10:06 AM
Lawrence Garvin
Lawrence Garvin

Stop The Cloud, I Want To Get Off

Hardly any of the services that vendors market as "cloud" adhere to the 2011 NIST definition. No wonder we're so confused.

Here a cloud, there a cloud. Everything today is a cloud service. Except most aren't.

In September 2011, after several years of discussion and 15 drafts, the National Institute of Standards and Technology adopted a real definition of cloud computing. Since then, however, NIST's definition has been lost in translation due in part to opportunistic vendors and marketers, aided at times by ignorant media.

NIST defined five essential characteristics of cloud services: on-demand self-service, broad network access, resource pooling, rapid elasticity, and measured service. Virtually no "cloud" service offered today meets all five characteristics.

NIST further defined three cloud models: software-as-a-service, platform-as-a-service, and infrastructure-as-a-service. But all three existed in practice long before the term "cloud" ever entered the vernacular.

[Will your cloud be successful? Read Enterprise Cloud Adoption: 5 Hard Truths.]

Consider the idea that AOL and CompuServe were SaaS providers, as were the myriad ASPs (application service providers) that sprouted around the time of the dotcom boom. Several companies have provided hosted corporate email servers for a dozen years -- are they not PaaS providers? It's been just as easy to buy a hosted "computer" for running a web server or other software fully managed by the customer. This is no different from IaaS.

None of these services were then -- nor are now -- consistent with the true ideals of cloud computing. Certainly none of them provided on-demand self-service. If I needed to ramp up a hosted email environment or acquire a machine to host a web server, those efforts took days, contract negotiations, and a bunch of other headaches that defied "on-demand."

Broad network access is probably the least significant of NIST's cloud characteristics. Everything runs across the Internet, a wireless carrier's infrastructure, or both, including simple file storage and sharing services, which are as old as FTP servers. But broad network access is the one characteristic most companies latch onto in claiming their cloud bona fides.

Source: Wikipedia.
Source: Wikipedia.

Resource pooling is a de facto characteristic in almost every IT environment because of the extreme levels of virtualization being employed. The latter is the biggest difference between hosting an email server today and doing so several years ago. Today, your email server is just as likely to be a virtual machine on a cluster of several dozen virtual machines -- assuming you're still running email in-house rather than just subscribing to a service.

A defining factor in whether a service is cloud based should be multi-tenancy, the ability for my services and your services to co-exist, in isolation, within the same physical environment. In contemporary terms, this is something like Office 365, whereby your organization has a group of users sharing the same email server with lots of other groups of users.

Two other defining characteristics are rapid elasticity (the ability to scale up and down quickly as needed) and measured service (whereby payment is based on actual use, not potential use).

Rapid elasticityimplies that the scaling of services happens automatically, not just when some human finally recognizes the need as requested.

If you're paying a monthly subscription fee for a SaaS product based on the number of licensed users, that's not measured service, so that's not a cloud service. If you're renting a machine in a hosting facility and you're paying a flat monthly fee for access to that machine regardless of how much you use it, that's not measured service. If you can't add more machines under that hosted service automatically before you exceed the capacity of the first machine, that's not rapid elasticity, thus not a cloud service.

It's no wonder IT professionals -- and consumers, for that matter -- are so confused. Some definition offenders label their products cloud just because they're on the Internet and are running in some virtualized infrastructure, which is the case with many SaaS products. Others have defined their own version of the term cloud, attempting to reduce the distinction to a simple matter of where the data is stored. For example, they state that the cloud is just a metaphor for the Internet, and that storing data on an office network doesn't count as cloud storage. But that claim puts a big a dent in the concept of a private cloud environment. It's also based exclusively on the idea of broad network access, without any consideration of the other characteristics of cloud services.

What would make the above "cloud services"? How about your SaaS provider billing you based on the actual number of users each day, or the number of actual logged-on minutes per day, or, best of all, the number of actual minutes of application used each day? For a hosted email service to truly be a cloud service, it would be billed based on the actual resource consumption each day, giving customers unlimited capacity and the ability to add and remove users on-demand. Customers wouldn't pay more just because they added more mailboxes. So if you have to do more than call up a single Web page to change something in your service provisioning, or if you're paying a flat fee per some time period or per user, let's just call the service what it is: SaaS, not cloud.

In a survey of 200 IT managers conducted by ElasticHosts in October 2012, more than 67% of respondents said they had been offered cloud services under a fixed term, 40% had been offered services that weren't scalable, and 32% noted that the services offered weren't even self-service. There's no reason to think much has changed since then.

Is your company using any actual cloud services? Or are you using not-cloud services labeled as such? Do you want to get off the merry-go-round with me?



Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Charlie Babcock
Charlie Babcock,
User Rank: Author
2/24/2014 | 7:21:47 PM
Maybe less confusion than Lawrence suggests
The NIST draft definition was in place in 2009, and was not drastically changed between then and the 2011 version you cite. The "definition" isolated key attributes of an evolving picture. Much has changed since it was drafted and I see the line blurring in particular between IaaS and PaaS. But nevertheless the definition was serviceable--it captured a computing reality that had appeared on the scene that did not match predecessor models. I would disagree that Amazon Web Services and several other providers fail to meet the terms of the definition. When it comes to cloud terms, there 's always room to debate but I see less confusion than Lawrence does as users move to the cloud.


User Rank: Apprentice
2/24/2014 | 5:09:08 PM
ASP masquerading as SAAS
I can confirm that there are numerous web based services in the Insurance vertical that would like to be considered SAAS but which are no where near meeting even an emaciated version of the NIST definition. 

Not only are the pricing and contractural models wrong, but many of these services lack a proper API to enable "on-demand self-service" which is at the heart of any true SAAS product.

One of our core service providers can only receive bulk data via an FTP upload, and emit it via CSV file download! This is a 1990's style Application Service Provider model, and not a very good one at that. Made all the worse by the recognition that we are already halfway through the second decade of the 21st century. 

Without the benefits of the agility, flexibility and integratability (to coin a term) of true SAAS, many of the benefits of cloud are being left on the table and clients are being served a thin mutton gruel charged out as lamb.


IW Pick
User Rank: Author
2/24/2014 | 11:35:48 AM
SaaS vs.Cloud
As someone who has been covering cloud computing for several years, I understand the community's fondness for definition debates. However, the reality is that most business-side people think of SaaS as cloud. They don't care about NIST definitions, nor do they want to debate them. They want speed -- and whether SaaS is cloud by your definition or not, SaaS has been the earliest exposure to cloud agility that many of the business side people have had. I would say let's stop worrying about definitions -- we are capable of explaining SaaS, IaaS, and PaaS differences. I have no problem lumping them all under the umbrella term of "cloud computing." By the way, I don't see why something must be multi-tenant to be cloud.
2014 Next-Gen WAN Survey
2014 Next-Gen WAN Survey
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest, Dec. 9, 2014
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong