Cloud Computing

A Few Reasons to Consider Cloud Security in 2012

Michael Osterman — Wed, 08 Feb 2012 19:33:50 +0000

While on-premises security solutions can provide robust defenses against spam, malware and other security threats, cloud-based security—used either as a standalone solution or in conjunction with on-premise defenses—offers a number of inherent advantages:

Most threats never hit the on-premises network—The use of a cloud service for spam processing, for example, eliminates the majority of content processing, storage and bandwidth associated with spam before it ever reaches the customer’s network, making the on-premise infrastructure more efficient. More critically, the bulk of malware can be eradicated before it ever reaches the corporate network, leaving on-premise solutions—if they are in place—to act as another layer of protection against these threats.
More efficient use of IT resources—One of the key issues that should be considered by any organization—but one that often is not—is the opportunity cost of IT staff members. Most CIOs and IT managers would agree that finding and retaining highly qualified IT staff is not an easy task. As a result, in-house IT staff should be used so that they can provide maximum efficiency to their employer, while also giving them a satisfying work experience that will motivate them not to move elsewhere. A cloud security solution—whether used for messaging security, Web security or other capabilities—allows IT staff members to move on from managing security servers and appliances and to work on projects that provide more differential value to the organization and that can result in greater job satisfaction.
Easier support for mobile and remote users - Given that a growing proportion of the working population is mobile—either because of corporate telework initiatives or employees who travel as part of their work—security for these employees can be difficult to manage using on-premise systems. Cloud security capabilities can provide a high level of protection for these employees, many of whom use Wi-Fi hotspots and other resources that are much less secure than their in-office counterparts.
Extending the life of on-premises solutions—Related to the point above is that cloud services allow an organization to extend the useful life of an in-house security solution. For example, if a company has reached the maximum capacity of its email filtering appliances, it could implement a cloud-based spam filtering service that would dramatically reduce the amount of incoming traffic and thereby allow new investments in internal hardware to be postponed or avoided altogether.
Improved disaster recovery and business continuity—Another important advantage of cloud solutions is that they can provide a very useful backup messaging solution in the event of an outage of the primary messaging system. For example, most cloud security providers will spool incoming email for at least several days (much longer in some cases) if it cannot be delivered to a customer’s server. This prevents an email server outage from causing bouncebacks to senders and ensures that incoming email is still being processed.

We have just published a white paper on this topic that you can download here.

An Interesting Approach to Cloud Storage

Michael Osterman — Thu, 08 Dec 2011 07:34:21 +0000

Symform is a Seattle-based company that has developed an interesting approach to cloud-based data storage. Instead of building out a traditional data center, Symform customers provide all of the local storage themselves that Symform assembles into a cloud-based offering. The system works like this:

Data is uploaded from your local sources and divided into 64-megabyte segments that are protected using 256-bit AES encryption.
Each 64-megabyte segment is then further broken up into one-megabyte segments.
To each group of 64 one-megabyte segments, 32 one-megabyte parity fragments are added using a RAID algorithm.
The 96 one-megabyte fragments are then distributed randomly across the base of Symform customers worldwide (although most are currently in North America and Europe, with a handful in Asia, South America and Africa).

When a customer pulls down data from the cloud, it’s gathered from these disparate sources and assembled into the file(s) that have been requested. The 32 parity segments for each block of 64 one-megabyte segments adds 50% to the overall storage requirement, but makes the system highly redundant when local storage is corrupted, customers’ storage systems are turned off or otherwise unavailable, etc.

One of the fundamental advantages of the Symform approach is its very low cost: the first 200 gigabytes of storage is free, while unlimited storage for three users is just $100 annually. The only “catch,” if you can call it that, is that customers must provide as much storage locally as they receive in the cloud, since they—in effect—are the cloud. Symform’s goal in using this highly distributed model is to drive down the cost of cloud-based storage, making it comparable in price to local storage.

This model of cloud storage raises a couple of important questions:

Are data protection laws obsolete, such as those that require data not to leave a certain geographic region? Because data using the Symform model is encrypted, then broken up into small bits and then distributed all over the world, content stored in this manner is actually more protected against inadvertent or malicious interception than it is if data is stored traditionally in a “protected” geographic region.
Can cloud storage be as inexpensive as local storage? While Symform’s current pricing model makes cloud storage only modestly more expensive than local, it will be interesting to see if the model is sustainable (I believe it will be).

Symform’s innovative offering is very definitely worth a closer look if you’re at all interested in using the cloud to store some or all of your data.

Unified Communications: Is the Public Cloud Your Enemy?

Stephanie Jordan — Tue, 08 Nov 2011 21:08:31 +0000

The hype surrounding the public cloud has reached a fever pitch in the past year. Amazon is making big news with EC2. Meanwhile, in the unified communications (UC) arena, Microsoft’s recent introduction of the Office365 service is really making IT departments sit up and take notice. This combined email, IM/Presence, conferencing, collaboration and voice behemoth — largely because it is delivered as a public cloud service — was billed as a panacea for the ills of the communications and collaboration world. Despite the fact that the public cloud has achieved “darling” status in the computer industry, is it really the friend of IT? Perhaps hype is getting ahead of reality.

