Author Archives: CloudTweaks

Cloud Infographic: The Rise Of Cloud Hosting

Cloud Infographic: The Rise Of Cloud Hosting

The Rise Of Cloud Hosting

In years past, companies looking to host a high-traffic website have had one of three main options:

  1. Shared Web hosting services
  2. Dedicated Web hosting services
  3. Hosting on local IT infrastructure

Shared Web hosting services have been most popular with small businesses, but they suffer from performance bottlenecks, limited management features, and no direct server access. Dedicated Web hosting offers a solution to the performance issues of shared Web hosting—but at a cost. Monthly rates are typically high, and support is either expensive or nonexistent. Local hosting has been the route chosen by most corporations, but small businesses and startups often lack the resources and personnel necessary to maintain their own on-premises Web servers.

More recently, virtual private servers have emerged as an intermediate option for customers wanting the flexibility and performance of dedicated servers without the costly hardware overhead. Virtual private servers work well for some customers, but they’re not without their own problems. Continue Reading…

cloud hosting graph


BYOD Is In – Bring Your Own Cloud, Not So Much

BYOD Is In – Bring Your Own Cloud, Not So Much

Bring Your Own Cloud

As employees continue to bring personal mobile devices and laptops into the workplace, most businesses have resigned themselves to dealing with the security and management headaches of the new BYOD reality. But now, with the growing popularity of cloud storage and synchronization services, companies have found themselves facing the next wave in the consumerization of IT: “Bring your own cloud” or BYOC.

In large part due to the flexibility of cloud collaboration services, it’s not uncommon for employees to telecommute from home or from one office to another. Many of these employees back up the entire contents of their computers with services like Carbonite or sync their data between computers with services such as Dropbox or SkyDrive. The practice may seem harmless, but it’s a data management and security headache for IT administrators.

IBM recently banned its employees from using iCloud and Dropbox on any device containing company data, and it’s far from the first. IT managers of companies dealing in significant amounts of confidential and proprietary data can’t do their jobs unless they can control data security and leakage. Employees who share their data with cloud storage services put that information outside the company firewall and beyond the IT department’s visibility. Users who lack tech savvy may even put data at risk of being unintentionally modified or deleted by misconfiguring a cloud app’s file sync settings.

In response to IT professionals’ frustration with the unauthorized use of personal cloud services, Spiceworks—a social network of over two million IT professionals—released a new version of its network analysis tool (Spiceworks 6.0) that can detect over 40 different cloud services running on a network. The tool, which seems to be the first of its kind in public release, identifies all of the cloud services running across a network and which devices they’re running on. The tool’s creation was in direction response to the Spiceworks community’s frustration with the growing BYOC trend.

Corporate executives are also waking up to the reality of BYOC risks at the enterprise level. A recent survey by Forrester found that only 36% of organizations currently have policies in place regarding public cloud storage services, but Forrester analysts expect that number to grow dramatically over the next year.

One of the most common responses to the BYOC phenomenon is for companies to foist a single centrally managed cloud service on their employees. Google Apps and Office 365, for example, have experienced strong growth in the SMB sector, and Box tripled their enterprise cloud storage revenue in 2011. All three services now integrate central data management and strong security features.

As IT administrators fight back against the consumerization of IT—at least when it comes to company data—the future may see a wave of new centrally managed cloud storage services. In a preface to a potentially much larger movement, Google surprised many of its Google Apps resellers by recently announcing that Google Apps administrators will be able to administer their users’ Google Drive accounts. If Google’s willing to do it, then who isn’t?

By Joseph Walker

Data Security In The Cloud: Solutions For Consumers And SMBs

Data Security In The Cloud: Solutions For Consumers And SMBs

Data Security in the Cloud

A recent small business cloud computing survey from Microsoft found that a chief concern of potential SMB cloud customers is the security and privacy of their data. A full 70% of small businesses are concerned about where their data is stored. Just over half of all SMBs cite data privacy as a potential deal breaker for adopting cloud services. And only 36% of businesses think their data is as or more secure in the cloud than their current on premises solution.

