Security as a Service — few words

I am going to write after a long time. Don’t know why I messed up my writing with my talking. In this post I would like to focus on an aspect that looks promising for service providers, that holds alot of thinking for service takers, and that demands alot of creativity when it comes to seperating on-premises security notions to the off-premises security notions. By default, what we assess from the bare term is that Security might not be dealt with weapons that one posses to tackle attacks. Why would someone think of getting security services that are coming entirely from outside? But when thought and provided in a manner that is much more intuitive than the notions of endpoint security or in-network access gateways, this new tool can give benefits to companies in search of a secure off-the-hook solution and new business models for the security service providers.
Costs for such a service should not be considered as benefit, because normally costs adjust themselves to come to a point where it becomes equally costly as compared to buying a solution without a cloud aspect into it. But reliability, and 24/7 access to a service that meets security can be a good starting point. Security assurance being the second parameter will be a good thing to consider. Two reasons which are provided by the security service providers for providing security-as-a-service are economies of scale and streamlined delivery mechanisms. What exaclty that means? Reach to SMBs? pick-your-own-profile type features? or what? In this respect all consumers have to do is to get educated. They have to know what exactly security-as-a-service offering implies, what it caters for, why its beneficial, and why they have to consider it in decision making. This is the responsibility of the service provider to provide needed documentation, demos, etc to educate the consumer. Since economies of scale means it might reach much more consumers, so an emphasis of education is a must have by the service provider.
I will end few words here. I hope to come back with a deeper look into that.
Till then have a nice time.

Cloud and indoor positioning- A recipe in the making

Cloud computing is reshaping the IT and Telecommunications landscape, and the way we think of provisioning. On the other hand indoor-positioning with its technology agility and innovative prospects for location based services, will enable new forms of developer productivity. The question is how far mobile location can benefit from cloud computing?

Environment
Telco clouds are now on the move, and many telecom companies are building infrastructures around cloud computing e.g. SAIL (Scalable and Adaptive Internet soLutions) project to enable networks of the future. The other noteworthy dimension is M2M and cloud computing. Cloud computing is core value proposition for smart phones, and thereby for M2M. The connection has already being made and analysed by companies like Ericsson and Nokia Siemens Networks (M2M Cloud Platform-Cumulocity).

Developers
The second aspect is that developers now love to work in the cloud especially in a multi-cloud environments. The reasons for that are ease of provisioning, resource utilisation, and scalability in the cloud. Developers like to work with APIs creating new applications and services that don’t die with load fluctuations on the network.

The new mix
Right now location-based-services companies are utilising cloud largely for storage. Apart from storage what computational and platform benefits LBS can gain from? One such approach must be provisioning of a service platform where developers can plugin their code through location-based enablements provided by companies like Qubulus using there industry leading Qubulus Positioning System. In this space new APIs targeting at developer productivity will enable a plathora of indoor positioning services. So the new mix is location-based cloud-enabled developer platform.
Now think of combining indoor positioning, M2M, cloud computing, developer agility, and unified service provisioning. Then the customer will be served best.

HP CloudSystem landscape!

HP CloudSystem

1. Utilizes HP CloudSystem Matrix, used for priavte cloud and IaaS
2. Especially optimized for HP ProLiant, HP Integrity Servers, HP Storage, and HP Networking
3. VMware, Microsoft HyperV and Integrity VMs supported
4. It helps you BUILD and MANAGE cloud services
5. Private, Public, and Hybrid Support
6. 3 Dimentions viz HP CloudSystem Matrix (Private Cloud), HP CloudSystem Enterprise (Hybrid Cloud), HP CloudSystem Service Provider (Public or Hosted-Private (SaaS-based) Cloud)
7. HP, EMC, and NetApps disk-arrays for storage
8. HP, Cisco, and Brocade Communications switches for Networking
9. Core of the system is HP Server Automation Software (SA)
10. APIs are due to be matured-Keep looking, they are making APIs to integrate with Public Clouds

HP and IBM both have quite agile strategies for enabling cloud computing. Waiting for a major public cloud vendor who bases itself on HP.

Verizon-Terremark Cloud Computing Offerings!

