CloudFucius Shares: Cloud Research and Stats

Sharing is caring, according to some and with the shortened week, CloudFucius decided to share some resources he’s come across during his Cloud exploration in this abbreviated post.  A few are aged just to give a perspective of what was predicted and written about over time.

Some Interesting Cloud Computing Statistics (2008)

Mobile Cloud Computing Subscribers to Total Nearly One Billion by 2014 (2009)

Server, Desktop Virtualization To Skyrocket By 2013: Report (2009)

Gartner: Brace yourself for cloud computing (2009)

A Berkeley View Of Cloud Computing : An Analysis – the good, the bad and the ugly (2009)

Cloud computing belongs on your three-year roadmap (2009)

Twenty-One Experts Define Cloud Computing (2009)

5 cool cloud computing research projects (2009)

Research Clouds (2010)

Cloud Computing Growth Forecast (2010)

Cloud Computing and Security - Statistics Center (2010)

Cloud Computing Experts Reveal Top 5 Applications for 2010 (2010)

List of Cloud Platforms, Providers, and Enablers 2010 (2010)

The Cloud Computing Opportunity by the Numbers (2010)

Governance grows more integral to managing cloud computing security risks, says survey (2010)

The Cloud Market EC2 Statistics (2010)

Experts believe cloud computing will enhance disaster management (2010)

Cloud Computing Podcast (2010)

Security experts ponder the cost of cloud computing (2010)

Cloud Computing Research from Business Exchange (2010)

Just how green is cloud computing? (2010)

Senior Analyst Guides Investors Through Cloud Computing Sector And Gives His Top Stock Winners (2010)

Towards Understanding Cloud Performance Tradeoffs Using Statistical Workload Analysis and Replay (2010)

…along with F5’s own Lori MacVittie who writes about this stuff daily.

And one from Confucius: Study the past if you would define the future.

ps

The CloudFucius Series: Intro, 1, 2, 3, 4, 5, 6, 7, 8

Technorati Tags: F5, infrastructure 2.0, integration, cloud connect, Pete Silva, security, business, education, technology, application delivery, intercloud, cloud, context-aware, infrastructure 2.0, automation, web, internet, blog

twitter: @psilvas

CloudFucius Inspects: Hosts in the Cloud

So much has been written about all the systems, infrastructure, applications, content and everything else IT related that’s making it’s way to the cloud yet I haven’t seen much discussion (or maybe I just missed it) about all the clients connecting to the cloud to access those systems.  Securing those systems has made some organizations hesitate in deploying IT resources in the cloud whether due to compliance, the sensitivity of the data, the shared infrastructure or simply persuaded by survey results.  Once a system is ‘relatively’ secure, how do you keep it that way when the slew of potentially dangerous, infected clients connect?  With so many different types of users connecting from various devices, and with a need to access vastly different cloud resources, it’s important to inspect every requesting host to ensure both the user and the device can be trusted.  Companies have done this for years with remote/SSL VPN users who request access to internal systems – is antivirus installed and up to date, is a firewall enabled, is the device free of malware and so forth.  Ultimately, the hosts are connecting to servers housed in some data center and all the same precautions you have with your own space should be enforced in the cloud.


Since cloud computing has opened application deployment to the masses, and all that’s required for access is *potentially* just a browser, you must be able to detect not only the type of computer (laptop, mobile device, kiosk, etc.) but also its security posture. IDC predicts that ‘The world's mobile worker population will pass the one billion mark this year and grow to nearly 1.2 billion people – more than a third of the world's workforce – by 2013’  With so many Internet-enabled devices available; a Windows computer, a Linux box, an Apple iteration, a mobile device and anything else with an IP address, they could all be trying to gain access to your cloud environment at any given moment.  It might be necessary to inspect each of these before granting users access in order to make sure it’s something you want to allow.  If the inspection fails, how should you fix the problem so that the user can have some level of access?  If the requesting host is admissible, how do you determine what they are authorized to access?  And, if you allow a user and their device, what is the guarantee that nothing proprietary either gets taken or left behind?  The key is to make sure that only “safe” systems are allowed to access your cloud infrastructure, especially if it contains highly sensitive information and context helps with that.

One of the first steps to accomplishing this is to chart usage scenarios. Working in conjunction with the security policy, it is essential to uncover the usage scenarios and access modes for the various types of users and the many devices that they might be using.  The chart will probably vary based on your company’s and/or website’s Acceptable Use Policy, but this exercise gets administrators started in determining the endpoint plan.  Sounds a lot like a remote access policy, huh, with one exception.  Usually there is a notion of ‘trusted’ and ‘un-trusted’  with remote access.  If a user requests access from a corporate issued laptop, often that’s considered a trusted device since there is something identifiable to classify it as an IT asset.  These days, with so many personal devices entering the cloud, all hosts should be considered un-trusted until they prove otherwise.  And as inter-clouds become reality, you’ll need to make sure that a client coming from someone else’s infrastructure abides by your requirements.  Allowing an infected device access to your cloud infrastructure can be just as bad as allowing an invalid user access to proprietary internal information.  This is where endpoint security checks can take over. Endpoint security prevents infected PCs, hosts, or users from connecting to your cloud environment.  Automatic re-routing for infected PCs reduces Help Desk calls and prevents sensitive data from being snooped by keystroke loggers and malicious programs.