Most data security and privacy concerns revolve around four general scenarios:

  1. Hackers compromising data center servers that contain customer or proprietary information.
  2. Hackers “sniffing” improperly secured network traffic.
  3. Data center employees accessing (and possibly sharing) confidential information, especially within a corporate espionage or financial cyber crime context.
  4. Employees losing improperly secured laptops or mobile devices with saved credentials for accessing cloud services.

Thankfully, simple and relatively inexpensive solutions exist for all of these concerns.

Local Data Encryption: Most cloud storage services offer end-to-end data encryption as a standard feature. Unfortunately, relying on a storage provider’s encryption could still leaves data vulnerable to data center employees or hackers who directly compromise the data center’s servers. The simplest method for cloud storage customers to ensure data security is locally encrypting files before uploading them to the cloud. Programs like BoxCryptor allow one-click encryption of individual files or folders.

Encrypted Backup Services: For customers who rely on the cloud for automated backup (without the hassle of individually encrypting files) a third party backup tool can provide an additional layer of security. For example, Duplicati will locally pre-encrypt all designated files using a single user-provided encryption key before automatically archiving and uploading data to a cloud storage provider of the customer’s choice.

Email Encryption: Companies that share confidential information via email should seriously consider PGP for Outlook or GnuPG for Thunderbird. These products encrypt individual email messages using 256-bit AES encryption. Users who prefer webmail can also use FireGPG for Mozilla Firefox to encrypt their email. Email messages encrypted with PGP or GnuPG require that message recipients know the sender’s unique encryption key to decrypt and read the contents of a message.

Third Party Services and Appliances: An entire industry has sprung up around data security in the cloud. Porticor is an example of one such company. The Israeli startup combines a virtual cloud appliance and key management service to securely encrypt data stored in the cloud for Microsoft and VMware cloud applications. Porticor enables companies to run applications in the cloud while keeping their data encrypted.

A number of third party apps, such as Lookout Mobile Security, also exist for locking or wiping mobile devices that may contain saved credentials for cloud services.

HTTPS vs. HTTP Web Services: Many websites offer both HTTP and HTTPS versions of their apps. HTTPS combines the standard HTTP web protocol with the SSL/TLS encryption protocol to provide secure end-to-end data transfer over the Internet. Users concerned with data security should select services which offer the much more secure HTTPS protocol.

When properly deployed, most of these solutions are all but foolproof, but they do require both employee training and commitment. For such security measures to be effective, businesses must invest time and effort into communicating the importance of data security and reinforcing standard security routines.

By Joseph Walker

Cloudy Apps: New Challenges And Complexities

Cloudy Apps

New technologies often simplify some aspect of life, an aspect which was previously painful. But then, as soon as it is adopted, a technology presents new challenges and new complexities.

With cloud computing, you can get a new machine in minutes—less than a minute, in fact, with some of the leading systems. Alternatively, you can provision a new virtual datacenter with secure VLAN and as much storage and “core-age” as you need. Once this is done, the problem of manually sourcing an environment for your application goes away, as it becomes increasingly easy to source one automatically.

With applications, however, there is a new challenge: their environment has to be managed. In the world of cloud, an application is expected to be able to flex when load increases, contract in quiet periods, and generally be efficient about how it’s consuming resources, and do so dynamically. Furthermore, this is not just the case in one site, because if it’s serving users globally, or operating on data-sets in different geographies, it needs to span across sites, adding and removing regions depending on demand, cost or compliance.

The consequence for architects and developers is that an application is no longer just its business logic; it has to carry with its operational logic.

– When should it change the resources it is using?
– How does it safely give up resources, and efficiently “on-board” new ones?
– Where are these policies expressed?

