Thursday, October 29, 2009

Cloud Computing: Definition, Pros & Cons

My apologies, this article is a couple of days late due to illness.

I've talked about cloud computing and have touched more so on its benefits than anything else. In today's article, I wanted to give this technology-trend a place of its own, defining it properly and taking a closer look at its pros and cons ... perhaps more so on its cons; as to help exercise reasonable care, if nothing else.
Cloud Computing - Everything & The Kitchen Sink



What exactly is cloud computing?

You can find lots of definitions on Google or in technology-related publications. I, however, think of it as simply using centralized services over the Internet.

So what exactly are we talking about here? The "cloud" is more or less an IT or "geek" term for the Internet, and cloud computing, or cloud integration, means storing and having access to your computer data and software on the Internet, rather than running it on your personal computer or office server. In fact, if you use programs such as Gmail or Google Docs, you may not realize you are already doing cloud computing.

To put cloud computing in simpler terms, I invite you to watch this video:

Link: http://www.youtube.com/watch?v=XdBd14rjcs0

The companies offering cloud computing services are some of the biggest and best known in the information and/or technology industry: Google offers the Google App Engine, Amazon.com sells Elastic Cloud Compute (EC2), Microsoft released Azure and Windows Live Sky Drive, and AOL provides Xdrive, to name a few. If you’ve ever used MySpace, Facebook, LinkedIn, Picasa, Flickr, Hotmail, or one of the many Google services, then you’ve used cloud computing. A recent survey conducted by Pew Internet showed that 69% of all Americans use cloud-based software to store pictures, videos, emails, calendars and other various data online.

One definition I came across and liked enough to save (don't know its source) is:
Cloud computing is a way of providing both hardware and software as a service via the internet. Users access the necessary infrastructure, applications, systems, and hardware via the web using their web browser. Cloud computing combines the concept of software-as-a-service, where a software application is accessed and used in a hosted environment, together with the concept of utility computing, where shared, scalable software and hardware is purchased on a usage basis.

Whether cloud computing is the same as Software as a Service (Saas) or not requires a more technical definition and explanation. One I feel is not meant for this article. To learn more about that, however, I strongly encourage the following article, which I've found to be the best & most comprehensive explanation.

The benefits (pros) & advantages of cloud computing

Having your data and business computing programs running online, rather than exclusively on your office computers, means that you and your staff have access to them anytime, anywhere there's an Internet connection. Small businesses like the idea of being able to access their data from home, at a client's location, on the road, or even on a smartphone. And of course, if you know you will have to work disconnected, you can load the files you need onto a hard drive, a USB flash stick/drive or better yet use another offline/online cloud computing tool I mentioned in the past called Dropbox (or many like it). Many of the more common cloud computing offers out there, such as Google Gears and Adobe AIR, make it possible for some Web-based programs to be used on a computer even when you're not connected. That basically took one aspect that may have been viewed as a limitation and made it a huge plus.

Some of the more basic benefits/pros of cloud computing include:

  • How it frees up physical space - Think of remote data storage, servers you'd otherwise have to to keep in house, etc.
  • Cloud computing eliminates the needs for maintaining a cool enough environment for computer hardware that can easily overheat and crash.
  • Saves electricity - in larger organizations this alone may be worth it.
  • Eliminates the cost of maintaining one's own IT staff to update and upgrade software or hardware because the data center handles that.
  • Software & Hardware maintenance - Software provided online is upgraded and maintained by the provider, so the small business owner does not have to purchase the newest version of a software program or download fixes and patches for this or that server, router or hardware. Not having to buy a program outright but entering into a monthly or annual contract is very appealing, as is the fact that many applications are offered for free. The fixed cost allows business owners to plan rather than be caught off-guard when a costly software or hardware upgrade must be purchased.

For me personally, cloud computing has provided a sense of work-life balance. My personal budget, without any account numbers or anything except debits and credits, is in the cloud shared with my wife to simplify budgeting & updating. My to-do list is on the cloud. I email strictly now via the cloud. And best of all, my calendar is in the cloud. This affords me the flexibility to coordinate things between my personal life (more like several lives) and work. But enough about me.

