1. Give the sys admin the root password to every other system in the data center.
2. Rent a wrecking ball, put it in front of the data center and give them the keys.
3. Give them an Open Purchase Order with the ability to buy unlimited amounts of equipment!

Now, no IT Manager would ever do this  with their current data centers, but it’s pretty much what every IT manager has to do with most of today’s cloud environment.  That’s because the vast majority of clouds today are built to be used by one person with one password.  If you want multiple people to access the account, they each have to use the same user-name and password!

That’s like having every single person in your IT department using the same password for every system.  I’m not a security paranoid, but even I shudder at the thought.  Every single system with the same user name and password?  You have no way of tracking who’s made what changes to the systems or who is even allowed to make changes to the systems.  Someone could install a virus across your environment and there would be no checking on who did it because everyone uses the same user name and password!

But with cloud it’s even worse than that.  Not only could they infect all of your systems, they could wipe them out with a few clicks of the mouse (hence the Virtual Wrecking Ball.)  You could log in to find hundreds of systems and years of work completely destroyed in about 3 minutes by one windows admin with a grudge.   But of course you wouldn’t know who did it because everyone uses the same user name and password!

Finally, even assuming your staff has the best intentions (and most of them do), you are also giving them unlimited access to add as many systems and as much storage as they like.  That’s liking me giving my 7th grade daughter unlimited text without a plan (like this Dad did.) You’re going to get a 500 page bill at the end of the month.  10 cents an hour sounds cheap, but it adds up fast.  That’s doubly true  when it’s not your credit card where you have to make the payments.  And of course unlike the mega-texting teen, you wouldn’t know who spent all the money  because everyone uses the same user name and password!

By the way, if that’s not risky enough for you, one major cloud provider doesn’t differentiate between web services user names and passwords and e-commerce user names and passwords.  On their cloud, the sys admin could even buy themselves a LED flat screen and an Xbox with your cloud password and you’d have no idea who bought it  because everyone uses the same user name and password!

Now there are third party applications out there that allow you to add multiple user names and passwords to your underlying cloud, but the security holes still exist.  Let’s be blunt; should people have to pay extra for basics like separate user names and passwords for each user?  Shouldn’t that be table stakes by now?

Let’s hope it happens soon, so we can start tackling the real enterprise issues around SSO, policy based management, and federated authority (I love jargon.)  Plus we can stop worrying about where we left the keys to the wrecking ball.

Interesting enough, the base reason for the inability of cloud providers to SLA latency between different systems in the cloud and the difficulty in locking down data in the cloud  is the same.  It is what I call the flat network problem.  The flat network problem is the underlying structural defect of the first generation of cloud systems.  Essentially in order to make the cloud as flexible as possible, all of the systems within a cloud sit on the same network.

This is fine if you want to add lots of front end systems doing the same thing.  But in a traditional two tier architecture, putting your databases on the same network as your front end web traffic creates all sorts of headaches.  First of all, while you can secure the servers it’s generally best not to directly connect sensitive database servers to the internet.

Secondly, since all traffic between your web/application servers and your database servers must be routed over the front end network it is difficult if not impossible to guaranty latency between those systems.  Even if they sit in the same data center, the latency can often be microseconds instead of milliseconds.  That just won’t work for most traditional two tier architectures.

Now their have been many ingenious work arounds to the increased latency between cloud based systems.  That said, what would make the cloud much more accessible for enterprise is a way to create what I call Virtual Private Clouds within the public cloud.  Essentially it gives cloud users network level as well as systems level control on how their infrastructure is managed.  Cloud infrastructures would look much more like this:

By creating true layer two connections between systems within the public cloud we solve three issues.

