Whenever I explore or explain a technology construct, my natural inclination is to pick up a pen and draw.  The resultant diagram typically contains domain, interaction and mind mapping elements.  Despite the non-standard output, these diagrams help me delve into broad and/or complicated topics, and communicate with practitioners.

My exploration of cloud computing is no exception.  As I was researching cloud computing, I created the following “cloud-o-gram” diagram.  Rather than (yet another) definitional or architectural diagram, the cloud-o-gram is my interpretation of the cloud computing space.

[Click on diagram to enlarge]

As you will quickly notice, my interpretation varies from the typical “as-a-service” stack model.   This comes from looking at the space with the lens of an enterprise architect.  Enterprise architects start with abstractions rather than products.   Abstractions allow for a broader viewpoint and are more accommodative of change.  Given the emerging nature of cloud computing, change is inevitable.

Over time, Elemental Cloud Computing will explore each area of the cloud-o-gram in depth, including representative software, hardware, service and practice offerings. 

For this introductory post, I want to provide a quick walkthrough of the cloud-o-gram.  Before that though, I should probably comment on the name, “cloud-o-gram”.  Simply, I needed a name that would in no way connote definition, architecture or design. Cloud-o-gram fit.

Cloud-o-gram Overview

Recently, consumers co-opted the term “cloud” to refer to any application or information service that runs elsewhere.   This is a point of confusion since the consumer view is independent of the service provider’s use of cloud computing technologies, techniques and practices.

For clarity, the cloud-o-gram refers to the term cloud in quotes, in recognition of the colloquialism, and introduces a more precise, successor term, “cloud computing environment” (CCE).  The diagram illustrates this via the dotted line from the yellow “Cloud” box to the blue “Cloud Computing Environment” ellipse.

The cloud-o-gram has four inter-related areas: cloud computing offerings, cloud computing environment, cloud computing environment offerings and customer-provider agreements.  

Cloud Computing Offerings

Cloud computing environments and the services offered in those environments are the most prominent cloud computing offerings.  However, as the cloud-o-gram indicates, the cloud computing space is much broader. 

Referring to the diagram, the cloud-o-gram includes five categories of cloud computing offerings, illustrated as yellow and green rectangles emanating from the yellow Cloud Computing Offerings ellipse. 

Each category is named for its relationship to the cloud computing environment (“cloud”).  These include offerings “for the cloud”, “about the cloud”, “on the cloud”, “of the cloud”, as well as the cloud computing environment itself.

The “of the cloud” and “on the cloud” offerings are colored green to show these are both cloud computing offerings and cloud computing environment offerings.

A brief description of each cloud computing offering category follows.  Referring to the diagram, the offerings are listed clockwise, starting at the top.

Cloud Computing Environment:  A cloud computing environment (CCE) is the end result of applying technology, architecture and engineering practices, along with operating, security, policy and economic models, in a manner that optimizes for resource sharing, elasticity (scale), automation, self-service and pay-as-you-go.

Rather than chasing cloud computing environment descriptors – public, private, virtual private – the cloud-o-gram calls out the underlying aspects, such as physical location, owner and target markets.  This allows for a wide range of cloud computing environments, such as a government agency CCE designed to provide services to other agencies, a CCE that specializes by industry, or even a CCE that specializes by workload.

For the “Cloud” (CCE):  Offerings for the CCE include all of the hardware, software, standards, practices and services to build, use, manage and secure a cloud computing environment.  Many of the wares in this category are not unique to cloud computing, however each contributes to the existence and success of a CCE.

About the “Cloud” (CCE):  Offerings about the CCE include all the software, services, practices and standards concerned with delegating management control of business information and workloads to external parties.  Facets include assurance, compliance, billing and metering, and brokering. 

Cloud Computing & Cloud Computing Environment Offerings

On the “Cloud” (CCE):  Offerings on the CCE are applications, software, information, services or processes services deployed onto, and therefore accessed from, a cloud computing environment.  Typically, these offerings provide agency, business or consumer capability, rather than technical capability.   

Of the “Cloud” (CCE):  Offerings of the CCE are technical capabilities exposed via service interfaces, which are consumed during the development and/or delivery of agency, business or consumer capabilities.  These technical capabilities provide infrastructure (IaaS) or platform (PaaS) services.  Examples include compute, storage, data management, integration, orchestration, and application development.