The only sane answer to the last question is that orchestration policies need to be part and parcel of the application. If an application doesn’t describe its deployment and its management—the operational logic—alongside its presentation tiers and its business logic, it is already legacy, and it will bring more complexity over time, not less. On the other hand, if the application embraces its fate, taking responsibility for its runtime lifecycle at dev-time, these operational challenges are addressed in a way app teams know well: by writing it as code—as part of the application—it can be tested, tracked in version control and reused. Continuous integration and testing applies to cloud complexity just as much as to other facets of application development.

There are a number of ways this can be done, with the most exciting activity occurring in the open-source world. Deployment frameworks, such as Puppet and Whirr, can ensure machine portability. Provisioning libraries, such as jclouds, can ensure cloud portability. PaaS offerings, including OpenShift and Cloud Foundry, can ensure application portability, and integrated deployment and management tools such as Brooklyn ensure policy portability.

For green-field applications, these tools—and an approach which treats deployment and ongoing management as core parts of development—give engineers what they need to tackle these challenges.

They enable complexity to be delegated to a PaaS or middleware for those components where it’s appropriate, and for the unavoidable complexity to be managed in other cases, where custom analytics or I/O is essential, or where we are faced with the wide-area realities of replication, consistency, bandwidth and security. By tying in with these open-source projects, application teams benefit from the best practices created by experts without being locked in to proprietary ways of running or managing.

For legacy applications, of course, it might not be practical to transition to new runtimes. However, many of these tools can still facilitate cloud-readiness. By adding a layer of operational logic to the application without touching existing code or business logic, deployment to cloud can be automated, and management introduced, with minimal risk. Eventually, re-architecting may make even better use of the cloud, but the benefits of a lightweight wrapper are significant, bringing at least the orchestration of legacy applications in line with post-cloud application development.

Coming back to our premise, if these tools solve current emerging complexities, it is inevitable that they will soon introduce new complexities. What will these be? Based on our experience, there are a few:  but they’re healthy complexities!

Firstly, the policies become a source of complexity: we recommend keeping them as simple as possible and composing them. But we in the cloud industry (née software industry) are still figuring out best practices.  Open-source policy frameworks are a great place for these conversations to happen. Secondly, everyone in the DevOps chain has to work together to make sure the policies are right for the app and right for the business. In some organizations this can be a challenge, but the rise of DevOps, more agile practices, and testable deployment are helping to ensure that the most valuable resource—people’s time—is spent as productively as possible.

By Alex Heneveld, CTO, Cloudsoft

How To Find IT Specialists For The Cloud

How to find IT specialists for the cloud – CISCO implementation for ConnectEDU

As I said in an article some time ago, Cloud Computing Decreases Production Infrastructure Expenses by over 30% for Web Based Leader in Education Management, as a CTO, I had to find the best solution for implementing efficient and cost-effective production infrastructure. One of the challenges I had to face was migrating from all of my physical infrastructure to Navisite’s Managed Cloud Sevices for ConnectEDU.

In the Cloud Recruitment Perspectives I discussed the importance of professional assistance from specialized IT staffing companies for organizations searching to hire cloud IT specialist. Today I would like to talk about the process of hiring IT specialists based on my experience with the CISCO implementation for ConnectEDU.

First, we looked for migration specialists to map our 60+ servers into the cloud.  We analyzed the processing, memory and disk of each server and then estimated the size of the virtual (IaaS) servers that we would need. We were able to eliminate 15%+ of the servers just by adjusting what ran on each cloud server.

For example we found that we could combine some web services that did not require a tremendous amount of processing or used for overnight processing onto one large virtual server. This led to eliminating the number of servers required and also made things more efficient on the Cisco UCS Cloud Fabric.

When we could, we used physical to virtual conversions. There were several machines that could not be converted easily, like the massive data base servers. We estimated that it would take weeks to convert these massive data base servers so we rebuilt those physical to virtuals by hand and then transferred the data base from a restore point.

