It’s Time to Invest in The Cloud

Cloud computing is "shorthand for centralized computing services that are delivered over the Internet (a.k.a. the 'cloud')."

Cloud computing is to traditional computing as electricity is to rubbing two twigs together to make a fire. Ok. That’s a little bit of an exaggeration, but not by much.

Years ago, people made a fire in their home or workspace which they continually fed to get warmth, lighting, and cooking; now they get these from centralized utilities that distribute it to them on an as needed basis. It’s a lot more efficient that way!

With cloud computing—it’s very similar. Currently, we have our own computing resources (like a hearth and firewood) that we must purchase and regularly maintain to do basic information technology processes for transaction and analytical processing, information sharing and collaboration. Now, we can get these functions from centralized computing facilities or data centers that distribute them, as needed on a subscription or metered basis. This gives us a predictable, stable source of computing at reduced prices, delivered via the Internet, when we want and need it, and without the hassle of having to purchase and maintain the hardware and software infrastructure. It’s a user-centric model!

Most of us with very busy and already complex lives inherently understand and are drawn to a model that is convenient and cost-effective. Flip on the switch and voila—lights/heat in one case or email, e-Commerce, and online entertainment in another.

To me, if its not a mission-specific or highly sensitive application, the question is why shouldn't it be in the cloud?

Fortune Magazine, 2 March 2009, on the rise of cloud computing juggernauts like Salesforce “a public company with a market capitalization of $3.5 billion, generates revenue of more than $1 billion a year—a 60% five-year annual growth rate—all from providing software subscriptions to business.”

Marc Benioff, their CEO says “We’ve always believe everything’s going into the cloud.”

Even detractors, like Larry Ellison, the CEO of Oracle, has helped fund Saleforce and another major cloud computing vendor, NetSuite. Moreover, “Oracle at the end of January lauched a new version of its online sales-management product…CRM on Demand” —so you see where Mr. Ellison is strategically placing some of his chips.

What about the other major application vendors?

“SAP said it would be releasing a software-as-a-service product in May…and Microsoft also has customer-management software available. IBM just named a cloud computing czar, and Google and Amazon are launching ambitions initiatives.”

So what’s holding up the transition?

Generally, the biggest cited obstacle to moving to cloud computing is security. Yet, “Salesforce has recorded only one security breach, a phishing attack in November 2007.” Moreover, because of the scope, scale, resources, and expertise that these vendors have, they can actually deploy and maintain a level of security that other organizations may only dream of.

Never-the-less, “companies remain committed to owning and hosting their own software and despite the tough economic times, they are loath to try something new, especially if it means making additional investments, however meager.”

But in the end “cost cutting and convenience are expected to prompt more firms to rent software that will be delivered over the Internet cloud.” IDC projects that by the end of 2009, “76% of U.S. organizations will use at least one web-delivered application for business use.”

Further, according to research firm, Gartner, "of the approximately $64 billion spent on business applications in 2008, about 10% or $6.4 billion, was spent on applications housed remotely and delivered via the Net."

The writing is on the wall or should I say in the cloud!

Security Architecture Q&A

Recently, I was interviewed on the subject of Security Architecture and was given permission to share the Q&A:

In general, what kinds of information security issues does an organization face?

The overarching information security issue in any organization is one of communication, collaboration and the need for transparency vs. the need to protect information from being compromised. Information security is about more than just "stopping leaks." It is also about making sure that people don't intercept, interject or otherwise manipulate agency information for their own ends.

A related issue has to do with protecting the agency's critical IT infrastructure from physical or cyber attack. It's the age-old conflict: If you lock it down completely, then you're protecting it, but you also can't use it. And if you open yourself up altogether, then obviously it won't be long before somebody takes aim.

Finally, the largest threat to an organization's information is clearly from insiders, who have the "keys to the kingdom." And so one must pay great attention to not only the qualifications, but also the background, of the employees and contractors entrusted with access to IT systems. Additionally we must institute checks and balances so that each person is accountable and is overseen.

How do leaders demonstrate security leadership?

Leadership in the area of security is demonstrated in a variety of ways. Obviously the primary method for demonstrating the importance of this function is to formalize it and establish a chief information security officer with the resources and tools at his or her disposal to get the job done.

But security leadership also means building an awareness of risk (and countermeasures) into everything we do: education, awareness, planning, designing, developing, testing, scanning and monitoring.

When new applications or services are being planned and rolled out, does security have a seat at the table?

I can't imagine any organization these days that doesn't consider security in planning and rolling out new applications or services. The real question is, does the organization have a formal process in place to provide certification and accreditation for IT systems? By law, federal agencies are required to do this.

Would you say that information security is generally tightly integrated into organizational culture?

I think that a security mindset and culture predominate in professions where security is paramount, such as law enforcement, defense and intelligence, for obvious reasons.