Customer-Provider Agreements

A critical component to the success of cloud computing is the customer-provider agreement.  The agreement must provide legal protection for both parties, clearly spell out the financials and terms of service, and protect the information assets and IP of the customer.

While some equate cloud computing agreements and governance to corresponding SOA practices, that is an understatement.  Cloud computing adds the dimension of one, or several, outside parties and therefore the contract and governance practices must incorporate outsourcing concerns and be legally enforcable.

Next Steps

As mentioned in the opening, this post is an introduction to the cloud-o-gram, in its first public release.  As the cloud computing space evolves, so will the cloud-o-gram.

Over time, Elemental Cloud Computing will explore each area of the cloud-o-gram in depth, including representative software, hardware, service and practice offerings. 

If you have questions, comments or suggestions regarding the cloud-o-gram, please leave a comment, ping this post, find me on twitter, or drop an email.

Copyright Notice: Elemental Cloud-o-gram is a copyrighted work of Elemental Links, Inc.

Elemental Cloud Computing is a new research offering dedicated to exploring the opportunities, issues, technologies, offerings and implications of cloud computing from a practitioner perspective.

Key to the practitioner perspective is context.  Context influences the Elemental Cloud Computing (ELCC) research philosophy in two ways.  First, cloud computing is being viewed in the broader context of business, technology, people, and value attainment.

Second, cloud computing is being considered as part of a broader enterprise technology strategy.  This includes understanding the connections and/or potential conflicts between cloud computing and services architecture, information strategies, portfolio management, business architecture, business-driven IT profiles and IT capability delivery.

Although Elemental Cloud Computing is a new research offering, I have been following and writing about the cloud computing space over the course of 2009.  As many know, it started unintentionally, after attending the Open Group’s Cloud Computing Summit in early February.

Shortly afterwards, I published my Unintentional Cloud Watching >> Cloud Watching for Enterprise Architects post on elemental links, and began an intentional study of cloud computing through the lens of an enterprise architect.  

Elemental Cloud Computing is a means to extend, organize and share my intentional cloud watching. Departing from traditional research services, Elemental Cloud Computing contains a mix of original works, formal research, commentary and curated industry content.

Check it out.  Let me know what cloud computing topics are on the top of your list.

At the risk of over generalizing, in these “emergencies”, the deciding factors are time, short-term cost, security risk and short-term technical risk (availability, reliability).  So, if bypassing the architecture gains time, but creates a security or short-term technical risk, then no bypass is granted.  But, if these risks aren’t a factor, well, “get it done”. 

The problem, of course, is that most bypasses are never revisited, and accumulate as expensive, high risk, Technical Debt.  Even worse, most organizations don’t recognize the existence of, nor manage, that technical debt. 

So, how do you raise awareness about mounting technical debt, without being labeled “technology purist”?  Use the inherent “debt metaphor” to build your case in business terms.  Start with a point from Martin Fowler’s recent Technical Debt Quadrant Bliki entry:  “The decision of paying the interest versus paying down the principal…”

The interest is the recurring cost of maintaining a subpar solution that is outside the architecture.  The principal is the subpar solution itself.  Principal is paid down by investing resources to remediate the subpar solution.

Organizations with existing technical debt, need to add technical debt management practices to periodically review the costs and risks of continuing interest payments, versus the costs, risks and opportunities of paying down the principal. 

And for those organizations staring down a “new finding” at a “crucial moment” for a “critical project”, add technical debt to your decision making.  Can you afford to incur additional technical debt?  If so, for how long?

“Pay the interest, pay down the principal, manage your credit line.”  That sounds like a good conversation starter to me...

Panelists:

• Jack Baxter, Manager, IT&S, Government Printing Office
• Richard Fichera, Director, Blade Systems Strategy, HP
• Bernard Golden, CEO, HyperStratus
• Dale Wicklizer, US Public Sector CTO, NetApp

Larry Hale has some starter questions for the panel:

1. Biggest challenges in adopting virtualization?

Jack Baxter: Greatest challenges: application qualification, funding, hardware and how it’s going to be used.  Heterogeneous environment calls for a lot of up-front research.

Dale: Moving to cloud computing requires a mental shift.  Iron huggers need to switch from managing stuff to managing service-level agreements.

Richard Fichera: Distinction between virtualization and cloud.  Virtualization is well adopted.  Cloud is very early.  Adding to Dale and Jack, there are internal process barriers.  Applying current processes to virtual machine environment will lose advantage of shared service environment. 

