Jump to content
tanknet.org

Cloud Computing; Good, Bad, Or Ugly?


Recommended Posts

We have quite a few IT workers here on Tanknet, and now that we're in Stage II of the cloud computing hypestorm, I thought it would be interesting to critique the realities of cloud. Some of the facets I would like your opinions on are:

 

- security

- performance

- regulatory/standards compliance

- manageability (particularly high-level stuff like vendor lock-in)

Link to post
Share on other sites

I'll start off by writing a couple of my concerns.

 

On security, I have no idea how well cloud providers are handling security inside their firewalls. I am increasingly skeptical about the security of IPsec tunnels, simply because the US government has proven to be a bad actor in the realm of communications security. If Diffie-Hellman has been compromised, the whole IPsec infrastructure is compromised. And then there's the issue of firmware backdoors being soldered into routers, supposedly for overseas sales. If a backdoored Cisco router is sold to some firm in the PRC, ends up in the used gear market, and finds its way to another country such as the US, there's no feasible way to prevent Local Savings and Loan, Inc. from buying it and using it in their DMZ.

 

Note that I'm not so much concerned about the NSA databasing all traffic through an IPsec VPN to a cloud provider; I'm concerned with a fundamental flaw that turns out to be exploitable by anyone, such as the fatal flaws in WEP. A backdoor that the NSA can exploit at will IMHO is a backdoor that will eventually be exploited by all sorts of governments and criminal syndicates.

 

On performance, I've read differing opinions. In big cities with lots of big pipe access and a short geographic distance from a compute center, I can believe that application performance is no worse than a local datacenter. I'm wondering though how this works out for small and medium sized firms in towns and cities somewhat off the beaten path. If you've got just one telecom provider in town, and/or the last-mile providers only have one real route to the big pipes, its not hard to imagine having higher latencies, bandwidth throttling, and lower availability.

Link to post
Share on other sites

If you live in a smaller town, considering investing in your own server, perhaps have a cloud backup or have the data backed up in 2 separate buildings.

Link to post
Share on other sites

Make your own "cloud". You just cannot trust some random firm in the cloud. You never know what might happen with it. Being bought by another firm. Going out of business suddenly. And all those other bad things that can happen. And can you really trust another firm especially when it is a big one not to peek into your data?

Link to post
Share on other sites

I keep on OneDrive (the MS cloud) some photos and some unimportant docs that I have to access often, otherwise no. But some expensive software is now offered "as a service" where you only pay a little every month as opposed to a one-time huge lump of cash, so I am doing that (we're talking about programs that normally cost thousands of $). This is directly linked to the cloud. We'll see where this is all going.

 

Regarding "your own cloud", actually I do that with my webspace, but OneDrive is just more convenient for photos.

Edited by Fritz
Link to post
Share on other sites

Make your own "cloud". You just cannot trust some random firm in the cloud. You never know what might happen with it. Being bought by another firm. Going out of business suddenly. And all those other bad things that can happen. And can you really trust another firm especially when it is a big one not to peek into your data?

 

At the "brochure engineering" level, to me the private cloud concept seems pretty appealing. Most of the advantages of cloud computing without questionable 3rd parties rummaging around in your data. If something goes badly wrong at least you can box up the hard drives and bring them home. Plus you've got end-to-end custody of discoverable evidence, in case of suits and filings.

 

Even the biggest names in cloud raise some uncomfortable questions. Google, well they have a miserable track record for corporate ethics. I pretty much expect their execs and staff to perform a certain amount of subtle hacktivism against customers inconsistent with Silicon Valley mores. An oil company or Christian church would be hosed, I think. Amazon I would tend to trust, simply because their bookselling arm seems to treat all authors equally fairly; Bezos doesn't creep me out, and I haven't heard of Amazon doing anything unethical. Microsoft I would tend to trust on ethics (no, really!) but they seem so unpredictable in terms of customer support. I am thinking here of the overt program for eliminating SBS and forcing those customers to the cloud. Kind of a regime uncertainty sort of thing.

 

It would be fun to create a corporation called Trustable Cloud, Inc. and see if we could get anyone to sign up. A nice professional website, some stock photos of a big datacenter, Facebook and LinkedIn presence, it just might work.

Link to post
Share on other sites
Guest Jason L

I'm a pretty huge fan of dropbox, it has really changed the way I work. The threat of fatal computer issues causing irreperable data loss is from my perspective a much bigger and more likely risk than data theft and the like.

