Cloud Computing & The Forgotten Legal Aspects

With all the hype (technical & marketing) around cloud computing the business risks of the cloud often get overlooked - especially the legal aspects. We've heard about the big benefits:
- access from anywhere with an internet connection
- minimizes capital investment (hardware, facilities, etc.)
- potential for quick scalability (if applications are capable)
- temporary computing capacity (staging, development, DR, migrations)

Most of us in the industry also know about some of the security risks (CIA) associated with cloud computing too. An example of the availability risk recently occurred on August 6th, 2009 when Twitter, YouTube, and LiveJournal were all impacted by a DDoS attack (see NYTimes article). Unlike some of these areas, the legal implications of the cloud are still "To Be Determined" (TBD).
What are some of the legal areas that need to be considered when you begin to seriously consider Cloud Computing for your enterprise?

Jurisdiction: How do you determine where the data is being stored? This is important because it will determine what courts have jurisdiction and what law governs the use and treatment of that data.

Privacy: What legal access rights do law enforcement organizations have over personal information stored in the cloud? Remember that privacy laws vary considerably between countries and also between states within the US.

Licensing and Contractual Issues: What controls are in place for fee increases and service levels. How do you transfer from one cloud provider to another? (Are you locked in to a technology if your utilizing Microsoft's Azure or Google's App Engine?) What intellectual property protections are in place for the solution, the stored information, the hosted applications, etc.

I'm not suggesting these legal issues are important to everyone, or even enough of a reason to avoid the cloud in it's current state. What I am suggesting is, you want to be sure and consider these areas and understand the risks involved for your organization before you decide to jump on the cloud computing bandwagon.

Don't be Another Statistic!

Small Business Cloud Computing Value

I've been following cloud computing (in the loose marketing sense of the word) for the last 18 months or so. There's quite a bit of conversation in the press, IT circles, with friends and colleagues about the merits of the "cloud" and when it's best used and how. I am of the mindset that it makes sense depending on the circumstances (what every IT consultant always says right).

Over the past 18 months I've been lucky enough to have the opportunity to work on\in two start up companies. One of the items I've learned from this experience is cloud computing (application hosting variety) provides a great advantage to small business, which were unthinkable 3+ years ago. The advantage it provides is the opportunity to leverage the same type of business processes supported by technology that in the past only the medium to large enterprises had the scale and money to utilize. 3+ years ago, how many small businesses could have CRM, HRIS, email, website, telephone systems, and ecommerce functionality? Because of cloud based computing and application hosting, small businesses can utilize the technology that in the past only the bigger companies could afford. And they can do this without paying computing professionals to manage computing infrastructure every day.

The services are wide ranging - but here are some of the services I've used for free or very little cost:

CRM - Everyone knows about salesforce.com but Zoho CRM is my preference at the moment. It's free for up to 3 users and provides lead generation forms that can be integrated into your website along with basic workflow all for free.

HRIS (Human Resource Information System) - Zoho People provides a nice employee portal and HR management (application tracking, vacation requests, etc) system that is free for up to 10 employees. It allows you to integrate an application\profile submission process into your website along with basic workflow all for free. Zoho also provides an online testing tool that could be used to test potential candidates via the web - they call it Zoho Challenge.

Phone System (PBX\Auto Attendant) - My favorite in this space is Grasshopper (previously gotvmail). Using their system allows you to have a toll-free number with an answering machine on steroids. While they don't offer a free plan, they have pricing plans starting as low as $10/month. This is a great deal when you consider a system that offers this type of functionality would cost at least $10k to implement and $2.5k a year to maintain.

Document\File Share (file server) - There is a lot of competition in this space that comes in many varieties from the likes of big players like Microsoft and Google - along with Zoho who all want you to use their applications for your work. I find that people like to use their preferred tool for documents (MS Word, Open Office Writer, etc), presentations, spread sheets, etc. so I like to use a storage platform that doesn't lock people into a set of tools. My favorite tool here is called DropBox. It stores your files in the "cloud" while representing them as a local directory or directories and it allows you to manage who can access the files and directories (you can share them with people by just using their email address). And a side benefit is you don't have to worry about setting up a backup schedule!

