The survey, conducted by research firm TheInfoPro in June, also asked IT managers from which vendors they were most likely to switch. Hewlett-Packard, Oracle and Sun Microsystems, which was acquired by Oracle in 2009, took the top spots.

For the second year, results showed Oracle struggling, TheInfoPro said in a statement. Asked how difficult it would be to switch vendors, 21% of the IT managers surveyed said it would be hard to replace Oracle, while 43% said it would be easy, and 35% said it would be “somewhat difficult.” For IBM , 36% said it would be hard, 23% said it would be easy and 41% said somewhat difficult. For HP , 41% said it would be hard, 26% said it would be easy, and 33% said it would be somewhat difficult.

In other areas, equipment from Hewlett-Packard and IBM was seen as highly replaceable, according to InfoPro, which also conducted hour-long interviews with the participants. Respondents said EMC or Hitachi Data Systems would be the most likely candidates to replace their IBM equipment, Coulter said, adding 29% of IBM customers surveyed said they’re planning to spend less this year than in 2009, he said.

“From narratives we read from interviewees, it’s mainly about their storage,” said Marco Coulter, managing director of TheInfoPro’s storage and cloud sectors.

Among IT vendors, EMC remained the clear leader in respondent’s minds when it came to storage area networked (SAN) systems, and NetApp led the way with network-attached storage (NAS), Coulter said.

Five EMC products were listed as among the “most exciting” as was the company itself by the Fortune 1000 respondents. EMC was rated second most exciting by mid-sized enterprises, with NetApp as first. Many of EMC’s customers said they plan to spend more than $25 million with the company this year, InfoPro said in a statement.

In the category of data storage management software, CommVault came out ahead of Symantec, with 54% of CommVault customers indicating they will spend more on their products in 2010, compared with 28% of Symantec’s customers.

“They’re just sitting there taking away from Symantec. I think there’s a lot of frustration with Symantec,” he said. “This is only my personal opinion, but I think people have used Symantec over the years and seen backup as very difficult with them, while CommVault has a slightly easier way of solving the backup problem.

CommVault also received high scores for technical support, Coulter said, where Symantec got slightly weaker scores.

The survey also showed that 28% of respondents said their spending on data storage systems would be flat this year, while 42% said the same for 2011. For 2010, 30% of respondents said they plan to cut spending on storage, while 42% they expect to increase it.

“As we look at the storage market overall, there’s still growth in 2010 and 2011, but we do see the growth rate slowing down,” Coulter said. “Just keeping the lights on is becoming a growing narrative.”

For the first time, a category of spending titled “Just keeping the lights on” reached the number 10 spot in the “new initiatives” category in TheInfoPro’s survey.

The respondents, 165 of whom worked for Fortune 1000 companies and 113 for mid-sized enterprises, said that dealing with capacity growth was the number one pain point, followed by a lack of proper forecasting and reporting tools.

Many of the IT managers indicated that using thin provisioning, which allocates storage to applications on an “as-needed” basis, helped them to better use their storage capacity. They also said they were able to reduce backup array and tape drive capacity through the use of deduplication, Coulter said.

Coulter was quick to point out that primary deduplication, however, technology that removes duplicate data before it’s stored on disk storage systems, is still mostly unused by large organizations.

“At some point, once you’ve thinly provisioned everything and deduplicated everything, you can’t continue to store more data on the capacity you have. At some point, storage growth will pick up,” Coulter said.

The expected use of solid state drives (SSD) in storage arrays, saw a modest 2% to 3% growth rate among those surveyed.

As in previous TheInfoPro surveys, virtualization and cloud computing remain top of mind this year with 54% of respondents saying virtualization is changing roles and responsibilities, and one in four indicating they expect the majority of production to be virtualized by 2012. And, while 8% of enterprises use an external cloud for storage, 31% expect that by 2012 more than 25% of data services will be protected through the cloud.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• Researchers slate ‘month of bugs’ launch for Wednesday

By Ellen Messmer
Network World (US)
September 1, 2010

FRAMINGHAM - Trend Micro is blazing a new trail with a service called SecureCloud intended to give enterprises a way to encrypt data in cloud-computing environments.

SecureCloud allows you to maintain control over the encryption key used to secure data stored in the Amazon EC2, Eucalyptus or VMware vCloud cloud infrastructures. Other cloud-computing variants could be added in the future.

“IT operations may be firing up [a remote virtual machine] image but we have security validating the integrity, and it’s encrypted until it hits the cloud, and it’s encrypting data at rest,” according to Todd Thiemann, senior director of data center security and marketing at Trend Micro.

He notes that SecureCloud allows the IT department using either public or private cloud-computing services to answer the basic questions, “Is this image OK? And is it mine?”

Greatest Tech Arguments: Public vs. Private Cloud

Now in beta with general availability expected by year end, SecureCloud is provided through a Web site portal and makes use of policy-based encryption to allow access to a virtual-machine image as well as storing related activity logs.

In addition to offering the security service, Trend Micro is looking at making comparable software available to companies for on-premises use.

In a separate announcement, Trend Micro also unveiled an antimalware protection module for its VMware server security software, Deep Security 7.5. It includes integrity monitoring, log inspection and stateful firewall capabilities, and leverages the most recent VMware vShield Endpoint APIs. Trend Micro Deep Security 7.5 is expected to ship in October.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Lisa Banks
CIO Australia
August 31, 2010

SYDNEY - A majority of Australian CIOs are moving towards the cloud at a rapid rate, with cost effectiveness and reduced infrastructure being top-of-mind for IT leaders looking at SaaS.

IDC released its latest VMware-sponsored cloud computing research in Sydney this week. VMware managing director, Paul Harapin, said the survey results indicated flexibility was a key reason CIOs were looking at cloud.

“Efficient use of technology was one theme that emerged when we asked why people are using cloud computing. Agility and control were other key reasons, as was self-service, the ability to control use and freedom of choice,” he said.

“In both the public and private cloud sectors, cloud computing is an enabler and allows us to use our IT infrastructure better. You can save costs and we need to reduce IT spending. Cloud computing can improve the overall IT operating environment,” he said.

The research is based on 326 phone interviews in Australia and 100 in New Zealand conducted between March and May of this year with CIOs and IT managers in companies of varying sizes being asked about public and private cloud adoption. Harapin said a huge shift in thinking has emerged around cloud in the past 12 months.

“Cloud services have shifted from a year ago. We did a focus group around 12 months ago and they pretty much took the mickey out of cloud. It was seen as unrealistic and CIOs weren’t considering it. What’s even more of a surprise is that in a short period of 12 months, we’ve seen cloud go from a bit of a joke to a number two priority on the plate of CIOs today, and a very serious consideration that they are taking on board,” he said.

About 70 per cent of the CIOs surveyed are investing in private cloud, while public cloud adoption is becoming prominent due to a desire for less infrastructure.

“If we take a look at the public cloud results, we realise public cloud adoption allows companies to have the capacity to free up space in the internal infrastructure of the businesses,” Harapin said.

The research also found the CIO is generally the key initiator behind cloud adoption, but CEOs are taking a more proactive interest in the movement.

“The CIO is the primary initiator in both the public and private clouds, but what is interesting is that the CEO, managing director and board takes a much more proactive interest in public cloud than most other technology areas.

“Why? Organisations are talking about the savings being made through cloud and this is resonating with the board and are driving down to the CIO on how do we do this internally?,” Harapin said.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

by John Mark V. Tuazon
Computerworld Philippines
August 24, 2010

BORACAY, AKLAN — With the introduction of EMC’s VPLEX, a new technology which enables the concept of storage federation, jumping to the cloud has now become more sensible for enterprises, a company executive remarked recently.

Launched only in May during the recent EMC World in Boston, VPLEX will allow companies to create a storage pool and move stored data within, across, and among data centers. Currently, only VPLEX Local and VPLEX Metro, which allows movement of data within and between two data centers, respectively, are available in the market.

With the entrance of VPLEX, deploying a private cloud solution is now a more viable option. “The enabling technologies currently present has already reached a level of maturity,” expressed Ronnie Latinazo, country general manager, EMC Philippines.

“The technology on the server, VMWare, and now the technology on storage side, VPLEX, together allows companies to come up with a wholly virtualized infrastructure, and offer private cloud services to their users,” he added.

Latinazo said it makes sense to implement a cloud infrastructure right now, since most systems in data centers are operating on siloes, and most data used are unstructured. “The typical IT infrastructure of today is not integrated and complex. It is hard to manage, or if manageable, it is inefficient because it is still working on siloes. It is inflexible because there’s a lot of control, and as such, it’s costly,” he related.

Another compelling reason for firms to look for better ways to run their infrastructure, Latinazo said, is the proverbial innovation-versus-maintenance gridlock, which has hounded organizations over the years.

“Based on studies, in a typical company’s budget, 72% goes to maintenance of the system, and only 28% is left to investments that change the way they do work and contribute value to the organization,” he shared, adding: “There alone is the dilemma: budgets are not rising, yet there are a lot of inefficiencies.”

On the flip side, data growth is projected to reach an all-time high, as it is forecasted to reach at least 35 zettabytes by the year 2020. “It’s a problem that companies need to address, are facing, and have no choice but to address. It’s a perfect storm to compel companies to take action,” Latinazo added.

The Journey
The move to the cloud is but a natural progression in the evolution of computing, according to Latinazo. Global enterprises have moved from the centralized environment of mainframes back then, to the client-server setup for less-critical applications, and, more recently, the deployment of business applications through the Web.

“The next inflection point we see is really the journey to IT cloud services, with companies transforming their data centers into private clouds,” he said, adding that the cloud provides lower IT costs, improved business agility, and higher quality of service to its users.

EMC is well-poised to deliver such private cloud services, especially that it has acquired a mass of solutions that help to address cloud concerns all around.

The company has expanded its portfolio to reach both ends of the information management spectrum, from its traditional core enterprise solutions down to the consumer market in recent times.

With this positioning, IDC pegs EMC as the consistent market leader in information management in the Philippines, Latinazo shared. Now on its 10th year, EMC Philippines’ key focus for its customers is in helping them undertake the journey towards the private cloud, he added.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Mitch Betts
Computerworld (US)
August 24, 2010

FRAMINGHAM - Cloud computing isn’t just a way to try to save money on IT infrastructure; it’s a way to accelerate business agility and innovation , according to a recent report by PricewaterhouseCoopers.

Traditional, rigid IT infrastructures get in the way of innovation because they take months or years to deploy when a business decides to try something new, the report said, whereas on-demand computing services can be set up in days.