1. Security - Any database servers can be disconnected from the public net.  This makes securing and locking down data much easier to do.
2. Performance - By creating a VLAN within the Virtual Private Cloud, users can ensure layer two access between systems that sit on that VLAN.  That alloows for millisecond access times between systems and performance that mimics traditional hosted architectures.
3. Network Based Management - This is the last benefit.  Right now to achieve functions like VPN’s, Clustering, and custom Access Control Firewalls, cloud users have to provision open source “servers” to do the trick.  Virtual Private Clouds allow these functions to be migrated back in to the networking gear where the performance is much higher and the management is much simpler.

While we are seeing some of the elements of virtual private clouds in the cloud offering out there (GoGrid does allow you to configure network based clustering) most of the solutions are not truly cloud based, flexible, API driven offerings.  Instead they are virtual farms you order where the networks can be configured.  For the cloud to truly take off with corporate users, we’ll need to see true cloud offerings with this type of network configurations.

Many vendors are proposing Private Clouds as a solution. Private Clouds are clouds that run inside enterprise data centers, by enterprise IT, for the use of the members of the enterprise. Basically it’s a way to virtualize a large swath of the IT data center. As is often the case with technology vendors, they think that the infrastructure technology, virtualization, is the end solution the user wants rather than the vehicle with which their needs are filled. While large scale adoption of Private Virtual farms will aid in the management of the data center, it will not address the value that users are getting from true Cloud computing.

To understand the true value of Cloud computing, you first need to understand how the ‘Cloud Generation’ uses technology and why the Cloud is so attractive to that generation as an infrastructure solution. The Cloud Generation has grown up on the web.  As a result they have come to expect three core elements to their technology experience:

1. Immediate Availability - They do a search and get going right away.
2. Ubiquitous Access - They can get to their data and apps anytime, anyplace.
3. Sharing and Collaboration - They expect to be able to collaborate and share anything they are working on.

The current Cloud addresses those needs by providing infrastructure in a way that is far different than any past solutions.

Immediate Availability = Complete Flexibility

Cloud solutions allow users to provision resources immediately. By the time you are done reading this, you could have a server running in Amazon or an application published in Google. It’s that immediate. Moreover, it’s completely flexible. You can turn off services as quickly as you turn them on. Finally you only pay for what you use down to the hour or gigabyte. This resonates with a group that’s not use to spending up front for anything on the web.

Ubiquitous Access = APIs

A true Cloud solution not only offers infrastructure anytime, anywhere, it also provides access either through a web interface or through an API. To the Cloud Generation of programmers this means anything they can interact with on the Cloud they can program to through APIs. The idea of infrastructure being an item that can be addressed as part of the application, instead of something the application lays on top of, is a radical concept.  It has allowed not only for innovative applications, but also for true elastic computing making the Cloud environment even more flexible. Finally, it’s an essential element of the communities that have become critical to the advancement of Cloud computing.

Sharing and Collaboration = Communities

Great Cloud offerings have great Communities around them. This is the aspect of Cloud computing that is so often missed – and even scoffed at – by the IT folks who think it’s all about virtualization. One of the biggest gripes about Cloud computing is that support is done by the Community and not the vendor. While most will agree that far more proactive vendor support is necessary for Cloud computing, Community support is just as critical. For questions of configuration and usage tricks, the Community is a far better source of information than some call center employee with limited access. Often the Community devises more innovative solutions than the vendor ever could.

But in addition to support, the Community can create third-party add-ins that make the Cloud even more useful. As easy as it is to set up a server on Amazon’s EC2, the vast majority of pre-configured Amazon Machine Images created by the community make it that much easier, shaving hours of configuration time. In conjunction with the aforementioned APIs, it also allows for a healthy development of third party add-ons that both add functionality to the Cloud vendor’s solution and even act as a channel to market for the vendor.

So let’s take a look at Private Clouds. They don’t provide complete flexibility. You still need to buy a bunch of servers and virtualization software and data center space first and, once you’ve bought it all, you’re paying for it whether you use it or not. Private Clouds also don’t provide Ubiquitous Access and if they do have APIs they are usually extremely limited compared to true Cloud solutions. Finally, if there is any Community at all (which there usually isn’t) it’s restricted to the enterprise that is deploying it. That’s a much less powerful Community than the group of internet users as whole.