 

Dropbox has already saved my ass numerous times when files got corrupted, it got me up and running right before a huge deadline when my HDD crapped out a bit ago, saved my ass when I urgently needed something and I was able to pull it up remotely, and of course the ability to use it collaboratively. The only other real option to have all your data on the go is carrying a USB key that is constantly synched and encrypted in case you lose the damn thing.

 

Same problem with smart phones and laptops, more data vulnerability comes from having those things lost or stolen than from a company creeping on your data or someone intercepting traffic between you and the cloud.

Link to post
Share on other sites

Security: The data security at most tech companies is poor, and I know for a fact that employees often do go spelunking in customers' data.

AFAICT, Diffie-Hellman is not itself compromised, but the most common random number generators used to create DH keypairs on Windows and Linux systems are not very secure. An adversary who can predict the output of your RNG can surmise the content of your DH private key, and it's game over.

AES ciphers might be compromised. The security community is split on this. Schneier makes a good point that if the NSA could defeat AES, they wouldn't be using riskier methods to circumvent SSL, and they have been observed to do so.

A Chacha20 cipher is available for some SSL implementations, but it's not used much yet. The security community is split on the viability of Chacha20 as well, but mostly because it is relatively new and hasn't yet had thousands of eggheads and blackhats spend significant brain-hours searching for vulnerabilities.

An AES-Chacha20-Counter or AES-Threefish-Counter cipher would be the best of both worlds. I'm working on an implementation of the latter (for OpenSSL; nfi if it has a chance of being accepted upstream).

Performance: It's a crapshoot. Some services perform well, others perform poorly, and some (like AWS) perform well sometimes and poorly other times. Ditto with reliability. A sysadmin friend described his experience working with AWS EC2 as "like having a datacenter that you can't get in which also happens to have a bunch of rabid macaques running around turning the power on and off". I've held the shoulder of another who was at wit's end because network performance between two EC2 instances could be superb one week and abysmal the next.

If you can try before you buy, you totally should. Give it a nice several-months-long burn-in and find the gotchas so you can decide whether you can live with the gotchas.

Regulatory / Standards Compliance: Also a crapshoot. They all claim to be compliant, about half are lying, and you have no way of knowing which. I worked for a little 40-employee company which provided EXCELLENT regulatory compliance (including a separate datacenter in the UK for EU Directive 95/46/EC compliance), and I've worked for a huge Fortune-500 company which played fast and loose with observation of regulatory laws. From what my friends in the industry tell me, it's about half-and-half.

You'd think Google, of all companies, would be decent at standards compliance, but at DM we got some of the worst-formed LF and XML datasets from Google's legal department. Neither company size nor public reputation are any indicator of what to expect.

Manageability / Vendor Lock-In: Also a crapshoot. Some services are very good about this, and offer an easy way to download all your data so you can archive it locally and/or migrate it elsewhere. Others close on your hand like a toothy steel trap. Again, if you try before you buy, you can root around and see if infrastructure management and mass data export are available (and work as described). Linode's simple web-based infrastructure management interface is decent for small deployments, for instance, but you'll be wearing out your mouse-clicker-finger if you try to use them to manage hundreds of instances.

Private cloud: If you already have the talent and infrastructure in-house to implement this, you should do so. If your application can be made to work with EC2, for example, you can implement a cheap private Eucalyptus cluster to handle the expected load, and have jobs "spill over" to AWS EC2 instances if load bursts higher than your local capacity can handle. "Cloud Computing" mostly makes sense for companies which do not have sufficient in-house technical talent, but are willing to spend $$$ for immediate capacity, even if that capacity is expensive and low-quality. It's faster and easier than finding and hiring engineers/sysadmins and building out space in an Xo or HE datacenter. It's a way to become profitable immediately, and not six months from now when the market might have already moved out from under you.

Alternatively, if your load is predictable or slow-growing and you can get away with an entirely in-house solution, you can make do with a much simpler infrastructure than the current "cloud" offerings. A single sysadmin can run and maintain a big dumb linux cluster several hundreds of nodes in size. OpenStack is pretty easy to pick up, and gives you most of the Enterprise VM management goodies (if you even need those).

I know that's all very general and vague, but you haven't said much about the specific problem you're trying to solve :-)

Edited by TTK Ciar
Link to post
Share on other sites

I know that's all very general and vague, but you haven't said much about the specific problem you're trying to solve :-)

 

Only hypotheticals. If I were CIO/CTO of some medium sized business, or a non-tech enterprise, and the CEO/prez called me in and started waving a "cloud uber alles" article from HBR or whatever, the challenge would then be to explain to PHB that you can't just cut a monthly check to your cloud provider and watch increased margins come rolling in.