“Often the costs and time required to test a new product or service, or try a new way of engaging customers, are so prohibitive, they discourage companies from even trying them,” according to the PwC report. “But cloud computing offers an inexpensive and flexible way to deploy the infrastructure as needed to test ideas.”

For example, the report said that 3M Corp. is using Microsoft Corp.’s Azure cloud technology to quickly analyze new designs for consumer products, and McKesson Corp. is using SAS Institute Inc.’s “analytics cloud” to study marketing data.

However, the report acknowledged that cloud computing raises security issues , as well as regulatory compliance, tax and financial accounting considerations.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Roger A. Grimes
InfoWorld (US)
August 6, 2010

SAN FRANCISCO - If malware were biological, the world would be in the grip of the worst pandemic in history. In 2009, more than 25 million different unique malware programs were identified, more than all the malware programs ever created in all previous years (see the annual report from Panda Labs). That’s a pretty incredible statistic. Malicious programs now outnumber legitimate ones by many orders of magnitude.

The world’s largest cloud computing user? Not Microsoft, not Google, not Amazon.com. The ringleaders of the Conficker botnet, with more than 4.6 million infected computers under their control, win by a mile. Some antimalware vendors report that 48 percent of the computers they scan are infected (see page 10 of the APWG Phishing Activity Trends Report) with some sort of malware. Trojan horse programs make up 66 percent of all threats (see page 4 of the annual report from Panda Labs).

[ Get the full scoop on successfully defending against modern malware in the InfoWorld "Malware Deep Dive" PDF special report. | Better manage your company's information security with our Security Central newsletter. ]

No one need wonder what malware is trying to do: It’s trying to steal money, whether it’s through data theft, bank transfers, stolen passwords, or swiped identities. Each day, tens of millions of dollars are stolen from innocent Internet victims. And yet many computer defenders can’t tell you what the biggest threat is to their environment. If you don’t know the biggest threats, how can you defend against them properly?

Today’s malware differs dramatically from the threats we faced just 10 years ago, when most malicious programs were written by young men looking to earn cyber bragging rights. Most malware made the user aware of its existence through a displayed message, music (as in the Yankee Doodle Dandy virus family), or some other sort of harmless mischief. Those were the days.

Thoroughly modern malware
Today’s malware is written by professional criminals. In most cases, users are unwittingly tricked into executing a malicious program in the form of a Trojan horse. Users think they are installing needed software, often “recommended” by a site they trust. In fact those sites are recommending nothing of the kind. Malware producers routinely break into legitimate websites using found vulnerabilities and modify existing Web pages to include malicious JavaScript redirects. Or the malicious code is hidden inside a banner ad on a website, supplied by legitimate ad services.

Either way, when the user surfs to the legitimate website, the malicious JavaScript is loaded, and it either prompts the user to install a program or redirects the unknowing user to another website where they are told to install a program.

Trojans lead the pack
Trojans typically camouflage themselves as downloadable antivirus scanners, “needed” patches, malformed PDF files, or add-on video codecs required to display an exciting video. Most of the fake programs have the clean look and feel of a real app. Even career antimalware defenders find it hard to tell the difference between what is real and what is fake.

Fake programs are even more successful at duping victims when they appear to come from popular, well-known websites that a user has trusted and visited, without incident, for years. Or they launch from one of the popular social networks, like Facebook and Twitter, which are all the rage among the least savvy computer users. Some malware programs scan the user’s computer for vulnerable software that lacks security patches, but typically, users cause infections themselves by installing apps they should not.

This is not to rule out the obvious impact of spam, phishing, adware, or other attack methods. It’s just that computer worms, viruses, and the other methods for exploiting computers, added up all together, don’t equal the threat of the socially engineered Trojan — even though some multivector worm programs, like Conficker, have victim figures that number in the millions.

In a common scenario, the first malicious program installed is called a downloader. A downloader’s goal is to be installed on the victim’s PC and then to “phone home” to the “mothership” Web server for more instructions. The downloader often has instructions to contact a dynamic DNS server to get the mothership Web server’s current location. The dynamic DNS server is just another Trojan-infected computer installed on an innocent user’s desktop. The DNS address record received by the downloader has an address that is good for only a short time — sometimes as little as 3 minutes. These “fast flux” techniques complicate efforts to investigate or eradicate malware. The downloader will eventually be redirected to another server (which is, of course, just another compromised host) and download a new program or receive instructions. This sequence of finding and downloading new programs and instructions can go on for dozens of cycles.

Eventually, the final program and instructions will be installed on the victim’s computer, with a handful of command-and-control servers under the direction of the botnet owners. Botnets can be used by the owners themselves to steal money, to conduct distributed denial of service (DDoS) attacks, or to break into other computers. Often the botnet owner will rent the botnet to other criminals who then use them to do their bidding. A good example of a common bot and botnet is Mariposa. At one point, it controlled more than 13 million PCs in 190-plus countries. The masterminds of Mariposa were not ultraskilled malware writing geniuses — they were three guys who bought a botnet “kit” on the Internet for $300.

DIY kits: Tools of the trade
Do-it-yourself malware kits have been around for two decades, but now they are soup-to-nuts efficient. The typical kit can spit out (currently) undetectable malware to do the customized bidding of its owner. Using these kits is as easy as clicking a few check boxes. The resulting malware will break into websites to start infecting innocent visitors, generate enticing spam and phishing e-mails, and do everything it takes to create the botnet — including bots, dynamic DNS servers, roving mothership Web servers, and the command-and control servers.

Many of the kits are directed toward bypassing particular types of authentication and focus on particular financial institutions. The better bot kits include a sophisticated administrative back end so that the hackers can read statistics on total infections, OS versions exploited, and tricks used. For another $30, the kit creators will include 24/7 tech support.

These kits aren’t hidden. With just a little bit of searching, you can find them on the open market, often marked as “experimental” or “test-only” products. And there are plenty of “service providers” willing to help malware hackers turn their ill-gotten gains into hard cash.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Rick Broida
PC World (US)
August 6, 2010

SAN FRANCISCO - I know a handful of people who suffer from netbook-buyer’s remorse: they bought one of the inexpensive little machines, then stuck it in a closet when they discovered how sluggishly it ran Windows.

If you’re in the same boat, you might be able to give that system a new lease on life. Jolicloud is a free, Linux-powered operating system designed specifically for netbooks. It’s fast (way faster than Windows), easy to use, and better optimized for cloud computing.

The OS offers just the basics, without the clutter. It comes with about a dozen apps already installed (Facebook, Dropbox, Gmail, Google Docs, etc.), but you can browse a library of hundreds more–all of which are free to download. I think it’s safe to say that virtually everything you can do with Windows, you can do with Jolicloud.

The OS comes in two flavors. The first installs alongside Windows, creating a dual-boot configuration. That’s great because it leaves your existing Windows installation alone, allowing you to return to it as needed (and uninstall Jolicloud as easily as uninstalling any piece of software).

You can also load Jolicloud on a CD or flash drive, then boot from either one (keeping in mind that netbooks don’t have CD drives). Unless you’re a tech-savvy user, I recommend going with the Windows installer.

Either way, Jolicloud is currently available only via Bittorrent. That might prove a hassle if you’re not already familiar with it (in which case I recommend this beginner’s guide).
I installed it on an aging Acer Aspire One. After a few confusing moments with setting up a Jolicloud account and activating the computer, I found myself navigating a speedy, stylish, mostly intuitive interface that never once left me longing for Windows. Admittedly, there’s a learning curve, but I think most users will figure out the basics fast enough.

Speaking of fast, I can’t say Jolicloud booted significantly faster than Windows on my Aspire, but overall operation was definitely zippier.

I’m not 100% decided I’ll stick with Jolicloud, only because it still seems a bit buggy, but I like what I see so far. It’s a lovely, simple operating system, one that can breathe new life into old or unloved netbooks. If you own one, this is definitely worth a look.

Possibly Related Posts:

• Fix a Windows 7 System That Randomly Freezes
• Update Firmware On Your HDTV, Camera, Smartphone, PC
• Keep Your PC Awake, Install Apps Fast & More–Free
• Use Facebook Places
• My Keyboard isn’t Working

By Steven J. Vaughan-Nichols
Computerworld (US)
August 4, 2010

FRAMINGHAM - Everyone knows the big virtues of using cloud computing services: They’re cheap, you can scale them on demand, and they’re fault-tolerant. Everyone also thinks they know cloud computing’s vices: a variety of security and management concerns . What a lot of people have been missing, though, is that there’s another real problem with cloud computing: legal liability.

You see, the default contract from Amazon Web Services and the other major public cloud providers puts the onus for any privacy trouble that might develop on you, the customer, not them. So, say that 100,000 of your best customers’ records end up on WikiLeaks because your cloud provider’s security is breached. Who do you think is going to be legally and financially responsible for the leak and any damages it causes? You can probably guess, but I’ll tell you anyway: If you signed the standard cloud contract, you are. Never mind that it was the cloud provider’s security failure; you’re the one who will be stuck with the bills. Lucky you.

According to one report from SearchCloudComputing, Eli Lilly , the pharmaceutical giant, is fighting with Amazon over just these kinds of issues. Amazon’s Werner Vogels denied the story’s contention that Eli Lilly had walked away from AWS. “Eli Lilly is still very much a customer and has not dropped their use of AWS,” wrote Vogels. Be that as it may, not everyone is content with Amazon’s contract policies. Burton Group analyst Drue Reeves said at the Burton Group’s Catalyst conference , “We don’t feel like there’s enough transparency in Amazon. We would like to trust you [but need more information].”

Trust is important. Eli Lilly was burned publicly once before by an accidental release of the e-mail addresses for nearly 700 subscribers to its Prozac.com e-mail alert. The company certainly doesn’t want a repeat performance of that, and no company wants to be left holding the bag in the event of a data breach because of the negligence of a cloud provider.

So, what can you, as a corporate officer, do about this? Tanya Forsheit, founding partner at the Info Law Group has some advice. First, Forsheit told me, you should be aware that “many providers of cloud services tends to offer one-size-fits-all contracts. You shouldn’t just sign up for them. You need to negotiate.”

In fact, Forsheit thinks you should start looking at the legal aspects of any cloud deal long before you get around to talking about the contract. “You should ask questions about data security and privacy during the preliminary stages, even before you get to the contract. You should ask them what kind of privacy and security controls they have, whether they’ll let you audit their security, and what they will agree to in regards to liability. These are all places where there’s room to compromise. On your side, you need to know what level of risk you’re ready to take. If a provider won’t agree to even consider negotiating, that’s a big red flag, You need to be ready to walk away from the deal.”

