CloudTweaks.com - Cloud Computing Community » Case Study

CloudTweaks Media Partner For The Cloud Security Alliance Congress November 16-17

cloudtweaks — Tue, 20 Jul 2010 12:57:49 +0000

CloudTweaks is pleased to be a Media Partner with the MIS Training Institute and The Cloud Security Alliance Congress.

Read more information on the Workshop Below.

Conference Overview Cloud Security Alliance Congress
November 16-17, 2010
Optional Workshops: November 15 & 18, 2010
Expo Dates: November 16 & 17, 2010
Hilton Disney World Resort
Orlando, FL

The Cloud Security Alliance, the world’s leading organization on cloud security and MIS Training Institute are assembling top experts and industry stakeholders to discuss the state of cloud security and best practice for cloud computing. This two day event will consist of four tracks consisting of Legal and Compliance Issues, Federal, Management and Security and Securing the Cloud.

Cloud computing represents the next major generation of computing, as information technology takes on the characteristics of an on-demand utility. The ability to innovate without the constraint of significant capital investments is unleashing a wave of new opportunities that promises to remake every business sector.

While the massive changes underway are unstoppable, our collective responsibility to good governance, compliance, managing risks and serving our customers must remain. Security is consistently cited as the biggest inhibitor to more aggressive cloud adoption. With this in mind, we have created our first annual Cloud Security Alliance Congress, the industry’s only conference devoted to the topic of cloud security. Our speakers’ roster and confirmed attendees represent the key thought leaders and stakeholders shaping the future of cloud security, which is the future of the cloud itself. On November 16-17, 2010, Orlando will be the epicenter of the movement to secure the cloud. Please join us.

Among the Topics to be Presented
+ Enabling Secure and Compliant Information Services in Hybrid Clouds
+ Audit Trail Protection: Preventing a False Sense of Security
+ Practical Ways to Measure Data Privacy in the Cloud
+ Bringing Cloud Operational Benefits to Security
+ Security in a Hybrid Environment
+ Top Threats and Risks to Cloud Computing
+ Disruptive Innovation and Cloud Computing Security
+ Latest CSA Research Findings
+ Cloud Identity and Access Management
+ Objectivity and Transparency in the Decision-Making Process
+ Security in a Hybrid Environment
+ Disruptive Innovation and Cloud Computing Security
+ Latest CSA Research Findings
+ Gain insight into how to streamline enterprise provisioning and access control
+ Find out how to use the CSA Controls Matrix to assess cloud security providers
+ Understand federal specific compliance requirements related to cloud computing
+ Learn from case studies detailing attacks against cloud computing infrastructures
+ Discover a framework for identifying customer governance and internal control requirements

Keynotes:

Creating a Safer, More Trusted Internet
Scott Charney, Corporate Vice President, Trustworthy Computing, Microsoft

Building a Secure Future in the Cloud
John W. Thompson, Chairman of the Board, Symantec Corporation

The Cloud Computing Forecast From a Former Regulator
Pamela Jones Harbour, former Commissioner, Federal Trade Commission 2003-2010; Partner, Fulbright & Jaworski, L.L.P.

The CSA Perspective: A Review of Cloud Security in 2010 and Our Roadmap for 2011
Dave Cullinane, CPP, CISSP, Chief Information Security Officer & Vice President, eBay MP Global Information Security; Chairman of the Board, Cloud Security Alliance

The Cloud Security Alliance was formed to promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing. Now in our second year, the Cloud Security Alliance has over 10,000 members around the globe, and is leading many key research projects to secure the cloud.

