The Madness of Clouds: Separating Hype From Reality

Suddenly The Cloud is all. The problem is that it is a solution to which too many problems are being directed. It can not solve them all, nor can it live up to the inevitable hype engulfing any relatively new tech concept. To push the metaphor too far, albeit in a contrary direction, clouds are gaseous and impermanent. They also occasionally assume a funnel shape and destroy all in their path.

Mickey McManus explains in Business Week:

"As cloud computing services become more popular with consumers and corporations, it's time to sort hype from reality.

A December survey by Cisco (CSCO) of more than 2,000 tech managers across 13 countries found that 52 percent are using—or plan to use—cloud computer services in the near future. (The percentages are even higher in emerging markets Brazil, India, and China.) Another report released in August by market researcher Gartner (IT) noted that nearly 40 percent of IT professionals worldwide are putting more money toward cloud computing than ever before.

When so many people are talking about "The Cloud" with such passion, and backing that interest with investments, I begin to ask questions. This is what I discovered.

The gap between the hype and the reality, particularly on the technical side, is immense. It may be better to think of these "clouds" as a collection of giant, sometimes flammable, gas-filled Hindenburg-like airships with fluffy pictures painted on their sides by clever marketing folks.

Lest you think I'm an enemy of progress, I did discover there are some amazing and powerful new business models coming out of the clouds. If you're just starting a business or looking to focus on what you really do well, "pay-per-service" is a prudent and cost-effective way to manage your affairs. Further, it levels the playing field, democratizing the tools of business.

Potential for Catastrophe
But over the last few months, I've spoken with many security analysts across a number of industries and they've expressed both excitement and a deep-seated dread. They are excited because agile security will need to be "built into the cloud," and worried because in private conversation, they don't talk about if a "Deepwater Horizon-like event" will happen in the cloud, but when.

Why is there such certainty that a catastrophic event will occur? For starters, we're on a path to remove all resiliencies from our global business engine. Five years ago, if you took a random sampling you would have discovered that most companies had physical control over their mission-critical data and processes. It was usually in the form of "Bob in IT" with a team of computer geeks tending closets filled with servers. It wasn't perfect, but if one, ten, a hundred, or even a thousand companies lost their data, or installed a bad software patch, or fell prey to a malicious attack, the lifeblood of business everywhere would still flow. It would be an isolated incident, with little or no damage done to the greater economy.

Today, many companies have put—or are beginning to put—their business-critical information into the hands of four or five companies that specialize in cloud services. These companies have placed all of their customer-specific data into a cloud run by one company, and other critical systems into another cloud run by a different company. The logic is simple: If one cloud fails, just move the information to another cloud. At most it will cause a few days of discomfort.

The problem is that different clouds are far from compatible; the information that went into building one cannot easily flow to another—well, not without a considerable investment in rebuilding much of your system from scratch over weeks, months, or in some cases years.

Centralized Market
Let's look at the big picture and be clear about the risks: We are migrating from a diverse way of dealing with business information to a centralized market with a few single points of potential catastrophic failure. If there is a hostile takeover of one of the handful of big cloud vendors, if a malicious attack succeeds in taking one or two of them down for any amount of time, if someone just makes one too many mistakes, if the shareholders of one of these firms decide it is not in their business interest to keep that service running, business information will not just magically flow from one cloud to another