Verizon-Terremark:
Cloud Products:

1. vCloud Express

a- Pay as you go
b- Get started with a credit card
c- scalable development platform

2. Enterprise Cloud TM

a- Robust Security Suite
b- Dedicated resource pools
c- Integration with Private Networks

3. vCloud Datacenter

a- Hybrid Cloud Compatible
b- Dedicated resource pools
c- Manage with vCloud Director

Terremark Enterprise Cloud TM
a- vmware enabled, clustered hypervisor, HA,
b- Yearly subscription based, means NOT pay-as-you-go
c- Basic package contains 5 GHz and 10 GB RAM
d- Multiple NICs allowed
e- Switches can be created, bridge and routing facility
f- All the functionalities of vCloud Express included
g- Maximum server size allowed is 4 VPUs and 16 GB RAM
h- VMware .vmdk files cannot be exported from private network to Enterprise Cloud (Not yet supported)
i- LAN-LAN connection from private network to Enterprise Cloud can be made
j- Integrated HA firewalls availabe, Private vLANs
k- Infinicenter Management Console
l- No auto-scaling as in AWS (readers! please confirm)

vCloud Express:
a- API access available (RESTful)
b- Web interface, CLI interface
c- Virtualization technology is VMware + clustered hypervisor with VMware vSphere and VMware HA
d- Up to 8 Virtual processor units, upto 16GB virtual ram
e- Hardware load balancing
f- Persistant storage available—just like Amazon’s EBS
g- Horizontal (add servers) and vertical (add RAM) server scaling
h- Blank server available to install OS from ISO
i- Only 1 NIC is allowed. (http://bit.ly/kYBf7o)
j- IPSec and PPTP supported

vCloudExpress Architecture

vCloud DataCenter
a- Enterprise-class solution
b- Hybrid Cloud
c- VMware vCloud Director Integration
d- Local VMware VMs can be run on this service
e- Available in limited beta
f- Would be an extension of Terremark Enterprise Cloud

Cloud Projections for a near future-factualFiction

Hi all,
Cloud is now getting mature enough to tell the big bosses in big companies to take some big radical decisions, because its the big time now.
Introduction

So what should we expect from the rain-bucket i.e. cloud? I am going to write about what implications the current trending will bring, what sort of new models can emerge, what opportunities can come, and what threats might stream with it.
Mainframe to Client/server had a generational impact and a generational shift in mentality. It also shaped the world with its opportunities, and challenges. Then came the convergence and the life-of-all became inter-meshed. Then came the marriage of telecom sector with the IT sector. Then came the tilting of social-media from vertical to an awesome horizontal. Now its time to go back to the old days of electricity.

Cloud trends across multiple service architectures:

I am trying to think not to write in a manner that this blog-post becomes again a mundane appraisal of cloud computing. But an inspection to see the trends and what tweaks we can introduce and what implications that would bring, is the issue here.
The IT companies have no doubt set the trend for others to follow suite, and showed tremendousness business-case opportunity for those who were sceptic in the first place. Telecom sector along with its IMS (IP Multimedia Subsystem), SIP, SS7 Stacks or INs (Intelligent Networks), WiMAX (Worldwide Interoperability for Microwave Access), Femtocells, and LTE (Long Term Evolution) has mesmerised Operators to use their Pipes to service customers at other service levels e.g. finance, medical, engineering, etc. Now IT and Telecommunications sector has the opportunity to be in the same room, and play the metal for the audience. Lets try our IF mentality i.e. IF this happens then this can happen and IF not then that.
Cloud service providers will be able to make cloud data centers in each country in a near future, lets say 2-3 years. Currently we have few datacenters in multiple countries BUT China, India, Canada, Nepal, Mexico, Brazil, Pakistan, Russia still don’t have that much to office in terms of cloud provisioning for the public. So if that happens, it will push certain behaviour in non-IT sectors. Telecom companies that are in every country perhaps multiple in each country, will be able to make cloud applications/services which are specialised with respect to locality, aggregation, security, and performance characteristics. Added to this flavour will be the horizontal aspect of social media. Added to this is the ease of access and broadband speeds that consumers will have in two to three years will grant throttle perspective to cloud computing where SOA will gets its out-of-the-box access, creation, maintenance, and serviceability from enterprise level to bare metal consumer level.