Board of Directors
Jerry Archer, Sallie Mae
Alan Boehme, ING
Dave Cullinane, eBay
Paul Kurtz, Good Harbor
Nils Puhlmann, Zynga
Jim Reavis, CSA

Thank you to the 2010 Program Planning Committee for all your hard work to put together this important event.
Glenn Brunette, Senior Director, Enterprise Security, Oracle Corporation
Ron Hale, CISM, Chief Relations Officer, ISACA
Chris Hoff, Director, Cloud and Virtualization Solutions, Data Center Solutions, Cisco Systems, Inc.
John Howie, Senior Director, Microsoft Corporation
Dan Hubbard, Chief Technology Officer, WebSense, Inc.
Scott Matsumoto, Principal Consultant, Cigital, Inc.
Rich Mogull, Analyst/CEO, Securosis, LLC
Michael Sutton, Vice President, Security Research, Zscaler
Becky Swain, CIPP/IT, CISSP, CISA, Program Manager, IT Risk Management, Cisco Systems, Inc.
Lynn Terwoerds, Vice President, Business Development, SafeMashups
Todd Thiemann, Senior Director, Data Center Security, Trend Micro

Interested in exhibiting or sponsoring?
Contact: Paul Moschella, Sponsorship & Exhibit Sales, 508-532-3652 or pmoschella@misti.com

How to Negotiate a Better Cloud Computing Contract

cloudtweaks — Thu, 22 Apr 2010 12:34:09 +0000

The typical cloud computing contract can look downright simple to an experienced IT outsourcing customer accustomed to inking pacts hundreds of pages long that outline service levels and penalties, pricing and benchmarks, processes and procedures, security and business continuity requirements, and clauses delineating the rights and responsibilities of the IT services supplier and customer.

And that simplicity, say IT outsourcing experts, is the problem with cloud computing.

“Failure to understand the true meaning of the cloud and to address the serious legal and contractual issues associated with cloud computing can be catastrophic,” says Daniel Masur, a partner in the Washington, D.C. office of law firm Mayer Brown. “The data security issues are particularly challenging, and failure to address them in the contract can expose a customer to serious violations of applicable privacy laws.”

If a cloud services contract (whether it’s for software-, infrastructure- or platform-as a service) seems less complex, that’s because it’s designed to offer products and services “as is”–without any vendor representations or warranties, responsibility for adequate security or data protection, or liability for damages, says Masur. (See Cloud-Computing Services: “Fine Print” Disappointment Forecasted.)

Cloud service providers will tell you the simplicity is precisely the point. They can offer customers low-cost, instantly available, pay-per-use options for everything from infrastructure on-demand to desktop support to business applications only by pooling resources and putting the onus for issues like data location or disaster recovery on the client. Adding more robust contractual protections erodes their value proposition.

“It is reasonable for vendors, particularly those who provide both traditional and cloud-type services, to point out that the further they are getting away from standard contracts–and, by implication, standard services–the more difficult it is for them to close the business case,” says Doug Plotkin, head of U.S. sourcing for PA Consulting Group. “Much of the economic benefit that the cloud can deliver is predicated on the services–and the agreements–being standard.”

Thus, the average cloud contract on the street is a one-sided document with little room for customer-specific protection or customization, says Masur. The question for new cloud computing customers is, Should you sign on that dotted line?

And the frustrating answer is, Sometimes.

“More robust contractual protection may or may not be the correct answer,” says Masur. “It depends.”

When to Negotiate a Better Cloud Services Contract

Prospective cloud customers should take into account the criticality of the software, data or services in question, the unique issues associated with cloud computing, and the availability and price of various alternatives, says Masur.

For non-core business tools or services involving routine, non-sensitive data, it often makes sense for customers to accept looser contract terms for that lower price.

But when you’re considering a cloud-related option involving mission critical systems, regulated personal data or sensitive business intelligence, it’s time to call legal and get the red pens ready. “A customer may opt to require a private cloud, data encryption, geographic restrictions, and other such terms,” says Masur.

The biggest mistake new cloud services customers can make is either assuming the vendor’s contract provides adequate customer protection or presuming there’s no room to negotiate at all. “Many prospective customers assume incorrectly that cloud contracting is very similar to traditional IT contracting and either fail to address the issues unique to cloud computing, such as data privacy and compliance issues, or do so in a manner that increases their price without delivering commensurate value,” says Masur.

