JBOWS, cloud computing and security

Just been reading up on cloud computing, and came across the JBOWS (Just a Bunch Of Web Services) idea, that was more or less derided here by Joe McKendrick at ZDNET for being too ad-hoc as compared to SOA. As the sheer complexity of SOA goes the way of SGML (and the dodo), I think that on the contrary, ad-hoc stringing together of web services to usher in a new age of web-driven services is a good thing for organisations learning to internalise the skills of this new paradigm/environment.

The problem with turnkey solutions is that you do not get the benefit of experimentation or immersion in building organisational knowledge of the technology. In a short-term world of quarterly expectations, you want to focus on what you're good at and what makes you different. If cloud computing and software as a service is not your core business, and is not likely to be going forward, I agree one shouldn't think about it too much and go ahead with SOA and other initiatives.

But if your company is going to offer software as a service as part of the portfolio going forward, you need this JBOWS attitude to gain long-term expertise about cloud computing and web-driven online software services understanding more generally. It's a longer term play but that boosts organisational knowledge, expertise, confidence and capability, leading to market-leading innovation and distinctiveness.

The other thing I have been reading about are the drawbacks to cloud computing, such as the lack of control over your own IP and risk of decreased security for your cloudised assets. I would argue neither of these problems are issues that are dependent on putting applications, source code and other IP into the cloud as opposed to keeping it behind the company firewall, but a good example of mitigation for the risks of cloud computing for SAAS/PAAS/IAAS players is HP's new Cloud Assure.

This service offers cloud computing assurance services against the main 3 concerns of cloud computing: cloud security, cloud performance and cloud availability. It will be interesting to see the uptake of such services by blue chips or IT companies that have already made the leap. Maybe it is too early to tell or maybe we will need more major outages a-la-Gmail, over at Amazon (Amazon Web Services/Marketplace), Microsoft (Windows Azure) and Salesforce.com and for prolonged periods of time to highlight the need to pay for these services. This movement would help establish industry standards for cloud assurance, and ensure safety, consistency and compliance for the upcoming mass-scale adoption of cloud computing services predicted over the next 5 years. So cloud computing assurance looks more like an emerging market within the next 5 years, but with limited revenues until then.