Let’s take a look at the evidence.

The obvious starting point is the myriad of service outages that have occurred over the course of the past year. From August 23rd, 2010 through Sept 8th, 2011 there have been at least three major Gmail outages and eight major Microsoft outages of either Office 365 or its predecessor BPOS. Together, these have totaled over 50 hours of downtime for end users….and those are just the outages that have been publicized!

What about security? Just because the public cloud is generally considered more secure than enterprise datacenters, that doesn’t mean it specifically meets corporate security standards and policies. For example, multi-tenant servers, unsecured access to server logs, non-granular administration rights and spotty TLS enforcement can introduce security risks in public cloud UC services that are unacceptable in on-premise systems.

As for reliability and availability, the public cloud doesn’t really care if multiple servers die each day. This explains why downtime penalties for missed SLAs are built into cloud service provider business models.

When it comes to recovery times, these are not always satisfactory. Most public cloud providers offer downtime recovery, which does not meet expected enterprise requirements, e.g. recovery point objectives (RPO) can range from 15 minutes to 24 hours.

Do you need customization? This is not an option in the public cloud. Today’s UC deployments have become quite sophisticated and intensely customized, but yet the public cloud has rules and procedures that only allow for generic deployments.

Compliance is also an afterthought. Many public cloud providers don’t allow enterprises to customize long-term storage policies, which is often a requirement for meeting regulatory compliance requirements.

Support is quite often frustrating and slow. In many cases public cloud providers outsource support calls overseas to teams who are either not well versed in the complexities of the system, or don’t have access to the servers to make immediate changes.

You must be able to give up control, because the public cloud decides when upgrades take place and when downtime occurs. It doesn’t adapt to your business; you must adapt your business to the public cloud.

Finally, what about hidden costs? Public cloud UC systems, with add-on options like archiving, migration, mobile device support, increased network bandwidth, etc. can often be just as costly as on-premise systems. Furthermore, the ongoing costs of the public cloud are theoretically never-ending, will never decrease, and will only go up. In addition, these costs cannot be counted as an asset or depreciated as a facilities investment.

Nevertheless, the public cloud is here to stay. The question is: will it shed the cloak of immaturity and inflexibility that today makes it more of a foe than friend of IT? Clearly the answer is yes — both Google and Microsoft have already made significant forward progress with their cloud platforms. However, ultimate success in the public cloud UC space will take time.

In the interim, there is a work around that doesn’t involve overzealous server-hugging by IT. A close relative of the public cloud is available now, and offers many of the same benefits without the downsides. It’s called the Private Cloud. For many organizations that have bought into cloud computing, the main driver is not lower costs. Rather, it’s about adopting the operational advantages provided by the cloud – shared resources, hardware usage optimization, and elasticity – and applying them in datacenters using a private cloud model. The cloud can be your friend, but only if you make yourself its master.

About Scott Gode
Scott Gode is vice president of product management and marketing for Azaleos, a provider of managed unified communications services.

Thoughts on Two Recent Events

Michael Osterman — Wed, 19 Oct 2011 22:48:24 +0000

Last week I attended the Sendmail Messaging Infrastructure Summit 2011 and the week before that Trend Micro’s Insight analyst event—both very good meetings! Here are some thoughts on both companies:

Trend Micro is doing very well financially: the company’s CFO reported that Trend could fund 891 days of its operating costs with no revenues coming in—Microsoft, also doing well financially, could do so for 434 days, while one of Trend’s biggest competitors in the security space could do so for 108 days. An unusual measure of a company’s financial health, but an interesting one nonetheless.
Trend has a strong focus on security in virtualized environments and it’s a focus that I think is serving and will serve the company quite nicely. The company’s Deep Security offering is the foundation of their cloud security capability and offers a wide range of capabilities, allowing security to be built around the data itself so that it can, in essence, be self-defending. Given that virtualization will be key to success in most cloud data centers, the ability to efficiently provide security in a VM environment is essential. Trend’s agentless anti-virus, for example, can reduce overhead on physical hosts, allowing greater VM density relative to agent-based approaches. Without going into details, Trend is winning a lot of key accounts using its agentless security model and has seen its server security revenue increase fairly dramatically. Trend is also making a major push with enterprise public cloud providers, as well as in the SOHO market, in mobile, and in the big data market.
The primary message from the Sendmail event—and one with which I wholeheartedly agree—is that the cloud for mid-sized and large enterprises will be based on a hybrid model. While smaller companies can likely use off-the-shelf offerings from cloud providers, larger companies tend to have specialized applications and use cases that demand some proportion of the infrastructure remain on-premise. Even Microsoft admits in its BPOS documentation that it may be necessary to keep some of the email environment on-premise.
The meeting also provided some valuable insight into how companies decide to go to the cloud. For example, the CIO of one of Sendmail’s customers was impressed with BPOS—aided by a personal visit from Steve Ballmer—and decided to migrate the company’s many thousands of users to the cloud. However, the decision was made before the review, input or approval by any of the company’s IT architects. After their review was completed, the company concluded that more than one-half of its key requirements could not be satisfied by BPOS, and so the migration of email was put on hold, although the company is migrating SharePoint to the Microsoft cloud.