Bernard Golden: Breaking down of traditional IT silos, forces people to work together who never have, need to optimize / change vertical processes for horizontal view.

2. Is there one government agency that best illustrates benefits of virtualization?

Dale: Federal government is Navy / Marines.  In rest of public sector, great work going on in universities.  Grant providers don’t want money going to IT, want it applied to research.  Universities are starting consortiums of shared IT resources, using virtualization.

Richard: School district work as well.  Virtual desktops that follow students around school.  Others that provide shared resources across schools in a district.

Bernard: Refers to prior session, says Casey Coleman was modest in her description of Apps.gov, and he points to Apps.gov as the best example.

3. Role of virtualization in government in next 5 years?

Jack: Downside of virtualization is ease of creating a server, results in server sprawl.  Still need a datacenter plan and management.  Calls out VMWare as an important management tool.

Bernard: Virtualization will be the defacto way servers work.  Will be packaged with every server and default configuration.

Dale: Most organizations will have hybrid cloud environment.  Legacy will remain as is.  Core, mission critical applications will run on internal (private) cloud.  Other mission applications will run on public clouds.

Richard: Not focused on government.  Financial services industry is further ahead, virtualization is mainstream in commercial space.  Emphasizes he is saying virtualization, not cloud.  There is still a layer of physical machine management.  In future, integrated management of these two control planes. 

Need to think about overall reliability, not reliability of single elements.  This can be achieved with a collection of cheaper infrastructure, don’t need to rely on expense high availability infrastructure.  But, need to plan and manage for overall (application layer) reliability, not physical elements.

Dale: Points out that cheaper infrastructure models, such as Google and Amazon, require more physical infrastructure and creates server (and therefore datacenter) sprawl.  This is fine for users of Google and Amazon, but not necessarily for private datacenters and private clouds. (Please note, Dale is with NetApp).

Richard: Coming to Dale’s defense, reminds everyone that infrastructure from vendors like NetApp is not nearly as expensive now, as it has been.  This price efficiency will only increase.  At the same time, systems integrators will become more sophisticated in delivering low cost infrastructure solutions.  [Of course, you need to pay the SIs].  [Please note, Richard is with HP]

Bernard: Going forward, applications will be written with different assumptions, one of which is that hardware costs won’t be constraining. 

4. Primary security considerations with virtualization?

Dale – starts with cloud, not virtualization.  Calls out Terremark and FISMA certification.  States that many virtual private cloud environments have better security than organizations currently have in place, on premise.

Bernard – In addition to FISMA, organizations need to be concerned with privacy regulations.  Privacy regulations are not up-to-date with technology advances.

Richard – The “spectacular security breaches” in cloud computing will have same root causes as today, passwords on post-its, using dog’s name for server password, etc.

The panel continued with a good discussion on virtualization, product or journey.  The answer, as you know, is journey.  The steps expressed, standardization, consolidation etc. are well known, so I didn’t capture again here.

An important note, is that this panel focused heavily on virtualization as being a step to the clouds, leading cloud thinkers, say otherwise.  I’ll post in-depth on this another time.  Think bundles, patterns and frameworks.

Panelists:

• Doug Bourgeois, Director, National Business Center, Dept. of the Interior
• Casey Coleman, CIO, GSA
• William (Bill) Turnbull, Associate CIO for Advanced Technology and Systems Integration, Department of Energy

Robert Ames of IBM opens, sets context for panel and quips on the 4th Cloud Delivery model, “Hype as a Service”, via David Vap.

Casey Coleman, opens saying hard to give progress report at this early stage, but there is a lot of momentum for cloud computing in the government.  A big part of that momentum is the recently launched Apps.gov site. 

Goals of CIO Council and Apps.gov work: establish governance, procurement Leadership, technology innovation, Implementation and adoption, enable sustainable and cost-effective computing, operate as a service provider, and conduct outreach activities.

Doug Bourgeois of the National Business Center is up next.  National Business Center is a service provider to other government agencies.  Doug begins with starting point operational challenges: security, infrastructure sprawl (datacenter growth containment), limited flexibility/adaptability to change.

How to overcome this: 1. security program, 2. service-oriented architecture to add standardization, interoperability and business process management into organization, 3. virtualization 4. dual data center (risk management, failover).  These provided preparedness.

