Where does the cloud end?

When we talk about the "public cloud," most of us are referring to the hosted, multi-tenant servers that software-as-a-service (SaaS) vendors use to run their systems. In recent years, the generally accepted definition has expanded to include the servers hosting platform-as-a-service (PaaS) and infrastructure-as-a-service (IaaS) as well.
 
But does the cloud end where these servers open up ports to users? That depends on whom you ask. Some cloud vendors assume or require that you have more than just a browser; we're seeing, in some cases, a significant set of additional software requirements. What's that, you say?  What “software” requirements?  Shouldn't the public cloud require nothing more than a free, modern browser and a (preferably high-speed) Internet connection?

Turns out this is a philosophical issue. Some software vendors simply believe that it's okay, or perhaps even desirable, to create tight coupling between its server-side resources and its customers' desktop and network environments. For the record, my view is that the public cloud experience isn’t supposed to include interminable client-side desktop setup steps.

Heavyweight desktop requirements are a step backward in the history of public cloud computing, but they do raise a useful point.  The cloud doesn’t have to end at the vendor’s server port.  It’s necessary, but not sufficient, for the server-side software to be hosted, and multi-tenant.  In order to realize the full potential of cloud computing, the burden on IT should be reduced further.  One of the greatest benefits of the cloud is that IT can stop worrying about care and feeding of servers.  But another, less obvious benefit is the ability to reduce, if not eliminate, IT’s burden in maintaining client software and systems.

In the client-server era, we expected employees to install “thick clients” to get online to access our corporate systems.  Towards the end of this era, we began adding native web capabilities to these server-based systems, so users could point browsers at port 80 and get some basic functionality.  (I recall, while running tech support at Borland around 2004 or so, asking one of our product managers why we still required customers to install our thick client, rather than providing web-based access.  Answer:  we’d like to, but it’s not on the short-term roadmap.  Never made it, either.)

Fortunately, as we passed from the client-server to the public cloud era, browser-based access became table stakes.  The shift occurred quite dramatically for consumers; when’s the last time you bought shrink-wrapped software for the home computer?  Yet still today, many companies tolerate the “thick client” mindset for corporate software.

This mindset is costly, in terms of both dollars and mental bandwidth.  To put it simply:  IT should not be in the desktop/laptop business.  The idea that your IT department ought to dedicate a hefty amount of its time, attention, and budget to distributing and maintaining PCs is outmoded, rooted in an era when workers weren’t familiar with technology and enterprise software required complex client configurations.  The only reason in 2011 for IT to continue providing this anachronistic service is institutional inertia, pure and simple.

And this mindset isn’t costly just for IT.  It’s off-putting, and counter-productive, for employees too.  I worked onsite for a large customer for awhile last year, and while our project work was quite innovative, the surrounding IT environment felt like stepping back via a time machine.  PCs that took 10 or 15 minutes to boot up and configure onto the network.  Restrictions against installing useful software utilities.  Inability to use video conferencing on any platform other than the corporate-approved vendor’s.  The cumulative effect of such arbitrary and needless restrictions is to institutionalize mediocrity by essentially making employees give up on trying anything remotely creative.

The cloud shouldn’t end at the SaaS server.  It should end as far out as we can push it.  Recent experiments with Internet-only notebooks are the right sorts of idea - getting IT out of the laptop game entirely, making the operating system itself part of the cloud.  The security benefits of doing so are significant.  As much as the “cloud security” red herring gets tossed around, real-world security breaches are almost inevitably the result of compromised corporate networks and lost laptops containing sensitive data. Even last week's Sony Playstation data breach was apparently caused by an unpatched Apache server and improper server firewall.  Our data is more secure when we move it away from the lightly-defended perimeter - our employees’ machines and corporate servers - and into the hardened core, which is in our SaaS providers’ data centers, where dedicated security professionals have proven that their infrastructures can withstand constant attack.  If you are aware of a single security incident that occurred as the result of a breach of a SaaS provider’s native security infrastructure, I’d like to hear about it.

I’m describing a cloud nirvana, where all corporate systems rely on public cloud SaaS and PaaS, virtually all documents are stored in the cloud, “client software” is a largely forgotten concept (except for some client-side-only developer and graphics tools), and there’s no need for a corporate network, so employees can connect to company resources anytime, anywhere, from any device.  IT is free to focus almost exclusively on solving business problems, rather than maintaining commoditized infrastructure.

By the way, I’ve just described my company.  How about yours?  Are you there yet?  Are you moving in the right direction, or is your IT idling in place, preserving (or deepening) its dependency on outmoded on-premise technology?  Where does your cloud end?
 
Glenn Weinstein is the CTO and co-founder of Appirio, where he oversees the CloudWorks and Cloud Management Center product lines as well as internal IT.