Lets dig up the protos:

Spot Cloud, Storms in Clouds, intercloud, API explosion, and multiple implementations has already started a shift in academia to get to the standardisation stage for clouds. IEEE has opened its hands to get the standardisation outputs, IETF is on its DOING to get it standardised, and Orange, Ericsson Research Labs, and AT&T are moving in the directions of how to standardise their own or public implementations of clouds using their initiatives e.g. SAIL (Scalable and Adaptive Internet Solutions) by Ericsson.
Now comes the BIG V i.e. virtualization. Distributed virtualization is gaining more strengths and fluid nature and easy management of VMs will boost another layer of virtualization to be formed. This layer will have tendencies to form SOA models from within this layer. So the front ends to this will be used in enterprises to have their own machines flowing in their own distributed virtualization pool and a much more generic output will come with architecture independence. I will touch this somewhat later in a new post.

Security concerns never die

Security concerns as they are now in the market are pretty much natural but have lack of judgemental treatment. If enterprises will not solve this psychological milestone or cloudKnot, then we will see more PRIVATE then PUBLIC in the next few years. If they solve it then TESTING in the cloud will be augmented with application delivery with Telecom Pipes coming IN and OUT of the public clouds too. Currently not possible, but this radical step might be in the way. But be cautious, the main security threat will COME at that time. I guess the concerned guys know what this prick (myself) is writing here.

Have a nice day.
Enjoy

Is Cloud Consultancy Apocalypse coming in next few months?

Shlomo Swidler and Reuven Cohen wrote very good starup-posts on how to select the contractors for cloud consultancy, back in 2009, when the cloud-roar was in its infancy. Back then the topic of interest was around Amazon EC2. In this post I will try to generalize that to multiple clouds, and will look it in terms of whats happening 2011, 2 years after they wrote the articles.
They gave guidelines of how to select a cloud consultant. I would check out in further highlighting whats happening in the arena. So lets kick off.

Currently there is a big move of all sorts of enterprises to shift to cloud. Since many of these enterprises don’t have that level of cloud knowledge as a dedicated one OR who is working on it for a long time as the posts from the guys (Shlomo and Reuven) recommend them to be, the market for the cloud consultants is far more attractive now than before. And we see many good market players and startups jumping into the cloud consultancy. They are using all sorts of tiers, and many of them even can manage all the services in almost all the cloud providers.

So what dimensions are being picked up by these cloud consultants, and how they are specially valid for the current shift in enterprise tastes. Obviously the homework done by these cloud consultants is on the basis of some kind of need by enterprises, but whats the main thing that derives enterprises to focus more on consultancy than geting involved into geting experts in cloud management and provisioning. To become an expert they would have to go through some kind of learning curve and even then they have to trust their own employees for that. Infant trust is the kind of things in which most bigger enterprises don’t beleive normally. So the coming months could be some kind of a biggy for cloud consultants. But still one more thing is lagging. And that is how important and URGENT the need is for the enterprises to shift to cloud, specifically in 2011?

To answer this question we would have to dig user behavior and not the development behavior thats going on in enterprises. I may be wrong in here but would love to think it back. That analysis will also come, hopefully if I have ink left on my keyboard for tomorrow.

Behavior, Experience, and Band Wagon:
Migration consultants typically first go through the Cloud adoption assessments. These assessments weigh heavily on the correlation between the internal datacenters and cloud environments. I guess the weigh should be equal in terms of what user behavior, experience, and band wagon demands. They should include some kind of services level assessments too. Many of them do too. But the pronounced effect that tells an enterprise that its time to rely on consultants isn’t that powerful, to me I guess. One obstacle is the concerns of the enterprise to hide the secrets of the service that they are providing in their local datacenters. So a true augmentation of the Shlomo’s post can help these enterprises alot. But consultants have to push this kind of knowledge to the enterprises. Its their responsibility.

When a company thinks of adopting the cloud, they have to think in terms of some kind of shift in current strategies for

• development
• configuration and environment
• operations and monitoring
• provisioning and metering
• data auditing
• costing

So consultant fall in the above areas. They were individually targeting each section back in 2009, but now they have gone as far as providing consultancy in all or mix of these areas. Plus since multiple clouds exist, they can provide in multiple cloud environments. Even phased migration doesn’t mean that an enterprise get rid of the contractor after the last phase of migration. Now the game will turn towards TRUELY MANAGED SURVICES, atleast for the time when enterprise develops its own skills in cloud.

