The IRM April newsletter 2010 announces the article For 2010, Cloud Presents Significant Problems, Opportunities for Architects by Mike Rosen, Director of Cutter Consortium Enterprise architecture Practice. The article is unusual in modern chorus and fanfares glorifying Cloud Computing; it articulates simple business risks associated with a reckless surrender to the Cloud hype demonstrated by the businesses, which don't see benefits further than 'for today'. This recklessness is not a corporate illness but rather an individual one because I cannot explain Mike's comment about Citibank in another way: "Just last month, Citibank (the third-largest bank in the US and no technology neophyte) lost tens of millions of dollars to cyber thieves, apparently in a Russian-based organization." Here is another example from the article: "...last month it was reported that Iranian militias have been intercepting the video feeds of Drone aircraft for at least six months. Worse, the Pentagon knew about the vulnerabilities ever since the weapons were deployed in Bosnia over 10 years ago, but didn't think local insurgents would be clever enough to exploit them. Well, $29.95 for some off-the-shelf software from a Russian company was all it took."
I agree with Mike about the current state of Cloud Computing, which "brings the industry back to the bad old days" by allowing Business Unit's (BU) interests to prevail over the corporate ones. Particularly, Mike says: "The "cloudy" future, where business units go to the cloud to provision their own infrastructure, brings the industry back to the bad old days, when every line of business did whatever it wanted, optimizing its own P&L while suboptimizing the enterprise; implementing redundant and inconsistent capabilities and data stores. This approach was largely responsible for creating the infamous "Enterprise Application Spaghetti" that business had spent, and continue to spend, billions cleaning up."
I can sign under this statement. However, I have been surprised by the means offered in the article to heal "the business rushed shortsighted into this decade's panacea[M.P.: i.e. cloud computing]". Mike talks about an education and certification of IT Architect who are supposed to stand up on the way of unjustified use of Cloud Computing in spite of the business "willingness" to do so. This sounds like a call for IT Architects to protect Business from itself...
Well, any education is always a good thing but in this case it appears as a reference to a second cousin instead of to the 'person' in fault. I think that right instrument to protect Business from itself is the Business's instrument only - money.
In my book "Ladder to SOE", I describe a service-oriented enterprise where IT is split by the BU, i.e. the thing so much criticised by Mike. However, this split must be accompanied by revoking the budget spending rights from the BU with regard to any modifications or new development. These rights must be allocated to the cross-functional and cross-departmental management team. Such team comprises Senior Executives, who have only one task - preserve interests of the enterprise over the interests of BU. The BU makes money but may not spend it on IT development without an approval from the cross-departmental management team. If the BU Manager wants to reduce a cost of technology maintenance in the department via deploying its applications into the Cloud and puts the entire company into the risk of exposing sensitive information (Clouds are not transparent to the corporate business so far) and losing the company's reputation, this manager better be stopped beforehand.
IT Architects are not in the position of stopping error-prone business decisions of this scale: promised initial money saving frequently overtakes justified risk of exposure; the business takes this risk on itself but immediately delegates to IT, to the same Architects, who raised the alarm. In my opinion, the role that can influence and protect (to some degree) an organisation from the cloudy threads is Business Architect. The Business Architects are those Senior Executives, who transforms Business Strategic plans into Business solutions, functions, features, products and services. The Business Architects are those who tell BU what to do (but not how to do), when and why. The Business solutions should be realised by the BU management in integrity and in balance of interests across the enterprise. The business well-being in the long perspective may be more important than saving on technology in one particular moment of the enterprise history.
First, I’d suggest people read my article for themselves and see what they think. You’ll notice that I’m only making some predictions about issues that will concern enterprise architects in 2010, nothing more. But, I feel that I have to repsond to Michael Poulin’s representation of my article to clarify a few points.
- My comments about Citibank and the US military are explained this way. If an organization as sophisticated as Citibank, or with the huge resources of the US military are subject to hacking, what can you expect from a less well equipped SaaS provider? Are you really ready to trust your data there? I’m not.
- In many circles, IT still has a reputation for being unresponsive. Many business focused viewpoints on the cloud tout it as a way for the business to circumvent IT and provision their own services and other infrastructure. I believe this is a step backwards for the enterprise. But, if IT doesn’t do something to be more responsive, it’s going to happen.
- I did not intend to imply any connection between certification and the cloud, merely that certification is another issue that architects will have to contend with in 2010. I don’t view certification as a solution to this issue. Perhaps I could have been clearer about that.
- I did not suggest that IT should protect the business from itself. Rather, what I said was that architects need to get out in front of cloud adoption and clearly articulate what the important enterprise concerns are, and what decision are reasonably within the domain of the business. This will give the business the flexibility it needs, within the boundaries required for enterprise consistency, security, reliability, etc. With these guidelines in place, the management and spending structure that Michael suggests could be an effective way to govern.
My views on the role of architecture are clearly explained in my book “Applied SOA: Architecture and Design Strategies� which is dedicated to practical ways to use architecture to influence enterprise outcomes at the business and technology levels. Michael - I’d be interested in understanding more about your approach and engaging in a constructive conversation…send me some email, and if you like, send me a copy of you're book and I'll review it for my Cutter column.
I an very thankful to Michael Rosen for the comments and clarifications. I think we are looking to the same directions and very similar concerns. It is also possible that I misread the part of the article related to certification and, indeed, it sounded to me in a resonance to the rest of the text.
Nonetheless, IMO, telling Business "what the important enterprise concerns are" can bring real result if these words are said by the business executives (i.e. those with authority to point division managers on the concerns); at least, this is my experience.