So while Private Clouds may offer many advantages for managing your data center, they do not truly address the Cloud Generation’s needs. What’s really needed is a way to make the true Cloud (that is to say the public internet) safe for enterprise use by improving security, performance, SLAs, support, standards and management tools. That way the users and the enterprise both get what they want. What does it take to do that? That’s a subject for the next post.

For those without the patience to read her prose, Sarah basically says, the world is going to On Demand but selling this stuff is really, really hard.  CEO’s are flying all over the place trying to get deals done.

The natural reaction might be, isn’t this the case with traditional software as well?  It is for big deals, but smaller deals (still the majority of SaaS sales) are done through the channel.   The network of channels for traditional ISV’s is huge, from local Mom and Pop VARs, to huge resellers such as CDW, to the big integrators like Accenture.  Unfortunately none of these organizations does much for SaaS (seems like they are as addicted to up-front revenue as the traditional ISV’s.)

Fortunately we are seeing a next generation of integrators focused on integrating SaaS products.  Companies such as Astadia, BlueWolf, and Appirio have built burgeoning business’s around SaaS application cusotmization and integration.  Problem is that most of the focuse has still been around integration SalesForce.com.

That’s where web services come in.  By insuring you have a good web services interface you allow your app to be integrated in to these solutions by these next generation integrators.  This opens whole new channels (admittedly small right now, but growing like the rest of SaaS.)   Integrators can either use your software as a platform in which to develop custom apps, or more likely, integrate your app as part of a custom solution for a specific company or vertical.

Beyond the SI play, there is the ability to integrate your app in other SaaS applications allowing them do the hard work of sales while you grow every time they get a new customer.  Intacct software has done just that with RealPage.  Intacct is a critical component of RealPage, providing the underlying financial package that is part of RealPage apartment management solution.  Now every time RealPage signs up a new apartment building, Intacct get’s a new customer.

Now that’s a great way to stay off the plane.

According to recent research by both Saugatuck and Forrester, integration has surpassed security as the main concern for enterprise implementations of SaaS.  This is actually a great sign for SaaS vendors.  It means that SaaS is extending beyond the departmental sale and making true progress into the enterprise.  It also means that in order to get past this increasingly common sales objection, companies need to figure out how to use Web Services to integrate their SaaS application.

While enterprise adoption of SaaS has been quite good, it’s usually done at the departmental level initially.  That means good SaaS apps appeal to business users with specific problems.  As the adoption of those applications spreads from the department to the whole enterprise, IT gets involved.  And it’s logical to think IT wouldn’t want a separate employee record in its Taleo system than it has in its payroll system.  Solutions such as Boomi’s Atoms help IT shops avoid that problem.

Besides integrating with legacy applications, Web Services are beginning to help companies integrate multiple SaaS applications.  Up to now the most ubiquitous integration problem, user management, has either been ignored by companies using SaaS or has had to be cobbled together by in house teams.  I can tell you, we use everything from SalesForce to NetSuite to RightNow and we’ve had to put some pretty tricky things in to (imperfectly) manage users.  Now we are seeing ready built solutions from TriCipher and Symplified that are making this easier and easier for both the SaaS vendor and the enterprise.

Finally, the integration piece is allowing companies like Astadia to go beyond SalesForce customizations in to the world of really creating custom applications out of many different SaaS apps.   Astadia’s acquisition of Theikos indicates that pre-built custom applications are going to be a big part of their future.

So while integration may be listed as a concern on SaaS adoption in the enterprise, it’s really an opportunity.  An opportunity to expand your app by tying it in to other SaaS apps, to legacy apps, and to even see it as the basis for custom apps.  Next post, we’ll talk about using Web Services to not only to break down customer objections but to actually create new opportunities.

