If you haven’t yet checked out the papers and presentations from Usenix/HotCloud ’09, you definitely should.
Some very interesting stuff.
Here.
/Hoff
The view from the last 2 weeks clearly has been from the short bus squad*.
That is all.
/Hoff
*WARNING: Those who travel by means of the horizontally-challenged horseless carriage may be offended by my analogy. Those of you suggesting I am being insensitive should know that I pick equally on long buses also.
For those of you who are not in the security space and may not have read the Cloud Security Alliance’s “Guidance for Critical Areas of Focus,” you may have missed the “Cloud Architectural Framework” section I wrote as a contribution.
We are working on improving the entire guide, but I thought I would re-publish the Cloud Architectural Framework section and solicit comments here as well as “set it free” as a stand-alone reference document.
Please keep in mind, I wrote this before many of the other papers such as NIST’s were officially published, so the normal churn in the blogosphere and general Cloud space may mean that some of the terms and definitions have settled down.
I hope it proves useful, even in its current form (I have many updates to make as part of the v2 Guidance document.)
/Hoff
Cloud Computing (“Cloud”) is a catch-all term that describes the evolutionary development of many existing technologies and approaches to computing that at its most basic, separates application and information resources from the underlying infrastructure and mechanisms used to deliver them with the addition of elastic scale and the utility model of allocation. Cloud computing enhances collaboration, agility, scale, availability and provides the potential for cost reduction through optimized and efficient computing.
More specifically, Cloud describes the use of a collection of distributed services, applications, information and infrastructure comprised of pools of compute, network, information and storage resources. These components can be rapidly orchestrated, provisioned, implemented and decommissioned using an on-demand utility-like model of allocation and consumption. Cloud services are most often, but not always, utilized in conjunction with and enabled by virtualization technologies to provide dynamic integration, provisioning, orchestration, mobility and scale.
While the very definition of Cloud suggests the decoupling of resources from the physical affinity to and location of the infrastructure that delivers them, many descriptions of Cloud go to one extreme or another by either exaggerating or artificially limiting the many attributes of Cloud. This is often purposely done in an attempt to inflate or marginalize its scope. Some examples include the suggestions that for a service to be Cloud-based, that the Internet must be used as a transport, a web browser must be used as an access modality or that the resources are always shared in a multi-tenant environment outside of the “perimeter.” What is missing in these definitions is context.
From an architectural perspective given this abstracted evolution of technology, there is much confusion surrounding how Cloud is both similar and differs from existing models and how these similarities and differences might impact the organizational, operational and technological approaches to Cloud adoption as it relates to traditional network and information security practices. There are those who say Cloud is a novel sea-change and technical revolution while others suggest it is a natural evolution and coalescence of technology, economy, and culture. The truth is somewhere in between.
There are many models available today which attempt to address Cloud from the perspective of academicians, architects, engineers, developers, managers and even consumers. We will focus on a model and methodology that is specifically tailored to the unique perspectives of IT network and security professionals.
The keys to understanding how Cloud architecture impacts security architecture are a common and concise lexicon coupled with a consistent taxonomy of offerings by which Cloud services and architecture can be deconstructed, mapped to a model of compensating security and operational controls, risk assessment and management frameworks and in turn, compliance standards.
Setting the Context: Cloud Computing Defined
Understanding how Cloud Computing architecture impacts security architecture requires an understanding of Cloud’s principal characteristics, the manner in which cloud providers deliver and deploy services, how they are consumed, and ultimately how they need to be safeguarded.
The scope of this area of focus is not to define the specific security benefits or challenges presented by Cloud Computing as these are covered in depth in the other 14 domains of concern:
We will discuss the various approaches and derivative offerings of Cloud and how they impact security from an architectural perspective using an in-process model developed as a community effort associated with the Cloud Security Alliance.
Principal Characteristics of Cloud Computing
Cloud services are based upon five principal characteristics that demonstrate their relation to, and differences from, traditional computing approaches:
Cloud Service Delivery Models
Three archetypal models and the derivative combinations thereof generally describe cloud service delivery. The three individual models are often referred to as the “SPI Model,” where “SPI” refers to Software, Platform and Infrastructure (as a service) respectively and are defined thusly[1]:
Understanding the relationship and dependencies between these models is critical. IaaS is the foundation of all Cloud services with PaaS building upon IaaS, and SaaS – in turn – building upon PaaS. We will cover this in more detail later in the document.