While completely unrelated events, one of the key themes running through both meetings was the importance of very good planning for large companies migrating to the cloud, whether public or private. Clearly, the cloud is where much of messaging and collaboration will migrate over the coming years, and for good reason—it allows better allocation of resources, lower costs, greater efficiency, etc. However, for large organizations every aspect and nuance of the messaging and cloud experience needs to be thought through very carefully, particularly in the context of security and application support. Yet, many key decision makers are not doing so with enough rigor or input from key stakeholders, and without sufficient consideration of every ramification of a wholesale move to the cloud.

How Will You Know When It’s OK Not to Fear the Cloud?

Michael Osterman — Wed, 05 Oct 2011 23:04:19 +0000

Many decision makers are fearful of moving any—or at least all—of their users to cloud-based email, collaboration, storage and other services. Their concerns focus on a variety of issues, including the security of their data when stored in remote data centers, the security of data in-transit between their firewall and these data centers, their ability to retrieve data when required, the government’s potential access to their data, the uptime provided by cloud providers, and other issues.

To an extent, these concerns have some grounding in reality. Some cloud providers don’t have a stellar record of uptime. Some don’t make it particularly easy to retrieve data on demand. Some might not encrypt data as rigorously as they could. To be sure, there are lots of very good providers that keep data highly secure, but the concerns still linger.

This raises two important issues, and several questions, that any decision maker should consider:

How will you know when the cloud—or a particular provider—is sufficiently safe to earn your trust? In other words, what are the metrics that you will use to decide if a particular provider meets your requirements for adequate protection of your content or if they provide enough uptime? Have you even established these metrics? If not, when and how will you develop them?
Have you applied these standards to your own, on-premise infrastructure with the same rigour? That is, do you encrypt all of your content between remote locations and your firewall? Is the content stored on your on-premise servers sufficiently protected from access by unauthorized parties inside of your organization? Is your content protected from intrusion by external parties as you demand from cloud-based providers? What sort of uptime does your on-premise system provide?

The bottom line is that decision makers should be concerned about content security, uptime, unauthorized access to data and other important issues. However, they should be just as concerned about their on-premise infrastructure—and they should be asking the same questions of internal IT as they do of cloud providers.

Being Part of the Underclass…and What You Should Do about It

Michael Osterman — Tue, 27 Sep 2011 22:02:29 +0000

There’s an interesting post on Adrian Short’s blog about the “Web underclass”—those of use who use free Web services and have no control over the content that we post, how it is used, how we can retrieve it, etc. In essence, Adrian is saying there are three tiers of a Web experience:

If you pay for a domain, you own and control the content and experience.
If you pay to use services on someone else’s domain, you’re a renter.
If you use a free Web service, you’re a guest subject to the whims of the owner.

He makes a good point. While there are many good free Web services that provide significant value in a personal and business context, there are a number of serious risks that business decision makers should take into account when opting to run some aspects of their business using these free services, whether they intentionally do so or do so implicitly by not having policies or technologies in place to manage them.

Expanding on that theme, here are some questions that any organization’s decision makers should ask about their business operations:

Should we use Facebook to market our company?
Doing so can provide enormous exposure, but it also has some downsides that should be seriously considered, such as the presentation of your company information alongside adverts over which you have no control. For example, Infiniti of Chicago’s Facebook page that I’m viewing as I write this is presented along with adverts for the University of Phoenix, Seattle’s Lecosho restaurant, an SAP certification program and a company that can re-level and raise concrete floors—all good organizations, I’m sure, but these are offers attuned to Facebook’s perception of my needs and location, not Infiniti of Chicago’s.
Should we use Twitter or other free social media tools instead of deploying a private social network?
Again, Twitter is extremely useful, but it has some downsides: Twitter maintains a (sort of) archive of old tweets, but they are not obligated to do so; your employees can post anything they want to the world without any sort of controls unless you have deployed technology to monitor their behavior; and you are exposed to the potential for malware infiltration through short URLs, again unless you have deployed technology to protect your company.
Should we allow the use of free Dropbox accounts to share and store content?
Again, Dropbox is a great tool, but one with a less-than-perfect record for securing content, and they offer no guaranteed service levels or content preservation.
For small businesses, should you use free Hotmail or Yahoo! accounts as your email address?
Again, nothing wrong with these services per se, but you lose not only an advertising opportunity when you don’t use your own domain, but you also lose the ability to transport your email capabilities to other providers and you have less control over your own content when you don’t use your own domain.

The issue here, whether you’re a huge multinational or a mom-and-pop operation, is to carefully consider the right balance between cost and control when it comes to the communication, social media, content management and other capabilities you need to run your business.

What the Stock Market and GroupWise Have in Common

Michael Osterman — Tue, 09 Aug 2011 19:24:43 +0000

After the collapse of worldwide stock markets like we have seen in late July and early August, people are quick to remind us of the emotional and irrational nature of investing, investors and the market in general. I disagree, believing instead that investors (at least more seasoned ones) are largely unemotional and, for the most part, quite rational.

For example, Sally is an investor and reads the news about the European debt crisis, the US federal deficit, high unemployment numbers, slowing GDP, etc. She know that none of those things will have a short-term negative impact on her investments in Proctor & Gamble, Google, Merck or her stock-oriented mutual funds. However, she believes that Bob and a few million other investors are quite emotional about these developments and will, in knee-jerk fashion, sell a big chunk of their investments and put the money into bonds or gold or simply sit on the sidelines waiting for things to calm down. So, unemotional and rational Sally makes the decision to dump her stocks based on her fear about Bob. Meanwhile, unemotional and rational Bob fears Sally, and so dumps his investments. You end up with a situation in which just about everyone is levelheaded, but their fear makes them all act in a frantic way. The bottom line is that markets go down in a big way as they have recently because investors lack confidence in the future.

In a way, that’s part of the problem that GroupWise is having right now. To be sure, there are competitive incentives, the allure of Microsoft’s roadmap and other reasons that decision makers are considering other platforms and are moving away from GroupWise. But the big problem for Novell before and Attachmate now is that many GroupWise customers hear about their fellow customers leaving the platform in droves (whether it’s real or not) and so decide they need to do the same. In short, many decision makers simply lack confidence in the long-term future of the GroupWise platform and Attachmate’s commitment to it.

Should decision makers in organizations that run GroupWise have a lack of confidence in the platform? Aside from the conventional wisdom (which, in any realm, is heavy on the former and light on the latter) that everyone is leaving GroupWise for greener pastures, there are good reasons for staying with GroupWise:

In a good interview between Gert ter Burg and Novell’s President and General Manager Bob Flynn, Flynn reiterated Attachmate’s long-term commitment to the GroupWise platform.
GroupWise is now available as a hosted service through HostedEM.
GroupWise has a strong partner community offering everything from basic email security through compliance-based archiving.
GroupWise deployments worldwide continue to send email reliably, they run with minimal IT staff requirements, and they cost less to maintain than Exchange.
Plus, migrating to any email platform can be an expensive and disruptive proposition.

The same argument for staying with GroupWise can be used for lots of other email platforms out there from companies like IBM, Alt-N, Ipswitch, Gordano and many, many others.

Am I saying you should never migrate to another email platform? Certainly not. But what I am saying, Bob and Sally, is that if your decision is based more on emotion than on solid business benefits, it might be useful to re-evaluate the whys of that decision before committing to an expensive and time-consuming migration.

Some Thoughts From the Microsoft Worldwide Partner Conference

Michael Osterman — Wed, 13 Jul 2011 18:30:58 +0000

Microsoft’s Worldwide Partner Conference (WPC) is an annual event that this year drew 12,900 attendees (9.300 partners and 3,600 Microsoft employees) to downtown Los Angeles for a multi-day set of keynotes, sessions and parties. The keynote on Monday morning, led by Steve Ballmer, was quite interesting in a number of respects. Here are some thoughts on the keynote and the part of the conference that I attended:

Ballmer was quite honest about the minimal impact that Windows Phone has thus far had on the smartphone market, citing it’s market share as growing from “very small” to “very small”. While Windows Phone has some nice design elements that Windows 8 will borrow (just like Apple is borrowing some of the features from iOS for its new OS “Lion”), the jury is definitely out on the ultimate success that Microsoft’s mobile platform will have. It’s hard to imagine how Windows Phone will make significant headway against Android and iOS 4/5.
There were several jabs at Google and Apple during the keynote. These, coupled with Microsoft’s naming the new version of its Windows Phone OS “Mango,” were interesting in a keynote of this type. I got the impression that Microsoft is not only feeling the heat from these companies, but is genuinely worried about the impact they will ultimately have on Microsoft’s long term success in the cloud and smartphone markets.
The keynote included the interesting comment that (paraphrased) “a modern desktop computer and OS are key to successfully using the cloud.” It makes sense that Microsoft pushes this message given that, according to Ballmer, “Windows is the backbone of Microsoft.” However, in my opinion both comments suggest that Microsoft is truly feeling its vulnerability from Google and others in the context of its overall cloud strategy. If anything, the cloud reduces the importance of the desktop (ask iPad users for their opinion about this) and it renders any particular OS much less important. In essence, the more the cloud gains a foothold, the less likely that organizations will be to migrate to Windows 7 and ultimately Windows 8.
As further evidence that Microsoft is feeling vulnerable in its still very successful Windows business is that two-thirds of Windows desktops continue to run XP, which, as of this writing, will be end-of-lifed in 998 days. Windows 7 has sold 400 million copies, but much of Microsoft’s future success is heavily dependent on its ability to convince business and personal users that they need to migrate to newer versions of Windows. The cloud makes that more difficult.
As evidence that Microsoft has embraced the consumerization of IT—and is actually helping to drive it—was Ballmer’s comment after a cool demo of a voice-activated Xbox console that integrates live TV and Bing: “think how you’ll one day be able to use these concepts at work.” Clearly, Microsoft—like Apple—is becoming more focused on its consumer business and will be introducing some of its coolest technology there first, as it did with Kinect, and then figuring out how to use it in a business context.
There was less said about Skype in the Monday keynote than I would have expected an $8.5 billion acquisition would have warranted. Ballmer implied that some of Microsoft’s customers and partners view Skype as a substitute for Lync, which Ballmer was quick to correct.
Ballmer spent a fair amount of time discussing Office 365, citing the fact that there is a new trial every 25 seconds. That equates to 3,456 trials every day—a significant number, but less than I would have expected this soon after its introduction.

Overall, this was a good conference and offered lots of useful content. While there continues to be some good news for Microsoft on a variety of fronts (Office 365 adoption, Bing market share increasing, Windows 8 seemingly on track, cool consumer technology, etc.), WPC left me with the impression that Microsoft is increasingly concerned about the impact that the cloud in general (and Google, Apple and IBM in particular) might have on the continued success of the company.

Reliability and Security Must Be Decision Criteria for the Cloud

Michael Osterman — Thu, 23 Jun 2011 01:08:03 +0000

I have been following the cloud industry since the late 1990s, long before it was called the “cloud.” Way back then—and, for many, still to this day—the primary objections to the cloud focus on four primary issues when they compare it to on-premises systems: (a.) cost, (b.) the functionality and flexibility available for managing cloud-based systems, (c.) reliability/uptime, and (d.) security of content.

The response of cloud-based providers relative to a) and b) have been very good. Our own cost modeling demonstrates that the cloud can be (but is not always) less expensive than on-premises systems; and the features and functions for managing a cloud-based system, provisioning users, etc., is also clearly very good for most vendors.

However, (c.) and (d.) still have room for improvement. For example:

On May 10th, Microsoft BPOS had malformed email traffic problems that impacted some customers for between six and nine hours. It happened again two days later, with the problem lasting up to three hours for some customers. If we assume a customer was impacted for nine hours, that means the very best level of uptime that BPOS could have delivered for the month of May—assuming flawless performance for the balance of the month—was 98.79%.
During the afternoon of June 19th, Dropbox updated its software, resulting in the service’s authentication mechanism failing. For almost four hours, you could access any Dropbox account simply by typing a random combination of characters into the password field.

My point here is not to pick on either company—both provide excellent products and services that make our work experiences better, help us to communicate more quickly and generally make our work life more efficient. I value the contributions of both companies greatly.

That said, put yourself in the shoes of a CIO or an IT manager that is making a pitch for migrating corporate services to the cloud. When the CFO or CEO points out the problems noted above, what would you say? To be sure, you have the assurances from Microsoft and Dropbox, respectively, that “Office 365 should provide more stable service” and “…we will be implementing additional safeguards to prevent this from happening again.” If you were the CIO or IT manager standing in front of your senior management, would you be comfortable with that as your defense If you were the CFO or the CEO, would that put your mind at ease?

I think what we need is a much heavier emphasis on the long-term reliability and security of cloud-based providers as the key competitive differentiators that will help us select from among them. I can visit a cloud provider’s Web site and quickly find the price of their service. However, data on their reliability (actual uptime over the past X months) or security (data from the independent lab that tested how secure their infrastructure and internal controls are) is not nearly as prevalent (although it is there for some providers), despite the fact that these parameters are much more important than their price for most decision makers.

As corporate and personal consumers of cloud services, we can vote for the most reliable and secure providers simply by asking about their performance on these parameters and using the best ones we find.

We should do just that.

YouSendIt Has Reached 30 Million Unique Users In Nearly 200 Countries

Melisa LaBancz-Bleasdale — Fri, 27 May 2011 06:06:24 +0000

YouSendIt,makers of file sharing solutions for professionals, announced that it has reached a new milestone surpassing 30 million unique users across 193 countries in the past 12 months. This includes more than 18 million users who have registered for an account and over 400,000 paid subscribers.

Over the past few years, YouSendIt has refined its expertise in the freemium business model and can now claim one of the highest free-to-paid conversion rates in the industry. The company also enjoys strong customer loyalty with a Net Promoter Score of 68 percent. According to the 2011 Net Promoter Industry Benchmarks by Satmetrix, companies with similar scores include Amazon.com and Apple.