While many cloud providers have been reluctant to deviate from their standard contracts whether due to their own restrictive business models or industry inexperience, that’s beginning to change in this quickly evolving market.

For would-be cloud consumers looking to beef up the standard vendor agreement, the traditional IT outsourcing contract can be a good model. While there are no standard best practices in cloud contracting and no one-size-fits-all document capable of covering the spectrum of services available in the cloud, it can help to peruse a list of standard outsourcing provisions: privacy and security standards, regulatory and compliance issues, service level requirements and penalties, change management processes, business continuity, mandatory flow-down of all terms to subcontractors, termination rights.

Determine which are critical to address in your cloud services deal. After all, cloud computing is just another way to purchase software or infrastructure services, says Masur. Traditional outsourcing contract terms offer useful guidelines for cloud computing engagements, particularly infrastructure-as-a-service transactions involving sensitive data. And software licensing terms offer useful precedent for SaaS deals.

When Los Angeles and its IT outsourcing provider CSC signed a three-year Google Apps contract, the city was able to incorporate a surprising number of customer-friendly terms into the deal: a private cloud for sensitive data, mandatory data encryption, U.S.-only data storage and access, service levels with meaningful penalties, e-discovery functionality, a four-hour service restoration requirement, clearly defined exit rights, mandatory subcontractor flow-down, and broad indemnification obligation with unlimited liability for certain breaches.

The average cloud services customer may not be so lucky. You may find no cloud computing vendors willing to agree to your must-have terms–an indication you’re not ready to send that particular IT service into the cloud.

But watch out for the converse, as well–an overeager provider that agrees to everything.

“A provider can agree to anything, and if the service level penalty for failing to deliver is insignificant, it can be cheaper to fail than in fact to deliver,” says Plotkin. “This is a danger for all service providers. But it is probably a bit more of an issue because many of the cloud providers are less mature and have not gone through the crucible of having to keep promises as the larger, traditional providers have over many years.”
Read more: http://www.sfgate.com/cgi-bin/article.cgi?f=/g/a/2010/04/21/urnidgns852573C4006938800025770C0069DA68.DTL#ixzz0lpd4qeFs

Cloudnomics: The Economics of Cloud Computing

cloudtweaks — Mon, 22 Mar 2010 20:24:56 +0000

This week saw the latest edition of CloudConnect, a cloud computing conference, held in Santa Clara. It was a well-attended, highly energized get together. CloudConnect (think I’ll refer to it as “CC” for the rest of this post to reduce typing) contained a number of tracks, including Development, Standards (more on this one in a bit), Big Data, Migration, Case Studies, and Cloud Economics/ROI (I spoke in this track in the “Cloudonomics” session, where, perhaps somewhat confusingly, I presented the TCO of a case study).

I would say the feel of the conference reminded me of Internet conferences around 1995 — when it was clear that something big was going on, which the following year just exploded. Internet conferences went from well-attended small venue events to stuffed-to-the-gills big venue events in the course of just 12 months. I predict the same sort of thing for cloud computing. So get your reservations for cloud computing conferences early for 2011!

In addition to the general feel of the conference, several things stood out for me that I want to share:

Cloudonomics. This is a neologism coined by Joe Weinman (@joeweinman) meaning the economics of cloud computing. Joe and I shared a session on this topic, with Joe presenting an analytical framework to understand the economics of cloud computing, and me presenting a TCO case study of a project my firm did for the Silicon Valley Education Foundation. The room was absolutely packed. It’s clear that people want to learn more about the potential financial benefits of cloud computing. There’s been an amazing amount of FUD strewn about on the topic of cloud TCO, which I’ve written about in the past. The biggest challenge in making a TCO comparison of cloud vs. internal isn’t in understanding the cloud costs — they’re pretty transparent, typically — it’s in establishing the baseline costs. I will say, though, that I had a conversation with a man at the conference who said they couldn’t establish a TCO for AWS due to the difficulty of figuring out how much data their application was going to transmit (perhaps a Monte Carlo simulation would be a good way to address that question).