Once the system was running in parallel we were able to add additional virtualized load balanced servers for reliability.  It was very helpful working with a team of cloud computing experts that we contracted with during this phase. I also should mention that some of the existing IT staff was hesitant to help with this transition, because they felt like their jobs keeping physical servers running were going away. We worked with them on helping them train for new positions, but they still had a difficult time leaving the physical world. The support of the team was very important during this process. Believing in a better solution and working as a team had great benefits on achieving our goals.

The solution we implemented was a total success and we shared our success with other companies to help them migrate from proprietary application servers towards virtualization and cloud computing. The benefits are massive in terms of technology and employees’ activity. And if you have migrated or are looking for professional assistance please reach out to me, I would be interested in hearing about your successes or for those of you making the switch, I will share with you some of the things I have learned.

By Rick Blaisdell / RicksCloud

Is My Public Cloud Too Public? Part 5

Is My Public Cloud Too Public? Part 5 (Conclusion)

Continued From Part 4

The ideal cloud equation

Control + Visibility = Trust

A cloud deployment that overcomes these myths is built on trust. Trust cannot be achieved without control and visibility across the cloud infrastructure, identities, and information.


  • Availability: Ensure access to resources and recovery following disruption or failure.
  • Integrity: Guarantee that only authorized personnel can access specific information and applications.
  • Confidentiality/privacy: Protect how information and personal data is obtained and used


  • Compliance: Comply with specific legal requirements, and industry standards and rules.
  • Governance: Establish usage rights and enforce policies, procedures, and controls.
  • Risk management: Manage threats to business disruptions or derived exposures.

Changing realities

Cloud computing promises to change the economics of the datacenter, but before sensitive and regulated data move into the public cloud, issues regarding security standards and compatibility must be addressed, including strong authentication, delegated authorization, key management for encrypted data, data loss protection, and regulatory reporting. All these are elements of a secure identity, information and infrastructure model, and are applicable to private and public clouds as well as to IAAS, PAAS and SAAS services.

While security emerges as a major concern among the barriers to adoption of cloud computing, the key to understanding security in cloud computing is to realize that the technology is not new or untested. It represents the logical progression to outsourcing of commodity services to many of the same trusted IT providers we have already been using for years.

Having said that, cloud security is part of the inevitable progression of IT. It must be embraced by organizations if they wish to stay competitive. Companies who approach cloud computing with a mature attitude need not be afraid of entering the cloud due to security concerns. Dealing with security in the cloud is no more difficult than addressing it internally. And there are steps you can take that can make cloud security just as effective—or even more so—as your internal IT.

By Gopan Joshi

Gopan is Product Manager: Cloud Computing Services, Netmagic Solutions Pvt. Ltd. and has expertise in managing products and services in various market scenarios and life cycle stages. His experiences ranges from introducing cutting edge innovations in existing products, existing markets to new technology, new markets

CloudTweaks Comics
The DDoS That Came Through IoT: A New Era For Cyber Crime

The DDoS That Came Through IoT: A New Era For Cyber Crime

A New Era for Cyber Crime Last September, the website of a well-known security journalist was hit by a massive DDoS attack. The site’s host stated it was the largest attack of that type they had ever seen. Rather than originating at an identifiable location, the attack seemed to come from everywhere, and it seemed…

The DDoS Attack That Shook The World

The DDoS Attack That Shook The World

DDoS Attack: Update 2 6 days after the DDoS attack that rocked the internet to its core, Dyn have released detailed analysis of the attack and further details have emerged. The attack has been confirmed to have been the largest of its kind in history, and the Mirai botnet has been cited as the official cause.…

Update: Timeline of the Massive DDoS DYN Attacks

Update: Timeline of the Massive DDoS DYN Attacks

DYN DDOS Timeline This morning at 7am ET a DDoS attack was launched at Dyn (the site is still down at the minute), an Internet infrastructure company whose headquarters are in New Hampshire. So far the attack has come in 2 waves, the first at 11.10 UTC and the second at around 16.00 UTC. So…

Cloud Infographic – DDoS attacks, unauthorized access and false alarms

Cloud Infographic – DDoS attacks, unauthorized access and false alarms

DDoS attacks, unauthorized access and false alarms Above DDoS attacks, unauthorized access and false alarms, malware is the most common incident that security teams reported responding to in 2014, according to a recent survey from SANS Institute and late-stage security startup AlienVault. The average cost of a data breach? $3.5 million, or $145 per sensitive…

Ending The Great Enterprise Disconnect

Ending The Great Enterprise Disconnect

Five Requirements for Supporting a Connected Workforce It used to be that enterprises dictated how workers spent their day: stuck in a cubicle, tied to an enterprise-mandated computer, an enterprise-mandated desk phone with mysterious buttons, and perhaps an enterprise-mandated mobile phone if they traveled. All that is history. Today, a modern workforce is dictating how…

The Cloud Is Not Enough! Why Businesses Need Hybrid Solutions

The Cloud Is Not Enough! Why Businesses Need Hybrid Solutions

Why Businesses Need Hybrid Solutions Running a cloud server is no longer the novel trend it once was. Now, the cloud is a necessary data tier that allows employees to access vital company data and maintain productivity from anywhere in the world. But it isn’t a perfect system — security and performance issues can quickly…

Adopting A Cohesive GRC Mindset For Cloud Security

Adopting A Cohesive GRC Mindset For Cloud Security

Cloud Security Mindset Businesses are becoming wise to the compelling benefits of cloud computing. When adopting cloud, they need a high level of confidence in how it will be risk-managed and controlled, to preserve the security of their information and integrity of their operations. Cloud implementation is sometimes built up over time in a business,…

How Formal Verification Can Thwart Change-Induced Network Outages and Breaches

How Formal Verification Can Thwart Change-Induced Network Outages and Breaches

How Formal Verification Can Thwart  Breaches Formal verification is not a new concept. In a nutshell, the process uses sophisticated math to prove or disprove whether a system achieves its desired functional specifications. It is employed by organizations that build products that absolutely cannot fail. One of the reasons NASA rovers are still roaming Mars…

Three Reasons Cloud Adoption Can Close The Federal Government’s Tech Gap

Three Reasons Cloud Adoption Can Close The Federal Government’s Tech Gap

Federal Government Cloud Adoption No one has ever accused the U.S. government of being technologically savvy. Aging software, systems and processes, internal politics, restricted budgets and a cultural resistance to change have set the federal sector years behind its private sector counterparts. Data and information security concerns have also been a major contributing factor inhibiting the…

Digital Transformation: Not Just For Large Enterprises Anymore

Digital Transformation: Not Just For Large Enterprises Anymore

Digital Transformation Digital transformation is the acceleration of business activities, processes, and operational models to fully embrace the changes and opportunities of digital technologies. The concept is not new; we’ve been talking about it in one way or another for decades: paperless office, BYOD, user experience, consumerization of IT – all of these were stepping…

The Importance of Cloud Backups: Guarding Your Data Against Hackers

The Importance of Cloud Backups: Guarding Your Data Against Hackers

The Importance of Cloud Backups Cloud platforms have become a necessary part of modern business with the benefits far outweighing the risks. However, the risks are real and account for billions of dollars in losses across the globe per year. If you’ve been hacked, you’re not alone. Here are some other companies in the past…

Are CEO’s Missing Out On Big Data’s Big Picture?

Are CEO’s Missing Out On Big Data’s Big Picture?

Big Data’s Big Picture Big data allows marketing and production strategists to see where their efforts are succeeding and where they need some work. With big data analytics, every move you make for your company can be backed by data and analytics. While every business venture involves some level of risk, with big data, that risk…


Sponsored Partners