The OpenCrowd Cloud Solutions Taxonomy shown in Figure 1 provides an excellent reference that demonstrates the swelling ranks of solutions available today in each of the models above.
Narrowing the scope or specific capabilities and functionality within each of the *aaS offerings or employing the functional coupling of services and capabilities across them may yield derivative classifications. For example “Storage as a Service” is a specific sub-offering with the IaaS “family,” “Database as a Service” may be seen as a derivative of PaaS, etc.
Each of these models yields significant trade-offs in the areas of integrated features, openness (extensibility) and security. We will address these later in the document.
Figure 1 - The OpenCrowd Cloud Taxonomy
Cloud Service Deployment and Consumption Modalities
Regardless of the delivery model utilized (SaaS, PaaS, IaaS,) there are four primary ways in which Cloud services are deployed and are characterized:
The consumers of the service are considered “trusted.” Trusted consumers of service are those who are considered part of an organization’s legal/contractual
umbrella including employees, contractors, & business partners. Untrusted consumers are those that may be authorized to consume some/all services but are not logical extensions of the organization.
The difficulty in using a single label to describe an entire service/offering is that it actually attempts to describe the following elements:
The notion of Public, Private, Managed and Hybrid when describing Cloud services really denotes the attribution of management and the availability of service to specific consumers of the service.
It is important to note that often the characterizations that describe how Cloud services are deployed are often used interchangeably with the notion of where they are provided; as such, you may often see public and private clouds referred to as “external” or “internal” clouds. This can be very confusing.
The manner in which Cloud services are offered and ultimately consumed is then often described relative to the location of the asset/resource/service owner’s management or security “perimeter” which is usually defined by the presence of a “firewall.”
While it is important to understand where within the context of an enforceable security boundary an asset lives, the problem with interchanging or substituting these definitions is that the notion of a well-demarcated perimeter separating the “outside” from the “inside” is an anachronistic concept.
It is clear that the impact of the re-perimeterization and the erosion of trust boundaries we have seen in the enterprise is amplified and accelerated due to Cloud. This is thanks to ubiquitous connectivity provided to devices, the amorphous nature of information interchange, the ineffectiveness of traditional static security controls which cannot deal with the dynamic nature of Cloud services and the mobility and velocity at which Cloud services operate.
Thus the deployment and consumption modalities of Cloud should be thought of not only within the construct of “internal” or “external” as it relates to asset/resource/service physical location, but also by whom they are being consumed and who is responsible for their governance, security and compliance to policies and standards.
This is not to suggest that the on- or off-premise location of an asset/resource/information does not affect the security and risk posture of an organization, because it does, but it also depends upon the following:
Table 1 illustrates the summarization of these points:
Table 1 - Cloud Computing Service Deployment
As an example, one could classify a service as IaaS/Public/External (Amazon’s AWS/EC2 offering is a good example) as well as SaaS/Managed/Internal (an internally-hosted, but third party-managed custom SaaS stack using Eucalyptus, as an example.)
Thus when assessing the impact a particular Cloud service may have on one’s security posture and overall security architecture, it is necessary to classify the asset/resource/service within the context of not only its location but also its criticality and business impact as it relates to management and security. This means that an appropriate level of risk assessment is performed prior to entrusting it to the vagaries of “The Cloud.”
Which Cloud service deployment and consumption model is used depends upon the nature of the service and the requirements that govern it. As we demonstrate later in this document, there are significant trade-offs in each of the models in terms of integrated features, extensibility, cost, administrative involvement and security.
Figure 2 - Cloud Reference Model
It is therefore important to be able to classify a Cloud service quickly and accurately and compare it to a reference model that is familiar to an IT networking or security professional.
Reference models such as that shown in Figure 2 allows one to visualize the boundaries of *aaS definitions, how and where a particular Cloud service fits, and also how the discrete *aaS models align and interact with one another. This is presented in an OSI-like layered structure with which security and network professionals should be familiar.
Considering each of the *aaS models as a self-contained “solution stack” of integrated functionality with IaaS providing the foundation, it becomes clear that the other two models – PaaS and SaaS – in turn build upon it.
Each of the abstract layers in the reference model represents elements which when combined, comprise the services offerings in each class.
