Just a few days away from Las Vegas

I'm just a few days away from Las Vegas and the Spring 2012 Cloud & Windows Connections conference and my enthusiasm is starting to ramp up! For every vendor I meet I'll ask just one simple question, "What can the Cloud do for me?"

Rob

The Cloud still needs work....

To put it bluntly, the Cloud still needs work. In a simple example, instead of using music that is stored on a local device, you want me to listen to my music using a Cloud based service such as Pandora? I've used several different cellular vendors and they all have flawed networks. If I have trouble making a phone call, why would you think I'd be able to listen to my Cloud-based music?

I'm a big believer in Cloud based services, especially for businesses. Google Apps is good for small businesses while Office365 is a more viable solution for larger entities that rely upon Microsoft Office for their productivity suite.

Rob

IT Operations and keeping the lights on.....

As the IT Manager for a geographically dispersed organization, I spend much of my time “keeping the lights on” - meaning making sure that the voice & data networks are up & running. A better way to refer to this is IT Operations and that is what I spend the majority of my time on.

Now the cloud computing proponents out there would tell you, “Hey, with the Cloud you have nothing to worry about” but that is not actually the case. All the Cloud does is make computing resource available over the Internet (via web services). End users must still get to the Cloud and most folks still work in an office building which means a Local Area Network (LAN) so people can share local computing resources. And Local Area Networks, just like Wide Area Networks (WAN), mean Identification & Authentication (IdA) plus don’t forget Authorization. Because I manage a geographically dispersed network, I deal with LAN and WAN networking as well as Cloud issues – has anyone heard of DNS (aka Domain Name Services)? If you have, good and if you haven’t, do a bit of homework because it’s important. Both internal & external DNS must be managed so whether the SoA (Start of Authority) for your organization is your ISP or a third party vendor, someone within your organization still must be in charge. There is always a person responsible for the important things.

How about Software-as-a-Service (SaaS) or Cloud-based applications? Your company is still responsible for the customer & client data in the databases that are the backend systems of all SaaS solutions. It is immaterial whether the server housing your confidential customer data resides locally (meaning “on premises”) or in the Cloud – you are still responsible for protecting it. Who administers the user accounts of SaaS applications? The Cloud vendor’s responsibility is to make sure “the lights are on” – meaning the application is up & running and nothing more. Your firm must still decide which employees get access to what data and that is an organizational decision. What doesn’t have to be done is the maintenance work on the individual servers that would house the application software if they were on premises. That is one advantage of the Cloud that is undeniable and a reduction in the amount of work the internal IT staff has to do by about 10%.

So your organization has moved its critical systems into the Cloud (public, private, or hybrid it doesn’t matter – all that matters is that the systems are not on premises). Ensuring that the end users have access to these systems is IT Operations and still the responsibility of the internal IT staff. Teleworkers working remotely from their homes, sales people on the road, and employees spread out among branch offices all represent the different kinds of access required for an organization to function. Oh, did I forget to mention phone service? Well, these days with simple VoIP solutions such as Skype or more complex telephony solutions, phone service is just another form of data – getting access to your phone is the same as getting access to your applications.

A good principle to remember is C-I-A which means Confidentiality, Integrity, and Availability. Integrate these principles into your IT Operations so that regardless of where you compute from (locally or in the Cloud), you can feel confident in your systems.

Rob

'Cloud Computing' and how it has affected my job as the IT Manager for a small business

I’ll keep my example focused on a single piece of software, CRM (Customer Relationship Management).

When I joined my current firm, they used an on-premises CRM that required a fat client to be installed plus a network drive mapping in order to work. I was responsible for the server hardware (including warranty coverage), the application itself (purchase of the initial product + ongoing support), backing up data on the server, backing up the server itself (which is different), and keeping the server powered up and cooled down.

The positive was that we weren’t being nickel & dimed for every user account. A negative was that the old CRM didn’t work well across a wide area network (WAN) because it was never designed to be used in such a way.

Because the server that housed the CRM sat in a room in an office building, it was vulnerable to any ‘event’ that might affect Houston. A prime example is 2008’s Hurricane Ike.

The new CRM is software-as-a-service (known as SaaS) and thus has business continuity built into it. A SaaS CRM works well across a wide area network because it was designed from the ground up to work in a distributed environment (i.e., the Internet).

