Digital Walkabout

Does big data belong in the public cloud?

Data scientists and business bigwigs discussed the thorny logistics and ethics of big data analytics last week at MIT, and whether this type of data belongs in the public cloud.

 

When a panel of two data scientists and a business expert here were asked about cloud computing's role in the big data trend, some expressed skepticism about its trustworthiness.

 

"We will continue to invest in internal infrastructure," said Claudia Perlich, chief scientist for media6degrees, a marketing research firm based in New York. "Our customers don't necessarily trust cloud providers, and we like as much control as we can get."

 

She said it is in the company's best interest to invest in its own infrastructure, even though it may cost more than using a public cloud service. A company that's less focused on data processing at its core, which just uses big data for decision support, might feel differently, she conceded.

 

But more and more businesses have begun to run big data operations in the cloud, according to MIT conference attendee Mike Olson, CEO of Cloudera, an Apache Hadoop-based software and services business in Palo Alto, Calif. Not necessarily even because it's cheaper -- in some cases it's not -- but because of the flexibility of scale, he said.

 

In fact, there are a lot of startups in the big data space that were born on the public cloud and find it a better way to keep infrastructure and management costs low, said panelist Tom Davenport, a professor at Harvard Business School and Babson College.

 

This is also the reason for the prevalence of open source tools in the big data market currently, Davenport said. But he added he'd be surprised to see large enterprise companies running big data operations on Amazon Web Services' public cloud.

 

Another panelist, Rachel Schutt, a senior statistician at Google Research, was sanguine about private cloud deployments in support of big data projects. She pointed out that big data usually won't fit on one machine, requiring a scale-out approach to computing in which multiple models run across multiple machines, which can be scaled quickly. Google's big data research runs on an infrastructure it hosts itself, of course.

 

One thing the panelists agreed upon is the need to educate the next generation of data scientists on the ethics of what they do. A later presentation by MIT Media Lab professor Alex "Sandy" Pentland detailed his work with the European Union as well as the United States on a Data Bill of Rights. "It has to be you that controls data about you," Pentland said.

 

But there are tradeoffs to consider when it comes to privacy versus the public good and the use of advanced big data techniques to analyze information such as health records and user behavior to stop the spread of disease, for example. With end users' permission, more invasive big data analytics might be helpful, Pentland said.

HTML5/CSS3 continue to make strides into desktop and mobile web - Sencha

On the Sencha blog, Michael Mullany has written about the current state of HTML5 and CSS3, and enthused about the progress that's been made since the introduction of the technologies. "It's been almost three years since HTML5 entered the mainstream," he said, citing January 2010 as "month zero for the HTML5 boom". Today, he reckoned "HTML5 and CSS3 implementations across all major browsers on desktop and mobile have become increasingly convergent," with charts showing particularly noticeable strides in HTML5 support across rendering engines and browsers during the past year. For example, "The feature implementation ramp from IE8 in 2010 to IE9 in 2011 to IE10 this year has been very steep."

Mullany noted that HTML5 progress has not been without its hiccups, singling out Android 3 and its "embarrassingly bad browser implementation," along with issues relating to device APIs and the performance and correctness of CSS 3D transforms. However, he praised the manner in which standards groups and browser makers have navigated disagreements, such as how "the CSS Working Group worked through the issues over gradient syntax and functionality". There, WebKit's syntax originally merged linear and radial gradients into a single property, which Mullany said hadn't worked well for flexible layouts. Mozilla's alternative implementation boasted superior syntax and is now the standard.

Mullany also noted that HTML5 has shown how "standards status is often only loosely related to dependability or usability". HTML5-bashers often claim the technology is not ready, he explained, and yet plenty of major HTML5 technologies have now reached advanced stages of standardisation, and frameworks like Sencha's own can "abstract away differences in implementations" while further standards work progresses. "We now have five modern HTML5 browsers to choose from, all with very complete HTML5 implementations," he concluded, stating that there's plenty more to look forward to in 2013.

HP aggressively enters the OpenStack Public Cloud market

HP has taken the wraps off its first public cloud computing service with an aggressive price and SLA that compete with Rackspace and Amazon. Prices for Hewlett-Packard's (HP) Cloud Compute service start at four cents per hour for a small instance with 1 GB of RAM – 2 cents lower than the price for Rackspace's 1 GB instance. Amazon Web Services' (AWS) Reserved Small Instance, which comes with 1.7 GB of memory, costs 3.9 cents per hour.