IaaS includes the entire infrastructure resource stack from the facilities to the hardware platforms that reside in them. Further, IaaS incorporates the capability to abstract resources (or not) as well as deliver physical and logical connectivity to those resources. Ultimately, IaaS provides a set of API’s which allows for management and other forms of interaction with the infrastructure by the consumer of the service.
Amazon’s AWS Elastic Compute Cloud (EC2) is a good example of an IaaS offering.
PaaS sits atop IaaS and adds an additional layer of integration with application development frameworks, middleware capabilities and functions such as database, messaging, and queuing that allows developers to build applications which are coupled to the platform and whose programming languages and tools are supported by the stack. Google’s AppEngine is a good example of PaaS.
SaaS in turn is built upon the underlying IaaS and PaaS stacks and provides a self-contained operating environment used to deliver the entire user experience including the content, how it is presented, the application(s) and management capabilities.
SalesForce.com is a good example of SaaS.
It should therefore be clear that there are significant trade-offs in each of the models in terms of features, openness (extensibility) and security.
Figure 3 - Trade-off’s Across *aaS Offerings
Figure 3 demonstrates the interplay and trade-offs between the three *aaS models:
The key takeaway from a security architecture perspective in comparing these models is that the lower down the stack the Cloud service provider stops, the more security capabilities and management the consumer is responsible for implementing and managing themselves.
This is critical because once a Cloud service can be classified and referenced against the model, mapping the security architecture, business and regulatory or other compliance requirements against it becomes a gap-analysis exercise to determine the general “security” posture of a service and how it relates to the assurance and protection requirements of an asset.
Figure 4 below shows an example of how mapping a Cloud service can be compared to a catalog of compensating controls to determine what existing controls exist and which do not as provided by either the consumer, the Cloud service provider or another third party.
Once this gap analysis is complete as governed by the requirements of any regulatory or other compliance mandates, it becomes much easier to determine what needs to be done in order to feed back into a risk assessment framework to determine how the gaps and ultimately how the risk should be addressed: accept, transfer, mitigate or ignore.
Conclusion
Understanding how architecture, technology, process and human capital requirements change or remain the same when deploying Cloud Computing services is critical. Without a clear understanding of the higher-level architectural implications of Cloud services, it is impossible to address more detailed issues in a rational way.
The keys to understanding how Cloud architecture impacts security architecture are a common and concise lexicon coupled with a consistent taxonomy of offerings by which Cloud services and architecture can be deconstructed, mapped to a model of compensating security and operational controls, risk assessment and management frameworks and in turn, compliance standards.
I want tell you a little secret. I want to be the next Ron Popeil. I don’t care to be the first, just the first to realize a vision regarding something I verbalize. I think I actually have a reasonable track record to warrant my lofty aspirations:
*When I was six growing up on a sheep farm in New Zealand, I grabbed an air mail envelope, drew a picture accompanied by some text and sent it off addressed to some generic address at the Pentagon in the U.S. The drawing was an idea I had for what is now called a Thrust Vectoring Nozzle on jet aircraft. I also paired that with oil injection into the manifold to produce enormous amounts of black smoke to enable evasive action. I figured I’d go for a two-fer.
* When I was 17 I wrote a similar letter complete with diagrams to Shimano because I was so damned tired of the crappy braking system on my off-road bicycle and suggested a hub-centric disk brake system for bicycles.
* In 1996, after forming my first startup and angel funding, my father-in-law and I architected an ASIC-based firewall appliance that would run Check Point firewall-1 code (ported) to a platform that had no OS and provided extremely high levels of performance with offload NPU’s and high-speed memory for state-table synchronization in clusters. We took it to Check Point. They laughed. 6 months later they did a deal with Ascom Timeplex…
* In 2001 I built a prototype of an, um, entertainment system that involved 3D goggles, VRML, a nintendo power glove and, er, adult entertainment via a network-based pay-per-play service
* Oh, the hits just-a-kept-on-comin’…
Somewhere between then and now, despite helping raise millions in VC funding for other people’s ideas, I stopped verbalizing my own and that makes me sad.
Where and when I can, I’m going to verbalize some of the ideas buried in my brain. I have hundreds of them. One day I hope one of them make someone else say “HEY! I thought of that!” I’m an idea guy. I want a T-Shirt that says that.
You have anything you’ve “invented” that’s showed up sometime later?
/Hoff
It’s that time again. I am compelled after witnessing certain behaviors to play anthropologist and softly whisper my observations in your ear.
