Global CIO: Cloud Computing's Deadly Vulnerability--And How To Avoid It
This one even trumps concerns about security, compliance, privacy, and management.
"It could be that cloud computing is the biggest thing since the internet, but remember that the internet took 20 years to become a big thing," Art wrote. "What makes a successful market for a vendor—the ones beating the cloud drum so hard right now—is no more than a few percentage-points shift in IT spending. If IT changes its spending patterns at 3% a year, the vendors will consider it wildly successful and in 20 years, you'll have phenomenon like Internet.
"I've repeatedly asked Charlie [our superb cloud-covering colleague Charlie Babcock] if he knows of any major companies who are using cloud services other than SaaS in a strategic way (meaning anything other than toe-dipping) and he can't really point me to anyone. So far, non-SaaS cloud services (IaaS, PaaS) are largely for other developers—period," Art wrote.
I see Art's point and agree that cloud computing is in its infancy, but where I disagree is with his 20-year horizon and with his steady-state theory—his assumption that right now in 2010 is just like 2007 is just like 2002 is just like 1996 and so forth. No, what we are facing here in 2010 with a global recession is a set of business challenges unlike anything I've seen in the past 30 years: uncertain credit, uneasy financial systems, jittery investors trying to divine if the stock market has any connection any more to the real world, and unprecedented government involvement in the private sector in every area from regulation to oversight to direct ownership.
As a result, I think the time-horizon most CIOs are looking at is 20 months rather than 20 years—there exists right now an incredible urgency to address and overcome the internal IT shortcomings that until recently have been shrugged off as just, well, insurmountable laws of physics. And cloud computing—or at least the promise and potential of cloud computing—just might change all that.
But let's go back to Art and his perspectives on whether that promise and potential have any chance of bearing fruit:
"Sure we need to cover this stuff, but I do worry that we're overdoing it. As it stands right now, you have crazy things going on like boards of directors asking 'what are you doing about cloud computing' to hapless CIOs and CEOs who SHOULD be doing nothing but watching and learning. But because it's being hyped by us, Barrons [in a recent cover story] and everyone else in the press who's buying into the vendor hype machine, readers are being forced to scramble for a proactive strategy much sooner than they should. I hate to use a Gartnerism, but we are so high on the hype curve it's nothing short of ridiculous. The trough of disillusionment is right around the corner . . . so let's temper the exuberance just a tad."
Again, Art offers a compelling and sobering assessment, as he always does. But also again, what is different here is the extraordinary urgency those "hapless CIOs and CEOs" face in getting their overall operations on track to perform at unprecedented levels of speed, global scale, flexibility, precision, customer engagement, and financial clarity. The status quo that Art would have those executives cling to for at least a while longer is simply not up to the task—and in these demanding days, the alternative isn't just devoting a couple more years and another pile of cash to finding new solution; rather, in this highly demanding and unforgiving global marketplace, t's oblivion.
That's why the urgency on the part of CIOs to see if cloud computing is real. That's why the urgency to test and tinker and experiment, rather than "doing nothing but watching and learning." And that's why, while it may be true that cloud computing's biggest vulnerability is hype, CIOs' biggest vulnerability is doing nothing—that is simply not an option.
So let close with some final and extremely valuable closing remarks from Art, along with the promise that across all of InformationWeek—from our Analytics research business to here at Global CIO to our well-grounded Plug Into The Cloud site to our core news coverage—you can be sure that you'll be getting cloud-computing coverage that reveals the failures as well as the successes, discusses the problems as well as the opportunities, and separates the hype from the reality.
In short, we promise that as we help you wrap your brains around the cloud, we won't get our heads lost in the clouds.
Dark Reading Tech Digest, Dec. 19, 2014Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Published: 2015-02-26 Cross-site scripting (XSS) vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title.
Published: 2015-02-26 Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via unspecified vectors.
Published: 2015-02-26 Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors.
Published: 2015-02-26 Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (...
Published: 2015-02-26 SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.