Corporate Users Now in Over 92 Percent of Fortune 500
The company stated that growth has been particularly strong among corporate users. YouSendIt now has users in 92 percent of Fortune 500 companies. The company’s focus on business users, investment in robust cloud computing services and the delivery of new products for enterprise-wide deployment have been key to this growth.

“As file sizes continue to grow and distributed collaboration becomes a fact of life, the demand for our service has never been stronger,” said Ivan Koon, CEO, YouSendIt. “Today’s professional requires new tools for the challenges of balancing work and personal life. We’re focused on creating seamless file mobility for business content – product designs, medical images, sales contracts and creative assets. Our customers spend a lot of time collaborating with clients, colleagues and partners. We make it easy and intuitive for them to move their documents so that they can be truly free to create and collaborate.”

Volkswagen, Callaway Golf and Nixon Peabody LLP are among the companies using YouSendIt today.

“We’ve seen a significant productivity increase in transferring electronic data related to e-discovery using YouSendIt,” said John Roman, Director of Litigation Technology Services, Nixon Peabody LLP. “It has given Nixon Peabody the peace of mind to be able to send critical data securely.”

Strategic Partnerships Bring YouSendIt to New Users
Continuing its commitment to enrich the user experience of its popular web email service, Yahoo! partnered with YouSendIt to launch the YouSendIt Attach Large Files application earlier this year. YouSendIt grew its user base by more than 1 million in 60 days through the application and continues to average more than 20,000 new registered users a day through the app.

“YouSendIt’s Attach Large Files has swiftly become one of the most popular applications in Yahoo! Mail,” said David McDowell, Senior Director of Product Management, Yahoo! Mail. “Yahoo! Mail users are able to send large files up to 100 MB per mail, which allows our 284 million users to share videos, photos and presentations directly from Yahoo! Mail.”

Following the introduction of YouSendIt Pro capabilities within the Attach Large Files app this month, YouSendIt Pro users can now enjoy all the benefits of their Pro account – including sending up to 2GB of attachments per email – within Yahoo! Mail.

Industry Recognition
Thanks to its explosive growth, YouSendIt ranked in Deloitte’s Technology Fast 500 and Inc. Magazine’s Inc. 500 in 2010. The company also received the Red Herring Global 100 Award, honoring promising new companies and entrepreneurs that change the way people live and work.

The Non-IT Cost Implications of the Cloud

Michael Osterman — Wed, 25 May 2011 17:55:20 +0000

Much has been made of the impact of the cloud on IT, but what about the impact that cloud-based communications and other applications could have on non-IT expenditures? Here are a couple of back-of-the-envelope calculations to consider:

An employee who makes $60,000 per year, works 245 days per year, has the US average commute length of 32-miles (round trip) each day, has a car that gets the US average of 22.6 miles per gallon and pays the US average of $3.814 per gallon of gasoline (as of May 25, 2011), will spend $1,323 on gasoline every year; add in the cost of oil and tires, and the total commute cost per employee is $1,457 per year, or about $121 per month. If each employee could work from home two days per week because he or she had cloud-based applications that enabled them to work remotely with the same efficiency they experienced in the office, his or her savings would be $583 per year, or the equivalent of a 0.97% salary increase. Working from home three days per week would increase the savings to $874 per year—equivalent to a salary increase of 1.46%.
Office space that leases for $18.05 per square foot per year (the current average for downtown Atlanta) and provides an average of 175 square feet per employee will cost a 200-employee company $631,750 per year, or $3,159 per employee. If that company’s employees averaged two days per week working from home (again, assuming the availability of robust cloud-based communications and other applications that enabled them to do so), the office space required by this company would need to accommodate only 120 employees at an annual cost of $379,050, or a savings of $252,700 per year.

So, companies that allow employees to work from home two days per week and provide them with access to good cloud-based communications and applications would save employees $116,554 per year in commute costs, and would save themselves $252,700 per year in real estate costs. This translates to total savings of $369,254 annually, or $1,846 per employee per year, or $154 per employee per month—all for an investment of no more than about $15–20 per month for cloud-based services. This does not include companies’ power savings (which would be mostly transferred to employees working from home) and other, less tangible, benefits like happier employees.

The implications of this are not only significant cost savings, but also the ability to justify much higher expenditures for cloud-based services that offer extraordinary Service Level Agreements, additional features or other benefits.

Your thoughts?

UN and ITU team up to fight Cybercrime

Melisa LaBancz-Bleasdale — Tue, 24 May 2011 06:38:57 +0000

On May 19, 2011 the ITU , the United Nations agency for information and communications technologies, cemented new global partnerships designed to make cyberspace a safer, more secure place to be for consumers, businesses, and – most crucially – children and youth.

A Memorandum of Understanding (MoU), signed between ITU and the United Nations Office on Drugs and Crime (UNODC) at this year’s WSIS Forum event in Geneva will see the two organizations collaborate in assisting ITU and UN Member States mitigate the risks posed by cybercrime.

