Big banks, including JPMorgan Chase, Commonwealth Bank of Australia and ING, are among the first and most entrenched users of internal clouds, those massive farms of servers harnessed together through virtualization, workload management, provisioning and other overlay software that allows processing work to be sent to the most appropriate machines, then lets those machines be quickly re-provisioned when that batch of work is done. Banks are also keen observers of public clouds and builders of hybrid approaches that send certain work, such as applications involving sensitive data, to the internal cloud and more generic applications to shared or public cloud providers for the efficiency and pay-as-you-go properties of external clouds.
But uncertainty and confusion still pervade the financial services community about whether or not cloud technologies afford the level of security, availability and capacity that banks need. Tony Kerrison, who recently became chairman of the TM Forum's Enterprise Cloud Leadership Council, is hoping to bring clarity to this world. The ECLC is a consortium of 25 large-company users of cloud products and services (the TM Forum has 770 members). "We saw this as a great opportunity to help us with what we're trying to achieve at ING but also to help define the industry a little better, because clearly, it is in need of definition," he says.
The ECLC is not intent on building definitions of cloud computing — Kerrison believes enough of those exist already — but on creating technical definitions for aspects of cloud purchasing such as service level agreements and application programming interfaces. For example, the group has issued a handbook to its members that defines SLAs and sets parameters for measuring what's actually happening against the promises laid out in the SLA. It's also starting to create prototype technologies that vendors and users can adopt, a la open source technology.
The ECLC has been working on Frameworx, a set of best practices and standards for cloud components such as database-as-a-service and desktop-as-a-service. It's also defining cloud training that was started at ING and is now offered through TM Forum.
Many bankers feel that before they buy services from a cloud vendor, they want and need to perform the same types of due diligence they would for any other vendor: visit the vendor's data center, see for themselves how secure it is, meet some of the vendor's people, and so on. Some feel that with cloud computing, it's much harder to do that — the service is floating somewhere on a nebulous cloud. Kerrison says there's an ECLC framework for this.
"Depending on the type of cloud service you're looking to consume, it will have certain requirements for reliability, recoverability, and security that we would define within a framework," Kerrison says. He observes that the issue of data security is very important, especially as information moves across borders, but that some vendors are learning to tag data so that customers can see and audit its path. "It's very important when you look at consuming cloud services, that you understand where that data's being housed," he says. This framework will also take into account how service providers are set up, how they perform, and what their relative strengths are and delivery capabilities.
Unlike other technology user groups, such as the Open Data Center Alliance and the Cloud Standards Customer Council with whom the ECLC sometimes works, the ECLC is also actually developing technology and making code available to its members. For instance, Kerrison recently saw a piece of provisioning software being used in the telecommunications space to select payment plans. The ECLC is now working on adapting the software to be useful to provision cloud services. Another prototype technology could be one that generically delivers a desktop through the cloud.
The ECLC members use these projects as a way to evolve standards, as they identify the gaps and technical issues that need to be addressed and come up with a better version. It's not quite open-source programming per se, but it's a collaborative product development approach that should help banks steer their way through the murky waters of cloud computing.
