Global CIO: Cloud Computing's Deadly Vulnerability--And How To Avoid It
This one even trumps concerns about security, compliance, privacy, and management.
"It could be that cloud computing is the biggest thing since the internet, but remember that the internet took 20 years to become a big thing," Art wrote. "What makes a successful market for a vendor—the ones beating the cloud drum so hard right now—is no more than a few percentage-points shift in IT spending. If IT changes its spending patterns at 3% a year, the vendors will consider it wildly successful and in 20 years, you'll have phenomenon like Internet.
"I've repeatedly asked Charlie [our superb cloud-covering colleague Charlie Babcock] if he knows of any major companies who are using cloud services other than SaaS in a strategic way (meaning anything other than toe-dipping) and he can't really point me to anyone. So far, non-SaaS cloud services (IaaS, PaaS) are largely for other developers—period," Art wrote.
I see Art's point and agree that cloud computing is in its infancy, but where I disagree is with his 20-year horizon and with his steady-state theory—his assumption that right now in 2010 is just like 2007 is just like 2002 is just like 1996 and so forth. No, what we are facing here in 2010 with a global recession is a set of business challenges unlike anything I've seen in the past 30 years: uncertain credit, uneasy financial systems, jittery investors trying to divine if the stock market has any connection any more to the real world, and unprecedented government involvement in the private sector in every area from regulation to oversight to direct ownership.
As a result, I think the time-horizon most CIOs are looking at is 20 months rather than 20 years—there exists right now an incredible urgency to address and overcome the internal IT shortcomings that until recently have been shrugged off as just, well, insurmountable laws of physics. And cloud computing—or at least the promise and potential of cloud computing—just might change all that.
But let's go back to Art and his perspectives on whether that promise and potential have any chance of bearing fruit:
"Sure we need to cover this stuff, but I do worry that we're overdoing it. As it stands right now, you have crazy things going on like boards of directors asking 'what are you doing about cloud computing' to hapless CIOs and CEOs who SHOULD be doing nothing but watching and learning. But because it's being hyped by us, Barrons [in a recent cover story] and everyone else in the press who's buying into the vendor hype machine, readers are being forced to scramble for a proactive strategy much sooner than they should. I hate to use a Gartnerism, but we are so high on the hype curve it's nothing short of ridiculous. The trough of disillusionment is right around the corner . . . so let's temper the exuberance just a tad."
Again, Art offers a compelling and sobering assessment, as he always does. But also again, what is different here is the extraordinary urgency those "hapless CIOs and CEOs" face in getting their overall operations on track to perform at unprecedented levels of speed, global scale, flexibility, precision, customer engagement, and financial clarity. The status quo that Art would have those executives cling to for at least a while longer is simply not up to the task—and in these demanding days, the alternative isn't just devoting a couple more years and another pile of cash to finding new solution; rather, in this highly demanding and unforgiving global marketplace, t's oblivion.
That's why the urgency on the part of CIOs to see if cloud computing is real. That's why the urgency to test and tinker and experiment, rather than "doing nothing but watching and learning." And that's why, while it may be true that cloud computing's biggest vulnerability is hype, CIOs' biggest vulnerability is doing nothing—that is simply not an option.
So let close with some final and extremely valuable closing remarks from Art, along with the promise that across all of InformationWeek—from our Analytics research business to here at Global CIO to our well-grounded Plug Into The Cloud site to our core news coverage—you can be sure that you'll be getting cloud-computing coverage that reveals the failures as well as the successes, discusses the problems as well as the opportunities, and separates the hype from the reality.
In short, we promise that as we help you wrap your brains around the cloud, we won't get our heads lost in the clouds.
Published: 2015-10-09 Simple Streams (simplestreams) does not properly verify the GPG signatures of disk image files, which allows remote mirror servers to spoof disk images and have unspecified other impact via a 403 (aka Forbidden) response.
Published: 2015-10-09 The Telephony component in Apple OS X before 10.11, when the Continuity feature is enabled, allows local users to bypass intended telephone-call restrictions via unspecified vectors.
Published: 2015-10-09 IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly sanitize applet URLs, which allows remote attackers to inject applets into the .appletTrustSettings configuration file and bypass user approval to execute the applet via a crafted web page, possibly related to line breaks.
Published: 2015-10-09 IcedTea-Web before 1.5.3 and 1.6.x before 1.6.1 does not properly determine the origin of unsigned applets, which allows remote attackers to bypass the approval process or trick users into approving applet execution via a crafted web page.
Published: 2015-10-09 The Safari Extensions implementation in Apple Safari before 9 does not require user confirmation before replacing an installed extension, which has unspecified impact and attack vectors.