You may be familiar with Beckett’s “Waiting For Godot”*:
Waiting for Godot follows two days in the lives of a pair of men who divert themselves while they wait expectantly and unsuccessfully for someone named Godot to arrive. They claim him as an acquaintance but in fact hardly know him, admitting that they would not recognise him were they to see him. To occupy themselves, they eat, sleep, converse, argue, sing, play games, exercise, swap hats, and contemplate suicide — anything “to hold the terrible silence at bay”
Referencing my prior post about the state of Cloud security, I’m reminded of the fact that as a community of providers and consumers, we continue to wait for the security equivalent of Godot to arrive and solve all of our attendant Cloud security challenges with the offer of some mythical silver bullet. We wait and wait for our security Godot as I mix metaphors and butcher Beckett’s opus to pass the time.
Here’s a classic illustration of hoping our way to Cloud security from a ComputerWeekly post titled “Cryptography breakthrough paves way to secure cloud services:”
A research student who had a summer job at IBM, has cracked a cryptography problem that has baffled experts for over 30 years. The breakthrough may pave the way to secure cloud computing services.
This sounds fantastic and much has been written about this “homomorphic encryption,” with many people espousing how encryption will “solve our Cloud security problems.”
It’s a very interesting concept, but as to paving the “…path to secure cloud computing,” the reality is that it won’t. At least not in isolation and not without some serious scale in ancillary support mechanisms including non-trivial issues like federated identity.
Bruce Schneier wades in with his assessment:
Unfortunately — you knew that was coming, right? — Gentry’s scheme is completely impractical…Despite this, IBM’s PR machine has been in overdrive about the discovery. Its press release makes it sound like this new homomorphic scheme is going to rewrite the business of computing: not just cloud computing, but “enabling filters to identify spam, even in encrypted email, or protection information contained in electronic medical records.” Maybe someday, but not in my lifetime.
The reality is that in addition to utilizing encryption — both existing and new approaches — we still continue to need all the usual suspects as they deal with the fact that fundamentally we’re still in a cycle of constructing insecure code in infostructure sitting atop infrastructure and metastructure that has its own fair share of growing up to do.
As a security architect, engineer, or manager, you need to continue to invest in understanding how what you have does or does not work within the context of Cloud.
You will likely find that you will need to continue to invest in threat and trust models analysis, risk management, vulnerability assessment, (id)entity management, compensating controls implemented as hardware and software technology solutions such as firewalls, IDP, DLP, and policy instantiation, etc. as well as host of modified and new approaches to dealing with Cloud-specific implementation challenges, especially those based on virtualization and massive scale with multitenancy.
These problems don’t solve themselves and we are simply not changing our behavior. We wait and wait for our Godot.
So here’s the obligatory grumpy statement of the obvious as providers of solutions and services churn to deliver more capable solutions to put in your hands:
There is no silver bullet, just a lot of silver buckshot. Use it all. You’re going to have to deal with the cards we are dealt for the foreseeable future whilst we retool our approach in the longer term and technology equalizes some of our shortfalls.
Godot is not coming and you likely wouldn’t recognize him if he showed up anyway because he’d be dressed in homomorphic invisible hotpants…
Get on with it. Treat security as the enterprise architecture element it is and use Cloud as the excuse to make things better by working on the things that matter.
If Godot does happen to show up, tell him I want my weed whacker back that he borrowed last summer.
/Hoff
* Wikipedia
My friend Dave Shackleford made one innocent little quip about social media experts on Twitter yesterday and in a fit of caffeine inspired (a)muse(ment) I went on a little rant.