The fact that people are so interested in cloud TCO indicates that the general value proposition of cloud computing has been accepted and absorbed — in other words, one doesn’t care about putative financial benefits of an unworkable technology, but once the technology is conceptually accepted, potential financial outcomes become a key issue. There were perhaps 150 people in the room, all of whom stayed awake even though the session was directly after lunch, which is a key indicator of audience engagement! Full Source

Amazon Cloud Computing Case Studies – SaaS Companies

cloudtweaks — Wed, 27 Jan 2010 14:31:23 +0000

What types of SaaS related companies are getting involved in the cloud? Here are a list of some of them taken directly from the – AWS website.

Application Hosting

99designs
99designs’ massive design marketplace has received over 3.1 Million unique design submissions from over 53,000 designers around the world and runs entirely on AWS.

Abaca
Abaca, a spam blocking application, chooses Amazon EC2 as a low-cost computing alternative after they surpass their estimated growth rate.

AdaptiveBlue
Glue uses Amazon SimpleDB, Amazon S3 and EC2 to power their browser add-on which lets users share feedback with their friends on things found on Amazon.com, MTV, Wikipedia, and other websites.

Appirio
Appirio worked closely with The American Society of Composers, Authors and Publishers (ASCAP) to migrate their infrastructure to AWS.

Autodesk Seek
Autodesk, Inc. selects Amazon Web Services as the infrastructure upon which to build its new software-as-a-service solution, Autodesk Seek.

Cirrhus9
Ekabhi Enterprises recently came to Cirrhus9 to help them successfully implement a virtual data center that would be used on a global scale by the Chandaria Foundation, global charitable organization.

ddsWebLink
ddsWebLink turned to AWS to run their HIPAA-compliant application for sending, managing, and storing patients’ electronic Protected Health Information (ePHI) in the dental care industry.

DigitalChalk
DigitalChalk powers its easy-to-use application for creating, delivering, and managing online training videos using Amazon S3, Amazon EC2, and Amazon SQS.

directthought
directthought worked with Xerox to build a scalable document processing solution that leveraged the cost effective storage of Amazon S3 and the scalable compute resources of Amazon EC2.

DreamFactory
DreamFactory selects Amazon Web Services as a cost-effective platform which meets technical and business requirements for delivering products in the cloud.

Envoy Media Group NEW!
Envoy Media Group is an integrated direct marketing firm that offers solutions and highly-targeted media campaigns running on AWS. Michael Taggart, Chief Technical Officer claims, “I will never build another web app on a traditional datacenter setup again.”

Eton Digital
StudentBox online student community chooses Eton Digital to support large scale photo and video sharing via AWS.

ftopia NEW!
To deliver their online file-sharing application, ftopia decided to use Amazon Web Services and leverage its data centers in the EU and US. Lisez en français.

HostedFTP
HostedFTP.com, a File Transfer Protocol (FTP) replacement solution for businesses, hosts their file sharing system on Amazon S3 and EC2.

InstallFree
GDS integrated InstallFree and Amazon EC2 & Amazon S3 to deliver a virtualized version of GE Centricity along with their custom PAX system to their network of hospitals, doctors, and medical providers to comply with Electronic Medical Records Act.

Kehalim
Kehalim, a contextual affiliate platform, turned to Amazon SimpleDB and Amazon Relational Database Service to scale their data storage.

Kooaba Till Quack, CTO of Kooaba AG, shared some insight into their application for the iPhone and Android running on AWS.

LiveLeader
LiveLeader estimates that they’ve saved nearly $200,000 by deploying their live chat tool for business on Amazon Web Services.

Livemocha
Livemocha, an online language learning site with free courses in over 25 languages and 3 million users worldwide, chose Amazon SimpleDB to help them store, process and query large datasets. Their online service also makes use of Amazon EC2, S3, SQS, and CloudFront.

Meginfo
Meginfo was chosen as the vendor to build PSA’s (Peugeot and Citroën) new Chinese website and tailor the content to meet the needs of the Chinese market.

