« April 2011 | Main | October 2011 »

July 28, 2011

Why mobile and cloud security eventually converge

The two hottest areas in enterprise security are undeniably mobile and cloud. As small and large security companies go after the fast growing markets, few seems to understand that both markets will rapidly converge to be serviced through a single solution. Yet, it should not come as a surprise since both enterprise cloud and mobility are about enabling employees to access corporate resources and information from anywhere, any time.

Mega-Pains.JPGBeyond the simple fact that mobile is about the cloud and the cloud needs to be mobile, there are profound technology-driven drivers for mobile and cloud security solutions to become one. Unlike the PC platform that preceded them, IOS and Android heavily sandbox application and data, making them very poor platforms for security software developers to replicate yesterday's agent-based security approach. Turn yourself now to the cloud and it is the same dilemma. Since an enterprise does no longer run the applications and infrastructures that host corporate data and services, it is no longer possible for security vendors to leverage traditional infrastructure hooks to provide consistent security. In particular, the network-based security controls are outside of reach since cloud vendors will not expose them.


Where does it leave us? The answer is as simple as it is obvious. Both mobile and cloud require the emergence of a new security control point that stand below mobile devices and above cloud providers. Think of it as a new layer of security. That layer of security will control and police service and data access across mobile devices, cloud data and services. It is an identity security service. It will have to control and protect the flow of information between mobile devices and cloud storage. It is an information security service. It needs to enable audits of event across mobile and cloud access . It is a log and event management solution.


Indeed, mobile and cloud security are the two faces of one and the same security, and compliance solution. The perimeter is dead, but the age of "security in the middle" only begins


July 11, 2011

From Windows to the Cloud: "Nothing is created, nothing is destroyed, everything transforms."


Every so often in technology, new trends emerge to drive large changes to society by transforming our established computing paradigms. Cloud as a computing pattern is certainly not dissimilar. The cloud carries in itself all the genes of disruption that the PC, client-server and Web revolutions embodied before it. For many, cloud computing is the logical evolution of information technology towards the utility model. From an economic standpoint, it signals the great commoditization of IT.


old.JPG

When large technology shifts occur, opportunities arise for new and innovative companies to displace the large and sleepy incumbents within their core markets. To understand the cloud tectonic shift, and the potential losers and winners, I devised a simple visual representation that captures the competitive landscape of cloud computing. If one thinks of the traditional computing world as the "primordial Pangea", the old world appears as a highly coupled stack with devices on top, infrastructure at the bottom and applications and development platforms snugged in-between the two dominant businesses. Although simplistic, this representations has the merit to capture the market significance of companies such as Microsoft/Intel, Oracle, SAP, HP, IBM, Cisco and EMC (the device and infrastructure incumbents).


Cloudscape.jpg

When the shift to the cloud happens, the old continents spread apart, and the original Pangea morphs into a "cloudscape". New major classes of devices platforms appear (mobile platforms in particular). The old core platforms have transformed and taken new names (SAAS, PAAS and IAAS). The four strongholds drift apart creating "seas" of opportunities for new intermediaries (the cloud brokers). who can integrate, secure and harmonize these new heterogeneous environments. Many of these new markets are still up for grab, but a few enlightened companies have already moved in a an attempt to capitalize on explosive growth as old budget money shifts towards the new models.


The four strongholds

The cloudscape shows the four old strongholds as four new distinct and decoupled markets. Furthermore, a new generation of cloud-enabled device platforms have emerged (IOS, Android...). SAAS are rapidly replacing traditional applications in the eyes of corporate users and consumers. For developers, PAAS are becoming the environment of choice for custom web service development and deployment. At the bottom, infrastructure is becoming a commoditized utility service. The four strongholds are still differentiated markets. No real consolidation has occurred yet, as the new players are too busy battling for supremacy within their own market. Each of the four platforms appear to present a significant business model with large ecosystems acting as powerful "moats" or barrier to entry.


IAAS and the commoditization of I.T. infrastructures

The most powerful stronghold may prove the IAAS since the business model is based on very large economy of scale with razor thin margins and high volumes that cannot be realized by new entrants who may lack the CAPEX muscle or the home-grown commodity technology to enter. The IAAS vendors are rapidly commoditizing the compute and storage stack. They are now walking up the stack to subsume middleware such as RDBMS (database.com, BigTable and the No SQL movement). The next target is the network infrastructure. Large virtual private clouds soon emerge that allow enterprises to create complex segmented networks without having to buy expensive networking gear. Corporate networks are built using virtual switches. They are secured by commoditized software appliance (virtual firewall, virtual IDS and virtual IPS) sold on a usage basis. As the IAAS market consolidates around Amazon, Google, a few large global Telcos, the old IT power houses (Cisco, HP, IBM) may still be able to carve out some land for themselves. Unfortunately, some of them have lost their strategic compass lured by the temporary gold rush of the so-called private cloud market, a desperate attempt to re-invent yesterday's "build-it-yourself" model of information technology.


The battle for Development as a Service (DAAS)

The cloudscape identifies and positions the main platforms tenants and their strongholds. For example, Amazon has a strong position in infrastructure as a service (IAAS), while Salesforce is a dominant SAAS vendor. Like OS vendors before them, both are vying to leverage their strength position to become the application development platform of choice. Amazon is betting on infrastructure for their unfair advantage. Salesforce is betting on corporate business data such as customer info and collaboration artifacts. Google's bet is on becoming "Office" for the cloud, thus owning corporate unstructured data. For new businesses like Zynga, infrastructure is king. For enterprises who need to build mission-critical business applications, data is queen. Google+ is more innovative than Chatter but Google needs to become enterprise-friendly (new DNA and a large M&A likely required).


The cloud brokers and the rise of the middle-man

Nevertheless, in between these giants, there is still ample room for trusted cloud brokers who can integrate business data across multiple cloud sources and provide business intelligence across all SAAS services. In fact, the map identifies very large intermediary opportunities. Cloud brokers can become significant disintermediation businesses. The distant and heterogeneous nature of the four large cloud markets creates a real opportunity for cloud middle-men to reduce the complexity of integrating, securing and brokering the capabilities of the new cloud platforms through a unified management interface. The "device management as a service" layer (e.g. VDI in the cloud) or user and SAAS management (e.g. SAAS marketplaces and SAAS data integration as a service) are examples of these new intermediaries seeking to capitalize on the plurality of devices and SAAS platforms.


Security as a fundamental ingredient (says the wishfully-thinking security guy)

Interestingly, Security emerges as a fundamental enabler. If one considers availability as a form of security, security is in actually relevant to all forms of cloud brokering. This leads us to believe that security companies could benefit from the new world balance if they can establish partnerships with the strongholds who are about to significantly impact the distribution of security services. Moreover, security assets provide a natural beachhead for security companies to extend into cloud brokering opportunities. Conversely, security M&As could become increasingly important to cloud platform vendors or cloud platforms wannabes in search of differentiation and higher margins.


Eventually, what the cloudscape demonstrates is that in the long run, information technology is not immune to the fundamental laws of physics. Cloud computing is undeniably disruptive technology. But, in the end, the four core business strongholds still exist, granted, under new names, forms and shapes. Under the tectonic shift of cloud computing, the whole industry landscape of information technology is about to radically transform under our eyes, reminding us once again of what an old French chemist taught us a few centuries ago: "Nothing is created, nothing is destroyed, everything transforms." -Lavoisier


ABOUT SSL CERTIFICATES

Search

Disclaimer: Opinions expressed here and in any corresponding comments are the personal opinions of the original authors, not of VeriSign.

VeriSign Legal Notices

Read our Privacy Policy