Sung to the tune of Jeff Foxworthy’s “You might be a redneck…”:
- “If you think twitter is a sexual position, you might be a social media expert”
- “If the top three items in your browser history include the words “singles” “dating” or “matematch,” you might be a social media expert”
- “If your idea of fast food is ordering your X-Large pizza online — for yourself only — you might be a social media expert”
- “If you go to tweet-ups to pick up on women…you might be a social media expert”
- “If you’ve ever asked someone to become a Facebook fan of YOU, you might be a social media expert”
- “If you’ve ever broken up with someone over twitter & mistakenly @’d instead of DM’ing them, you might be a social media expert”
- “If your mom has more Facebook friends and Twitter followers than you do — some of whom she’s met– you might be a social media expert”
- “If you apply the David Koresh definition of ‘followers’ to Twitter, you might be a social media expert”
- “If you’ve ever sent defensive DM’s to @beaker because you’re offended by his SocMed jokes, you’re def. a fscking Social Media expert
- “If you had no idea ponies don’t really come in pink with bedazzled outfits, you might be a social media expert”
- “If you’ve ever tweeted for help on how to operate a power tool in real-time, you might be a social media expert”
- “If your idea of a hot date is the poetry aisle @ Barnes & Nobles on ‘Middle Eastern Comedy Reading Night’ you might be a SocMed Expert”
- “If your idea of a pet is a LOLcat that uses kitty twitter, you might be a social media expert”
- “If you went to Defcon and had a shirt made that said “I poked your mom on Facebook” to wear to the invite-only FB party that night, you…oh”
- “If you have seen, let alone own, ‘Breakin’ 2: Electric Boogaloo,’ you might be a social media expert”
- “If you’ve EVER said ‘Thunderbirds are go!’ at a party that involved alcohol and people over 23, you might be a social media expert”
- “If your idea of a tough workout is 10 minutes on the Wii Fit, you might be a social media expert”
Here are some of the contributions that my like-minded and sheepish followers penned:
- If you use your WiiFit to update your statistics on Facebook and MySpace, you might be a social media expert [@n0b0d4]
- If you’ve ever suggested a IPS and SIEM based on Twitter, you might be a Social Media expert *looks at @Beaker* [@innismir]
- If you named your twins Tweet and Retweet, you might be a social media expert [@n0b0d4]
- If you refuse to talk to your parents because they aren’t on Facebook and Twitter, you might be a social media expert [@n0b0d4]
- You know you’re a social media expert when…you can celebrities look at you followers and are jealous [@n0b0d4]
- If people send help when you haven’t tweeted in 3 hours, you might be a social media expert? [@samj – in response to my CTO wondering why I was MIA from Twitter for 3 hrs ;)]
- If you bought a book of funny quotes cause you thought it would make for interesting tweets, you might be a social media expert. [@pcalvin]
- If you stopped posting for 1 day and people start asking if you’re ok, you might be a social media expert. [@lonervamp]
- If you learned how to dance from Dance Dance Revolution, you might be a social media expert [@noora_freedman]
- If followe[rs|es] exceeds your dunbar number by an order of magnitude you might be a social media expert <- works for monkeys too [@samj]
- If you’ve ever cared whether or not someone follows you back you might be a social media expert. [@samj]
- If you shake hands by making sure to follow everyone who follows you, you might be a social media expert [@jamesurquhart]
- If the thousands of hours you spent playing Everquest are finally paying off, you might be a social media expert. [@jamesurquhart]
- If you’ve ever left a meeting with your CIO to finish a tweet you might be a social media expert [@andywillingham]
- If you’ve ever won a blogworld pass with a tweet, you might be a social media expert [@n0b0d4]
- If you refer to Friendster as the historic way people used to communicate, you might be a social media expert [@munozrick]
- If you follow 10,000 people but only 20 follow you back, you might be a social media expert” [@vmdoug]
- If your idea of a great book title is “How to win followers and influence people”, you might be a social media expert. [@daveshackleford]
- If you count the letters in every sentence as you write, you might be a social media expert” [@munozrick]
- If you become anxious about the number of API calls left in your Twitter client, you might be a social media expert. [@daveshakleford]
- If you’ve ever switched Twitter clients to avoid RT your own lame joke, you might be a social media expert [@n0b0d4]
- If you can’t live without your Flip Video camera, you might be a social media expert. [@dirflash]
- If you think hashtags should not be removed from mattresses, you might be a social media expert. [@lmclaughlin]
- If you’ve ever though 140 characters is too much, you might be a social media expert [@n0b0d4]
- If you have ever switched the keys on your keyboard around just to keep life interesting…you might be a social media expert [@cparadis_]
/Hoff
There are voices raging in my head thanks to the battling angel and devil sitting on my shoulders.
These voices echo the security-focused protagonist and antagonist perspectives of Cloud Computing adoption.
The devil urges immediate adoption and suggests the Cloud is as (in)secure as it needs to be while still providing value.
The angel maintains that the Cloud, whilst a delightful place to vacation, is ready only for those who are pure of heart and traffic in non-sensitive, non-mission-critical data.
