Published:
May 26 2011, 11:42 AM
|
no comments
by
Robert Stroud
As mentioned on Monday, this week I am attending the Plenary Meeting of SC/7, where CA Technologies is the major sponsor. CA Technologies sponsored this event as we believe standards are important to the delivery of our own IT as well as that of our customers. CA Technologies investment in standards supports our customers in their acceptance and adoption of cloud technologies by delivering them secure, interoperable and transparent path. These comments were featured in the opening session which featured a keynote from my French colleague, Yves La Roux, who has been involved in standards for many years.
Yves has allowed me to share his keynote with you below. Well done Yves and thanks CA Technologies for sponsoring the event.
Yves Le Roux Keynote
ISO/IEC/JTC1/SC7 Plenary Meeting
Paris May 23rd 2011
On behalf of CA Technologies, I want to welcome you in Paris for this ISO/IEC/JTC1/SC7 Plenary meeting.
Personally, to be on this stage reminds me the time where I was a Vice-Chairman of the ISO/ TC 97. I was not in charge of the ISO/TC97/SC7 which was one of your ancestors but Wada-San was. I don't know if some of you were SC 7 members at that time. When it was? From 1984 to 1987. The first meeting of JTC1/SC7 took place in Paris in 1987 and we have seen how much work this subcommittee has accomplished during these 24 years.The main challenge with Information Technology is the speed of evolution with sometimes the apparition of disruptive technologies which may turn upside down our practices.
Ten years ago, remote access was still in its infancy. Most consumers and businesses relied on 56k modems, and faster lines were cost-prohibitive. Now that cheaper alternatives, such as DSL and cable, are readily available to all budgets, remote desktops run at the same speeds or even faster than locally-run systems.
Cloud computing is seen by many as a new wave of information technology for individuals, companies and governments. The National Institute of Standards and Technology (NIST) defines cloud computing as "a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources that can be rapidly provisioned and released with minimal management effort or service provider interaction."
This created new roles inside our IT environment (Cloud Service Consumer, Cloud Service Provider, Cloud Carrier, Cloud Broker and Cloud Auditor) According to the NIST definition, this Cloud computing is proposed in three well-known and frequently-used service models (Software as a service, platform as a service and Infrastructure as a service) and four deployment models (Public, Private, Community and Hybrid). In an on-premises model, the organization is responsible for all aspects of IT-people, processes, and technology. The organization buys the hardware, licenses the software, secures the datacenters, defines processes and procedures, and hires the people who run everything.
By contrast, particularly in non-private clouds, many of these functions may be handled by the Cloud Service Provider, whose system administrators might be its own employees or even third parties it has hired.
Many elements of cloud services represent wholesale change. For example, to make cloud services capable of expanding flexibly, hardware is often shared among customers, and the -security boundary between them may be virtual (through the use of virtualized compartments) rather than physical (through the use of separate hardware). In addition, on the- fly allocation of extra resources might mean that the geographic location of data depends on scalability, availability, or other factors rather than on security and jurisdictional considerations, especially when a Cloud Service Provider has datacenters in multiple jurisdictions. This can create uncertainty about which laws apply to the handling of the data.
But, today's data governance and compliance issues faced by companies around the world are the same whether information is in a cloud environment or on premise.
We must never forget that a system consists of five key components organized to achieve a specified objective (Infrastructure, Software, People, Procedures and Data). The massive managerial and technical interdependencies between cloud services providers and clients create many difficulties and costs.
Last March, Neelie Kroes, EU commissioner with responsibility for the Digital Agenda, stated:
"International standardization efforts will also have a huge impact on cloud computing. Open specifications are a key in creating competitive and flourishing markets that deliver what customers need."
Similarly, in April, during the last NIST Cloud computing forum, the U.S. Chief Information Officer Vivek Kundra called upon NIST to help accelerate the federal government's adoption of secure cloud computing practices by leading efforts to develop standards and guidelines in collaboration with standards bodies, the private sector, other government agencies and other stakeholders.
But, to-day, there is much less standardization across Cloud Service Providers, which can create problems if an organization wants to use more than one cloud. Providers often specialize in particular business applications, so organizations may well want to link information, processes or interfaces between clouds or between internal and external services, for example to provide single-sign-on.
They may also wish to change providers but find it hard or expensive to transfer and convert data, programs or applications from one provider's format to another.
For CA Technologies, standards that support interoperability, portability, and security, developed with input from stakeholders and in an open and transparent process, can help the movement to the cloud.
But currently, a plethora of organizations are working to standardize cloud computing without coordination
In May 2010, the ITU Telecommunication Standardization Bureau finds some 20 standards bodies, consortia and other interest groups working on cloud computing standards. And we see more coming
For CA Technologies, we need to have a clear vision of the standardization effort and to understand how these standards are complementary and can be used in conjunction for business benefit.
Any non-trivial application or business service is a composite application. Composite applications assemble functional building blocks into the solution using technology like SOA, workflow management and business processes, and portals or mashups. Online commerce, self-service banking, and internal HR systems are all examples of composite applications.
Today, almost all resources in a composite application are "behind the firewall" and "in the datacenter". This approach to deploying applications is analogous to vertically integrated manufacturing and logistics. Retail and manufacturing has evolved from vertically integrated manufacturing to a distributed, multi-company supply chain. The emergence of cloud services will create a similar transformation in business applications. The composite application becomes a supply chain of cloud services and infrastructure.
Enterprise IT will evolve from a primarily on-premise "factory" model to a cloud service supply chain.
It is crystal-clear that the cloud service supply chain cannot thrive without an effective Cloud Computing governance framework standard that promotes and ensures coordination between the various actors and JTC1/SC7 working in close cooperation with others in ISO is well placed to work on this potential standard.
Another important point for CA technologies is the impact of the Cloud computing wave upon some of the SC7 standards that we have currently implemented or used as a basis for our products; particularly, those related to Information Technology Service Management (e.g.ISO 20000), Information Systems Governance Frameworks and Systems (e.g. ISO 38500) and Process Implementation and Assessment (e.g. ISO 15504).
We are quite sure that this subcommittee has noticed this point and will work in order to evolve those SC7 impacted standards to encompass the Cloud Computing phenomena.
Concluding on this remark, on behalf of CA Technologies, I wish everyone a very fruitful meeting.