While AWS still offers the best deal, HP's pricing for the fledgling service might attract Rackspace customers. "It looks to me like HP's killing Rackspace [on price] right now," said Boyd Hemphill, a Rackspace customer and chief systems architect for social media aggregation service provider FeedMagnet LLC. "I'm eager to get in there and try it out."

For larger FeedMagnet customers who would use the 1 GB server instance, the cost difference would be more than $10 a month. HP's Cloud Compute would come to $29.20 per month, as opposed to Rackspace's $43.80. Not every customer of FeedMagnet needs the full gigabyte of memory, however, Hemphill said, and for those customers, he prefers Rackspace's 512 MB instance, which costs $16.06 per month.

Meanwhile, HP still has to establish its reputation as an Infrastructure as a Service (IaaS) provider. One IT manager at a quick-service restaurant company based in the Northeast said HP remains an unknown quantity in that regard. "I might consider alternatives when my current contract with Verizon's Terremark expires," the IT manager said, speaking on condition of anonymity. But he's more likely to go with a provider ranked on Gartner Inc.'s Magic Quadrant for cloud service providers, he said. "Rackspace is one of them -- they're highly rated," he said. HP's OpenStack-based Cloud Compute will allow portability of workloads into and out of other OpenStack clouds on demand, HP claims.

HP Cloud Compute SLA, free trial gun for Amazon EC2
HP hopes its Cloud Compute service-level agreement (SLA) will help it catch up to such providers as AWS in the public cloud IaaS market. HP's Cloud Compute SLA calls for 99.95% uptime on a monthly basis. AWS also offers a 99.95% SLA, but for a yearly period. This means that cumulatively, HP's service could be down for only 21 minutes per year, whereas AWS has more leeway with up to four hours' downtime per year, according to a blog post by Gartner analyst Lydia Leong.

These cloud SLAs might sound good on the surface, but buyer beware, according to Leong. "It's a tossup which SLA is worse," she wrote. "HP has a monthly credit period and an easier claim process [than AWS], but … that's totally offset by HP essentially defining an outage as something impacting every [Availability Zone] in a region -- something which can happen if there's an AZ failure coupled with a massive control-plane failure in a region, but not otherwise likely."

Like AWS, HP also offers a free usage tier for Cloud Compute, but its free offering is capped at 1,000 hours as opposed to AWS's 750 hours. HP's free trial period ends after one month, while AWS offers its free usage tier for a year.

The Cloud Compute rollout came amid a broader set of cloud announcements from HP this week, which included new support for the kernel-based virtual machine, or KVM, hypervisor in its CloudSystem product; a new connector to allow CloudSystem users to burst into service provider data centers; and Continuous Delivery Automation software that automates the process of sending a workload from development to test, quality assurance and production.

 

Mobile cloud enables enterprises to mitigate risk

The overwhelming need to provide centralized management and security for multiple types of mobile devices is driving the increased adoption of mobile cloud computing and mobile cloud applications.

This is especially true for organizations adopting a bring your own device (BYOD) strategy. Over time, mobile devices will be able to access many of the traditional mission-critical business applications.

The growing acceptance of the mobile cloud has led to several notable trends in IT. Here's a rundown of those trends, the advantages and disadvantages of cloud computing and some thoughts on how they might affect organizations going forward:

Cloud trends in mobile applications
Gartner Inc. says that the mobile applications market is highly competitive and attracting the interest of many stakeholders. Gartner predicts that end users will spend about $15.9 billion on mobile applications in 2012, and those investments will in turn drive hardware sales and new technology innovation.

As the workplace becomes more mobile, with about 140 million smartphones and tablets entering companies in 2013 and more than 60% of enterprises endorsing BYOD strategies, custom mobile apps will emerge as a way for corporations to streamline how they do business.

A survey by AppCentral shows that about 19% of enterprises have in-production app stores. Enterprise applications stores are the direct result of BYOD strategies. Companies such as CDW and General Electric have implemented private stores to help take the burden off IT to move apps to individual devices or upload each application to a public app store.