Made business decision to employ cloud technology, refer to their cloud site for more information, including roadmap (pdf).

Now, William Turnbell of the Department of Energy.  DOE’s efforts include (1) data center virtualization, (2) private clouds (Argonne National Lab, Lawrence Berkeley National Lab, National Renewable Energy Lab (green focus)), (3) business applications and (4) research areas: security, HPC, authentication in the cloud.

William states that not all applications are suitable to general purpose clouds.  Experimenting with different private cloud approaches to suit different business needs, including high performance computing.

Q: Biggest Challenges?

Doug: Challenges that rise to top: Governance model for the cloud.  From roles and responsibilities from security standpoint.  Shared multi-tenancy model, who decides, who pays, when it is time to upgrade.  (This is private cloud issue).

Federal government is moving more quickly than OEM suppliers.  OEM (software) licenses are not very cloud friendly. 

Casey: Security is big challenge that people talk about.  Not comprised security, but a different approach is required.

Apps.gov changes purchasing model.  Right now, need purchasing authority to participate.  But, it could (eventually) move to the users of applications and IT services in federal government.  Would need to change purchasing model, authorities and governance.

William: Not all applications move smoothly to the cloud.  Some require re-writing, this is a significant challenge.

Opened to Audience Q&A

Q: Audience question directed at Doug, why did NBC build out the infrastructure, when it could have been commercially acquired?

Doug: Didn’t implement a bunch of new infrastructure to implement cloud, moved existing infrastructure to cloud, added virtualization, management controls: provisioning, metering etc.  The decision was based on economy of scale.  Leveraged existing investment, able to spread that investment out to greater number of consumers (agency support).

Q: Culture Issues?

Casey: Disruptive technology adoption always has culture issues.  Early uses are collaboration and commodity IaaS.  As move to mission critical support, there will be more private cloud adoption.

Q: Security/Risk

Doug: Mission is sensitive but unclassified information (personally identifiable information).  Implementing 3 security zones, dev/test, production, PII.

Q: NASA with Nebula is creating an open source cloud.  What is the role of open source in your agencies?

William: Open source can be looked at as another competitor.  Run TCO models on both commercial and open source offerings.  Key that there is a community supporting the open source software (project).

Doug: Looked at from economic perspective.  Viable from risk perspective.  Are using some open source products at O/S level.

Robert Ames, IBM: Notes really interesting / innovative work going on in the open source community, such as Hadoop.

Q: Can existing datacenter assets be used to create IaaS services?  Especially, with efficiency gains of virtualization etc.  What happens to underlying assets?

Casey: Enormous legacy datacenter investment.  Great question.  Are currently asking themselves how this can be repurposed.  Some newer assets and applications may be candidates to be IaaS providers.  But some older assets and applications may never be cloud friendly, cloud ready.

Q: Low hanging fruit / general characteristics of good cloud candidates? Hybrids models (mix of public and private clouds)?

Doug: Can be very theoretical question / answer.  Best advice is to look at commodity stuff, things with low security model, things with low interoperability requirements.

Casey: USA.gov citizen portal is moved to a cloud solution.  Cost savings approx 75%.  Another high potential area is email and collaboration.  Agency requirements are similar.

William: Collaboration is one area. 

Q: Working with communities?

All of the panelists mentioned working on security models, and working with researchers on security models.  Robert Ames added information sharing, agencies who use / require the same information, and opportunities for new findings (disease prevention) via access and updates to a shared information source.

Q: Apps.gov and IaaS, will there be agency offerings, such as NBC, with commercial offerings?

Casey: Good question.  Very early stages right now.  Could evolve to a competitive marketplace over time.

Q: Platform as a Service?

Casey: Interesting aspect is that government applications developed on a government provided PaaS could then be shared amongst other government agencies, the IP would be a public asset.  Robert points out this could be “jumpstart for innovation”.  Both Casey and Doug agree.

Q: What about compliance issues like HIPAA and Sarbanes Oxley?

Casey: Great many compliance issues.  For example, agency video on YouTube also needs to be agency website where it is captioned.  So, compliance is about the offering (video), not necessarily the delivery platform (YouTube). 

Doug: Cloud users have a responsibility, nothing (technical) prevents them from bringing HIPAA type data to non-compliant platform, so there needs to be education, governance and communication.

In Closing…

Doug: Try it, start small, low risk.

Casey: Despite hype, cloud is real.  Reduce friction, increase capability delivery.