A negative aspect of a SaaS CRM is that we are getting nickel & dimed by the vendor when it comes to per-user licensing.

Running reports from the SaaS CRM is painfully slow and as the vendor adds more customers to their shared environment, things get even slower. SaaS vendors only make money by adding more & more customers while not adding additional resources to support their growing environment. It’s the old adage of, “Let’s see how many people we can fit in a telephone booth.”

I still must take backups of my firm’s data from the SaaS CRM (via FTP) just in case something happens to the vendor. Always have a backup plan, whether it’s a cloud based application or on-premises software. That will never change.

I still have to create new user accounts, disable old user accounts, and set access rights to the SaaS CRM just like I did with the old on-premises CRM. That aspect of my job has not changed. What the SaaS vendor provides is the environment and it’s up to the customer to determine who gets access to what.

Overall, I still must administer the CRM, it has built in business continuity features, it works well for all of my office locations, but the SaaS CRM can be slow and is affected by not only your connection to the Internet, but the traffic patterns of the Internet itself.

Something to think about are the “peering agreements” between the major Internet Service Providers. My firm experienced a “peering” issue. What happened? My firm was caught in the middle of a dispute between ISPs. I’ve had real experience with this problem and the most frustrating part was that all the vendors pointed their fingers at the other vendors and said it was their fault – it was like a Three Stooges routine but with terrible consequences. I remember telling the ISP that provided access for my office that when I used my wireless broadband card, I could access the CRM just fine. This stunned the technical support folks and made them realize the problem was larger than they’d first thought (that plus they had dozens & dozens of complaints from other customers of our specific SaaS CRM who experienced the same issue).

So what is the take away from all of this? A SaaS CRM is a mixed bag just as the old on-premises CRM was a mixed bag. I still spend as much time administering the new SaaS CRM as I ever did on the old CRM.

Rob

Windows IT Pro has a new columm by Sean Deuby named "Enterprise Identity" that is quite useful. His column, "Federation Paves the Way Toward True Enterprise Cloud Identity" in the February 2011 issue is full of information relevant to those of use making decision when it comes to what goes up in the cloud. Below is a primer when it comes to Identity -

Identification - who are you?

Authentication - I need to verify that you are who you say you are.

Authorization - these are the things you can do because of who you are.

Auditing - we are watching what you are doing.

I found Sean's column full of great information. Here are some of the best tid-bits (some direct quotes, some I've put my own spin on) -

• Cloud computing complicates the traditional, password-based model because cloud services aren't on your protected corporate network. This is a good piece of information to keep in mind, even for technical folks.
• Enterprise cloud identity (which might seem like an oxymoron but makes sense more & more every day) is the practice of securely extending the core corporate identity infrastructure outside an organization's perimeter to manage access to distributed services, applications, and infrastructure.
• Trying to push passwords into the cloud is like putting the bank vault door on the outside of the bank. Even using something like the Google connector for Active Directory pushes your AD password out to Google - not a good idea even if their motto is, "Don't be evil."
• Securely extending your existing corporate identity infrastructure outside your organization's perimeter, without entering another password once you've logged on to your corporate network (aka Internet single sign-on or SSO) requires another method - federation.
• Federation (federated identity) - is a collection of standards and technologies that enables authentication & authorization data to securely pass between an identity provider (Active Directory on your local domain) and a service provider (such as a cloud-based CRM) without exposing password data.
• Federation uses security tokens in much the same way that Kerberos uses tickets. Kerberos tickets and federated security tokens are tightly restricted on when they're valid - they are not usable out of the context they were generated for. The best part is that these tickets & tokens contain no password data.

Microsoft's Active Directory Federation Services (AD FS) looks interesting for those of use running Windows networks. But what is most interesting is Google and how they handle Identity across their various platforms. I can sign into Gmail then bring up another tab and be signed into Blogger, have another tab with my Google Docs, and the last tab will have Android Marketplace. Google might be a good initial model when thinking about Federated Identity. Of course that's just my opinion, I could be wrong (thank you Dennis Miller).

Rob

The Employee is Always Right!

The crux of a recent article by Michael Healey in Information Week is that employees have never been more demanding about technology. The consumerization of technology (hello iPhone!), tech-savvy employees (they probably have a better computer at home than in the office), and cloud computing (I should be able to put data anywhere I want to).