Many companies, Forsheit said, find walking away hard to do. “Companies get excited about a solution or provider because they think the service is great or the cost is great, but they need to look at the business and legal concerns. Far too often, legal issues aren’t looked at until it’s too late, or not at all.”

On the other side, Forsheit noted that cloud providers’ legal policies and security and software audit standards vary. For example, Salesforce , the CRM (customer relationship management) power, will let customers audit their operations and is compliant with SAS (Statement on Auditing Standards) 70 , a service auditing standard. Others aren’t.

“At the end of the day, the provider wants you to agree to their terms. Many won’t accept reliability and liability terms. Or, for example, they’ll want to limit their liability to what you paid them for their services,” said Forsheit. This could easily end up being mere pennies on hundreds of thousands of dollars in damages.

So, is moving to the cloud still worth it for your company? It may very well be, but before making the jump, you need to have your in-house counsel, as well as your IT staff, go over the package. And, Forsheit added, “If you don’t have the expertise internally, find outside counsel to go over each proposed deal with you.”

Or, as I’d sum it up, when it comes to cloud computing, it’s better to be safe than sorry regarding both the legal and technical issues. Good luck.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Ross O. Storey
MIS Asia
July 14, 2010

SINGAPORE - Ninety per cent of Information Security Forum (ISF) members believe cloud computing changes their information security risk landscape, but they maintain they are well-placed to address these security issues.

The vote of confidence in cloud computing was revealed in the ISF’s latest survey involving more than 300 of the world’s major companies and public sector organisations. The ISF is a major independent, not-for-profit authority on information security, dedicated to reducing risk and resolving information security challenges.

The rapid adoption of cloud computing was identified as one of the top information security challenges in the ISF’s latest Threat Horizon Report.

Adrian Davis, a senior research consultant for the ISF, said the research highlighted concerns about cloud computing.

“The main areas of concern are focused on managing user identities and credentials, third-party service providers, emerging cloud technologies, protecting against new forms of malware and legal and regulatory issues,” Davis said.

Mobility, cyber crime and online espionage

The ISF said other key threats highlighted included the increasing use of powerful mobile devices, the growth in cyber crime and online espionage, and the merging of home and work computing.

“In our latest report on cloud computing, we advise members to address five tasks: prepare a strategy; identify the impact on business operations; assess risks to data; ensure information security is part of the decision-making process; and work under the assumption that cloud computing is already being used within the organisation.”

Davis will by the keynote speaker at the forthcoming SecureAsia@Singapore Conference & Exhibition, one of the Asia Pacific’s major events for information security professionals to be held at Suntec City in Singapore from 26 — 27 July 2010.

The event is organised by (ISC)², the largest not-for-profit membership body of certified information security professionals worldwide, with nearly 70,000 members in more than 135 countries.

INCREASING CLOUD CONFIDENCE

The conference will present high-level tips for increasing confidence and reducing the risks in cloud computing. It will bring together more than 20 information security industry experts from the Americas, Europe, Middle East and Africa (EMEA), and the Asia Pacific to share their insights and strategies. More than 400 information security professionals from the region are expected to attend.

Davis will examine the relationship between cloud provision and outsourcing, along with key technologies such as virtualisation.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Lucas Mearian
Computerworld (US)
July 9, 2010

FRAMINGHAM - EMC’s agreement to buy Greenplum Inc. adds a key component to the storage vendor’s strategy to boost its business intelligence and data analytics business.

EMC has long been trying to shed its image as a data storage vendor in order to become recognized as a player in the larger information infrastructure business. Tuesday’s move is the latest aimed at fulfilling EMC’s goal of providing the hardware and software users need to build large cloud infrastructures, and the analytical tools that can be used to mine data stored within those clouds.

In a written analysis, Pund-IT Inc. analyst Merv Adrian said Greenplum gives EMC a structured data management tool for databases.

Citing dozens of other EMC acquisitions in recent years, Adrian wrote “Disruptive? You bet. Is EMC finished with acquisitions? I doubt it.” The acquisitions have ranged from very small vendors to large companies like unstructured data archive vender Documentum and virualization vendor VMware.

Adrian said EMC is likely to continue looking to buy business intelligence tool providers, master data management firms, as well as a companies that sells ETL (extract, transform, and load) software, which allow businesses to consolidate data from disparate systems.

“Finally, and not least, it’s about performance. Technical improvements become more possible when a vendor owns the whole stack. Balancing IO, processor speed, memory, multiple tiers of storage, virtualization, security, calls to external analytics, ingesting data, exporting data - all become more tunable, more optimizable, if you own all the pieces,” Adrian added.

Charles King, principal analyst at Pund-IT, said the Greenplum acquisition is also about EMC getting its foot in the door with cloud service providers, enabling the data storage vendor to compete against other cloud storage providers, such as Amazon.com and its S3 hosted storage service.

“It’s really about understanding that storing data is the foundation for information intelligence, but you need a lot of tools to really allow the users to enjoy the greatest benefits from it,” King said. “I think Greenplum is just another step forward in this broad but powerful strategy.”

EMC said that following the close of the acquisition, Greenplum will form the foundation of a new data computing product division within EMC’s information infrastructure business.

San Mateo, Calif.-based Greenplum sells a data warehouse platform based on a massively parallel processing (MPP) architecture that can scale out to hundreds of servers running a single database instance. Greenplum’s software is used in business analytics and is flexible in the different business applications for which it can be used, King said.

For example, privately-held Greenplum has a customer list of more than 100 companies that include large retailers such as Sears and Sony as well as financial services entities such as Nasdaq and the New York Stock Exchange or telecommunications providers such as Vodafone and Skype.

“They’re using Greenplum’s technology to mine their data warehouse to garner insight on data they’ve collected,” King said.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Computerworld staff
Computerworld (US)
July 8, 2010

FRAMINGHAM - EMC plans to acquire Greenplum for an undisclosed sum and form a new division around the privately held company’s data warehousing technology.

Greenplum sells software for analyzing large amounts of structured data, breaking up the information into multiple databases and working on each separately for quick results, according to co-founder and President Scott Yara. Its technology works across both computing and storage infrastructure to allow individual employees, instead of just IT departments, to ask questions and generate answers about an organization’s data.

EMC aims to integrate this kind of processing more tightly with its storage systems to further increase performance. All this can also be implemented increasingly across cloud-based and virtualized storage and computing, the companies said. The technology could also potentially be used in EMC’s backup and recovery business, based on its recent Data Domain acquisition, and its RSA security business, said Chuck Hollis, vice president and global marketing chief technology officer at EMC.

The buyout is just the latest in a string of acquisitions being carried out as IT vendors gear up to address the coming trend of cloud computing.

Following the close of the all-cash acquisition, which is expected in the third quarter of this year, EMC will form a “data computing product division” around the technology. The setup will be similar to that of the security and backup divisions, as well as the information intelligence unit that was formed after the company’s acquisition of Documentum. Greenplum’s technology is designed for structured data, whereas Documentum’s is unstructured data, Hollis said.

EMC said it will continue to sell Greenplum’s entire portfolio of products while also developing an integrated hardware and software offering for higher performance and lower implementation costs.

Greenplum’s customers include the Nasdaq and NYSE Euronext stock exchanges, Skype, T-Mobile USA and credit-monitoring company Equifax. T-Mobile is already using the company’s “self-service” model, in which employees within the business can create new virtual databases and initiate queries on the fly, Yara said. Greenplum helps T-Mobile analyze all the activity on its mobile networks to better target customers and prevent fraud, he said. In other organizations, it can also be used with surveillance data and to monitor compliance.

Greenplum, based in San Mateo, California, was founded in 2003 and has 140 employees, who will be integrated into EMC, according to Yara. Greenplum CEO Bill Cook will head the new division at EMC and will report to Pat Gelsinger, president and chief operating officer of EMC Information Infrastructure Products.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Ellen Messmer
Network World (US)
July 7, 2010

FRAMINGHAM - Despite how attractive cloud computing can sound as an outsourcing option, there’s widespread concern that it presents a security and legal minefield for businesses and government. Cloud service providers often cultivate an aura of secrecy about data centers and operations, claiming this stance improves their security even if it leaves everyone else in the dark.

Lawmakers question the security of cloud computing

Businesses and industry analysts are getting fed up with this cloud computing version of “don’t ask, don’t tell,” where non-disclosure agreements (NDA) dominate, questions aren’t answered, and data center locations and practices are treated like national security secrets. But public cloud service providers argue their penchant for secrecy is appropriate for the cloud model — and at any rate, everyone’s doing it. They often hold out their SAS-70 audit certifications to appease any worry (though some don’t have even that).

“The business data you store in Google’s cloud is safe,” said Google product marketing manager Adam Swidler at the recent Gartner security conference held in National Harbor, Md. He emphasized that Google’s multi-tenant distributed model entails “splicing data across many hard drives” so that in this “hardened Linux stack” there’s a “quick update of all fragments of all files in the hard drives,” a process he called “obfuscated files.”

Swidler acknowledged there has been some secrecy about where things are located because “we think it’s a security risk.” Nonetheless, “Google is trying to open up a little transparency in what we do,” he said.

Currently, the information Google will disclose publicly or even under NDA won’t satisfy everyone, Swidler acknowledged. “It’s not enough for everybody. Some people do want to go deeper.”

The location of data centers is a big issue in contract negotiations, where legislative and judicial issues abound. For instance, the location of data is an issue under some data-privacy laws, such as those from the European Union. But while customers often care about where their data is physically located, Google “believes this notion of where is data physically located is a bit antiquated,” Swidler said.

Many disagree, however.

Customers want to know where a cloud provider’s data center is, said Kurt Jackson, managing director in a Pitney Bowes division called OnDemand that offers software-as-a-service applications, such as maps for city services, to business and government customers.

The willingness of cloud provider Terremark to allow site visits and to discuss details about its data centers and its physical and network security was critical in the decision to use Terremark, Jackson said. “If you’re running in Miami, you know you’re in Miami,” he said. “Some other providers just aren’t as transparent.”

The argument over transparency vs. secrecy in cloud computing is leading to a culture clash between the more traditional ways of handling data outsourcing and the newer cloud-computing utility methods and mindset.

Gartner analyst John Pescatore said it’s simply not possible to know whether Google’s technique of “hiding the data in a million places” is good security or not since there’s no way to evaluate it. Speaking at the Gartner security conference, he said SAS-70 certification of any public cloud provider may be considered adequate for some customers, and not others. “SAS-70 is pretty meaningless from a security level, but it makes auditors happy.”

Organizations with certain kinds of sensitive data are simply unlikely to find public cloud computing a right fit until the day comes when they can be sure their favorite security mechanisms are running in their cloud environment, Pescatore said.