The MoU will enable the two bodies to work together to make available the necessary expertise and resources to establish legal measures and legislative frameworks at national level, for the benefit of all interested countries. It is the first time that two organizations within the UN system have formally agreed to cooperate at the global level on cybersecurity.

“This new alliance with UNODC is a major milestone in implementing a coordinated global approach to an increasingly serious global problem. Together, our two agencies will generate powerful synergies that will help all interested countries fight the scourge of cyberthreats and cybercrime and create a safer online environment for all,” said ITU Secretary-General Dr Hamadoun Touré.

In line with its long tradition of public-private partnership, ITU has also signed an MoU with Symantec, provider of security, storage and systems management solutions. ITU will use Symantec’s security intelligence, in the form of its quarterly Internet Security Threat Reports, to increase understanding of and readiness for cybersecurity risks.

By distributing this report – which captures data from across Symantec’s Global Intelligence Network – to interested Member States, ITU aims to help better prepare governments in developing and developed nations alike to respond to the ever-growing risk from malware, cyber attackers and information thieves. This will facilitate awareness raising and knowledge transfer, complementing the work of ITU and strengthening its effectiveness as a global forum for governments and private sector to build confidence and security in the use of ICTs.

Commenting on the partnership, Enrique Salem, President and Chief Executive Officer of Symantec, said: “Over the past year and a half, the researchers that make up Symantec’s Global Intelligence Network have noted a dramatic increase in the number of cyberattacks, as well as the growing sophistication and impact of threats. The partnership between ITU and Symantec will facilitate an increased understanding of cybersecurity risks and how they can be reduced, increasing confidence in new and emerging technologies and facilitating the evolution of the digital world.”

Further reinforcing ITU’s efforts in this area, ITU’s work and relations with IMPACT continue to gain momentum, with over 130 ITU Member States now part of the ITU-IMPACT coalition.

ITU-IMPACT is the first cooperative global venture to make available cybersecurity expertise and resources to enable interested Member States to detect, analyze and respond effectively to cyberthreats. Of particular benefit to developing countries and smaller states without the capacity and resources to develop their own sophisticated cyber response centres, the coalition also benefits technically advanced nations by providing them with a global snapshot of potential and real online threats.

ITU-IMPACT members enjoy:

· Access to the IMPACT Global Response Centre (GRC), the foremost cyberthreat resource centre in the world for global threat information, at no cost.

· Access to the Electronically Secure Collaboration Application Platform for Experts (ESCAPE), allowing experts across different countries to share their knowledge and best practices with regard to cybersecurity, as well as facilitate the mitigation of cyberattacks, at no cost.

· On-site assessments and elaboration of implementation strategies for the establishment of the Computer Incidents Response Teams (CIRTs). To date 24 countries have been assessed, and work is in progress to move to the implementation phase.

· Specialized cybersecurity capacity building programmes to arm Member States and international agencies with relevant knowledge to face and prevent cyberthreats. To date, more than 200 cybersecurity professionals and 50 law enforcement officers have received specialist training. In addition, 155 training scholarships to 29 partner countries globally have been provided.

ITU-IMPACT also offers Managed Security Services to the UN family of agencies.

Symantec to Acquire Clearwell Systems

Melisa LaBancz-Bleasdale — Tue, 24 May 2011 06:05:18 +0000

Symantec Corp. announced it has signed a definitive agreement to acquire privately-held Clearwell Systems, Inc., a recognized leader in the eDiscovery market. The acquisition of Clearwell enhances Symantec’s position as a leader in security. The move, Symantec says, will provide customers one of the most comprehensive information management solutions available. Under the terms of the agreement, Symantec will acquire Clearwell for a purchase price of approximately $390 million, net of Clearwell’s existing cash balance of approximately $20 million.

“As information continues to grow at unprecedented rates, the biggest challenge for customers is to protect, manage and backup this information as well as have the ability to categorize and discover it efficiently,” said Deepak Mohan, senior vice president, Information Management Group, Symantec. “The acquisition of Clearwell’s market leading electronic discovery solution will further increase Symantec’s ability to get the right information, to the right people, at the right time, while reducing overall legal review costs and limiting risk.”

Clearwell’s eDiscovery solution will complement and enhance Symantec’s Enterprise Vault eDiscovery capabilities and the companies hope the move creates a more complete end-to-end eDiscovery solution. The existing integration of Enterprise Vault with the Clearwell eDiscovery Platform is thought to enable Symantec to quickly help IT and legal users streamline and reduce the cost, time and risk of eDiscovery across the most relevant information sources including email, desktops, file servers, backups and the cloud.

This acquisition will expand Symantec’s addressable market opportunity and the company believes it will position them as a leader in the fast-growing eDiscovery software market, which, according to Gartner, is growing at a compounded annual growth rate of 14 percent and is estimated to reach $1.7 billion by 2014. In addition, this acquisition is expected to provide future cross-sell and product integration synergies across Symantec backup and security, by leveraging Symantec NetBackup, Data Loss Prevention and Data Insight.