As the resident IT curmudgeon, I must rebut the above misconceptions! I will go point-by-point.

1. The consumerization of technology - Thank you Steve Jobs! Actually, I like Apple products (my wife does all her computing on Macs) but the mindset cannot be, "I bought it, why don't you support it?" I compare the consumerization of technology to impuse buying - I want it and I want it now! Take a step back, ask yourself why you want it, and IT can take care of the rest. Don't be impulsive!
   
   
2. Tech-savvy employees - This is a very good thing. It means you can roll out more complex computing environments without overwhelming the end users. Terminal services, thin clients, software-as-a-service, application virtualization - all these technologies challenge tradition and that is a good thing. You want end users that can keep up. I like to think of the concept of "core computing" - this means that as long as the core systems are configured properly, new technology won't present any fundamental changes to how employees access critical data.
   
   
3. Cloud computing - As mentioned in the article, regulatory compliance is a priority with IT departments these days - we are a litigious society. Protect important data by maintaining its confidentiality, integrity, and availability. Cloud computing immediately increases availability, but decreases integrity & confidentiality because you no longer control the system on which the data resides ("data at rest") or gets processed. If there was a way to keep the cloud computing vendors from accessing YOUR data on THEIR systems, it would be a no-brainer, but when they have access to the system, they have access to your data. IT is responsible for all corporate data. Where is that star employee when the lawsuit pops up because he/she put the entire customer database up on the web but didn't ensure its confidentiality? That employee will immediately point to IT and say, "it's their responsibility." If you want to be the boss, you have to pay the costs.

Of course this is just my opinion, I could be wrong.

Rob

Connectivity.........

In a recent article in Network World, the CEO of Riverbed said that, "...Cisco can have Layer 2-3." I know the implication of this because I'm an IT Professional and have a background in networking. As I'm reading the article, I'm thinking to myself, "How do you sell something like this (a reference to any layer of the OSI model) to management?"

The OSI model gives us a way to explain the various parts of networking, also referred to as the network stack -

Layer 7 - Application

Layer 6 - Presentation

Layer 5 - Session

Layer 4 - Transport

Layer 3 - Network

Layer 2 - Data link

Layer 1 - Physical

So when Riverbed says that Cisco can have layers 2-3, they mean they dominate the data link (layer 2) and network (layer 3) layers of the networking stack. Riverbed's contention is that layers 4-7 are WHERE the future of connectivity will reside.

All of this rolls into the larger discussion about "Cloud Computing" that is going on in the business world. Where do your apps reside? Where do your servers reside? Where does your infrastructure reside? Cloud computing is a shift away from on premise (a server sitting on your local area network) to Anything-as-a-Service (apps, servers, and even infrastructure sitting on the Internet and a wide area network).

I like the quote, "...importance of having knowledge workers connect to their applications effectively, cheaply, globally, seamlessly, 24-7..." because this is the ideal of what connectivity should be. Is this type of connectivity possible in the realm of net neutrality? What happens if a network carrier downgrades traffic from a Riverbed device because that same carrier has an agreement with Cisco to prioritize traffic from Cisco devices (such as an ASA 5505) above all else? Something to think about because it is not out of the realm of possibility (see recent 'agreement' between Google and Verizon regarding net neutrality).

If you run a business and have an office, then you'll still need a local area network and that means a gateway device (router and/or firewall), network switching gear (LAN switches), and wireless connectivity (wireless access point). I'm not a big fan of the all-in-one devices sold to consumers for their home network setup with the wireless access point built into the router - I like to keep those two functions separate. In the office, a user must be required to identify themselves & authenticate locally before logging onto your network - "trust but verify" (an excellent cyber security principle). So even if all of your apps and file servers are "in the cloud" the business will still need local resources for things like printing and authentication to the local network.

Something else to think about is integration - how do you get two software-as-a-service offerings to integrate if they are from different vendors? How do you integrate your Internet-based CRM with the online version of your Accounting software? I have personal knowledge of this issue and will tell you that it is a major hurdle. Vendors end up pointing fingers at each other and tell you to get rid of the other guy and go with their all-in-one offering even though it doesn't have nearly the features of the other product. How do you integrate email, CRM, and accounting software when all of them are software-as-a-service?

Of course, that's just my opinion. I could be wrong.

Rob