Cloud computing challenges traditional notions about auditing and security, and it’s possible a new way of auditing needs to evolve.

“If your service provider won’t give you information about security processes and plans in order to do what’s necessary, you shouldn’t trust that provider,” said Andreas Antonopoulos, an analyst with Nemertes Research.

The old idea of “security by obscurity,” which suggests you can defend your security position best by keeping mum about everything, is misguided, he said. “It doesn’t work. There’s always someone who knows,” Antonpoulos said. If you hear someone try to get your business by uttering that phrase, “run far and fast.”

Analyzing the fine print
Legal experts took notice when the City of Los Angeles posted its contract with Google related to the city’s migration to Google e-mail and collaboration services with the help of IT services firm CSC..

David Navetta, an attorney at Information Law Group, recently completed an analysis of the lengthy contracts with Google and CSC to determine how each side fared in defining responsibilities related to a potential data breach and indemnification of damages.

He note Google is defined in the arrangement as a CSC “subcontractor,” and “therefore, as respects indemnification for a breach of confidentiality obligations or for lost City Data, CSC would be responsible to pay for Google’s act or error.” However, he thinks the term “lost data” should have been defined more clearly in the contracts.

Speaking in general about the job of evaluating and approving cloud services contracts, Navetta said it’s common to encounter a rushed environment where cloud service providers insist they don’t have time to discuss details and don’t want to make changes.

“The usual line is ‘we can’t do this one change for one customer,’” Navetta said. Security and legal are typically “on the same side of the aisle,” while the IT department wants to get something done quickly to save money. He said cloud providers often don’t want to “let people truly look under the hood” and using them “constitutes a trade-off because you’re losing control.” Not surprisingly, large companies and government agencies can be expected to obtain more concessions from cloud-service providers.

But not all organizations have found they fret over contracts.

Lincoln Cannon, director of Web systems at Merit Medical Systems, said the manufacturer has taken a few steps into cloud computing with Google Apps and Telania’s eLeap for sales training, as well as Amazon for development work related to a new corporate Web site.

The providers’ boilerplate legal agreements were given to the legal department, which redlined them and went back and forth until both partners were satisfied, Cannon said. “The legal team was perfectly happy with Google Apps,” he said. The most concern over cloud computing probably came from the CIO because of his data-protection responsibilities related to Sarbanes-Oxley regulations, Cannon said.

Not all cloud service providers harp on secrecy, either.

Cloud infrastructure services provider ReliaCloud has two data centers in the Minneapolis/St. Paul area, and has about 100 cloud customers using its new VMware-based environment built on a management platform designed by Cloud.com, said CTO Jason Baker.

However, most of the hosting provider’s 5,000 customers continue to use the more traditional method the firm offers that entails use of dedicated servers in cages, Baker said. The idea of cloud computing is still very new and customers are still trying to understand what’s different. But Baker said he’s convinced a shared-tenant virtual-machine-based cloud service carries some inherent security attributes in terms of high availability that can’t be matched by dedicated servers.

“It’s more reliable,” he said. “If your application is running on one physical box, the customer would experience downtime. But in a cloud, we have a pool of virtual machines, and if one physical node goes down, we would automatically start somewhere else in the cloud.” In addition, he said, use of some APIs in the future could allow customers’ applications to sense when an increase in computing power is needed and execute that at once.

Unlike some cloud providers, Baker will willingly tell you about security defenses in use, such as the Cisco ASA firewall.

The question for customers is how far the public cloud providers are going to pull back the kimono, said HP’s chief security strategist Chris Whitener. “You should sort of insist on that,” he said.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Paul Venezia
PC World (US)
July 7, 2010

SAN FRANCISCO - It’s not the first time that I’ve had this question on my mind, but reading Matt Prigge’s post last week — which echoed my own sentiments about cloud computing — led me to contemplate why we seem to consider Google’s cloud more trustworthy than others.

Nobody pushes cloud computing harder than Google: Gmail, Google Docs, Google Apps, Google this, Google that. It’s all based on a framework of remote resources and an amorphous blob of processing that’s been tuned to spit out whatever we happen to be looking for, accept whatever documents we create, and send email and IM messages. And unlike so many other cloud service providers, Google seems to be accepted in this role, while others inspire skepticism.
[ Also on InfoWorld: Read about Google's adventures in Wi-Fi snooping in France. | Check out Neil McAllister's comparison of Google Docs and Microsoft Office Web Apps. ]
Most people have heard Google’s corporate motto, “Do no evil,” which has been challenged again and again, from censorship in China right up to Google Street View cars detecting and cataloging nearby Wi-Fi networks. Google claims the latter was inadvertent, but the company is still in hot water for it.
Nonetheless, Google is going a step further. To feed Google Places, it’s placing cameras in certain public places and establishments, so you’ll be able to view the interior of a restaurant, say, before heading out for dinner. And this seems perfectly fine to most people. I wonder what the reaction would be if Microsoft or Oracle tried the same thing? Would it be all roses and sunshine, or would people look at some crusty, beady-eyed Oracle guy and send him packing?
Somehow, Google has convinced the world that the company isn’t, in fact, evil. That’s despite the fact that Google is the most powerful force on the Internet today — a position that companies with different corporate mentalities might wield like a truncheon.

But Google steps lightly and presumes nothing. The famously sparse home page remains free of ads and clutter — a design so beloved that when Google introduced a Microsoft Bing-like background image a few weeks ago, the Internet exploded with outrage, and the situation was quickly reversed. But screaming about background images is like yelling at a prison guard for the quality of the food: You’re still under lock and key, even if the consistency of the pudding improves.

Recently I’ve noted how much Facebook knows about you, but make no mistake, Google knows plenty, too. Based on IP information, they know your searches, naturally, but they also know everything you do with Google tools. Planning a trip? They know where you’re going and how you’re getting there if you use Google Maps and directions. Correlate that information with keywords in messages in your Gmail account and you can determine times, companions, specific destinations, the whole works. Use Google Maps on your smartphone and, technically, they could track your progress.
Given the paranoia about so many other intrusions such as government surveillance, snooping bosses, predators, whatever, it’s amazing what Google has gotten away with. We’ve taken the candy, and in return we’ve given up significant levels of privacy to some huge corporate entity that we inexplicably trust not to betray us.

Maybe we trust Google because it has been benevolent in the past — in not “monetizing” when it could have, in promoting open source here and there, and in providing whimsical perks to its employees. Sure, now and again we’ve sucked air and said, “Oops, that was kinda evil.” But strictly speaking, the company hasn’t screwed over enough people to dent its public image. The idea that Microsoft — or even Apple — could ever make that same claim is almost comical.

Google also has the benefit of being constantly available. Can you even recall the last time that Google Search was unavailable or down? Some apps have had snafus in the past — notably Gmail — but the Google main page has always been ready for service, fast as you please. And that impeccable reliability may have more to do with why folks trust Google with their details, documents, pictures, videos, and so on than anything else.

Me, I don’t trust the cloud. I don’t know that I ever will. Yet I have a Gmail account and I use Google Maps and a variety of other Google tools all the time. At this point in the evolution of the Internet, it’s impossible not to. Let’s just hope that those in control of our information can truly be trusted to do the right thing. Hope, in the end, is all we can do.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Dan Nystedt
IDG News Service (Taipei Bureau)
July 6, 2010

TAIPEI - Taiwan’s biggest telecommunications company, Chunghwa Telecom, signed an agreement Monday with the world’s largest contract laptop maker to jointly develop cloud computing software, services and hardware products aimed at markets in Asia.

Chunghwa and Quanta Computer will focus on Taiwan first, offering Web storage and services hosting as well as projects tailored to customer needs, they said in a joint statement. They will also create new products and services. The companies hope to lead government offices, businesses and more into cloud computing through the initiative.

“The biggest challenge to entering cloud computing services is providing the rich applications and services that attract big clients,” the statement says. “Under the framework of this memorandum of understanding, Chunghwa Telecom and Quanta Computer will cooperate to develop software, hardware, and systems platforms as well as testing, certification and more.”

The agreement comes at a time when products from another Quanta Computer cloud computing project are due out. The Taiwanese company expanded a partnership with the Massachusetts Institute of Technology’s (MIT) Computer Science and Artificial Intelligence Laboratory (CSAIL) last year to include new cloud computing and mobile technologies. Quanta has said the first products from the partnership will be out this year.

Chunghwa Telecom has been offering some cloud services in Taiwan for some time, but this partnership stands to greatly expand its work in cloud computing, the company’s chairman said at a press conference in Taipei.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By J.F. Rice
Computerworld (US)
June 28, 2010

FRAMINGHAM - IN A RECENT COLUMN, MY SECURITY MANAGER’S JOURNAL COUNTERPART, MATHIAS THURMAN, WROTE ABOUT SECURING VIRTUAL DESKTOP ENVIRONMENTS. MY COMPANY IS GOING THROUGH THE SAME EXERCISE OF EVALUATING VDI AS A REPLACEMENT FOR TRADITIONAL DESKTOPS. AS MATHIAS POINTED OUT, THE CONCEPT OF VIRTUALIZING THE APPLICATIONS THAT RUN ON THE SYSTEM DOES NOT SUBSTANTIALLY CHANGE THE THREAT LANDSCAPE, NOR DOES IT MODIFY THE COUNTERMEASURES WE PUT IN PLACE TO PROTECT AGAINST THOSE THREATS.

This is true in the server world as well. Physical servers are being replaced in our data center by virtual machines, but these VMs look and feel like any other server platform from the security perspective. Whether the server is real or virtual makes no difference from the network point of view. They all look the same on the wire.

But what about Internet-based services? Cloud computing and software-as-a-service (SaaS) are beginning to proliferate in my company’s network, and I find myself struggling with trying to apply the best practices we are using inside our network perimeter to outside companies beyond our control. I believe that the risks associated with Internet-based SaaS services are a combination of those risks associated with traditional data center environments in addition to those of Internet-based services, added to a new set of risks that arise from the convergence of private and public environments.

We are using SaaS-based services, including the well-known Salesforce.com and Google Docs, other Web services, and outsourced third-party support and staffing services that connect into our network over the Internet. These services need to access some of our internal network infrastructure in order to work, such as our Active Directory authentication systems. Yet we don’t really know that these outside companies will treat that access with the same care and caution that we use, and how do we know they are safe? All we really have is contractual reassurance. That’s why I insist on a SAS70 certification from every potential SaaS vendor before we start any discussions about connecting to their service. While SAS70 may not completely guarantee that a vendor’s service is safe, it at least establishes that the vendor has given some thought to protecting its customers’ information assets.