Other less obvious benefits, especially for businesses, include:

  • Data fragmentation and dispersal are held by Unbiased Party (cloud vendor assertion); in fact, shifting public data to an external cloud reduces the exposure of the internal sensitive data.
  • Survey says that more than one-third of IT professionals abuse administrative passwords to access confidential data (see this)
  • Cloud homogeneity makes security auditing/testing simpler
  • Dedicated Security Team
  • Rapid Re-Constitution of Services
  • Greater Investment in Security Infrastructure (Real-Time Detection of System Tampering; Low-Cost Disaster Recovery and Data Storage Solutions, Hypervisor Protection Against Network Attacks).
  • 1 In 5 Companies Cutting IT Security Spending in 2009 (see this)
  • Simplification of Compliance Analysis
  • On-Demand Security Controls

It is important to note there are downsides to shipping your company's entire conglomeration of data to a remote storage site. Many people find it difficult to relinquish control of their data. And it's not what I recommend at all. Instead, I'm suggesting you understand the risks and make a decision about what needs to be in the cloud and what doesn't. For some, it all can be in the cloud, with back ups locally (on premise). For others it's a mix & match solution.

Let's take a look at some of the reasons why many are still apprehensive about cloud computing.

The risks (cons) & disadvantages of cloud computing

The chief executive of leading security company Check Point, Gil Shwed, has warned enterprises from plunging too quickly into cloud computing, stating that the technology is inherently dangerous.

“The basic fact that you’re sharing data with others is a huge security risk. If I have my server with my data at least I know that I can protect my data, but if I mix hundreds of these [servers] there might be one bug, in one application, that will allow a virus to move to the others. A bug, a configuration error, anything.”

Shwed did not wish to discourage the move towards the cloud, however.

“I am definitely a supporter of cloud computing, but I don’t think it will take over from traditional computing – it will have some portion of the market. One of the things the enterprises want is control, and once you outsource ... you lose a big portion of that control, so companies will only do this if there is a very, very, good reason," he said.

“There is a clear and interesting challenge there, the move from controlling things to letting other people control it for you.”

While I don't want to discount Mr. Shwed, you have to take his perspective into consideration. He's in the security business. Naturally, it's all about control; as evident by his quotes. As a small business or even a larger one (several larger ones actually), as I will mention in my conclusion below, some things are OK to relinquish control of provided the risks are understood and perhaps even mitigated. For example, I'm OK with relinquishing control of my email for my business or for most businesses I work with to cloud computing. The convenience and cost benefits out weight the control and risks (especially when they're mitigated).

Let's move on to other risks & disadvantages, and I'll try not to interrupt with my opinion again.

Security & Privacy
Research showed that the most common concern about implementing Cloud programs was security and privacy, a finding supported by an IDC study of 244 CIO's on Cloud Computing where 75% of respondents listed Security as their number one concern.

Cloud Computing Concerns



"With services such as Google's SaaS, data loss is less likely because the information is accessible from anywhere and anytime without saving it to an easily lost or stolen USB stick or CD" (Eran Feigenbaum, director of security for Google Apps)

Most organizations pay extraordinary attention and devote considerable resources to IT security, but that doesn't mean that their data is any more or less secure. The reality is that many attacks come from a lack of timely software update management and server misconfiguration. And the likelihood of such issues occurring (at least as frequently) is greatly reduced in the Cloud, where security-patching process is more streamlined than in a typical enterprise: vendors, servers and software architecture tend to be more homogeneous, and due to economies of scale, there is staff dedicated to security, ensuring application of the latest security patches.

While anonymous computer hackers are very unlikely to gain access to your business information in the cloud, a disgruntled former employee familiar with your company might be able to guess your passwords or answer your security questions and get into your accounts to do mischief —or worse.

Don't get me wrong, there have been a couple of highly publicized incidents recently where online services lost supposedly secure data or went offline for some period of time, during which their customers' accounts were inaccessible.

But it's worth noting that the larger Cloud providers tend to have a better grasp of threats, because these people deal with security issues at more complex levels than your own IT team sees on a daily basis.

Under the Law
To search your house or office (including documents or any files like music stored on your computer's hard drive), cops need to obtain a search warrant. To get to the information you've stored on a third-party's web servers, they only need a subpoena, which is easier to obtain. This latter kind of search can also happen without your knowledge. The NY Times reports:
Thanks in part to the Patriot Act, the federal government has been able to demand some details of your online activities from service providers - and not to tell you about it. There have been thousands of such requests lodged since the law was passed, and the F.B.I.'s own audits have shown that there can be plenty of overreach - perhaps wholly inadvertent - in requests like these.


