Risk
1/8/2010
07:56 AM
Bob Evans
Bob Evans
Commentary
50%
50%

Global CIO: Cloud Computing's Deadly Vulnerability--And How To Avoid It

This one even trumps concerns about security, compliance, privacy, and management.

"It could be that cloud computing is the biggest thing since the internet, but remember that the internet took 20 years to become a big thing," Art wrote. "What makes a successful market for a vendor—the ones beating the cloud drum so hard right now—is no more than a few percentage-points shift in IT spending. If IT changes its spending patterns at 3% a year, the vendors will consider it wildly successful and in 20 years, you'll have phenomenon like Internet.

"I've repeatedly asked Charlie [our superb cloud-covering colleague Charlie Babcock] if he knows of any major companies who are using cloud services other than SaaS in a strategic way (meaning anything other than toe-dipping) and he can't really point me to anyone. So far, non-SaaS cloud services (IaaS, PaaS) are largely for other developers—period," Art wrote.

I see Art's point and agree that cloud computing is in its infancy, but where I disagree is with his 20-year horizon and with his steady-state theory—his assumption that right now in 2010 is just like 2007 is just like 2002 is just like 1996 and so forth. No, what we are facing here in 2010 with a global recession is a set of business challenges unlike anything I've seen in the past 30 years: uncertain credit, uneasy financial systems, jittery investors trying to divine if the stock market has any connection any more to the real world, and unprecedented government involvement in the private sector in every area from regulation to oversight to direct ownership.

As a result, I think the time-horizon most CIOs are looking at is 20 months rather than 20 years—there exists right now an incredible urgency to address and overcome the internal IT shortcomings that until recently have been shrugged off as just, well, insurmountable laws of physics. And cloud computing—or at least the promise and potential of cloud computing—just might change all that.

But let's go back to Art and his perspectives on whether that promise and potential have any chance of bearing fruit:

"Sure we need to cover this stuff, but I do worry that we're overdoing it. As it stands right now, you have crazy things going on like boards of directors asking 'what are you doing about cloud computing' to hapless CIOs and CEOs who SHOULD be doing nothing but watching and learning. But because it's being hyped by us, Barrons [in a recent cover story] and everyone else in the press who's buying into the vendor hype machine, readers are being forced to scramble for a proactive strategy much sooner than they should. I hate to use a Gartnerism, but we are so high on the hype curve it's nothing short of ridiculous. The trough of disillusionment is right around the corner . . . so let's temper the exuberance just a tad."

Again, Art offers a compelling and sobering assessment, as he always does. But also again, what is different here is the extraordinary urgency those "hapless CIOs and CEOs" face in getting their overall operations on track to perform at unprecedented levels of speed, global scale, flexibility, precision, customer engagement, and financial clarity. The status quo that Art would have those executives cling to for at least a while longer is simply not up to the task—and in these demanding days, the alternative isn't just devoting a couple more years and another pile of cash to finding new solution; rather, in this highly demanding and unforgiving global marketplace, t's oblivion.

That's why the urgency on the part of CIOs to see if cloud computing is real. That's why the urgency to test and tinker and experiment, rather than "doing nothing but watching and learning." And that's why, while it may be true that cloud computing's biggest vulnerability is hype, CIOs' biggest vulnerability is doing nothing—that is simply not an option.

So let close with some final and extremely valuable closing remarks from Art, along with the promise that across all of InformationWeek—from our Analytics research business to here at Global CIO to our well-grounded Plug Into The Cloud site to our core news coverage—you can be sure that you'll be getting cloud-computing coverage that reveals the failures as well as the successes, discusses the problems as well as the opportunities, and separates the hype from the reality.

In short, we promise that as we help you wrap your brains around the cloud, we won't get our heads lost in the clouds.

RECOMMENDED READING:

Global CIO: The Top 10 CIO Issues For 2010

Global CIO: The World's Largest Private Cloud: Who's Number 1?

Global CIO: Riverbed Sees Cloud Computing Boom In 2010

Global CIO: Cloud Computing's New Name: Who Will Win $100 Million?

Global CIO: Cloud Computing's New Name: 500 Reader Suggestions!

Cloud 2010: Hype Or Value?

GlobalCIO Bob Evans is senior VP and director of InformationWeek's Global CIO unit.

To find out more about Bob Evans, please visit his page.

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2037
Published: 2014-11-26
Openswan 2.6.40 allows remote attackers to cause a denial of service (NULL pointer dereference and IKE daemon restart) via IKEv2 packets that lack expected payloads. NOTE: this vulnerability exists because of an incomplete fix for CVE 2013-6466.

CVE-2014-6609
Published: 2014-11-26
The res_pjsip_pubsub module in Asterisk Open Source 12.x before 12.5.1 allows remote authenticated users to cause a denial of service (crash) via crafted headers in a SIP SUBSCRIBE request for an event package.

CVE-2014-6610
Published: 2014-11-26
Asterisk Open Source 11.x before 11.12.1 and 12.x before 12.5.1 and Certified Asterisk 11.6 before 11.6-cert6, when using the res_fax_spandsp module, allows remote authenticated users to cause a denial of service (crash) via an out of call message, which is not properly handled in the ReceiveFax dia...

CVE-2014-7141
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (out-of-bounds read and crash) via a crafted type in an (1) ICMP or (2) ICMP6 packet.

CVE-2014-7142
Published: 2014-11-26
The pinger in Squid 3.x before 3.4.8 allows remote attackers to obtain sensitive information or cause a denial of service (crash) via a crafted (1) ICMP or (2) ICMP6 packet size.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?