Simply validating a user is no longer the starting point for determining access to cloud systems; the requesting device should get the first review.  Pre-access checks can run prior to the actual logon (if there is one) page appearing, so if the client is not in compliance, they won’t even get the chance to enter credentials.  These checks can determine if antivirus or firewall is running, if it is up-to-date, and more.  Systems can direct the user to a remediation page for further instructions to gain access. It’s easy to educate the user as to why the failure occurred and relay the possible steps to resolve the problem.  For example: “We noticed you have antivirus installed but not running. Please enable your antivirus software for access.”  Or, rather than deny logon and communicate a detailed remedy, you could automatically send them to a remediation website designed to correct or update the client’s software environment, assuring policies required for access are satisfied without any user interaction.  Inspectors can look for certain registry keys or files that are part of your corporate computer build/image to determine if this is a corporate asset and thus, which system resources are allowed.  Pre-access checks can retrieve extended Windows and Internet Explorer info to ensure certain patches are in place.  If, based on those checks, the system finds a non-compliant client but an authorized user; you might be able to initiate a secure, protected, virtual workspace for that session.
As the ever-expanding cloud network grows, the internal corporate resources require the most protection as it’s always been.  Most organizations don’t necessarily want all users’ devices to have access to all resources all the time.  Working in conjunction with the pre-access sequence, controllers can gather device information (like IP address or time of day) and determine if a resource should be offered.  A protected configuration measures risk factors using information collected by the pre-access check; thus, they work in conjunction.  For example, Fake Company, Inc. (FCI) has some contractors who need access to Fake Company’s corporate cloud.  While this is not an issue during work hours, FCI does not want them accessing the system after business hours.  The controller can check the time if a contractor tries to log on at 2 AM; it knows the contractor’s access is only available during FCI’s regular business hours and can deny access.

Post-access actions can protect against sensitive information being “left” on the client.  The controller can impose a cache-cleaner to eliminate any user residue such as browser history, forms, cookies, auto-complete information, and more.  For systems unable to install a cleanup control, you can block all file downloads to avoid the possibility of the inadvertent left-behind temporary file—yet still allow access to needed cloud applications.  These actions are especially important when allowing non-recognized machines access without wanting them to take any data with them after the session.

In summary: First, inspect the requesting device; second, protect resources based on the data gathered during the check; third, make sure no session residue is left behind.  Security is typically a question of trust. Is there sufficient trust to allow a particular user and a particular device full access to enterprise cloud resources?  Endpoint security gives the enterprise the ability to verify how much trust and determine whether the client can get all the cloud resources, some of the cloud resources, or just left in the rain.
And one from Confucius: When you know a thing, to hold that you know it; and when you do not know a thing, to allow that you do not know it - this is knowledge.

ps

The CloudFucius Series: Intro, 1, 2, 3, 4, 5

Related:

• Office Web Apps - Clients in the Cloud
• Windows Intune
• The Context-Aware Cloud

Technorati Tags: F5, infrastructure 2.0, integration, cloud connect, Pete Silva, security, business, education, technology, application delivery, intercloud, cloud, context-aware, infrastructure 2.0, automation, web, internet, blog, law

twitter: @psilvas

CloudFucius Ponders: High-Availability in the Cloud

According to Gartner, “By 2012, 20 percent of businesses will own no IT assets.”  While the need for hardware will not disappear completely, hardware ownership is going through a transition: Virtualization, total cost of ownership (TCO) benefits, an openness to allow users run their personal machines on corporate networks, and the advent of cloud computing are all driving the movement to reduce hardware assets.  Cloud computing offers the ability to deliver critical business applications, systems, and services around the world with a high degree of availability, which enables a more productive workforce.  No matter which cloud service — IaaS, PaaS, or SaaS (or combination thereof) — a customer or service provider chooses, the availability of that service to users is paramount, especially if service level agreements (SLAs) are part of the contract.  Even with a huge cost savings, there is no benefit for either the user or business if an application or infrastructure component is unavailable or slow.

As hype about the cloud has turned into the opportunity for cost savings, operational efficiency, and IT agility, organizations are discussing, testing, and deploying some form of cloud computing.  Many IT departments initially moved to the cloud with non-critical applications and, after experiencing positive results and watching cloud computing quickly mature, are starting to move their business critical applications, enabling business units and IT departments to focus on the services and workflows that best serve the business.  Since the driver for any cloud deployment, regardless of model or location, is to deliver applications in the most efficient, agile, and secure way possible, the dynamic control plane of cloud architecture requires the capability to intercept, interpret, and instruct where the data must go and must have the necessary infrastructure, at strategic points of control, to enable quick, intelligent decisions and ensure consistent availability.