When evaluating the security of SaaS services, I am concerned about some additional factors beyond traditional data center computing that need to be addressed. For instance, knowledge and control of the location of data are important for many reasons, with regulations being near the top of the list. In the past, service providers knew exactly where their customers’ data resided, because individual servers were housed in specific data centers with minimal interaction from the providers. But in newer, distributed cloud environments, providers have many data centers and leverage virtualization of servers, network, and storage to provide elastic environments that can be scaled on demand. This means that finding the physical location of data can be difficult, and it can move around without warning.

And where is my data? I’m concerned about service providers commingling my company’s sensitive and private data with that of other customers. Service providers typically store data from multiple customers on the same hardware. They state that controls are in place to provide logical separation of data for different customers, but validating that competitors can never access our data either intentionally or accidentally may not be possible. And how do we that ensure our data is completely removed in the situation where we want to terminate our contract with the cloud provider?

I’m also concerned about whether a service provider’s physical servers are located in different places, especially when those locations are outside the U.S., and possibly even in risky locales. Ensuring the integrity and confidentiality of data when the infrastructure resides physically in other countries, especially those hostile to the U.S., can be impossible.

Mission-critical services require some thought and planning around redundancy. An established practice is to assume that any given service will fail, and plan appropriately by using redundant providers. But if the service itself goes down, we typically have defined SLAs that are published by the service providers with a provision for a cash refund or service credit based on the cost of the service, not the cost of losses due to business downtime. SLAs for SaaS services are also affected by Internet reliability — if our Internet link goes down, access to data is impossible and there is no remediation, and our people can’t work. So the Internet itself has become a mission-critical application that our workers can’t live without, and it needs to be highly available, otherwise work will stop when there is no offline alternative.

Despite these challenges, my company, like many others, continues to march forward toward virtual hardware and software services, so I’m doing the best I can to secure them. There’s always a new challenge in my security world, which is why I like my job. It seems like there’s never a dull moment.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Jon Brodkin
Network World (US)
June 24, 2010

FRAMINGHAM - The “private cloud” is a popular phrase in IT these days, but often a meaningless one, with tech vendors slapping the label on any old product that happens to make an existing IT function slightly more efficient.

Logically, a private cloud should act just like a public cloud service – such as Amazon’s Elastic Compute Cloud - but exist entirely within an enterprise’s firewall. Few “private cloud” products actually recreate the functionality of a public cloud, but a new contender in the market called “Nimbula” has a product that, at the very least, can be called a private cloud without causing eyes to roll.

Greatest tech arguments: Public vs. Private Cloud

Nimbula was founded by Chris Pinkham, who led development of Amazon’s EC2, a service that greatly accelerated adoption of cloud computing by offering software developers access to raw computing power over the Internet.

Pinkham’s start-up, which is emerging from stealth mode Wednesday and has ex-VMware CEO Diane Greene on the board, has built software that lets businesses create their own Amazon EC2-style cloud by pooling together existing hardware.

Pinkham was an Amazon employee between 2001 and 2006, and was initially in Seattle where he ran network operations.

“Through that experience, I decided there had to be a better way of building and scaling this kind of infrastructure,” Pinkham says. He set out to build the service that became EC2, with the idea being “to focus on developers in a way that hadn’t been done before,” he says. “I initiated it and proposed it, and put the team together that built it. It started off as a reasonably independent project, but ultimately it belonged in the Amazon Web Services family.”

Eventually, Pinkham moved back home to Cape Town, South Africa for family reasons, shortly before EC2 was announced to the general public in August 2006. The departure was amicable, and Pinkham says leaving Amazon was the right thing for him to do at the time, even though it was a difficult decision.

“I’m ultimately an entrepreneur, not a big corporate kind of guy,” he says. “But in some ways I still regret not having been part of the [Amazon EC2] growth, which has just been phenomenal.”

Nimbula – which was called Benguela when the company was in stealth – was founded in late 2008 by Pinkham and Willem van Biljon, who was part of the team that built EC2.

The company has $5.75 million in funding from Sequoia Capital and the virtualization vendor VMware. Former VMware CEO Greene is one of Nimbula’s four board members, along with Pinkham, van Biljon, and Sequoia investor Roelof Botha.

The software is called Nimbula Director, and is in beta with about six “large international customers in the financial services, technology and healthcare industries,” with general availability planned for the fall of 2010, Nimbula says.

Nimbula Director automatically discovers servers, lays down the virtualization technology and control pane software, automatically organizing the nodes into an EC2-style cloud.

“The build process is ongoing. As new nodes are introduced or retired, those resources are automatically discovered,” Pinkham says.

Although Nimbula Director initially integrates with Xen and KVM, the technology is “fundamentally agnostic” and the company is working on integrating with VMware deployments, Pinkham says.

Businesses that use Nimbula Director will be able to offer virtual machine instances in any flavor they like, from Linux to Windows, while setting policies that determine how much compute and storage capacity VMs can consume. Unauthorized access is prevented with a built-in identity and permission system.

Nimbula’s announcement explains that the “cloud control software isolates customers from the operational and hardware complexity associated with deploying compute in a static private data center. A RESTful HTTP API provides a simple and comprehensive interface to all aspects of cloud resource control. Cloud resources can also be managed via a command line interface (CLI) and web control panel, built on top of the API. Beneath the virtual data center abstraction sits a physical layer of storage, network and compute hardware managed by multilayer control software. Nimbula integrates a hypervisor (KVM and/or Xen) with node management software on each node to achieve automated deployment and configuration.”

Naturally, workloads that run on Nimbula Director can be moved into the Amazon EC2 cloud if overflow capacity is needed, according to Pinkham. Companies that have large populations of Web developers are Nimbula’s most likely customers, he says.

One early customer is CIO Joubert Steyn of the Metropolitan Health Group, a health insurance company in South Africa.

MHG has installed Nimbula on just five physical servers so far, but intends to use the software on its VMware deployment. The company is testing the software out with some of its light healthcare applications and middleware products.

Steyn has not used EC2. “South Africa is still quite bandwidth-constrained,” making it difficult to effectively use public cloud computing services,” he says. “That’s why we looked at some kind of a private product.”

It took a week or so to deploy Nimbula, but “once we got it up and running, and configured correctly, the product has performed very well,” Steyn says. “It’s all the things cloud computing is going to give you – much better resource utilization, resource planning, and the ability to simplify the management of your infrastructure components.”

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Preston Gralla
Computerworld (US)
June 22, 2010

FRAMINGHAM - The latest news from HP should be chilling to IT employees: The company is eliminating 9,000 IT positions. James Staten, an analyst at Forrester Research Inc., told Computerworld that it’s probable that IT operations jobs such as systems administrators will bear the brunt of the layoffs .
For anyone who’s been paying attention to the news lately or the arc of technology, this should come as no surprise. Cloud computing has already passed from the realm of hype to having a significant impact on businesses. And outsourcing infrastructure and IT has become a way of life at many enterprises.
Does that mean that it’s time for Willie Nelson and Waylon Jennings to update their old hit and sing instead, “Mamas, don’t let your babies grow up to be IT staff”? Is IT in the enterprise dying? It’s not as far-fetched as you might think. Imagine, for a moment, that a company is starting a business today. It has a choice about how to handle its computer infrastructure. It can build a network, install countless servers and many applications, pay a big staff to maintain and update all of them, and be responsible for uptime 24 hours a day, seven days a week. Or it can instead outsource much of its network and applications — or perhaps have them live in the cloud — and have some other company take care of its data center, applications — and headaches.

For a small company, the choice is an easy one: Pay for virtual IT, not on-site staff. Increasingly, small companies are turning to cloud computing and similar services rather than deploying their own infrastructure with an IT staff. Of course, large enterprises don’t start from scratch, and they can’t outsource that easily. But they are outsourcing more and more. And as for those start-ups, some eventually grow into large companies. If they’re hooked on virtual IT from the beginning, they’re not likely to need a sizable IT staff once they grow.

There are other reasons that IT in enterprises is in trouble. Even companies that don’t move toward the cloud need less infrastructure these days than they did in the past. Virtualization and blade servers allow companies to consolidate data centers, requiring fewer IT staff to provide the same amount of services as previously — or even provide more services than previously. In addition, automated management tools increase IT productivity, allowing companies to do more with less as well.

All this sounds very bleak. The truth is, though, that IT isn’t going away any time soon, or possibly ever. But IT does need to recognize that its job is changing very quickly — and for IT staff members, it’s either change or die.

What is IT’s new job? Providing services to make the business run more effectively, rather than maintaining hardware and software. That means that IT staff may no longer be in charge of an enterprise’s plumbing. But it will be in charge of something far more important — matching a company’s business needs to its technology needs, and finding and implementing the right solution, even if someone else does the implementing. Business smarts may ultimately become as important as tech smarts.

Manesh Patel, CEO of San Jose-based electronics manufacturer Sanmina-SCI, put it succinctly to Computerworld when he explained , “IT is becoming more of a service-oriented organization, providing more value-added services, with less emphasis on [maintaining in-house] systems, networks and architectures.”
And what’s happening at HP is a perfect example as well. Although the company is laying off 9,000 IT staff, it will also be hiring 6,000 new employees. HP is looking for people who can sell and deliver IT services.

What does this mean to you? If you’re in IT, it’s time to learn new skills — less about the network and applications, and more about how they can be used to run a business more effectively.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By John Mark V. Tuazon
Computerworld Philippines
June 7, 2010

The emergence of the cloud, the potency of the new Web, and the proliferation of mobile devices are just some of the key technology trends global outsourcing provider Accenture is seeing to take over the enterprise world in the next three to five years.

In an announcement made before the press hours before the annual CIO Forum where the company gathered local CIOs and IT mangers to update them on new technology trends, Michael Redding, the BPO firm’s global managing director for Accenture Technology Labs, their R&D division, highlighted seven key trends that will define the way enterprises run their businesses.

Foremost of these trends is the jump to cloud computing, which Redding describes as a “powerful trend” that can match IT supply to business demand. “20% of servers in the world are bought by only four companies: Amazon, Yahoo, Google, and Microsoft,” he pointed out.

This enables the aforementioned firms to offer their servers for rent, which is a form of cloud computing. “Every layer of the stack can be subscribed to as a service,” Redding explained. “So instead of owning the hardware, they can just rent it.”

IT equipment, however, is not the only element of IT being dispersed by new technology developments. Special equipments—such as video and audio players—are slowly being replaced by new Web 2.0 elements, according to Redding.

“Now, the browser is all you need,” he emphasized. Redding highlighted the emergence of HTML5, which is able to deliver rich media experience through the browser, instead of other standalone applications. “This will change the way CIOs deliver applications to their employees,” he added.