Because more than 60% of corporations are implementing BYOD strategies, according to some estimates, many different types of mobile devices may be in use within a single corporation. It is too costly to provide native apps for all of these different types of devices, paving the way for mobile cloud apps that can be built once and used with many different mobile devices.

New technologies such as HTML5 and jQuery Mobile are enabling mobile cloud applications developers to build apps with more polish. Mobile cloud apps have the big advantage that they can run on many mobile device platforms that have standards-compliant Web browsers and are much less expensive to build.

Mobile hybrid apps are being used in those cases where on-device features are needed but the mobile cloud app is the preferred mobile app choice. A hybrid app is one that is written with the same technology used for Web apps and mobile Web apps, but is hosted or runs inside a native container on a mobile device. A Web-to-native abstraction layer enables access to on-device features that are not accessible in mobile Web apps.

Independent retailers will begin creating public app stores. BestVendor and Listio are examples of two directory sites that could grow to compete with Apple.

Mobile cloud trends
In the near future, as developers move away from native apps, the world will see more consumer applications built as mobile cloud applications -- software that resides in the cloud but is accessed via an interface or browser on a mobile device.

The rise of mobile cloud applications can be attributed to the rising cost of deploying and supporting native applications and the fact that development tools are getting better all the time. HTML5 and CSS3 adoption is on the rise, making it easier to design and build mobile cloud apps. Basically, an HTML5 specification tells a Web browser what to display and a CSS3 specification tells the Web browser how to display it.

According to Gartner, corporate employees using smartphones and tablets for business purposes represent about 75% of the mobile cloud app market. The mobile cloud app market is expected to exceed $9 billion by 2014.

Corporations are getting pressure from their customers to build mobile cloud apps or make existing applications available via mobile devices. If they fail to do so, they are in danger of losing ground to competitors.

Mobile network operators (MNOs), such as Vodafone and Verizon, and other cloud vendors such as Global One are entering the mobile marketplace with mobile clouds that compete with other non-MNO vendors.

The resource-poor nature of mobile devices is driving the adoption of mobile cloud computing. Mobile apps are becoming more powerful as processing power is offloaded from mobile devices to the mobile cloud. Mobile devices that are 4G LTE (Long Term Evolution) compatible, which support bandwidth intensive apps and reduce latency issues, are helping to open markets for mobile cloud apps.

Security is a continuing issue for adopters of mobile technology. Some companies believe the risk of using mobile devices to access and update corporate data is too high. As a result, some companies allow mobile devices read-only access to corporate data, but not write access. Other companies, such as some financial institutions, allow customers to update their accounts using mobile devices. Authentication mechanisms are available to control how mobile cloud apps use data, locking down sensitive proprietary data while making less risky data more available.

A new approach to security for protecting mobile devices from malware and intruders is being examined. With this approach, multiple mobile cloud protection engines (virtual servers) run security programs that analyze a device activity file that each mobile device periodically uploads to them. Each mobile device has a software agent program installed to create the activity file. This approach promises to provide much better security for mobile devices than with a mobile device running a single security program.

Mobile clouds centralize the management and security of mobile devices, placing mobile device users into a safer, more controlled environment. This is being driven by the plethora of mobile devices of differing types, with different operating systems.

 

The Skinny on the Pivotal Initiative

VMware and parent company EMC will create a new "virtual organization" called the Pivotal Initiative to realign their collective big data and cloud application platforms. Some 1,400 employees from EMC Corp.'s Greenplum and Pivotal Labs organizations, VMware Inc.'s vFabric (including Spring and Gemfire), Cloud Foundry and Cetas organizations will move under the new initiative. The organization will be led by former VMware CEO Paul Maritz.

Speculation surrounding this spin-off organization has swirled since Maritz stepped down as CEO in July. Amid renewed rumors of the move last week, partners and analysts debated whether it would be a good one for the two companies. "It's early in the market, and having a dedicated sales force that isn't subject to the political whims of the business owners who own the big revenue drivers for VMware, that's not a bad thing," said John Treadway, vice president of Cloud Technology Partners LLC, a cloud services provider and a VMware partner.