 

Excellent response, BTW, exactly what I was looking for. A bit depressing! But that's how a lot of IT stuff seems to be.

 

I'm only vaguely aware of OpenStack, having watched an intro video or two. It does look interesting.

Link to post
Share on other sites

What ever app a you build for amazon, make sure it's redundant. Their TOS assumes no fault tolerance on their physical iron.

Link to post
Share on other sites

In Germany could services are being used by many companies, but the legality is actually dubious if personally identifiable information (PII) is processed (and which corporate documents don't fall into that category?)

 

The point is that PII receives special protection under German law, among which is that while you may task a third party to handle the data processing, you must keep track of its physical whereabouts and it must not be transferred to countries that do not comply with European privacy standards related to PII. With cloud services you know neither where the data are stored nor do you have firm control over them, and that should be the end of the debate already. Of course, some companies don't care (and one day it'll blow up in their faces).

 

Another rather obvious point is that anything transmitted over public IT infrastructure can (and probably will be) intercepted. IT security depends on nobody in the entire chain fucking up, and how likely is that? Add to the mix certain interest groups that have every incentive and interest to not play by the rules, who have the financial and technical means, and whose understanding of their job description is to snoop around without any restrictions whatsoever; parties who are known to have subverted the academic world (as far as cryptography is concerned) as well as parts of the IT world.

 

Anything that is publicly transmitted I treat as letters in an open envelope. If encrypted, it's like a "Do not read this" stamp, but the envelope is still open. If it's really well encrypted with forward secrecy and real good infrastructure and a cloud service provider that does his job the envelope may actually be sealed, but then you invariably attract the interests of the NSA what it so particularly secret in your data that you want to hide it from them, and they will actively seek to undermine whatever level of security you may have achieved.

 

Technical aspects are only one thing. But security is a mindset of everybody involved. You need motivated and alert people who will recognize attempts from outsiders to breach security as such, they need to report it, and management needs to act on such reports. If simple, automatized signal intercepts don't work, they will try social engineering to figure out passwords to hack into your databases. So not only is it a question of how secure the transport between end user and cloud server is, or how secure the cloud storage is but also whether Joe Schmoe is willing to help that "new intern" calling who needs the "misplaced" password of Mr. Bigwig for whom he is supposed to "create that Powerpoint presentation until tomorrow morning", or else he's fucked. Mr. Peacounter from purchase department must realize that this special offer for routers that is too good to be true IS too good to be true, and that the big savings he might make will actually cost the company a fortune if he buys those discount hardware backdoors. Very soon people will complain about an atmosphere of paranoia in the company, and they are right: You HAVE to be paranoid when it comes to (IT) security if you take your job seriously, and that's an aspect that the nerds usually overlook. You can't get security without a paranoid mindset, and while the paranoia might make things more secure it's usually detrimental to the quality of work and/or to the quality of work atmosphere/corporate culture.

Link to post
Share on other sites

I don't trust it at all, too many security breaches. I only back up to the cloud those things that I absolutely, positively cannot avoid backing up. Now Lupe and the girls, iCloud was the only way to go for them, since I cannot remember everyone's passwords, etc. I make them remember those passwords, and I make them multi character, numeric, and special character nightmares.

I use cloud to back up only my pictures off my iphone

Otherwise I avoid it like the plague

I don trust it

Link to post
Share on other sites

In Germany could services are being used by many companies, but the legality is actually dubious if personally identifiable information (PII) is processed (and which corporate documents don't fall into that category?)

 

The point is that PII receives special protection under German law, among which is that while you may task a third party to handle the data processing, you must keep track of its physical whereabouts and it must not be transferred to countries that do not comply with European privacy standards related to PII. With cloud services you know neither where the data are stored nor do you have firm control over them, and that should be the end of the debate already. Of course, some companies don't care (and one day it'll blow up in their faces).

There is the bittersweet aspect of nations not-US. You don't enjoy the wealth that develops due to hosting Big Web (Google, Amazon, etc.) but you also don't have legislatures that have been thoroughly compromised by said Bigs. I would luvvv for the US to pass some Euro-inspired privacy and DLP laws, but it will never happen. The guys who became billionaires collecting and selling PII can simply buy enough legislators to prevent any restriction on their racket.

 

 

I think some time back I read a short article or blurb where prevailing national legislation was used to create a market niche. IOW, host your datacenter here in X and your data must be protected to Y standard. I really like that, lets have nations compete in the global marketplace in terms of beneficial regulations as well as adverse.