Another change in the application delivery space is brought about by mobility, which is opening up the enterprise to new channels and devices acting as doorways to information. “Smartphones are not expensive phones, they are cheap computers,” the Accenture executive remarked.

Redding said CIOs should first think about building their mobile platform, because today, “the way to reach customers is through mobile.”

The name of the game, therefore, is flexibility, or as Accenture would candidly put it, elasticity. “The successful enterprise of tomorrow is going to be flexible, and can adapt to a number of factors and changes in the industry,” Redding added.

Other technology trends Accenture is foreseeing to dominate global organizations include: fluid collaboration through major software platforms; the rise of social media and the creation of the conversation economy; the use of data to make decisions in order to differentiate; and the fourth generation of system development, which relies on cloud-based architecture.

Accenture is a global management, consulting, technology services, and outsourcing company, with a 181,000 employee base in over 120 countries. In its delivery center in the Philippines, the company employs at least 18,000 people to service global clients in Europe, North America, and Asia.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Veronica C. Silva
MIS Asia
May 24, 2010

SINGAPORE - Major industry players recently forged an alliance to collaborate on cloud computing, which has recently become the buzzword in the IT industry.

Industry players, including a university and an investment firm, organised ‘Cloud Commons’, a Web-based collaborative community that seeks to help IT professionals learn more about cloud computing through sharing and feedback from peers.

With IT professionals sharing best practices and their expertise, Cloud Commons organisers expect IT professionals to be properly guided on how best to implement cloud computing to meet their organisation’s business objectives.

Among the founding collaborators of Cloud Commons include CA Technologies, TM Forum, Red Hat, Carnegie Mellon University and Insight Investments.

“Today, there is no comprehensive, unbiased source that solicits and aggregates the most current and relevant knowledge about cloud computing and the accumulated, actual experiences that organisations are having with the cloud,” said David Hodgson, senior vice president of the cloud products and solutions business line at CA Technologies. “Cloud Commons will address this need–providing IT professionals with situational awareness and visibility into what is possible with the cloud.”

Collaborative features

As a collaboration tool, the Web community contains features that encourage sharing of ideas and learning to allow IT professionals to implement cloud computing in their organisations. There is an area on the website that will allow participants to provide qualitative feedback on their experience with third-party cloud services. Participants can also post comments to share their best practices.

Carnegie Mellon University will also make available the Service Measurement Index (SMI) it is developing. The index is intended as a standard for quantifying and evaluating cloud computing services and addresses the need for industry-wide, globally accepted measures for calculating the benefits and risks of cloud computing services.

The website will also be informative, with articles from industry analysts and subject matter experts, blog feeds from industry thought leaders, white papers and stories on real experiences from IT professionals.

There will also be a marketplace of cloud computing service offerings to include vendor service ratings to enable participants to compare alternate service options.

Industry partners

“Demand for cloud services holds significant potential for the technology and communications industries, but many barriers still exist to widespread adoption at an enterprise level,” said Martin Creaner, president, TM Forum, an industry association of suppliers and providers of communications solutions and services.

“We are fully supportive of this type of initiative to improve the uptake and development of a vibrant and open cloud services market,” Creaner added.

CA Technologies said it has invested on independent research as initial information that can help IT professionals learn more about cloud computing services. But it expects the online community to contribute more information through the website.

“As a foundation partner for CA’s Cloud Commons, we look forward to providing continued leadership in driving the next wave of technology evolution through cloud computing,” said Scott Crenshaw, vice president and GM, cloud business unit at Red Hat. “With the rich cloud content and resources available through Cloud Commons, enterprises will be further enabled to unlock the value of the cloud.”

Other features to be added to the website include hosted webcasts and webinars delivered by subject matter experts on cloud topics, and content in podcast and video formats.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By John Mark V. Tuazon
Computerworld Philippines
May 5, 2010

Going against market anxieties about the cloud’s security, a local software firm recently unveiled their HR Payroll cloud application, aiming to deliver innovative payroll solutions for local companies.

Through the SaaS-deployed service entitled “iSuweldo,” the developers behind what is claimed to be as the first Filipino HR application in the cloud said they are looking to remove the common pains from payroll processing, which usually takes an HR expert to accomplish.

“We wanted to remove the pain points usually associated with payroll preparations such as deductions, loans, and government reporting,” said Grace Cariño, chairman and CEO of iSuweldo, Inc. “We built iSuweldo with the Filipino company in mind. With [it], we bring payroll management to a higher level where technology perfectly matches the needs of both employers and employees.”

The pioneering cloud application features a self-service module which integrates bundy clock logging, time sheet updating, loans, leaves, and overtime application, and the capability to print one’s own payslips, ITR, and other reports.

“Here [in the Philippines], the cloud is still in its infancy,” remarked Richard Quin, vice president for sales and marketing of iSuweldo, Inc. “But with our application, [we guarantee] no infancy in terms of capability.”

The iSuweldo cloud application—built only in 60 days—is hosted in Steadfast data centers located in Chicago, Illinois, as well as in Vitro and Data One data centers locally, which ensures uptime and service availability whenever needed.

Users who have little to no knowledge of payroll can be guided by the integrated eight-step payroll processing wizard, which takes the administrator from processing employees’ timesheets, other earnings, and allowances to expenses, deductions, and leave credits, among others.

One of the key features of the application, however, is the ability to process and print highly localized reports built-in to the system and is automatically filled out using employee data. Forms needed to comply with BIR (Bureau of Internal Revenue), SSS (Social Security System), and Philhealth, among others, are readily available through the applications’ reports module.

“We don’t have clients yet but the system has been tested on an engine already being widely used by some Philippine companies,” Quin said. “[With this pioneering effort], we hope to become the standard [in enterprise cloud applications] locally.”

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Chris Kanaracus
IDG News Service (Boston Bureau)
May 5, 2010

BOSTON - In one way, the global recession “felt like more of the same” for Microsoft CIO Tony Scott. “The boss comes in and says, ‘We want to cut costs.’”

But now, as the economy shows signs that a recovery is under way, “How many of us know how to grow?” Scott said during an event held in Boston on Tuesday by the Massachusetts Technology Leadership Council.

“The economy has flushed out the weak players. The strong have survived and picked up market share,” he said. “We’re talking big growth — right around the corner.”

Scott already has an ample IT environment to maintain for Microsoft’s roughly 93,000 employees. The company has 7,000 production servers and 11 production data centers, according to a slide Scott showed the crowd.

Save for a single instance of SAP, Microsoft has few packaged applications, Scott said. “What we prefer to do is act as a place where we can run our tier-one apps with Microsoft technology.” Microsoft is also famous for serving as a beta tester on its own products before making them generally available.

These days, “We’re taking all of our tier-one apps and moving them all to the cloud,” he added.

Cloud-style deployment allows applications to be provisioned dynamically in accordance with demand, versus dedicating a set of servers to a particular application all the time. Therefore, it is also distinct from traditional application hosting.

Microsoft is still shaking off that traditional style of IT and its inefficiencies, he said.

“We in the software industry have trained you to buy from us at the end of a quarter or at the end of the year,” Scott said.

That means Microsoft’s sales systems often sit idle only to explode into “mayhem” at quarter- or year-end, he said. Virtualization has helped, but only so much, he said.

In a brief interview following his talk, Scott said he is also interested in moving Microsoft’s SAP instance to a cloud-based delivery system. “Right now I’m hard-provisioning app servers and scaling that for peak demand.” But there is nothing to announce as of yet, he added.

Scott spends about 30 percent of his time on the road, talking to customers, and the topic of cloud computing comes up frequently, he said. Cloud-based services, especially for basic applications like e-mail, will be widely adopted not long from now, Scott predicted.

“In five years, I’m not sure there’ll be anyone saying that it’s really important that they run their own e-mail system,” he said. “It’s going to be like someone saying I want to run my own electric plant because I want reliable electricity.”

CIOs have three other broad transitions to make as the economy rebounds, said Andrew McAfee, a principal research scientist at the Massachusetts Institute of Technology’s Center for Digital Business, during a panel discussion later at the event.

First, organizations are becoming more “scientific,” driven by insights into hard data, said McAfee, who is known for his association with the Enterprise 2.0 movement. “That’s in contrast to the way decisions get made now, which is basically, ‘Trust me, I’m a smart guy.’”

Companies should also use technology to more effectively orchestrate how they do business, McAfee said. But at the same time, company leaders “need to get out of the way,” to let their employees “self-organize” using social-networking tools and related technologies, he added.

CIOs who don’t acknowledge the rise of cloud computing are in jeopardy, McAfee said. “The cloud is about as inevitable as the electrification of factories. It took a long time, but it was just flat-out the answer. If the CIO sees their role as maintaining some kind of physical plant, that will be more and more peripheral.”

For his part, Scott warned that “the enemy of the future is creeping incrementalism, laying a little more glue on top of what we already have.”

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Jon Brodkin
Network World (US)
April 29, 2010

FRAMINGHAM - Cloud computing is making it easier for start-ups to develop new technology, but once companies grow beyond a certain size they may find current cloud technologies do not meet their requirements, tech investors said during Interop in Las Vegas this week.

The ability to spin up multiple virtual machines on a hosted cloud computing service like Amazon EC2 makes testing new software products much simpler than in the days when companies were forced to provision their own servers, venture capitalists said during a panel discussion on cloud computing.

FAQ: Cloud computing, demystified

“You can iterate a lot and get feedback faster,” said Ping Li, an investor at Accel Partners. “You’re able to experiment in the wild, as opposed to experimenting in the labs or in your head.”

But the cloud is designed for the lowest common denominator, Li said. Eventually, a company’s technology becomes so complex that it must be customized to fit the needs of specific applications, and those levels of complexity are not yet available in the cloud. And at certain economies of scale, it may not be cheaper to rent storage or server space from Amazon than it is to host it internally, investors said.

“The higher levels of complexity in the cloud stack isn’t there yet to do the things a highly tuned application like Facebook and Twitter needs to do,” Li said. “That’s not to say the cloud won’t get there, but the cloud gap exists.”

That’s one of the reasons enterprises are interested in building so-called private cloud networks, which are managed internally but use a similar architecture as public cloud services.

“The gap between what IT does behind the firewall and what is done in the cloud is pretty wide,” said Guy Horowitz, a principal investor at Gemini Israel Funds. Horowitz also notes that cloud providers are typically not offering service-level agreements worthy of the enterprise, a problem that panelists said is unlikely to be solved anytime soon.

“There’s a reason these SLAs have no teeth,” Horowitz says. “If they were able to guarantee uptime and performance they would be selling it. … It’s not in the best interests [of cloud vendors] to provide specific SLAs that can be enforced.”