However, Treadway also wondered if a new organization would lose the cachet of the two parent companies and their strong relationships with enterprises. "They're not the only ones out there doing this, and so the chances of them having a really huge win and being able to leverage their purchasing relationships that they have within the large enterprises, that's what they may be potentially missing by doing this," Treadway said.

"The CloudFoundry, SpringSource, and other app dev tools organizations have been second-class citizens within VMware, targeting very different customers -- application developers -- than the rest of VMware's business -- IT shops," said Shlomo Swidler, CEO at Orchestratus Inc., an IT consulting firm. "Creating a new top-level division of EMC underscores the company's commitment to application developers."

But the new division could face the same challenges as any other startup in this space, despite the big names overseeing it, according to IDC analysts. It will compete with other companies in the application development space ranging from Windows Azure and Amazon Web Services to startups like CloudBees and DotCloud.

"VMware has been trying to figure out how to monetize the technology, give that much of it comes from open source roots," said Al Hilwa, program director for applications development software with IDC in Seattle, Wash. "Paul Maritz certainly has the passion and skills to take this business forward, but the same business challenges remain no matter what organizational structure picks up responsibility for it."

There is not expected to be any impact to existing agreements or committed support. Customers and partners can continue to buy products and services as they normally would from both companies without interruption during this alignment, according to a VMware FAQ. 

 

VMware cloud template tool to battle it out with AWS CloudFormation

In the high stakes war for enterprise cloud customers, VMware hopes a new tool for building and deploying cloud templates will cement its position.

When it comes to modeling and deploying cloud applications, enterprise developers and independent software vendors (ISVs) can build templates using Amazon Web Services CloudFormation, IBM Workload Deployer and tools from RightScale, to name a few. VMware, Inc., with its dominance in enterprises that run virtualization, hopes ISVs also consider its vFabric Application Director (VFAD), and eventually distribute those templates on the new VMware Cloud Applications Marketplace.

Developed in-house and first announced in March, vFabric Application Director gives developers a drag-and-drop canvas with which to build reusable application templates that can be deployed either to vSphere, vCloud-based public clouds, and now, with the new version 5.0, to Amazon Elastic Compute Cloud (EC2). Support for other cloud platforms is forthcoming, said Shahar Erez, VMware director for cloud applications on-boarding.

Calling all private cloud customers
The ability to deliver pre-configured repeatable cloud templates – "blueprints" in VMware-speak -- of complex server applications appeals to ISVs eyeing VMware's vast enterprise customer base.

"What this gives us as a company is a very good private cloud solution," said Kent Mitchell, senior director of product management at Zend Technologies Ltd, the commercial arm of the open source PHP scripting language. Zend used vFabric Application Director to build a template of its Zend Server PHP Web application server that it will offer on the Cloud Applications Marketplace.

In and of itself, access to VMware private clouds is good, but giving customers the option to deploy on a variety of public clouds is even better, said Kavitha Mariappan, Riverbed Technology’s director of product marketing for its Stingray application delivery family, which is also available on the Cloud Application Marketplace. "Integration with EC2 makes it much more compelling," Mariappan said. "It's not just restricted to the enterprise anymore." VMware's public cloud partners use these VFAD application blueprints to deliver more turnkey services and compete against Amazon EC2, said VMware's Erez.

"Service providers are working hard to differentiate themselves from other IaaS vendors," he said. vCloud partners that plan to support VFAD blueprints include BlueLock, iLand, Savvis, NTT America and TechDemocracy.

Application release automation -- plus
Broadly speaking, vFabric Application Developer falls into the bucket of application release automation software, offered by vendors that include  UrbanCode, Nolio and BMC, said Ronni Colville, a vice president and distinguished analyst at Gartner, Inc.

What VMware brings to the table with its application release automation tool is deep integration with the performance analytics tools in its vCenter Operations Management stack, she said. With it, developers will be able to specify up front how a cloud template should be monitored once it is launched and how to scale it up or down based on resource consumption.

Combined with the EC2 support, this release of vFabric Application Director sends a strong message, Colville said. "This is yet another step that tells us that they are trying to be about much more than the VMware stack," she said.