To whom do I (or we) listen?
The answer is a measured and practical one that we know already because we’ve given it many times before.
Is the Cloud Secure? That’s a silly question. Is the Cloud “secure enough” is really the question that should be asked, and of course, the answer is entirely contextual.
My co-worker, James Urquhart, wrote a great post today in which he summarized quite a few healthy debates that are good for Cloud Computing as they encourage discourse and debate. One of them relates to the difference between the consumer and small/midsize business versus enterprise as it relates to Cloud adoption. This is quite relevant to my point about “context” above, so for the purpose of this discussion, I’m referring to the enterprise.
To wit, enterprises aren’t as dumb as (we) vendors want them to be; they seize opportunity as it befits them and most times apply a reasonable amount of due care, diligence and evaluation before they leap headlong into course corrections offered by magical disruptive innovation. There are market dynamics at play that are predictable and yet so many times we collectively gasp at the patterns of behaviors of technology adoption as though we’ve never witnessed them before.
Cloud is no different in that regard. See my post regarding this behavior titled “Most CIO’s Not Sold On Cloud? Good, They Shouldn’t Be.”
When I see commentary from CEO’s of leading security companies (such as RSA’s Art Coviello and even my own, John Chambers) that highlight security as an enormous concern in Cloud, I urge people to reflect back on any of the major shifts they’ve seen in IT the last 15 years and consider which shoulder-chirper they listened to and why.
Suggesting that enterprises aren’t already conscious of what the Cloud means to their operational and security models is intellectually dishonest, really.
We’ve all seen convenience, agility and economics stomp all over security before and here’s how this movie will play out:
Cloud will reach a critical mass wherein the technology and operational models mature to a good-enough point, enough time passes without a significant number of material breaches or outages that disrupt confidence and then it becomes “accepted.” Security, based upon how, where, why and when we invest will always play catch-up. How much depends on how good a job we do to push the agenda.
The reality is that broad warnings about security in the Cloud are fine; they help remind and reinforce the fact that we need to do better, and quite frankly, I think we are. So we can either chirp about how bad things are, or we can do something about it.
The good news is that even with the froth and churn, there is such a groundswell of activity by many groups (like the Cloud Security Alliance and the Jericho Forum) that we’re seeing an unprecedented attempt by both suppliers and consumers to do a better job of baking security in earlier. The problem is that many people can’t see the forest for the trees; expectations of how quickly things can change are distorted and so everything appears to be an instant failure. That’s sad.
Of course Cloud Security is not perfect, but in measure, the dialog, push for standards and recognition of need (as well as many roadmapped solutions I’m privy to) shows me that our overall response is a heck of a lot better that I’ve seen it in the past.
We’re certainly still playing catch up on the technology front and working toward better ways of dealing with instantiating business process on top of it all, but I’m quite optimistic that we’re compressing the timeframe of defining and ultimately delivering improved security capabilities in Cloud computing.
In the meantime, the compelling market forces of Cloud continue to steamroll onward, and so these apocalyptic assessments of Cloud Security readiness are irrelevant as we continue to see companies large and small utilize Cloud Computing to do things faster, better, more efficiently, cost effectively and with a level of security that meets their needs, which in the end is all that matters.
At the same point — and this is where the devil will prove out in the details — execution is what matters.
/Hoff
This might seem just a tad bizarre, but I could really use your help.
I Built this diagram about a year ago. I *think* I remember what the hell it was I was trying to visualize, but for the life of me…I can’t recall.
Seems a little odd to be asking you lot, but you’re pretty darn good at interpreting my madness. Care to give it a whirl? Give me the best explanation for my diagram below and win $25. I’m good for it. Ask the people who have won my whacky challenges before…payable via PayPal.
Thanks.
/Hoff
I was brainstorming a couple of Cloud things with Doug Neal and Mark Masterson the other day and whilst grappling for an appropriately delicious analog for Cloud Computing, my 5-year old approached me and asked to play the “burping beer game (iBeer)” on my iPhone. Aha!
Whilst I have often grouped Cloud Computing with the consumerization of IT (and the iPhone as it’s most visible example) together in concert in my disruptive innovation presentations, I never really thought of them as metaphors for one another.
When you think of it, it’s really a perfect visual.
The iPhone is a fantastic platform that transforms using technology that has been around for quite a while into a more useful experience. The iPhone converges many technologies and capabilities under a single umbrella and changes the way in which people interact with their data and other people.