Although cloud computing is one of the hottest parts of the technology market, investors said there is risk in choosing the wrong cloud companies to invest in. Many start-ups are building technology that enhances the capabilities of Amazon EC2 and other cloud services, but they run the risk of Amazon developing the same functionality and eliminating the need for the third-party vendor.

“We all ask, is this a feature or is this a company? If it’s a feature, Amazon will innovate on it,” said Allan Leinwand of Panorama Capital.

That’s not always the case, though, Li said. Amazon’s core expertise is not enterprise software, even though it is the most prominent vendor offering cloud-based virtual server and storage capacity.

“Amazon’s not a software company,” Li said. “We’ve seen them not do as well building layers on top of the stack as you would think.”

Venture capitalists have one goal when they invest in start-ups: to make money through either an acquisition or IPO. There are many companies that seem poised to buy cloud start-ups, but the investors disagreed on which companies will do the buying.
Rackspace and GoGrid are likely to buy new technology to better compete against Amazon, Horowitz said.

Mark Fernandes, managing director of Sierra Ventures, said IBM, CA, HP, Dell and Microsoft will also be aggressive in the cloud acquisition market.

Fernandes also contended that AT&T and Comcast will make cloud buys, a notion Leinwand disagreed with. Service providers are unlikely to get in the enterprise software game, Leinwand said, and may look at AT&T’s Synaptic cloud service as a warning signal.

“AT&T announced Synaptic. Name a customer,” Leinwand said.

Oracle is a company to watch out for in the cloud M&A market, he said.

“Oracle has been relatively quiet in this space and that’s going to change,” he said.

Follow Jon Brodkin on Twitter: www.twitter.com/jbrodkin

Read more about data center in Network World’s Data Center section.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Tom S. Noda
Computerworld Philippines
April 27, 2010

Cloud computing firm Morphlabs recently launched a new product suite called mCloud Series designed to enable rapid deployment of the most sophisticated cloud delivery platforms for managed services providers (MSPs) and enterprise data centers.

Winston Damarillo, a Filipino national and CEO of Morphlabs, said the suite –  comprised of Morphlabs mCloud Controller 2.1 and mCloud Server – was built on industry-leading cloud standards facilitating the hybrid implementation of both public and private virtual resources to virtualize commodity hardware while simplifying system administration and application management.

The Morphlabs mCloud Controller 2.1 is an appliance used to convert commodity hardware into a cloud, while the Morphlabs mCloud Server is a fully contained cloud computing environment. Only last February, both products were successfully launched for two enterprises in Japan—CSK Systems and BroadBand Tower. Yet its recent launch in the US has already garnered interest from two major hosting and service providers —GoGoTech and ZeroLag—who plan to implement the mCloud series immediately. 

“Cloud computing implementation has become an essential requirement for every data center implementation. The goal of Morphlabs mCloud is to provide the simplest path to deployment involving the broadest range of use cases. We are very pleased with the customer response that has been generated from our product offerings,” Damarillo said.

Only recently, InformationWeek Analytics and Interop Las Vegas 2010 included Morphlabs mCloud series as one of the finalists for the “Best of Interop 2010” in the cloud computing category. 

Damarillo said the CSK Systems’ in-house ArvicioCloud embedded the mCloud Server to provide applications in a high-availability and flexible cloud implementation. 

Yet BroadBand Tower, which specializes in Internet services and distribution of content on broadband, was also one of the early adopters of Morphlabs mCloud Server.  “In addition to achieving cost savings by leveraging our current infrastructure, mCloud Server also helped us to focus on the real work at hand—without the repetitive system administration previously required,” said Toshihiko Yamato, executive president of BroadBand Tower.

Morphlabs said it is scheduled to showcase its mCloud series at Interop in Las Vegas Nevada this coming Wednesday until Friday. Immediately after the launch, the mCloud series will be available to the US market, enabling the following: virtualization and automated configuration; monitoring and self healing; system administration tools; self service interface for application developers; automatically configured backups; billing and reporting; and tools for creating a Platform as a Service.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Chris Kanaracus
IDG News Service (Boston Bureau)
April 27, 2010

BOSTON - Lawson Software announced a number of services and products Monday for running its software in a private cloud environment, following up on its recent move to support its ERP software on Amazon’s public Elastic Compute Cloud (EC2).

The ERP (enterprise resource planning) vendor has developed grid-computing technology for distributing application workloads over clusters of servers; the first two in a series of virtual software appliances; and a drag-and-drop Cloud Console tool for managing the appliances.

While Lawson built the grid technology, the appliances are VMware images that use a Linux OS and IBM’s WebSphere application server.

The first two appliance products are for Lawson’s Smart Office and Enterprise Search applications. Lawson began with this pair because they are considered add-ons to its core ERP systems, said Lee Kilmer, global director for technology product management.

“For customers who want to get started with it, these lend themselves very well to that,” he said.

Lawson is considering support for other virtualization technologies, such as Microsoft’s Hyper-V, but is not ready to make any public announcements, Kilmer said.

The appliances will be available worldwide in May. Kilmer declined to discuss pricing information.

Lawson’s announcement is more a telling indication of cloud computing’s growing ubiquity, rather than a major technological breakthrough.

But the new cloud console is significant because its ease of use should help customers reduce staffing costs, said analyst Ray Wang, partner with Altimeter Group.

Overall the announcement reflects the fact that much of Lawson’s base wants private rather than public clouds, he said.

“These are state governments, health care organizations, people dealing with a lot of HR data. Granted it’s fairly secure in the [cloud] environment but they still have to answer to their constituents,” he said. “It’s probably not the cheapest thing in the long run, but it’s the right thing for their company.”

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Channelworld staff
Channelworld India
April 23, 2010

BANGALORE - VeriSign has announced an industry collaboration aimed at building trusted online identity solutions - a lynchpin requirement for the widespread adoption of cloud computing and software as a service (SaaS) solutions. The industry effort combines technologies and best practices from Conformity, Ping Identity, TriCipher, Qualys, and VeriSign.

“Barriers to cloud adoption go beyond security; it’s about trust,” said Jim Reavis, executive director at the Cloud Security Alliance. “To create a trusted cloud-based ecosystem, it takes global associations like the Cloud Security Alliance and our Trusted Cloud Initiative, as well as industry leaders like VeriSign and its partners to establish identity trust solutions built on proven technologies, common standards and best practices. This industry effort is a welcome contribution to the SaaS community, and a reassuring and valuable option for enterprises aiming to confidently deploy cloud-based applications and services.”

With strong authentication from the VeriSign Identity Protection (VIP) Authentication Service, enterprises can protect data and applications from unauthorized access. VeriSign also enables encrypted transmission and exchange between the enterprise and the cloud via Public Key Infrastructure (PKI) and Secure Sockets Layer (SSL) certificates.

“Cloud computing offers organizations new options for scalable, cost-effective, and flexible IT, but to gain the full benefits of these services, enterprises have to trust the security, policies, and processes of the cloud,” said Nico Popp, Vice President Of Product Development at VeriSign. “Trust won’t happen if users worry their identities are vulnerable, or if they’re unsure whether the cloud-based service they’re accessing is legitimate. That makes identity trust the essential ingredient for cloud migration — and an industry imperative for SaaS providers.”

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By John Mark V. Tuazon
Computerworld Philippines
April 22, 2010

Cloud computing is slowly changing the game of enterprise computing, but qualms about its reliability and security continue to hamper its widespread adoption, industry experts and vendors said recently.

“[Cloud computing] is definitely showing a lot of promise,” said Monchito Ibrahim, commissioner of CICT (Commission on Information and Communications Technology), during Kaspersky Lab’s executive roundtable on Staying Secure in the Cloud. “But there are a lot of confusion in the market, especially regarding security.

Ibrahim said sources of these confusion emanate from varying models of cloud deployment, which include SaaS (Software-as-a-Service), PaaS (Platform-as-a-Service), and IaaS (Infrastructure-as-a-Service).

“Some of the other issues include standards, regulatory compliance, data ownership, multiple tenants, and data privacy, he added.

On the side of the government, Ibrahim noted that the many benefits the cloud brings push the public sector to take a look at the technology. “But personally speaking, I say these security issues may drive and define how we adopt cloud computing in the future,” he quipped.

The ‘Dark Side’ of the Cloud
Even if all clouds have a silver lining—as the saying goes—Kaspersky Lab believes cloud technology has an inevitable ‘dark side’. “[In cloud computing], everything is happening behind closed doors,” explained Magnus Kalkuhl, senior virus analyst, global research and analyst team, Kaspersky Lab Germany. “And there are no guarantees that services cannot easily be copied. What if the hosting systems were hacked? What if the Internet fails?”

Furthermore, according to an independent study on cloud computing, security remains the topmost concern of users at 64%, followed by administration (58%) and control/vendor lock-in (40%). “Major providers are arguably more secure,” suggested Calen Legaspi, associate analyst, enterprise architect and technology services, XMG Global, “because they have invested much more than normal companies for security.”

When dealing with small cloud providers, Legaspi advised users to do due diligence. “Check with the Cloud Security Alliance if they offer secure services,” he stressed.

Additionally, according to Kalkuhl, negotiating the contract properly can bode well for adopters. “Make sure you keep the freedom to switch,” he said, adding that being prepared for system failures—as in any other technology—can help abate future problems.

It’s All in the Mind
But for Amado Malacaman, vice president of ISSSP (Information Systems Security Society of the Philippines, the real issue is not security. “During the early days, concerns of companies evolved from malfunctions of machines, to risks from internal staff, to external hacks,” he explained. “Cloud computing addresses all of this.”

Malacaman said the real issue concerning the cloud is perception. “Because of the technology change, a new set of standards should be put in place,” he went on, “so training and retraining becomes necessary, while new business models pose new concerns for users.”

More importantly, users—especially the government—need to determine the relevance of cloud computing to their respective organizations, he suggested. “Cloud computing is a new area we should seriously approach. It’s an opportunity for government to leapfrog our neighbors,” he added.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Denise Dubie
Network World (US)
April 21, 2010

FRAMINGHAM - Microsoft’s plans for cloud computing don’t stop with infrastructure and applications. Company executives say Microsoft will also provide the heterogeneous management layer that customers will need to optimize application performance on-premises or in hosted environments.

Microsoft this week kicked off its Microsoft Management Summit 2010 conference in Las Vegas, welcoming some 3,500 attendees to learn more about the vendor’s products and plans for future technologies. Bob Muglia, president of the server and tools business at Microsoft, opened the event officially with a keynote speech that detailed — with product demonstrations — how Microsoft intends to manage customer environments from today’s data centers to tomorrow’s shared clouds, on-premises and off.