To use cloud templates, customers must run VFAD locally, which is included as part of VMware's vCloud Suite 5.1., or a la carte. The vFabric Application Director for Provisioning tool is priced at $6,250 for 25 VMs, and vFabric Application Director for Release Automation costs $9,375 for 25 VMs.

VMware also announced a new version of the VMware vCenter Operations Management Suite, which consists of performance management and monitoring tools derived from Integrien and EMC Ionix. Version 5.6 includes new compliance dashboards, customizable group-based views and application-level monitoring through vFabric Hyperic.

BYOD is the solution, not the problem

The BYOD movement can be a source of problems for IT pros. Enterprises are learning how to mitigate the security and compliance issues that arise when employees use personal mobile devices to access business applications. And when the benefits and goals of BYOD hinder the productivity advantages of cloud computing, things can get ugly.

Bring your own device (BYOD) policies complicate cloud because they limit a company's ability to optimize application delivery to a single platform -- a major benefit of cloud adoption. There are ways, however, to optimize the cloud so enterprises don't have to choose between either a cloud project or BYOD.

Creating a BYOD-compatible cloud
The first casualty of the BYOD and cloud collision will be custom client software. Some users have relied on graphical user interface tools or virtual desktops to create worker views of data; however, mobile devices offer limited support for application-specific clients. To expect client support on all popular mobile device OSes is unrealistic, and products such as Windows RT or Firefox OS will likely drive developers in too many different directions. Instead, focus on building a cloud computing environment that supports a modern -- and rapidly changing -- BYOD business.

The first rule of building a BYOD-compatible cloud is to base application interfaces on browser thin-client technology exclusively. This browser-based strategy means you should first ensure cloud applications are thin-client compatible. Next, you'll need to make certain all devices in your environment support necessary applications.

To build a browser-based BYOD cloud strategy, all applications must be exposed using URLs. Most modern software tools and nearly all cloud services work this way, but legacy applications that are hosted on Infrastructure as a Service (IaaS) platforms may include nonstandard interfaces. Some companies have also adopted Web services interfaces (using SOAP), which can be difficult to support on mobile devices, particularly if you can't target a single device type.

Once your applications are presented as URLs, you can build mobile device interfaces using Web-authoring tools. Keep in mind that not all browsers are the same; the HTML and scripting features various mobile browsers supported vary greatly. A quick Web search can find charts to help you understand particular Web-page features you can expect to use to support mobile-based cloud applications. Support for HTML5, cascading style sheets (CSS) features and scripting languages likely will be the most problematic.

Most enterprises correctly believe that HTML5 is the long-term future of UI, and most mobile browsers will support the basic features of HTML5. However, HTML5 does not support many database, device control and productivity tool functions on certain devices.

Extending support to mobile devices is an evolving process; some experts believe advanced HTML5 features will be widely available sooner than advanced scripting tools. The best strategy could be to start with basic HTML5 and evolve BYOD device screens as the support for HTML5 features expand. When it comes to older mobile devices with outdated OSes, it may be best to stick with older-generation HTML screens and use minimal to no scripting.

There are two options for browser support of applications: have the browser assemble the pages and access individual URLs, or have an agent process (a software that resides on the server and acts on behalf of the browser) assemble data from application URLs and present that data in a single screen to all browsers. The former approach allows for better control over what HTML features are used, while the latter method can offer better control over application and data integrity in the event of a failure.

When cloud processes are assembled to create a single virtual application for the end user, it's critical that any transaction can either be fully processed by all application elements or backed out completely. When the device has this responsibility, loss of connection may make it impossible to synchronize data state.

Managing devices and securing enterprise data
All cloud process frameworks for BYOD include device management and methods to secure enterprise IT resources. The use of URL-based device screens may make it difficult to manage and secure devices, because it is necessary to validate a device against browser tools the cloud processes use and also to ensure the device is secure.

One option is to use a security or management tool on each device that provide access to data and secures the device against most threats. But this hinges on the availability of a common utility that works with user-defined devices; your only option may be to check with the each vendor about compatibility.

Despite problems, BYOD and the cloud can live in harmony. As HTML5 support matures, it's likely the feature overlap among various mobile browsers will increase, solving one of the major problems with BYOD in the workplace. By developing effective processes in the present and planning for the future, a company can build a cloud strategy that supports BYOD.