The on-demand, elastic, scalable, and customizable nature of the cloud must be considered when deploying cloud architectures.  Many different customers might be accessing the same back-end applications, but each customer has the expectation that only their application will be properly delivered to users.  Making sure that multiple instances of the same application are delivered in a scalable manner requires both load balancing and some form of server virtualization. An Application Delivery Controller (ADC) can virtualize back-end systems and can integrate deeply with the network and application servers to ensure the highest availability of a requested resource.  Each request is inspected using any number of metrics and then routed to the best available server.  Knowing how an ADC can enhance your application delivery architecture is essential prior to deployment. Many applications have stellar performance during the testing phase, only to fall apart when they are live. By adding a Virtual ADC to your development infrastructure, you can build, test and deploy your code with ADC enhancements from the start.

With an ADC, load balancing is just the foundation of what can be accomplished.  In application delivery architectures, additional elements such as caching, compression, rate shaping, authentication, and other customizable functionality, can be combined to provide a rich, agile, secure and highly available cloud infrastructure.  Scalability is also important in the cloud and being able to bring up or take down application instances seamlessly — as needed and without IT intervention — helps to prevent unnecessary costs if you’ve contracted a “pay as you go” cloud model.  An ADC can also isolate management and configuration functions to control cloud infrastructure access and keep network traffic separate to ensure segregation of customer environments and the security of the information.  The ability of an ADC to recognize network and application conditions contextually in real-time, as well as its ability to determine the best resource to deliver the request, ensures the availability of applications delivered from the cloud.

Availability is crucial; however, unless applications in the cloud are delivered without delay, especially when traveling over latency-sensitive connections, users will be frustrated waiting for “available” resources.  Additional cloud deployment scenarios like disaster recovery or seasonal web traffic surges might require a global server load balancer added to the architecture.  A Global ADC uses application awareness, geolocation, and network condition information to route requests to the cloud infrastructure that will respond best and using the geolocation of users based on IP address, you can route the user to the closest cloud or data center.  In extreme situations, such as a data center outage, a Global ADC will already know if a user’s primary location is unavailable and it will automatically route the user to the responding location.

Cloud computing, while still evolving in all its iterations, can offer IT a powerful alternative for efficient application, infrastructure, and platform delivery.  As businesses continue to embrace the cloud as an advantageous application delivery option, the basics are still the same: scalability, flexibility, and availability to enable a more agile infrastructure, faster time-to-market, a more productive workforce, and a lower TCO along with happier users.

And one from Confucius: The man of virtue makes the difficulty to be overcome his first business, and success only a subsequent consideration.

ps

The CloudFucius Series: Intro, 1, 2, 3

Technorati Tags: F5, infrastructure 2.0, integration, collaboration, standards, cloud connect, Pete Silva, F5, security, business, education, technology, application delivery, intercloud, cloud, context-aware, infrastructure 2.0, automation, web, internet, blog

twitter: @psilvas

CloudFucius Says: Blog Series, Good Idea

Last year I wrote a blog series called, ‘26 Short Topics About Security’ covering an alphabet soup of stories.   It seemed to be well received and this year I’ve decided to do another – this time focused on Cloud Computing with ‘CloudFucius’ as my guide.  Confucius, of course, was a Chinese philosopher who focused on personal growth, morals, good judgment, ethics and many other life enlightening behaviors.  He lived around 500BC and is credited with, ‘Do not impose on others what you yourself do not desire,’ and many other gems like, ‘Choose a job you love, and you will never have to work a day in your life.’

First, I want to stake a claim here that CloudFucius (TM) is mine and I have started the copyright process.  :-)  I googled and did a copyright search for 'Cloudfucius' and absolutely nothing gets returned, which actually surprised me.  'Cloud-fucius' returns a bunch of 'fucius' stuff so I figured it’s good to take.  If you do have any rights, speak up now.  While I am well versed with the security stories, I can admit I'm no cloud super-expert; knowledgeable but certainly not to the level of MacVittie, Ness and the rest.  While weaving in what I do know, I was thinking of investigating a bunch of cloud topics that I’m not an expert on, learn along the way and report on it.  Education for all and playing off the fact that Confucius=wisdom.  Hopefully CloudFucius will teach us something along the way.  He’ll start next week with some easy doctrines like, CloudFucius Says: AAA Important to Cloud and in later weeks move into other areas like, CloudFucius Says: Secure Cloud is Possible.  I’m looking forward to what we uncover and CloudFucius is excited to spread some cloud knowledge to the masses and someday getting a Hasbro toy and game named after him.

下 周 见 - 下 for Next; 周 for week; 见 for see/meet.

ps

Technorati Tags: MacVittie, F5, infrastructure 2.0, integration, collaboration, standards, cloud connect, Pete Silva, F5, security, business, education, technology, application delivery, intercloud, cloud, greg Ness, context-aware, infrastructure 2.0, automation, web, internet, blog