Starting with its Dynamic Systems Initiative 10 years ago, Microsoft envisioned an environment that would connect the workflow between development and operations, providing end-to-end management, and helping customers reduce the overhead in delivering and optimizing business applications, Muglia said. It may not have been called cloud at the time, he clarified, but Microsoft recognized the model.

“There is a huge amount of opportunity to simplify the process and reduce the costs” associated with IT, Muglia told attendees.

Microsoft has worked on products such as Visual Studio and Systems Center, partnered with vendors such as HP for storage capabilities, and utilized acquired automation and orchestration software from Opalis, to take automation to the next level to enable IT staff to work on higher-priority tasks. The Opalis technology can work across platforms and enable Microsoft in the future to provide more heterogeneous management capabilities for customers. According to Paul Ross, group product marketing manager at Microsoft, the company already broadened its management reach into VMware environments with its Systems Center Virtual Machine Manager and added Unix and Linux support to System Center as well.

“Virtualization is a major disruptive force. Microsoft offered Hyper-V in a cost-effective manner, but recognizes customers adopted VMware and we work to protect that investment for customers with our virtualization management capabilities,” Ross said in a separate interview. He suggested Microsoft would also provide support for Xen virtual environments in future releases. “Opalis automates processes but also integrates across tools and platforms,” Ross explained.

In his keynote, Muglia also explained how Opalis technology, available now to System Center customers, enables the orchestration needed to scale cloud resources and provide the elasticity cloud computing promises. Demonstrating a “long-distance, fully coordinated live migration” of virtual machines, which add resources to bolster application performance, Muglia showed conference attendees how “the vision of dynamic IT is becoming a reality.”

IT workers today should not fear automation because it is necessary to enable such dynamic IT, according to Muglia. He said cloud is shifting the role of IT professionals as well.

“Cloud is a world-class dramatic shift. IT takes on a different and new role, jobs will change to enable higher degrees of service availability. The role running the previous generation changes,” Muglia said. “Your roles all become more important going forward [because you are] doing more to enable business solutions.”

Marking now as the launch of the cloud generation of IT, Muglia said the technology will “accelerate the speed of solution delivery” as well as “lower the cost of IT.” By coupling technologies such as Windows Azure, server containers and new applications models, Microsoft itself is road-testing the cloud and will take lessons learned to customers by way of products.

For instance, the company demonstrated how using a Systems Center Operations Manager management pack for Windows Azure (which is expected to ship later this year), customers can grow and shrink capacity and resources on-premises or in the cloud to optimize application performance. One tool will work in both environments, Muglia said.

“The platforms are getting smarter,” Muglia said.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Patrick Thibodeau
Computerworld (US)
April 20, 2010

FRAMINGHAM - WASHINGTON, D.C. — Microsoft Corp., which has spent millions lobbying politicians in recent years, appears to be looking to get some of that money back by selling a new set of services and tools for political campaigns and activist groups.

The new offering, called CampaignReady , is based on an interactive platform called TownHall that runs in Microsoft’s Azure cloud platform. The system stores data in a SQL Azure server.

Developers can download the TownHall code without charge, and are free to extend and customized it.

TownHall is part of a suite of online offerings, which range from free services like Office Live to paid online advertising programs. The suite also includes fee-based services built around existing products including Dynamics CRM Online.

The Town Hall tools are designed to provide political and lobbying campaigns the ability to connect with users across various online platforms, such as Facebook and iPhone Apps. The service can also be used to centrally manage contact lists and user responses.

The online TownHall application also includes templates for engaging users on specific topics and issues.

Stanley Freck, who directs Microsoft’s public sector cloud computing efforts, said the tools aim to “help help campaigns be ready to take advantage of technology [and] to help campaigns listen to their constituents.”

Freck noted that politicians using Microsoft cloud-based tools in winning campaigns may become advocates for other cloud-based services. “We want to make our money on our platform and what we think enables it to grow,” said Freck.

Microsoft unveiled the hosted tool set at the Politics Online conference held here today.

Microsoft’s new services take on several companies offering hosted political and campaign tools that often build online communities tageting specific audiences. Wired for Change, for instance, offers tools aimed at Democrats and progressive organizations.

Microsoft’s effort is politically agnostic, although in terms of its political spending it has favored Democratic candidates since the 2004 election cycle, according to the Center for Responsive Politics. Of the political contributions credited to Microsoft by the center, nearly $900,000, so far this year, 60% have gone to Democrats.

John Brougher, a business development executive at Wired for Change, said political organizations “like to work with people you trust,” as well as offer a lot of customer support.

Patrick Thibodeau covers SaaS and enterprise applications, outsourcing, government IT policies, data centers and IT workforce issues for Computerworld . Follow Patrick on Twitter at @DCgov , or subscribe to Patrick’s RSS feed? . His e-mail address is pthibodeau@computerworld.com .

Read more about saas in Computerworld’s SaaS Knowledge Center.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Tom S. Noda
Computerworld Philippines
April 14, 2010

Once again Filipino ingenuity has shone with the recent selection of a Filipino-led company in the US, making it to the finals of the Best of InterOp 2010, a contest that seeks to award the world’s most innovative technologies across nine major categories.

The company Morphlabs Inc., a cloud computing platform enabler for enterprise and service providers, was selected on Tuesday as one of the three finalists for the InterOp Awards’ cloud computing category. It is headquartered in the US, with operations in Japan and the Philippines. Morphlabs’ development center is composed mostly of Filipino software engineers.

“We are very proud to have been named for this recognition” says Winston Damarillo, a Filipino serial entrepreneur and CEO of Morphlabs. “mCloud™ is the result of a seamless collaboration between our US-based R&D and our Philippine-based engineering teams. This proves that impactful innovation can be created anywhere in the world.” 

Damarillo claimed Morphlabs’ flagship product – mCloud Series – provides complete cloud management and provisioning platform that enable enterprises of all sizes to leverage the benefits of both private and public cloud computing.

Only last month, Morphlabs also served as finalist in the ICT International awards for Innovation. This time at the InterOp challenge, it is said to have broken through the global arena with the likes of IBM among its co-finalists.

The cloud computing market, according to forecasts from Gartner Research, will reach approximately $150 billion by 2013.  It also reported that through 2012, IT organizations will invest more in private cloud services than in offerings from public cloud providers.

The panel of judges of the Best of Interop finalists was made up of award-winning editors and analysts from InformationWeek Analytics. The judges selected the products they believe have the greatest potential to impact and advance business technology efficiencies, helping move the industry forward.

Morphlabs is one of the exhibitors at Interop Las Vegas 2010 which starts April 25.  The Best of Interop Award winners will be announced on April 28 at the Mandalay Bay Convention Center.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds

By Jon Brodkin
Network World (US)
April 14, 2010

FRAMINGHAM - VMware and Salesforce.com are on the verge of redefining the entire virtualization and cloud computing market — or, at least, that’s what they want you to think.

The companies have set up a Web site called “VMforce.com,” and promise that they will unwrap the details on April 27 with “an exciting joint product announcement on the future of cloud computing.” The marketing site features a picture of Salesforce CEO Marc Benioff and Paul Maritz, the former Microsoft executive who became VMware’s CEO almost two years ago. But it contains zero details on what VMforce might actually be.

It’s not hard to make a few guesses, though, based on the name “VMforce.com,” and past products and strategy announcements from VMware and Salesforce.

Salesforce has a cloud service that lets businesses quickly develop applications and host them in the Salesforce infrastructure. The service is called Force.com, and is in the “platform-as-a-service” portion of the cloud computing market.

VMware, meanwhile, believes its technology should be the primary virtualization engine behind platform-as-a-service offerings. Toward that end, VMware acquired SpringSource, an enterprise Java vendor, and Rabbit Technologies, which makes an open source messaging platform which may make it easier to build cloud networks.

Add the “VM” from VMware to “Force.com” and you have, well, “VMforce.com.”

Given all that, an extension to Salesforce’s platform-as-a-service offering, powered by VMware, probably makes the most sense, says Yankee Group analyst Phil Hochmuth, who covers the cloud computing and virtualization markets. But it’s not a sure bet. “They certainly left this open to speculation by being so coy about it,” Hochmuth says.

Several news articles and blogs about VMforce have used the phrase “virtualization-as-a-service” to describe the mysterious offering, but it doesn’t appear that VMware or Salesforce have used the phrase themselves. A VMware spokeswoman declined to offer additional details beyond what appears on the VMforce Web site.

What “virtualization-as-a-service” means, if anything, is anyone’s guess. “That’s just a term people are throwing out because they don’t know what VMware and Salesforce are going to do,” Hochmuth says. “It doesn’t mean anything. That’s like saying ‘power-and-cooling-as-a-service.’”

Thinking creatively, perhaps virtualization-as-a-service could refer to offerings such as Amazon’s Elastic Compute Cloud, which gives customers access to virtual server capacity over the Web. Or it could be a Web service that lets customers manage internal virtual servers.

VMware and Salesforce offering a virtual server platform along the lines of Amazon’s EC2 would be big news, but “more of a reach” than the simpler play of extending the Force.com platform, Hochmuth says.

“The more radical move would be Salesforce getting into hosted server virtualization infrastructure,” he says.

VMware’s cloud strategy has focused heavily on helping customers build internal clouds, powered by the VMware hypervisor, and connecting those internal networks to the public clouds hosted by VMware partners, effectively allowing customers to manage internal and external computing resources from the same software interface.

According to Pund-IT analyst Charles King, VMware has “been at the forefront of defining the cloud” as the intersection between internal and public cloud networks. Salesforce partnering with VMware may thus suggest that the company is moving beyond its strategy of offering services only in the public cloud model.

“Salesforce is a great example of a company that leverages and relies exclusively on the public cloud,” King says. “That’s what they’re all about. It would make sense to see Salesforce come out as a firm supporter of VMware’s cloud initiative, and suggest some kind of relationship, maybe an optimization between VMware and cloud services that would help clients securely leverage the Salesforce public cloud.”

The bottom line is VMware and Salesforce aren’t revealing what they’re up to yet. VMforce could be an entirely new technology, or a combination of previously existing products and services. The announcement will be made by Benioff and Maritz at 1:30 p.m. EST on April 27.

Possibly Related Posts:

• Check Point clears the path to Web 2.0 application control
• Water cooling returns to IBM mainframe
• Microsoft still mum on programs prone to DLL hijacking attacks
• Mobile data traffic set to soar
• More IT managers plan to spend less, Oracle struggles with users, survey finds