Top five mobile application vulnerabilities

Mobile devices are the subject of many security discussions, but it's often mobile applications that serve as attack vectors.

Bad data storage practices, malware, sideloading and lack of encryption all contribute to mobile application vulnerabilities. It's important for users to understand best practices for downloading apps and granting permissions. And IT should require that users have anti-malware programs on their devices.

Bad data storage practices
One of the top reasons why mobile application vulnerabilities exist is because inexperienced programmers have bad data storage habits. Databases such as SQLite make it easy to store compact data on a local device, but programmers can still store that data in clear text or in the XML format, which is a readable, plain-text file that makes it easy to gain access to an app's data.

All it takes to access the data stored on an unlocked smartphone running a poorly written app is a simple extraction of the file attached to the mobile application, then a query. This action can tell you anything you want to know about the data stored in that app, which is especially troublesome if the database connects to a back end system. Because of these mobile application vulnerabilities, sensitive data should be encrypted at the device level, and external connections should be encrypted as well.

Malware
Android mobile application vulnerabilities have become a problem in part because of Google Play's open format, but also because users can sideload apps, removing any oversight regarding the safety of apps. Google has deployed Google Bouncer in response to malware, but Google Play still isn't fully protected from malware-laden apps. Malicious mobile application developers break up malware into pieces to avoid detection, and developers use the names of popular apps to entice users into downloading the malware.

There are also inconsistent updates and patches to the Android operating system. You can't count on Android to update itself in a timely manner, because wireless carriers control update schedules on all but Google's Nexus devices. That makes it more difficult for Android devices to stay up-to-date with protection against vulnerabilities.

Anti-malware apps, which can protect against mobile application vulnerabilities, are available in free and paid enterprise-class versions. You should make it a requirement that employees have some sort of anti-malware on their Android devices. Unfortunately, Android anti-malware apps don't get the system-level access they would in Windows, so the sandbox they operate in makes for limited success in malware blocking.

Unauthorized access
The best thing you can do to protect against Android mobile application vulnerabilities and malware is to educate users about access permissions after installing a mobile application. User approval is required before any app can access other data or apps on an Android device. Just as you train users not to open strange email attachments, they should be equally cautious with requests from apps to access data they shouldn't need access to.

Mobile application vulnerabilities are not limited to Android apps. A mobile application called Path, for example, offered a new way to socialize with friends and was hailed for its great user interface. Then someone sniffing the network activity of the app revealed that Path uploaded entire contact lists to its servers. It did not ask permission to do so in the iOS version of the app. Path had to apologize for unauthorized storage of users' personal data.

Many users are unaware of how valuable their contact data is, and applications' terms and conditions often hide the truth about personal data access. What Path did was an example of overzealous developers trying to provide a better user experience, but a less ethical app developer could use the same contacts data for spam, marketing or even malicious attacks.

Lack of encryption
Applications that don't use encryption can cause problems as well. LinkedIn's mobile application, for example, transferred local calendar data to LinkedIn servers when the site rolled out a new calendar integration feature. All of that data was transferred in clear text over the network and via the Internet, so it was open to anyone looking for the data. A similar incident also happened with contact data in LinkedIn's mobile application.

The hope is that mobile application developers will use common encryption frameworks to protect users' data, but nothing is guaranteed. And it is almost impossible to find out those details without transparency from the app developer or a full analysis of the app.

Data leaks from syncing
In applications where users sync data to the cloud, data leaks are the concern. Dropbox suffered a password breach that exposed many user accounts to a hacker. Luckily, it only resulted in those users receiving some spam. But other applications take advantage of Dropbox application programming interfaces to sync data between devices and even other services. A user could expose data to a security issue on Dropbox without being fully aware. You can't control a vendor's protection mechanisms, even if the company's published security policies comply with best practices. In the event of a security breach or a password issue, these services rely on verification through email. A reset link to a webmail account such as Gmail or Hotmail is hardly secure in most enterprise environments, and when they get hacked, the security of the synced data is compromised.

Ensure users don't have the same password for every app or service. Make sure they follow the one site, one password rule to limit mobile application vulnerabilities. If possible, discourage users from storing sensitive work data in these cloud services that IT does not control. Roll out an enterprise-ready system complete with local controls.