Knowledge of Business cases
While working with enterprises cloud consultants will be able to know deep enough of the business cases that are thinked of in enterprises. So it would be a kind of strange mix, where a cloud consultant will know you and your customers more than your enterprise does. I may be wrong but my braincells are tweeting me in this area. So this will help accelerates the consistancy in apocalypse.

Cloud consultancy dimensioning
Cloud consultants doesn’t need to think in only one aspect. They have Iaas, Paas, and Saas in the armory. And among these 3, they have so many sub-THINGS that you can’t imagine. Virt, I/O, scalability, performance, monitoring VMs, monitoring apps, security complience and much much more. And thats hell lot of stuff for the enterprise to learn in a few courses. They need experience. So we get the cloud consultant apocalypse on over hands.

Survival of the fittest
I hate the medical one, but love the innovative, and enterpreneurial one. Cloud consultants have to best to be picked up by enterprises. And they to provide the same kind of commitement to all sorts of enterprises whether small or large, because they use the same kind of tools for any kind of deployment and monitoring. So this consistancy will help competition, which will be the roar or cloud consultancy.

Startups in non-consultancy can benefit from being consultants
Startups, which provide their services in the cloud and manage those CAN make another tier of teir company where they provide cloud consultancy to smaller companies or NEW startups. Thereby creating a new form of cloud consultancy spectrum where they will be the enterprise at some future point in time, and will have the necessary skill to be in new frontiers of the cloud services or research. I hope some guys must have got my point.

Thats it for now. I would love to see comments.

Shopaholic’s approach to buying services from the Cloud

Compulsive shopping done in stores is the coolest thing for a guy like me. And discounts are like conditioning for the buying recipe. But what will I do if I were to buy services instead of hard-stuff. If I can transition then I can imagine how others simple-people-like-me can do the same.
So it would be good for those who are projecting billions of dollars in revenue from billions of connected devices and consumer-cloud-transformation scenarios.

1- Adventure + Need:

I would first look at the app. store then go through apps then would try each what meets my eye. Thats what I normally do. Not so beneficial SO I would have to transition my buying habits since it wastes my time too by going through trillions of apps out there. I would equate my adventure to my needs. I hate trial versions-and I hope/predict all my shopaholic friends do the same. So if companies out there can turn me in without the trial-version type service then I would be happy to take a look. So trial versions really kill my adventure part. Maybe they can give me a bit of a service or prep my need a bit BUT if they ruin my adventure then I am not buying it. So think a new strategy apart from trial versions.

2- LOVE-TO-GO-SHOPPING:

The best thing about the best-of-the-best stores is that they make YOU move. So If apps make me move that would be an awesome thing but thats an OPTION not a requirments from my-kinda-shopaholic. Let me give you an example IF you can’t find an example. Groupon moved me to move. Signing up on their service gives me more than sitting on computer/belly-top. BUT its kind of really hard for app developers who work inside cloud to make people move. So I would suggest partnerships with Groupon, livingSocial, and Google Offers. Concerned guys know what I mean.

3- B2B-to-B2C:

Shopaholic’s aren’t just the guls-n-guys who don’t have roles, they can be giving services to others. So a I would love to see a service that help me service others. For that Shopaholic is willing to pay and more than willing to pay if its pay-as-you-go. You know what I mean? Definetly.

4- Sharing is caring:

Shopaholic buys the things which others can see, comprehend, applaud, OR atleast take-notice. So apps developers have to think out-of-the-box to make such a kind of service that an end-user is able to do ‘Sharing is Caring’ kind of stuff. So social media, augmented reallity, and seamlessness is very very important for me.

Shopaholic will be back—right now gotta go on a Groupon Prix.

Some Cloud System-Testing Tools

Hi all,

Its been a while since my last post. Just trying to juggle up my memcapsules to create something of use. Here is a list of Cloud testing and performance measurement tools. Application performance tools and the variation in techniques is the hidden element that I will try to get out of them. Have a nice read.