Companies like SalesForce and WebEx have all shown the value of doing things like offering on-line ordering and billing, tracking site usage, and adding strong reporting and user management features. The problem with all of these additional features take programming time away from the core value of the apps, sales force automation and collaboration. That’s fine if you have 100’s of million in funding and 8 years of development. What’s the new SaaS app to do?

Fortunately, we have a new world of apps available to add that functionality. No longer is it just Google Maps and Hoover information. There is a ton of new apps you can integrate via api’s or web services. Examples include:

• TriCipher - For strong identity management and integration with corporate directories.
• Sabrix - For tax calculations.
• PivotLink - For graphs and pivot tables.
• OpSource Billing - If I don’t get one corporate plug in, Richard, Kim, and Christina get mad.
• Business Objects - For Crystal Reports and others.
• Ribbit - For integrating Cell Phones in to your app. If that doesn’t make sense, go to their site. It’s extremely cool.

This list could be ten times as long and it’s growing daily. Needless to say, a lot of the “extraneous” work of creating the app can now be integrated instead of programmed, allowing your precious coders to focus on the core value you are selling to your customers. This not only keeps the R&D costs down, it allows for more robust apps to hit the market sooner.

Up next, Silo Busting 3 - web services for enterprise integration.

SaaS adoption in the enterprise has definitely increased. But with that organizations are increasingly asking SaaS applications to start working with both other SaaS applications and the company’s legacy applications as well. According to recent studies by both Saugatuck and Forrester suggest that integration has surpassed security and compliance as Enterprise IT’s chief concern with implementing (or growing) SaaS applications.

This is an extremely encouraging sign. It shows the acceptance of SaaS as a legitimate enterprise software solution by the majority of Enterprise IT shops. Up to now, SaaS has been primarily a departmental sale. HR departments buy Taleo for human capital management, Marketing buys Marketo for marketing analysis, and call centers buy SupportSoft to manage their ticketing. As you know from past posts, selling immediately recognizable value at the departmental level is key to a strong success story in SaaS andwe can see how that has happened.

But now these apps are growing up and reaching across the organization (growing your app is another key SaaS sales strategy.) When that happens, IT is willing to accept the app’s growth, but needs it to do more now. Enterprise IT doesn’t want a separate employee record in Taleo from their payroll system. The want to be able to correlate all this marketing data back to their sales productivity, and they want to use the same master customer record for their ERP system as for their ticketing system. And they don’t want to have different log-ins for each employee, they want a single sign-on solution for all of their SaaS as well as on-premise apps (ala TriCipher.)

So SaaS applications have to stop being Silo’s that work just inside themselves. They need to start using web services to integrate with other SaaS apps and with legacy applications. By doing so, they’ll open up three great new areas for growth

1. Increased Functionality by working with other Apps
2. Enterprise Growth by integrating with existing Apps
3. The Opening of New Sales Channels

Their is so much to talk about in each of those three areas, they will get their own posts in the coming weeks.

In the meantime, think about adding web services, playing nice with others and growing up. It’s a great time to be an adult.

Alas, it was a case of mistaken identity but the post was real. This David Greenfield disagrees with my hogwash, but that’s O.K., I just like getting quoted. That said, I think Mr. Greenfield’s issue that function (cloud applications) and form (cloud computing) are mutually exclusive is misguided.

I was stating that the next generation of users will demand on-demand, collaborative group applications they can access anywhere and connect to in any way. This is what everything we see on the web from SaaS to Social Networking is driving to. David’s argument that these applications will run like exisiting applications behind the firewall and on servers bought and managed by IT is short sighted.