Also under the law, is the difficulty of determining where data will be stored, and, thus, what courts have jurisdiction and what law governs the use and treatment of such data (i.e., local, state, federal, foreign, etc.). Information sent or received by an organization or individual using a cloud computing service could be physically located in the United States or any other country in the world. How will a cloud computing customer address situations where one country’s reporting or discovery obligations conflict with the data privacy laws of another county? How will a cloud computing customer protect its intellectual property rights against infringement or other wrongful activity when its cloud-based applications are hosted in a country that does not recognize certain intellectual property protection measures?

Companies should take note that the concerns over security and privacy are not limited to law enforcement. A company considering a cloud computing arrangement will need to know what steps the cloud provider takes to ensure that a customer’s data is not inadvertently disclosed to another customer who may be sharing the same resources. Organizations need to extensively vet the security and privacy standards of a cloud provider, including asking the following questions: a) What security commitments are taken and are they sufficient to meet my company’s needs? b) Do the terms of use commit the cloud provider to keeping a user’s data secure, or even private, from other legitimate users of the service? c) Do you have the right to perform audits on the cloud provider’s policies and processes? d) What right does the cloud provider have to change those policies and processes?

Third Party Control
Although this mainly applies to services not at the enterprise level, it is still very relevant. Amazon reacheing into customers' Kindles and remotely deletes already-purchased books. Facebook launching Beacon, an advertising mechanism that collects and publishes information about what you do on external web sites on your Facebook profile (only to apologize and offer opt-out later). Apple denies approval for the Google Voice application in the App Store. Twitter doesn't offer the ability to export more than 3,200 status updates. Flickr only lets you see the last 200 photos you uploaded if you don't have a paid Pro account. MySpace and Facebook don't immediately remove photos from their servers when you delete them. When you're living in the cloud, you're at the mercy of a third party who can make decisions about your data and platform in ways never seen before in computing.

Lock-Out
One of the biggest benefits of storing your data in the cloud is that you don't have to worry about backing it up anymore. Big companies with hundreds of servers are more reliable than your little external hard drive, right? Yes. But servers do go down, and when you're dependent on a web application to get your email or access that presentation for the big meeting, there's always the risk that your internet connection will go down, or that the webapp's servers will. Offline technologies like the previously mentioned Google Gears, decent export functionality, and a good backup system can alleviate this particular concern, but not all systems offer those things. Again, it's about understanding the risks and mitigating them.

In conclusion ...
It’s interesting that the government is behind cloud computing and has recently launched apps.gov, a catalog of applications in the cloud. Despite the challenges of cloud computing, many large organizations are not only evaluating it, but are jumping to adopt it. Jaguar Land Rover moved to Google Apps. And the Los Angeles City Council today (if I wasn't ill to write this on time - 2 days ago) voted unanimously to “Go Google,” (like Jaguar Land Rover) approving a $7.25 million contract to outsource the city’s e-mail system to Google’s cloud and transition some 30,000 city employees to the cloud over the coming year, according to a report in the Los Angeles Times.

Riding the Cloud Computing Bandwagon


In case you haven't noticed, I personally am right on the cloud bandwagon with all of you. My web browser is the one app I run on my desktop at all times; I've entrusted the likes of Google, Facebook, Twitter, Dropbox, Amazon, and Yahoo with my data just like you have. The key is to know what you're getting into when you make that choice, to crank up your personal security (like alternate email addresses and password choices) and to lobby for better user protection by hosting providers in the cloud.

Cloud Computing on the Rise


It’s clear that cloud computing is a wave of the future. Ultimately, putting your data in the cloud involves choosing convenience and productivity at the cost of some security risk. In the real world, convenience almost always wins, and there's nothing wrong with that. What's important is that you understand the dangers. All you have to do is exercise some good judgment and practices and you ought to be able to alleviate many of the risks and challenges of cloud computing, leaving you to enjoy its many benefits.  ▣

UPDATE: A relevant story to this post hit this evening, Thursday, October 29th, 2009, that a Federal Judge Says E-Mail Not Protected by 4th Amendment.

Click here to see Tuesday-only posts.

3 comments:

we are cloud said...

To compliment this post, here's a nice little infographic about cloud computing that's much easier on the eyes and the brain than a long blog article: http://bit.ly/cZLjN3

Unknown said...

Hey, I appreciate to your writing.

alica said...

This will one of the most important factors to consider when it will select a backup solution. With a good Cloud Backup system in place your data will be instantly restored allowing you to minimize any periods of disruption to your business activity.Thank you for sharing a great post.


it4la.com