 

Another rather obvious point is that anything transmitted over public IT infrastructure can (and probably will be) intercepted. IT security depends on nobody in the entire chain fucking up, and how likely is that? Add to the mix certain interest groups that have every incentive and interest to not play by the rules, who have the financial and technical means, and whose understanding of their job description is to snoop around without any restrictions whatsoever; parties who are known to have subverted the academic world (as far as cryptography is concerned) as well as parts of the IT world.

Yeah, if we treat a packet like we treat a piece of physical evidence from a crime scene, then the chain of custody thing looks absurdly complicated. Its bad enough in-house, with the number of people who could sniff and store packets. Throw in your Tier III ISP, their Tier I ISP, and the whole staff of a cloud provider, and all bets are off.

 

Technical aspects are only one thing. But security is a mindset of everybody involved. You need motivated and alert people who will recognize attempts from outsiders to breach security as such, they need to report it, and management needs to act on such reports. If simple, automatized signal intercepts don't work, they will try social engineering to figure out passwords to hack into your databases. So not only is it a question of how secure the transport between end user and cloud server is, or how secure the cloud storage is but also whether Joe Schmoe is willing to help that "new intern" calling who needs the "misplaced" password of Mr. Bigwig for whom he is supposed to "create that Powerpoint presentation until tomorrow morning", or else he's fucked. Mr. Peacounter from purchase department must realize that this special offer for routers that is too good to be true IS too good to be true, and that the big savings he might make will actually cost the company a fortune if he buys those discount hardware backdoors. Very soon people will complain about an atmosphere of paranoia in the company, and they are right: You HAVE to be paranoid when it comes to (IT) security if you take your job seriously, and that's an aspect that the nerds usually overlook. You can't get security without a paranoid mindset, and while the paranoia might make things more secure it's usually detrimental to the quality of work and/or to the quality of work atmosphere/corporate culture.

Yeah, the humans are always the weak spot in the defenses. Riffing on TTK's sermon above, my gut feel is that everyone is lurching madly towards the Next Big Thing with a lot of rationalizations and proof-by-assertion w.r.t. security, rather than careful analysis.

Link to post
Share on other sites

Corporate manages have always behaved like lemmings. Everybody is doing it, we must not fall behind! We cannot tolerate a cloud gap!

 

...and the all-time classic:

The cost savings! The cost savings!

 

 

Robustness and resilience are no categories in most businesses because there rarely are rewards for that - - - aside from the corporation's survival, but why would you care about it if you're just an employed manager who can easily find some management position elsewhere, if everything begins to fall apart?

Link to post
Share on other sites

Corporate manages have always behaved like lemmings. Everybody is doing it, we must not fall behind! We cannot tolerate a cloud gap!

 

The Future lies in the Cloud After Next!

 

I guess I'm going to wait for the HyperCloud. That is, unless the MetaCloud becomes beta-release vaporware.

Link to post
Share on other sites

Wait till the hackers have a StormCloud and a veritable Hurricane with special Tornado features that'll suck up all your data and dish it out in unrecoverable pieces - except JPEGs of babies and kittens which will be deposited gently in what remained of your cloud storage space.

Link to post
Share on other sites

TTK and/or Ssnake; how about licensing? I guess a major benefit of public clouds is that the cloud provider does all the license management, and just bakes that cost into the metering rate. Does it really relieve the customer from all that hassle, though?

 

I'm trying to think of what things would look like for an SMB using public cloud. Network admin, Windows Server admin, Exchange admin, SQL Server admin, desktop admin, help desk. IT manager/director no longer does capacity monitoring or planning, or license management. Like electricity, use what you need, pay for it monthly.

Link to post
Share on other sites

I'm not calibrated on licensing issues. With the exception of Autonomy (with whom I was acquainted only briefly; they bought the company I was working for, and I BTFO soon after that) all of my employers since 1999 have used LAMP stacks with free/open-source software, unburdened by any licenses at all.

A friend is Director of Operations at a largish tech company, and he tells me that managing all their licenses is a major pain. Sometimes he doesn't even know that some infrastructure is dependent on licensed software until the license expires and that infrastructure stops working. There are companies whose only products are license management systems, so I'm guessing it can be a big deal that cloud providers alleviate license management concerns. It really never occurred to me before, but seems like a good point.