Instead, I think Cloud Infrastructures will evolve with the applications that they serve. And with that evolution, IT will find a way to exert the kind of data control and security necessary to run Enterprise critical applications. So instead of buying servers, IT will find ways to use cloud resources that give them the same type of control they had with the old models. We are already seeing that today. While an Amazon ec2 cluster is fine for a blog site, when a Web Applications (or SaaS) company wants to sell they know their cloud environement needs to be secure and robust. Hence the proliferation of certifications (SaS 70, PCI, European SafeHarbor, etc.) that have become the ingrained into the DNA of SaaS applications. These are the beginnings of IT reasserting it’s control over cloud apps.

I see the evolution of enterprise class Cloud computing similar to what we saw with Client/Server. When the PC was seen as a toy IT talked about getting apps back under central control. This was accomplished not by moving back to mainframes and mini’s but by evolving PC apps to Client/Server apps. Many people forget that “Servers” are just souped up PC’s with more processors, memory and disk and sturdier versions of desktop OS’s.

Now the interesting thing is how watching these “Cloud Environments” evolve to meet the enterprise needs. 10-20 years from now, I’m sure we’re going to see environments that are as different from today’s clouds as a 30 system HP blade farm is from the PC XT I first used in business.

I especially dislike the “Do No Evil” motto. As if other companies have the motto ”Do Evil.” It’s like an ad campaign that asserts “Trebelicious BubbleGum has no Spider Eggs in it.” (Although we know that certain telco’s bubblegum does have spider eggs.)

But lately, I’m beginning to like Google. They really do seem committed to an open web, and that is good for everyone. First was their support of Net Neutrality. Actively fighting the telcos in their effort to control what traffic they deliver is critical to the success of the Internet. To see what would happen if AT&T and Verizon got their way on Net Neutrality, one would just have to look at how horrible the mobile web browsing experience is (another area Google is trying to address with it’s gPhone initiative.)

Now one could argue that Google supports Net Neutrality because they don’t want to pay telcos for carrying terabits worth of YouTube videos. Except that Google has more than enough cash to pay the telcos and serve their cafeteria meals in disposable gold happy meal boxes.  If Google didn’t believe in an open web, it would do just that. The truth is while Google can afford to pay the telcos off, start-ups would not. They could effectively bar a good portion of their next generation of competitors from the market by allowing the telcos to set up a content tax that would be a market killer.

Google’s latest salvo of course is their OpenSocial initiative. Again, Google has come down on the side of an open platform over using its muscle to promote a Google-only platform. The cynics of my readers (also known as my family minus my wife) would point out that’s because Google is getting its seat handed to them on a platter in social networking by Facebook and this is their way of fighting back.

And the cynics would be right. They also would completely miss these two points:

1. It doesn’t matter if Google’s self interest helps everyone else. What matters is that we keep moving to an open web platform that fosters innovation and interconnectivity.
2. Google seems to be the only big company that realizes that an open internet is the best way to expand it’s market presence. By making the web more open (and by extension better) they believe they will have more opportunity, not less.

Not surpisingly the old line telco’s and software companies doen’t understand this, which is why we have so many proprietary platforms (from Verizon’s vCast to SAP’s NetWeaver.) Suprisingly, some of the coolest and smartest new companies don’t seem to realize it either. I love Facebook, SalesForce.com and Apple and I use their products every day, but all of them are closed proprietary systems. That makes it difficult for me to interconnect them and other apps in a way I find as useful.

So hats off to Google today. From Net Neutrality, to OpenSocial, to the gPhone - they are making the internet a more interesting place. I’m sure they will benefit from that openness mightily, but so will OpSource, and our customers and thousands of other companies who have yet to be formed.

And to thank them, I have now changed my default search engine from Yahoo to Google. Think that will get me a ride on Google Jet?

When these kids who never used installed educational software grow up to adults, do you think they are going to suddenly adapt to installed business apps? No, they are going to use Web Applications for work because that’s what they are used to. And don’t think the old guard will stop it. The old guard couldn’t force people to use main-frames when they were used to PCs.

Just one more reminder, All Apps will be Web Apps.