But the larger question is, how would other organizations make the transition to a culture of greater information security? And this is actually a really important question in today's age of transparency, social networking, Web 2.0, etc., where so much information is freely flowing in all directions. One approach that I have adopted as a culture-changing mechanism is to treat key initiatives as products to be marketed to a target audience. The IT security professional needs to be a master communicator as well as a technical expert, so that employees not only grudgingly comply with necessary measures, but are actively engaged with, and support, their implementation.

At the end of the day, the organization's information security is only as strong as its weakest link. So security has to be as deeply ingrained into the culture and day-to-day operations as possible.

Is information security an inhibitor to new initiatives?

Information security is one of many requirements that new initiatives must meet. And of course there will always be people who see compliance as an inhibitor. But the reality is that security compliance is an enabler for initiatives to achieve their goals. So the key for IT security professionals is to keep educating and supporting their stakeholders on what they need to do to achieve success and security at the same time.

The Stimulus Plan and User-Centric Enterprise Architecture

Just something I am thinking about...

Per Wall Street Journal, 14-15 February 2008, Stimulus Plan = 1,073 pages.

Imagine this...alternative stimulus plan--one sentence: Give everyone a debit card for $2500 that is good for 3 months.

(That's per every man, women, and child in this country!)

Result: spending will be pervasive and immediate, jump-starting the stalled economy.

(This can still be supplemented by long-term infrastructure projects and national investments as appropriate.)

This point is that the enemy of problem-solving is over-complexity.

We start with a problem that is so complex almost no one can understand it. For example, the financial market melt-down was tied in large part to dizzyingly constructed financial instruments that confounded and some say manipulated, even the most sophisticated investors.

And the answer was developed to respond to the problem. Sure, a complex problem may deserve a multi-faceted and even a thousand page answer.

But, perhaps it is time to step out of the trees and look at the forest. Is it time for a little simplicity?

Even if the answer is ok, maybe it needs to be communicated simply and straightforwardly--it's got to be user-centric!

Obviously, the point is not to over-simplify and miss the mark, but do be direct and to draw a clear relationship between problem and solution. Have we done that?

Change Agents--Poisoned or promoted?

Let’s fantasize for a moment about what it must be like to be an enterprise architect/change agent.

Here we go.

Our stereotypical organization, let’s call it ABC Company has a talented group of enterprise architects. They have worked hard, built partnerships, learnt the organization and its needs, and have done a remarkable job working with leadership, subject matter experts, and other stakeholders in identifying an accurate baseline, determining a promising target, and have helped the organization navigate a well thought out transition plan. The organization reaches its target—success—and the process continues.

Hooray for the architects. Praise and promotion be upon ABC company’s enterprise architects.

Wait. Not so fast. Let’s back up. Rewind and see what often really happens when architects or anyone else for that matter tries to change the status quo:

R—E—S—I—S—T—A—N—C—E!!

Research shows that change agents are often scorned by their organizations and their peers. In immature organizations that do not embrace constructive change, change agents like enterprise architects are often not looked upon favorably.

Remember what happened to Socrates more than two millennium ago (and countless others innovators, inventors, and thought leaders since)?

Strategy + Business Magazine, Issue 53, has an article called “Stand by Your Change Agent.”

The article states: “research shows that most transformation leaders go unpromoted, unrecognized, and unrewarded. And their companies suffer in the long run.”

In a study of 84 major change initiatives at Fortune 500 companies between 1995 and 2005, “some 70 percent of executives who led these major transformations went unrewarded or were sidelined, fired, or spurred to leave.”

Why are change agents treated adversely?

The research shows that “deep down, a great many people and organizations fear change. People do not like to move out of their comfort zones. Powerful institutional forces help maintain the status quo. In such companies, change simply has no constituency.”

In these change-averse organizations, change agents often “find their efforts impeded, undermined, or rejected outright. Change agents may also suffer from the delusion that others see the urgent need for action just as they do, and may be frustrated to discover how little key stakeholders care about the initiatives and outcomes they hold dear.”

What is the impact to companies that treat their change agents this way?

Both the companies and people suffer. Change initiatives remain unfinished. Investments do not see their payback. Highly talented change agents are lost. And worse, other potential leaders will think many times over before taking on a change effort that “could derail their careers.”

Well, which companies did best with change?

“Companies that scored highest in leadership development and embracing change were most likely to improve performance.”

The lesson is clear: If companies want to grow, mature, and improve performance, then they need leaders who are visionaries and change agents to step up to the plate.

Those organizations that recognize this truth will embrace their change agents—encourage, recognize, reward, promote, and retain them.

Talented and motivated change agents (like enterprise architects) are an organization’s best hope for innovation, energizing creative potential, and long-term organizational success.