Link to post
Share on other sites

A friend is Director of Operations at a largish tech company, and he tells me that managing all their licenses is a major pain. Sometimes he doesn't even know that some infrastructure is dependent on licensed software until the license expires and that infrastructure stops working. There are companies whose only products are license management systems, so I'm guessing it can be a big deal that cloud providers alleviate license management concerns. It really never occurred to me before, but seems like a good point.

 

 

I don't think I've ever seen it described as such, but license management is really its own weird little job function. As an example of how painful it can be, VMware vSphere has changed their licensing model twice between 4.5 and 5.1. For awhile they dallied with licensing both by socket and by vRAM, so refreshing your servers might mean unusable RAM until you sorted the license change. That licensing model was less than optimally received by the customer base, so they went back to socket count.

Link to post
Share on other sites

Generally not a fan of the concept, it's just too nebulous.

 

I've only in the last two months got a decent size ADSL2 internet plan (200gb/month) before that I've always been reliant on 3G and the costs over over $10/gb) make relying on the cloud prohibitive.

 

Things like steam games and what not I've only just started downloading online only as well for same reason.

 

There are just too many places in the world, with too little internet infrastructure to make it reliable for me.

The cloud is great if you never leave your basement in Europe or America, but outside of those places, the internet is often expensive and unreliable.

One of the reasons I cracked the shits after buying Battlefield 3 in a bargain bin, go to install and it requires 9gb of patches. Nine freaking gigabytes!

So many steam based games are the same, always requiring updates of multiple gigabytes.

Link to post
Share on other sites

License management may be one of the cases where there's an actual benefit for companies. Then again, it's at the expense of heightened dependency on someone else. But that's quite normal as far as business decisions go, you always depend on someone, somehow. But it's rarely limited to license management, and the question really is and should be how critical the information is for the survival of the company that must inevitably be sent back and forth between the cloud provider and you.

 

Can you trust the cloud provider?

Can you trust his employees?

Can you trust the underlying public IT infrastructure?

Will the dependency on the cloud provider create a single point of failure for company operations?

Can the cloud infrastructure handle sustained DDOS attacks from a cyber mob?

What's the potential damage to the company - both in finances and reputation - if the cloud provider cannot protect the data, or cannot maintain the infrastructure?

 

Tight security can only be maintained for truly critical data, if at all. The more people are involved, the more people can (and will) screw up. IT security requires a security oriented mindset in the first place, and since that mindset is often detrimental to other, equally important processes it must be limited to what's absolutely necessary. There, however, half-assed solutions are worse than no solutions at all. IT security isn't free, never was, never will be. Willingness to hand over mission-critical infrastructure to some service provider requires desperation, or a huge leap of faith (which more often than not results in a broken nose after the fall). If it cannot be avoided (the "desperation case") have some contingency plan for a worst case scenario.

 

The worst case can have many different faces. It could be data duplication that goes completely unnoticed. That's a risk that you'll also have to take for complete in-house solutions, of course. The vast majority of IT attacks are insider jobs, after all. Having everything in a remote location (e.g. a data center near the arctic circle) certainly reduces the chances of disgruntled employees to gain physical access to it. Then again, you just have to trust that this data center under aurora borealis illumination actually is as secure as the cloud operator claims, that your data are really there and not elsewhere, that the data center actually exists (if you want to go full retard on paranoia), that there are no government mandated backdoors, and if they exist, that they are created in a way that only the government can use it (unlikely).

Then there's the case of data theft and blackmail.

Then there's the case of PII data falling into the hands of cybercriminals (identity theft, credit card fraud) which opens the door for litigation risk and damage to reputation.

 

A careful analysis will probably reveal more possible risks. Some of them can be diminished with cloud solutions, others may be increased, but in any case good risk management starts with a systematical analysis of what can go wrong, and contingency plans how to react to it. The times where all vital corporate knowledge was stored in lever-arch file binders and rolodesks is long over, yet some managers still haven't grasped the graveness of the situation (or are unwilling to actually deal with it).

Link to post
Share on other sites

There are just too many places in the world, with too little internet infrastructure to make it reliable for me.

The cloud is great if you never leave your basement in Europe or America, but outside of those places, the internet is often expensive and unreliable.

 

Depends on what you mean by "America". In lots of small towns and minor cities in the US and Canada, broadband can be limited. Some locales, the options are either DSL or cablemodem, plus satellite. Fine for home use, but a small/medium sized business may just turn the lights off for the day if the network connection goes down. And those are the very businesses that would most benefit from cloud computing; the ability to outsource 90% of the IT infrastructure must be huge.

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...