Email\group calendaring\website - What business can survive without email and calendaring today? There are many free providers today - Microsoft and Google are the first that come to mind (Google for businesses isn't free anymore - $50/user a yr). I prefer Google email and calendaring (Gmail for organizations) because it's free and offers the right technical functionality for the price (biggest being IMAP access).

podcast hosting - If you use podcasting in your business, you can't beat libsyn for hosting of the podcasts for around $10/month.

There are many, many other areas and applications I could\should cover but I will end it here for now.

The main point here is if you're a small business, you have more tools available to you to help you serve your customers! And if your considering building your own infrastructure or upgrading it, WHY? Here are some simple numbers to think about when you begin to think the services outlined above are too expensive and you can do it yourself cheaper.

Cost of power for a computer per month: ~$20

Cost of a computer hardware per month: ~$17

Cost of 1 hour of computer support: ~$75 **

Total cost for a month: ~$112*

*not including cost for internet access because you'll likely need to have it regardless of your decision.

**assuming you only need 1 hr of assistance a month - which is really conservative

Here are some posting that cover what google apps you should use from a marketing\web perspective that are valuable:

Which Google Products Should A Small Business Use?

Which Google Products Should A Small Business Use? (Part II)

Windows 7: Enterprise Features Add Value for IT?

A recent article on CIO.com outlined some of the enterprise features that Microsoft product management believes Windows 7 provides. After reading the article and some of the posted comments I wanted to outline my thoughts on the features mentioned in the article and how they could have a positive impact for enterprise IT.

While I don't drink the MS kool-aid, I believe there are some advantages to the Windows 7 release for enterprises to consider.

For enterprise level endpoint OS management, MS has the most mature stack out there. If you're a doubter, look at how Red Hat and SUSE are playing catch-up on the Linux enterprise management front and Apple on the Mac front. Because its a mature stack you will likely continue to see incremental improvements as opposed to ground breaking advances. (the reality of mature products)

The incremental security functionality provided by BitLocker to Go and AppLocker, if it's not administratively burdensome, will help IT organizations to narrow the threats introduced by end user ignorance of maleware\spyware (which according to some security surveys is the #2 security incident within enterprises) and their propensity to leave intellectual property unprotected (especially when traveling - mobile device theft is the #3 most often occurring security incident). DirectAccess could help to protect the corporate network\infrastructure from the proliferating use of open WLAN access points that enterprise employees utilize when working remotely. If BranchCache improves MS's implementation of DFS (which still isn't ready for enterprise use), it could help to eliminate the capital outlays required for WAN acceleration and\or WAN bandwidth. All of these features, if they work well, could result in real capital savings for IT organizations. Desktop search - we'll see if they can beat the performance of the google search appliance.

Example of Why Cloud Based Computing is Smart

This Google Data Center YouTube video gives a great example of the attention to detail that Google has paid to data center infrastructure (HVAC, power, etc) along with the advantages of scale they have, provides efficiency levels most organizations could only dream of.

The way Google (along Amazon, IBM, Microsoft, etc) is much more efficient and cost effective than most of us can provide\justify for our own organizations. This is an example of why cloud computing begins to make sense and maybe the realization of Carr's vision of IT just being similar to the power grid - it just works.

Local SMTP Server setup for PHP on Mac OS X

I've been coming up to speed with PHP 6 on a Mac OS. One of the challenges I ran into was utilizing PHP's mail() command to send emails to my gmail and yahoo accounts for testing. There are plenty of directions out there on configuring Postfix on Mac OS X (default smtp server on OS X since since 10.3, I believe) but you'll have to configure dns settings (enable reverse lookups, etc.) in order for most public smtp servers to accept your smtp servers' connections. Failing to do this will cause Postfix errors like - "connect to gmail-smtp-in.l.google.com[*.*.*.27]: Connection refused (port 25)" -.

