ING examines cloud computing, but finds licensing a problem

Financial services firm does heavy testing of cloud services

ING is just the type of large user organization that cloud vendors want signing up for their various online business services, but licensing concerns are holding ING back

Cloud computing is on the minds of many IT pros today, and Alan Boehme of ING Financial Services is no exception.

ING is just the type of large user organization that cloud vendors want signing up for their various online business services. But while Boehme, senior vice president and head of IT strategy and enterprise architecture at ING, is excited about the potential of cloud computing, he says the industry needs to get a few things in order before this outsourced model fulfills its potential.

Boehme’s biggest concern is that software licensing policies haven’t caught up to the cloud. The cloud lets customers buy computing power on an as-needed basis, but software licenses for products that could be used in the cloud typically must be purchased up front, he says. Software licenses should also be available on an as-needed basis, he says.

"I haven’t seen any vendor with flexibility in software licensing to match the flexibility of cloud providers," says Boehme, who is based in Windsor, Conn. "This is a tough one because it’s a business model change. … It could take quite some time."

ING, which boasts an IT infrastructure featuring 2,900 to 3,000 servers and 900-plus network devices, has been using software-as-a-service for several years for needs such as sales automation, CRM, human resources, and succession planning. Now ING is evaluating hosted application building platforms as well as online storage and compute services.

"We are literally testing everybody. We have things running across multiple providers," Boehme says.

Boehme says ING’s policy is not to discuss specific vendors, but the players in this space include Amazon, GoGrid, Google, and Salesforce. ING is not yet ready to move from test to production.

"We have not put any of those services in production but we are testing the viability of all these types of services," Boehme says. "I know of very few large organizations that are doing these things in production. I know of a lot of small and medium-sized businesses that are."

Boehme has found that cloud services make it easy to scale resources up and down. But to build a business case for the cloud, companies need to look at the services’ technical viability, security, manageability, and the ability to move applications from one cloud to another.

Boehme is a founding member of the Cloud Security Alliance, a group formed last month to promote best practices in cloud security. The Alliance will release a white paper at the upcoming RSA security conference advocating a set of security standards for use in the cloud market. Ideally, security will be built into every application, and portability of applications across clouds is also important, Boehme and the alliance say.

If clouds are interoperable, customers can at least move an application from one to another in case of failure, the alliance notes on its Web site. "Businesses using the cloud should be prepared for the worst," the group says.

But that doesn’t mean avoiding the cloud makes sense, either, Boehme notes. ING already uses a mix of data centers operated by its own staff and data centers operated by third parties, he says. Cloud computing typically uses a multi-tenant, rather than single-tenant architecture, but that doesn’t make it completely new and unfamiliar, he says.

Boehme has been with ING since August 2008, but has more than two decades of experience including stints as the CIO of Juniper Networks, Sage Software, and GE. Boehme recalls using the IBM mainframe Time Sharing Option earlier in his career, a feature that gives users concurrent access to the mainframe while making it appear to each user that no one else is on the system.

"I didn’t know who was on that mainframe," Boehme says. "But the security infrastructure, and the risk management was already built into that."

Cloud computing isn’t as sophisticated as the decades-old mainframe technology, but Boehme is expecting great things. He predicts companies to use a mix of external cloud providers as well as so-called private clouds, with applications being portable across all platforms.

"We don’t believe you will see anybody participate with a single provider," he says. "We think you will have multiple providers, internal clouds, external clouds, hybrid clouds. … We like the concepts and the flexibility that this provides. We believe this is as big as the Web was in 2000."

Learn more about this topic

Cloud computing vendors converge on standard definition, goals

Cloud Security Alliance formed to promote best practices

Amazon cloud could be security hole
Join the Network World communities on Facebook and LinkedIn to comment on topics that are top of mind.

Copyright © 2009 IDG Communications, Inc.

SD-WAN buyers guide: Key questions to ask vendors (and yourself)