1- Phoronix Test Suite:
Its an automated open-source (GPL License:)) testing framework, which has php-cli dependencies. It give graphical output of the tests underway. It can test many suites of applications running over amazon EC2. Those who don’t want to use CLI can employ GTK2 GUI over php. The basic idea behind is AUTOMATED TESTING.
It comes with 130 test profiles and 60 test suites. Plus you can create and add your own test profile and suite by using their extensible architecture approach using just XML. It can monitor power consumption, disk-storage, system-memory, CPU utilization, disk-read/write speeds, graphics performance, and motherboard components.
Tests can be scheduled using Phoromatic.com.
You can find regression pattern in application software. Currently those folks have found regression on Linux Kernel using this test suite.
USE CASE: Deploy Phoronix TS on your local machine and then in Cloud. Run both of them and compare the results.

2- SOASTA:
Simply awesome. Used by well-renowned companies like Netflix, Intuit, Chegg, Microsoft, P&G, Cisco, AmericanGirl etc. Its commercial and on-demand. A demo is available.
It provides web-based distributed multi-object multi-threading testbench. It can create multiple objects like browsers, UI elements, AJAX put/gets, http(s) requests on multiple devices like mobile and desktop. More on that is that you can get into the live test and see what are the current bottlenecks.
Check out their Global Test Cloud offering which will give you testmarks on multiple clouds. You can simulate web-traffic on any cloud platform with any amount of load that you want to target. AND remember its TURNKEY. Isn’t that awesome. AND its pay-as-you-service. Isn’t that awesome too.

3- CloudTesting.com:
It provides automated website testing services. Plans for pricing start from 100 Pounds per month. It operates on SAAAS model.

4- PushToTest:
It runs on your test equipment, on cloud, or both. Runs on distributed TestMaker test environment. Its also on-demand. It can run on multiple cloud environments and global user traffic is one dimension of it. It also supports Collabnet Cubit. You can organize tests using simple XML configuration files. Customers include intuit and cisco.

5- SOAPSonar:
Its an offering from CrossCheck Networks providing testing for web-services and ESB. It can indulge itself in software, VMWare, and cloud image. It provides SOAP, XML, and REST testing over HTTP(s), MQ, and JMS protocols. It provides functional, performance, compliance, and security testing in cloud. One can validate SLA rates in terms of throughput, and capacity statistics from the back-end service in cloud, in performance testing mode.
Its a commercial offering, and many feature segregated editions are available along with a trial version. You can compare editions here.

6: Bonnie++ filesystem benchmarking:
In the words of Linus, the founder/maker of linux kernel, it is “reasonable disk performance benchmark”. SUN guys used it all the time. And its been around since 1996. Both 32 and 64-bit versions are available. It measures hard-drive and filesystem performance. If you wish to test different zones of a hard-drive, it would be good to use ZCAV along with bonnie++.

7: Sysbench MySQL benchmarking:
Back in 2006 SUN published Solaris vs REDHAT stuff, based on the output of this tool. Till now its been matured. It allows you to test file I/O performance, schedular performance, memory allocation, and transfer speed, POSIX thread implementation performance, and database server performance. First four are good for platform evaluation. E.g. test these four paramters on your local datacenter and then on public cloud to test both the platforms against your application. It uses LUA as scripting language, so you can write scripts into it for your own ride. Its a very good tool OR infact is for OLTP (OnLine Transaction Processing).

8: ProbeVue:
Those well-versed in knowing/comprehending that probeVue is the best, why I haven’t mentioned it in the first place. Well I don’t wanna answer that question, since I am waiting for it to be ultimate for me and available in other coding stylses also rather just in C. Apart from it, its the best of the best from IBM. It is basically a lightweight dynamic tracing utility, and many people think (ones like William Favorite from The Ergonomic Group), that its the future of system introspection.
When using ProbeVue a developer can select what he/she wants to extract from an event, and still able to make his/her own events using Vue as language. Here is the comparison from William’s Slides

I will be adding more to this post. Please add yours in the comments section.
Cheers

6 Phases of successful migration of Enterprise Apps to the Cloud

NOTE: This post is a sort of my abstract version with comments for a great document available here http://media.amazonwebservices.com/CloudMigration-main.pdf

Phase 1: Cloud Assessment Phase:

In this phase ask yourself these questions:

a- Whats the difference in Cost, Security, and Complience in your Data Center Reilm and Cloud Reilm?

b- Do you have a business case in hand? And Who in your organization knows about this and how much? Are the implementors aware of what part they have to play?

c- When you talk about Cloud, you have to take COMPUTE, STORAGE, AND TRANSPORT in mind. Have you got any plans for that? How will you handle compute, storage, and transport? A pre-assessment study should yield a start-off plan. Else application metering in compute domain, storage domain, and transport domain is necessary factor in Cloud for Enterprises expecially Telecom Enterprises.

d- Your security advisory and auditing advisory should have an assessment plan before hand for the Cloud, have you involved them OR you are just thinking of feeling the good guts?

e- Have you characterized the sensitivity of the Data that will be ported or kept?

f- Have you classified your enterprise application based on its dependencies and risk?