To get around this I did the following:
1) enable Postfix utilizing the "Activating Postfix on OS X 10.4 (Tiger)" from David Reitter's web site (works on 10.5 too) -
Utilizing the setup he outlines will allow you to send to test smtp servers you utilize internally but most properly configured external smtp servers will reject your smtp servers connection as I mentioned earlier.

2) setup postfix to utilize gmail or other publicly available smtp servers (if you have a gmail account of course...) by following these steps:
- add the following lines in "/etc/postfix/main.cf" by using the following command:
sudo pico /etc/postfix/main.cf
Add These Lines:
relayhost = [smtp.gmail.com]:587
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_CAfile = /etc/postfix/cacert.pem
smtp_use_tls = yes

3) create the file "sasl_passwd" referenced in the main.cf you just edited using the following command:
sudo pico /etc/postfix/sasl_passwd
Add this line:
[smtp.gmail.com]:587 user.name@gmail.com:password (if your using gmail)

4) restrict file permissions with:
sudo chmod 400 /etc/postfix/sasl_passwd

5) convert the password file (sasl_passwd) into the correct format for postfix:
sudo postmap /etc/postfix/sasl_passwd

6) download a copy of "cacert.pem" that you trust and install into:
/etc/postfix/cacert.pem

7) start postfix:
sudo postfix start

send a test email from php using sendmail and it should work.

I've also used information from Christer Edwards on his Ubuntu Tutorials site.

Cloud Computing Craze (C3)

The Cloud computing craze continues to grow. You know the craze is in full swing when other technologies start to utilize "Cloud" in their names and companies try to protect a common term like "cloud computing" with a trademark. Thankfully the USPTO came to their senses and rejected Dell's trademark application. (Guess you can't blame a company for trying...heck Microsoft has been able to maintain "Windows" as IP or was it Lindows?) Some of the latest terms being thrown around:
- Applications in the cloud - can you say SaaS, which was sexy along with web 2.0 until cloud became sexier (why does this remind me of the fashion world or Hollywood)
- Platform in the cloud - wasn't this originally called PaaS when SaaS was still sexy?
- Infrastructure in the cloud - this is your little brothers "Cloud"

With all seriousness, its amazing how portions of the technology field gravitate towards the next cool thing and then marketing organizations tag right along, renaming their products to sound sexy. Along with this mania, some techies will find a reason to use this technology whether its a fit or not. Some of the latest crazes that also follow this model are Ruby on Rails, Open Source, and VoIP. Just a few that quickly come to mind. These technologies aren't the panacea of their related technology areas. They are a tool in a tool belt of technologies we have available to us.

Cloud computing is great and offers a lot a benefits but it's not the end all, be all for IT. Many people such as Nicholas Carr and technology marketing departments like to make it out to be the killer app. They rally behind it because it helps to sell the books or technologies they happen to be pushing at the moment.

For those of you that make technology decisions for organizations - don't get caught up in the hype. Cloud computing has plenty of value but don't over subscribe to utilizing it. Be sure to analyze the appropriateness of it within the context of your overall architecture and business needs.

What to do with your life...

I've been reading chunks of "Best of Technology Writing 2007" via my DailyLit subscription. Best of Technology Writing is a culmination of articles that range from the philosophical diatribe to business ballyhoo. The portion I just finished reading was from Aaron Swartz called "A Non-Programmer's Apology". Its one of those interesting philosophical reads that takes you through a brief journey of 'What profession should I choose or attempt to do....'. I think most of us seem to ask this question at least once during our life. I'm almost forty and I remember three very distinct times where I struggled with this very same question. I assume I will struggle with it again in the future.

Am I right to assume that most people struggle with the question: "What type of work should I do for a living?"?