Model Metrics
Model Metrics developed the Cloud Converter to support its client Salesforce.com. Cloud Converter is an open source application that automates the migration of applications from on premise platforms to Force.com.

Monografias NEW!
This large Latin American community-built content site is entirely run on AWS with tens of thousands of original essays and publications and over 2 Million unique visitors per day.

Morph
Built from the ground up using Amazon Web Services, Morph Labs markets a “full service” deployment, delivery and management system for web applications.

Napera
Napera built their network security management layer on top of Amazon EC2, allowing them to go to market in under nine months.

nuTsie
In this interview, Bob Wise, VP Engineering of Melodeo tells us about nuTsie, an iPhone application they built on AWS.

ParkVu
Jeff Fedor and Terry Goertz, Co-Founders of ParkVu describe their media player for BlackBerry phones and how they run their application on AWS.

Peritor
Peritor supports MeinProf, one of the largest online academic community sites in Germany, with AWS implementation supporting large traffic spikes.

photoWALL
The photoWALL team launched their application using all AWS services: Amazon EC2 (with Auto Scaling, Elastic Load Balancing, CloudWatch, and Elastic Block Store), Amazon S3, Amazon CloudFront, Amazon SimpleDB, Amazon SQS, and the newly released Amazon RDS.

PicTranslator
PicTranslator, recently featured as New and Noteworthy on the App Store, uses AWS to scale their highly CPU-intensive workflows.

PostRank
As a young, bootstrapped company, the founders of PostRank architected their new service to take advantage of the AWS cloud computing platform. “Without EC2, the project would have been impossible.”

Ripplex NEW!
Ripplex Inc., based in Tokyo, Japan, has built a unique web service named Webpo, a greeting card printing web service built on AWS.

Roambi
Quinton Alsbury, Co-Founder of Mellmo, explains their new iPhone application, Roambi, and how they launched it on AWS.

rPath
rPath saves $80,000 by migrating 7,000 software appliance images from rBuilder Online to Amazon S3.

Skifta NEW!
Skifta, a wholly owned subsidiary of Qualcomm, has chosen AWS as their hosting provider. Skifta, a free service that allows consumers to shift media from the network it is stored on and access it in other locations, may not have been possible without AWS.

Smartsheet
To accommodate their growing business, Smartsheet, a web-based solution for managing tasks, projects and processes, turns to Amazon S3 and CloudFront for document storage and delivery. They have also created an easy point-and-click interface to access Amazon’s Mechanical Turk on-demand workforce.

SOASTA
SOASTA’s CloudTest solution on AWS enabled Intuit to do massive spike testing scenarios as Intuit prepared its TurboTax program to support over 18 million online tax preparers during the peak of tax season.

Sorenson Media
The Sorenson 360 Video Delivery Network service is architected entirely on top of Amazon Web Services—including Amazon EC2, Amazon S3 and Amazon CloudFront. “Our engineering team looked extensively at infrastructure and CDN solutions from a scalability, cost and API standpoint — and Amazon was the clear choice for us.”

StarPound
StarPound Technologies, an enterprise software company, deployed their business process management and telephony platforms on the Amazon Elastic Compute Cloud.

Techout.com
Amazon EC2 allows Techout to horizontally scale virtual monitoring instances with speed and at low cost whenever and wherever they’re needed around the world.

Unfuddle
Unfuddle is now using Amazon EC2 and S3 for virtually 100% of its infrastructure, including web and database servers. Unfuddle makes extensive use of EBS volumes and snapshots which has completely transformed their backup process.

Urbanspoon
Adam Doppelt, co-founder of Urbanspoon, explains how they use Amazon S3, EC2 and CloudFront to power their popular iPhone application.

Xignite
Xignite employs Amazon EC2 and S3 to deliver financial market data to enterprise applications, portals, and websites for clients such as Forbes, Citi, ING, kaChing, and Starbucks.

Wowza
Wowza teamed up with Amazon Web Services (AWS) to offer Wowza Media Server Pro on Amazon EC2 as self-managed Software-as-a-Service (SaaS).