, Elastic Block Store (EBS) volume and snapshot operations, image catalog listing and registration, user group operations, and elastic IP operations,” according to the company.

Eucalyptus 3.2 is more robust than previous versions as well, with the company stating its “load-test harness may handle up to 6000 concurrent connections to 20 test applications across multiple groups and phases of development.”

I asked Eucalyptus CEO Marten Mickos how he views the company’s positioning now and how much of 3.2’s improvements and enhancements came from customer feedback.

“Most of the new features came from customer requests,” he said. “One of our big
corporate customers asked for the VNX adapter, for example. The reporting and logging
was asked for by customers (in addition to other features).”

Mickos also said he thought that he and the company’s major competitors “each have our own sweetspot. We are the only AWS-compatible enterprise-focused cloud platform. OpenStack is popular among those who build their own cloud platform. CloudStack is popular among service providers. VMware’s vCloud Director is not very popular, but to the degree it is used, it is used by customers who have gone all-VMware.”

read more

“The ‘how,’ many change, but the ‘what’ is fundamental to risk management.”

I heard these sage words at a recent ISSA (Information Systems Security Association) meeting from a CIO speaking about security from the cloud.

He continued, “Risk is not unique to the cloud. It experiences the same issues that affect any outsourcing or third party deliverable. It is bounded by the same concerns regarding governance—does it meet the requirements of my industry? Is my data free from co-mingling? Are the proper notification protocols in place?”

Do a Google search on “cloud security” and the first entry is “How secure is the cloud?” True professionals know the argument is not about technology or how security is delivered, but rather one of governance. You need to know exactly who HAS access to what resources and if these levels of access are appropriate.

You need to know who IS accessing resources …

Cloud computing isn’t just re-inventing technology, it will also drive evolution of the business practices that the technology is used for.
For example CRM: Customer Relationship Management.
This is a science that started as simple contact management apps, like ACT!, through Goldmine then of course Salesforce.com.

After their ASP (Application Service Provider) phase of the Cloud evolution we’ve since had the social media explosion and so the principle category to add is “social media CRM”. After that came Cloud and so we’re now at a phase best described as Cloud 2.0.

This is most powerfully demonstrated by the public sector, where CRM is about ‘citizen engagement’ and where the core expression of the model can be referenced through ‘CORE’ design, standing for Community Oriented Re-Engineering.
In short this reflects the simple point that online is about communities, and how you re-engineer your business processes to harness this principle is the fundamental nature of this CORE design and therefore how it can be used to implement a Cloud 2.0 strategy.

read more

At the Amazon Web Services Re:Invent conference Tuesday Red Hat rolled out OpenShift Enterprise, the Platform-as-a-Service (PaaS) designed to be installed on-premise in customer data centers or on private, public or hybrid clouds that it announced in May.
Since it launched the thing at Re:Invent one might logically deduce that Red Hat will host the widgetry on Amazon’s EC2.
The product is bound to compete with VMware’s open source Cloud Foundry and its Spring framework if for no other reason than Red Hat loathes VMware and regards it as its biggest enemy, someone to crush.
Anyway, it’s Red Hat’s latest step in delivering its PaaS strategy and is supposed to be the industry’s first comprehensive open on-premise PaaS for the enterprise.

read more

SYS-CON Events announced today that Aspera, Inc., creator of patented fasp™ transport technology that moves the world’s digital assets at maximum speed, will exhibit at SYS-CON’s 12th International Cloud Expo, which will take place on June 10–13, 2013, at the Javits Center in New York City, New York.
Aspera’s unwavering mission is to create the next-generation software technologies that move the world’s large data at maximum speed, regardless of file size, transfer distance and network conditions. With the unstoppable explosion of Big Data in a world where IT and networking infrastructures are more diverse and flexible than ever, Aspera focuses on supplying innovative data transfer solutions that help organizations operate and collaborate more effectively on a global scale.

read more

Let’s take the notion of a user identity – or to be more precise, the user’s avatar – and consider it to be a Cloud resource. The user, that is, we can provision such avatars as we see fit. And because they’re in the Cloud, they’re location independent. Facebook could use our avatar. Assign it privileges or other properties. Or our bank. Or our employer. But we control it.
The reason PII has such power, of course, is because we give it power. Knowing a username and password gives you the power to access a system. Knowing your Social Security Number and birth date may give you the power to get bank account information from a call center rep. Add a bit more knowledge and you have the power to apply for a loan or a job or a security clearance. The old adage states that knowledge is power, but information only has power if we choose to empower it.

read more

SYS-CON Events announced today that SHI International Corp., one of North America’s top 20 largest IT solutions providers, has been named “Diamond Sponsor” of SYS-CON’s 12th International Cloud Expo, which will take place on June 10–13, 2013, at the Javits Center in New York City, New York.
Founded in 1989, SHI International Corp. is a $4 billion+ global provider of technology products and services. Driven by the industry’s most experienced and stable sales force and backed by software volume licensing experts, hardware procurement specialists, and certified IT services professionals, SHI delivers custom IT solutions to Corporate, Enterprise, Public Sector, and Academic customers. With over 1,900 employees worldwide, SHI is the largest Minority and Woman Owned Business Enterprise (MWBE) in the U.S. and is ranked 18th among Everything Channel’s VAR 500 list of North American IT solution providers.

read more