In some cases we have proprietary functions and capabilities which are locked into the provider and platform. We pay for this forced allegiance, but we tolerate it as necessary. We also see the inventiveness and innovation of people for whom brute forcing their way into openness with jailbreaks is a reasonable alternative.
There’s lots of ankle biting as vendors and providers clamor to bring the familiar trademarks of the iPhone to their own platforms. There are marketplaces being built around these platforms to open up new opportunities for collaboration, applications and experiences with the, gasp!, phones.
It’s true. The iPhone is, at its heart, a phone, and we’ve had mobile phones forever. Some complain that the iPhone is nothing more than a smartly packaged combination of technology we’ve already had for ages and that thanks to Moore’s law, we’re able to cram more and more stuff into smaller and smaller spaces. That logic therefore dictates that the iPhone is the mini-me “mainframe” of mobility. 😉 And millions buy it still. It’s like technology timesharing as the phone, Internet and mobility capabilities all compete for a timeshared swath of space in my pocket.
Yes, that’s right. The iPhone is simply timesharing of functions on a phone. <snort>
To the detractors’ point, however, for all the innovation and exciting capabilities the iPhone brings, it has and continues to suffer from some seriously goofy limitations that in other platforms would be game stoppers, but people settle anyway, waiting for the technology to catch up and dealing with the implications as they become important (or not.)
The best example? Cut and paste. I had freaking cut & paste in my Newton 15 years ago. The lack of C&P made certain things unusable on the iPhone let alone inconvenient and even insecure (having to copy and write-down complex passwords since I stored them in 1password, for example.)
However, I’ve purchased each revision of the iPhone as it came out and have been incrementally giddy with each new hardware/software combinaton, especially with the 3.0 software upgrade which finally gave me my beloved cut and paste 😉 The reality is that there are probably better solutions for my needs, but none that are so damned convenient and sexy to use.
The thing I love about my iPhone is that it’s not a piece of technology I think about but rather, it’s the way I interact with it to get what I want done. It has its quirks, but it works…for millions of people. Add in iTunes, the community of music/video/application artists/developers and the ecosystem that surrounds it, and voila…Cloud.
The point here is that Cloud is very much like the iPhone. As Sir James (Urquhart) says “Cloud isn’t a technology, it’s an operational model.” Just like the iPhone.
Cloud is still relatively immature and it doesn’t have all the things I want or need yet (and probably never will) but it will get to the point where its maturity and the inclusion of capabilities (such as better security, interoperability, more openness, etc.) will smooth its adoption even further and I won’t feel like we’re settling anymore…until the next version shows up on shelves.
But don’t worry, there’s an app for that.
/Hoff
I wanted to be able to take the work I did in developing a visual model to expose the component Cloud SPI layers into their requisite parts from an IT perspective and make it even easier to understand.
Specifically, my goal was to produce another visual and some terminology that would allow me to take it up a level so I might describe Cloud to someone who has a grasp on familiar IT terminology, but do so in a visual way.
I came up with extending the notion of infrastructure as a foundation and layering what I call metastructure and infostructure layers atop.
You can see how I define “metastructure” and “infostructure” in the diagram definitions to the left.
Essentially Infrastructure is comprised of all the compute, network and storage moving parts that we identify as infrastructure today.
Metastructure* is the protocols and mechanisms that provide the interface between the infrastructure layer and the applications and information above it.
Infostructure is the applications and information/content as well as the service definitions that depend upon the other substrates.
These groupings really align well and simplify how I talk about various elements of Cloud.
Specifically, these three layers line up remarkably well with the S, P, I layer demarcation points that I outlined in my Cloud Model (see the extensive discussion here) built before that I use in my Frogs presentation that has met with good reception thus far.
I can drill down as needed, but if I want to summarize from a security perspective where/what I am talking about, I now have three handy and easily understood set of macro-definitions to help me.
What do you think? I know we’re all pretty buzzworded out these days, but this really seems to resonate with folks up and down the stack I have presented it to.
Update 6/21: Reuven Cohen posted a nice follow-up to this blog on his in regards to his “metaverse” concept.
/Hoff
* I first mentioned the concept of “metastructure” in a post back in Februrary in another Incomplete Thought titled “Incomplete Thought: What Should Come First…Cloud Portability or Interoperability“
Recent Comments