“Archiving and eDiscovery are two critical elements of information governance,” said Aaref Hilaly, president and chief executive officer, Clearwell Systems. “By joining forces and combining the industry’s leading archiving solution with the industry’s leading eDiscovery solution, we will be uniquely positioned to deliver a seamless, integrated information governance workflow, benefitting both Symantec and Clearwell customers.”

Organizations are being required to adopt more formal information governance processes to help reduce the costs and risks associated with legal discovery. According to Gartner, through 2012, companies without an information governance strategy and technology for content archiving solutions, will spend a third more on eDiscovery than those with content archiving solutions. Together Symantec and Clearwell are positioned to offer customers the ability to both proactively and reactively manage and discover their information with increased speed, efficiency and scale, both on-premise and in the cloud, while at the same time helping customers reduce costs and risks.

Former Federal Trade Commissioner Becomes Co-Chair of Cloud Security Alliance's Legal Working Group

Melisa LaBancz-Bleasdale — Wed, 18 May 2011 06:06:29 +0000

The Cloud Security Alliance (CSA) announced in early May that former Federal Trade Commissioner Pamela Jones Harbour has signed on as a co-chair of the CSA Legal Working Group. Pamela is a partner in Fulbright & Jaworski L.L.P.’s antitrust and competition practice, heading the firm’s Privacy, Competition and Data Protection practice group. Pamela was the 2010 recipient of the Electronic Privacy Information Center’s (EPIC’s) “Champion of Freedom Award” for her defense of consumer privacy as an FTC Commissioner.

“As we have witnessed, technology generally outpaces the law,” said Pamela. “As companies and governments move, or plan to migrate, to the cloud, surveys show that the primary concern is maintaining the security of organizations’ applications and data. I am hopeful the CSA Legal Working Group will assist in creating international best practices that would address wide-ranging issues, such as jurisdiction, contract provisions, e-discovery practices, disaster recovery, record retention, data portability, and auditing to meet the national and international requirements businesses face today.”

“Organizations and individuals are grappling with the emerging legal issues that cloud computing has created, especially in the area of security and data ownership,” said Dave Cullinane, Chairman of the CSA board. “We are excited to have someone of Pamela’s stature and experience helping us shape and guide best practices in this new domain.”

Pamela served on the Federal Trade Commission (FTC), from 2003-2010, and prior to that she was an antitrust partner at a New York firm. She previously spent a decade working in the New York Attorney General’s Office, including as Deputy Attorney General, where she investigated and prosecuted a variety of antitrust and consumer protection violations.

Barracuda Backup Server Now Features "Private Cloud" Capabilities

Melisa LaBancz-Bleasdale — Wed, 11 May 2011 06:16:13 +0000

Barracuda Networks today launched site-to-site replication capabilities for the Barracuda Backup Service, a market leading solution that allows companies to efficiently back up their data both locally and offsite without the hassle of tapes or other removable media. This enhancement allows customers to deploy a “private cloud” by enabling one Barracuda Backup Server to replicate data to one or more Barracuda Backup Servers housed locally or deployed at other locations for disaster recovery.

“Many organizations today prefer to utilize internal company locations as the first line of defense for disaster recovery,” said Stephen Pao, vice president of product management for Barracuda Networks. “Site-to-site replication enables those organizations to redundantly back up their data to their preferred locations while also allowing economical cloud-based data protection where appropriate.”

Leading data deduplication technology in the Barracuda Backup Service facilitates efficient replication of changing data to cloud storage. The addition of site-to-site replication provides customers with the ability to use this technology in a private network environment. This expands the market served by the Barracuda Backup Server to include customers interested in private and hybrid data replication deployments.

Today’s launch delivers replication:

Between Barracuda Backup Servers; each can back up data locally as well as send it offsite to other backup servers.
From many Barracuda Backup Servers to a single unit; common for customers or partners who would like to replicate from satellite locations to a central location.
From one Barracuda Backup Server to several others; appropriate for customers with critical data they want replicated to multiple locations on their network.
To the cloud in addition to other Barracuda Backup Servers; ideal for customers with critical data they want to protect in multiple ways.

The City of Weston, in Weston, Fla., has two Barracuda Backup Servers deployed in conjunction with the Barracuda Backup Service and finds the new feature to be a crucial benefit, allowing them to safely and reliably replicate their business critical data offsite to their disaster recovery center.

”We are impressed with the easy setup for site-to-site replication and the efficiency of data replication,” said Steven Murray, director of information technology for the City of Weston. “This is the perfect solution for our disaster management needs.”

Customizable Hybrid Cloud Solutions

In addition, site-to-site replication enables organizations to take advantage of a “hybrid cloud” by combining private replication between Barracuda Backup Servers with replication to cloud storage provided by Barracuda Networks ultimately providing protection for an organization’s most critical data.