Dependencies: 1- Applications with Top-Secret, Secret, or public Data sets

2- Applications with low, medium, or High complience requirements

3- Aplications that are internal-only, partner-only, and customer-facing

4- Applications with low, medium, and high coupling

5- Applications with strict and relaxed licensing

Phase 2: Proof of Concept Phase:

In this phase consider the following points:

a- The goal here is to learn about the Cloud provider while you are in direct contact with it. Deploy a simple app and then see the output.

b- Approach your assumptions with real measured data of an example installment/deployment

c- Start with a small Public Dataset that depends on an application which has similar dependencies as your enterprise application

d- The purpose of the proof of concept is that you wet your hands and make a case for critical next-step evaluation based on phase 1.

Phase 3: Data Migration Phase

In this phase consider following points:

a- Involve Enterprise Architect into the equation. 

b- Evaluate Cloud storage options against your local-storage options

c- NoSQL or Relation Database?

d- Estimate the effort required to migrate data to the Cloud.

e- Get some metering software like OpenCore 6.1 that will measure latency, and response-time of read-write data on datasets.

f- If you don't have data or you only deal with real time non-persistance data, have a coke and enjoy the next phase. 

Phase 4: Application Migration Phase

a- Learn about forklift migration strategy and hybrid migration strategy. What you choose is important.

b- Is your application stateless or stateful?

c- In forklift you port entire application at once with minimal code changes and it deals with stateless apps

d- In hybrid approache you can move parts of the application one at a time. 

Phase 5: Leverage the Cloud Phase

This is the phase where your application lies in the cloud as you planned. In this phase consider the followings:

a- Now you think of auto-scaling, edge caching your static content, auto-recovery, and elasticity.

b- How about business continuity with the new knowledge at hand about cloud-aware applicatoin?

c- Network level parameter estimation should be considered also. Connectivity constraints should be put to desk.

Phase 6: Optimization Phase

In this phase consider following:

a- How will you optimize the application in terms of cost savings?

b- You pay as you go means if your application is highly optimzation, you will have to pay less too.

c- Get your highly qualified software architects and solutions manager to think about new ways to optimize using code optimization, dataset optimization etc.

d- You can get alot of help for optimization if you run metering and code-probing softwares on your application in the cloud.

e- Improve caching

Conclusion

If you do all of the above, you have successfully migrated the enterprise application to the cloud, BUT still you need to rethink factors according to your business case or organizational plan.

Ask Yourself! Basic Application-Migration Consideration Questions-Part 1

I have compiled few basic questions that are needed to be answered beforehand as the first step in migration-strategy. This part deals with IT Enterprise without the access-network implications. Part 2 will focus on Telecom Enterprise, and the perspective will be from access point of view.

So these are the basic questions that are needed to be considered by a person who is going to migrate the application without its network ramifications.

1- Which technologies we should use in the Cloud to PERSIST DATA?
2- How data will be shared between entities inside the Cloud and entities inside the local data center?
3- Application metering at Cloud should be compared with the application metering in local Data Center. Whats the difference between the two metering outputs?
4- Should we adopt the PHASED MIGRATION STRATEGY or SINGLE-THROW MIGRATION STRATEGY?
5- Should we consider NoSQL or SQL? Should we flatten the databases? Is there any need to convert a relational database to a NoSQL type database?
6- Cross-zone is definitely not an issue, BUT Is Cross-region an issue for Operators especially in Telecom perspective?
7- If you want to migrate the DB, then how would you be able to sync Oracle etc DB with the SimpleDB or S3 or any NoSQL offering?
8- Do you know MIGRATING DATA and MIGRATING APPLICATION SOFTWARE are two different things? IF YES, then how will you migrate DATA? (Compare above questions!)

If we can answer these questions, we might be able to get to a successful migration.