Risk
1/8/2010
07:56 AM
Bob Evans
Bob Evans
Commentary
50%
50%

Global CIO: Cloud Computing's Deadly Vulnerability--And How To Avoid It

This one even trumps concerns about security, compliance, privacy, and management.

"It could be that cloud computing is the biggest thing since the internet, but remember that the internet took 20 years to become a big thing," Art wrote. "What makes a successful market for a vendor—the ones beating the cloud drum so hard right now—is no more than a few percentage-points shift in IT spending. If IT changes its spending patterns at 3% a year, the vendors will consider it wildly successful and in 20 years, you'll have phenomenon like Internet.

"I've repeatedly asked Charlie [our superb cloud-covering colleague Charlie Babcock] if he knows of any major companies who are using cloud services other than SaaS in a strategic way (meaning anything other than toe-dipping) and he can't really point me to anyone. So far, non-SaaS cloud services (IaaS, PaaS) are largely for other developers—period," Art wrote.

I see Art's point and agree that cloud computing is in its infancy, but where I disagree is with his 20-year horizon and with his steady-state theory—his assumption that right now in 2010 is just like 2007 is just like 2002 is just like 1996 and so forth. No, what we are facing here in 2010 with a global recession is a set of business challenges unlike anything I've seen in the past 30 years: uncertain credit, uneasy financial systems, jittery investors trying to divine if the stock market has any connection any more to the real world, and unprecedented government involvement in the private sector in every area from regulation to oversight to direct ownership.

As a result, I think the time-horizon most CIOs are looking at is 20 months rather than 20 years—there exists right now an incredible urgency to address and overcome the internal IT shortcomings that until recently have been shrugged off as just, well, insurmountable laws of physics. And cloud computing—or at least the promise and potential of cloud computing—just might change all that.

But let's go back to Art and his perspectives on whether that promise and potential have any chance of bearing fruit:

"Sure we need to cover this stuff, but I do worry that we're overdoing it. As it stands right now, you have crazy things going on like boards of directors asking 'what are you doing about cloud computing' to hapless CIOs and CEOs who SHOULD be doing nothing but watching and learning. But because it's being hyped by us, Barrons [in a recent cover story] and everyone else in the press who's buying into the vendor hype machine, readers are being forced to scramble for a proactive strategy much sooner than they should. I hate to use a Gartnerism, but we are so high on the hype curve it's nothing short of ridiculous. The trough of disillusionment is right around the corner . . . so let's temper the exuberance just a tad."

Again, Art offers a compelling and sobering assessment, as he always does. But also again, what is different here is the extraordinary urgency those "hapless CIOs and CEOs" face in getting their overall operations on track to perform at unprecedented levels of speed, global scale, flexibility, precision, customer engagement, and financial clarity. The status quo that Art would have those executives cling to for at least a while longer is simply not up to the task—and in these demanding days, the alternative isn't just devoting a couple more years and another pile of cash to finding new solution; rather, in this highly demanding and unforgiving global marketplace, t's oblivion.

That's why the urgency on the part of CIOs to see if cloud computing is real. That's why the urgency to test and tinker and experiment, rather than "doing nothing but watching and learning." And that's why, while it may be true that cloud computing's biggest vulnerability is hype, CIOs' biggest vulnerability is doing nothing—that is simply not an option.

So let close with some final and extremely valuable closing remarks from Art, along with the promise that across all of InformationWeek—from our Analytics research business to here at Global CIO to our well-grounded Plug Into The Cloud site to our core news coverage—you can be sure that you'll be getting cloud-computing coverage that reveals the failures as well as the successes, discusses the problems as well as the opportunities, and separates the hype from the reality.

In short, we promise that as we help you wrap your brains around the cloud, we won't get our heads lost in the clouds.

RECOMMENDED READING:

Global CIO: The Top 10 CIO Issues For 2010

Global CIO: The World's Largest Private Cloud: Who's Number 1?

Global CIO: Riverbed Sees Cloud Computing Boom In 2010

Global CIO: Cloud Computing's New Name: Who Will Win $100 Million?

Global CIO: Cloud Computing's New Name: 500 Reader Suggestions!

Cloud 2010: Hype Or Value?

GlobalCIO Bob Evans is senior VP and director of InformationWeek's Global CIO unit.

To find out more about Bob Evans, please visit his page.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-4403
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in Zen Cart 1.3.9h allow remote attackers to hijack the authentication of administrators for requests that (1) delete a product via a delete_product_confirm action to product.php or (2) disable a product via a setflag action to categories.ph...

CVE-2012-2930
Published: 2015-04-24
Multiple cross-site request forgery (CSRF) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to hijack the authentication of administrators for requests that (1) add a user via an adduser action to admin/index.php or (2) conduct static PHP code injection attacks in .htusers...

CVE-2012-2932
Published: 2015-04-24
Multiple cross-site scripting (XSS) vulnerabilities in TinyWebGallery (TWG) before 1.8.8 allow remote attackers to inject arbitrary web script or HTML via the (1) selitems[] parameter in a copy, (2) chmod, or (3) arch action to admin/index.php or (4) searchitem parameter in a search action to admin/...

CVE-2012-5451
Published: 2015-04-24
Multiple stack-based buffer overflows in HttpUtils.dll in TVMOBiLi before 2.1.0.3974 allow remote attackers to cause a denial of service (tvMobiliService service crash) via a long string in a (1) GET or (2) HEAD request to TCP port 30888.

CVE-2015-0297
Published: 2015-04-24
Red Hat JBoss Operations Network 3.3.1 does not properly restrict access to certain APIs, which allows remote attackers to execute arbitrary Java methos via the (1) ServerInvokerServlet or (2) SchedulerService or (3) cause a denial of service (disk consumption) via the ContentManager.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.