Microsoft exec offers tips for CIOs moving to the cloud

Trying to fit cloud computing into the strategic future of government information technology plans has become a significant issue for federal chief information officers.

That subject resonates with Ron Markezich, who was Microsoft’s CIO, responsible for the company’s global network, data centers, information security and IT services, before taking his current role as corporate vice president at Microsoft Online.

Markezich spoke with GCN recently about what federal CIOs should keep in mind as they weigh the merits of a future in the cloud.

GCN: How do you see the evolution of cloud computing unfolding in the government landscape?

Markezich: Well, first, I don’t think government is going to be any different than [the] commercial [world]. I think you’ll have some early adopters, playing with cloud computing to see where value can be added and where benefits can be had. But I think that the organizations that will be most successful with cloud computing are those that will look at it in context of their overall IT strategy and architecture. You want to make sure you do not treat it as an experiment, but as something that’s core to your strategy.

Second, I think cloud computing will happen regardless of what the IT organization does, meaning that users will start using more and more services over the Internet, as “shadow apps.”

GCN: How should federal IT managers think about cloud computing from an architectural point of view?

You need to look at a couple of things. One is the workload, or applications. What applications are so core and unique to your business that you would never move them to the cloud? And what applications are common across many companies that can move to the cloud?

Second, the big, big piece of cloud computing — and computing in general — is identity management. If you don’t have a centralized identity management system, your controls will be lacking because you don’t know who has access to what systems. Cloud computing exposes any gaps in your identity management system.

And third, you have to understand where your competencies are for your organization. And how does that competency tie to the overall mission of your organization?

GCN: What would you say to government CIOs and chief technology officers about common concerns related to security and whether creating private clouds is a partial solution?

Let me start with some taxonomy. Think of the public cloud as a place where you have your data shared with Acme Inc. and John Smith all in one database; a corporate cloud where you share data with other organizations; and a private cloud, dedicated to your organization.

Security concerns exist in all three of those. The biggest thing is whether that service provider is going to commit to you what they can and cannot do with your data and how they handle your data.

For instance, a lot of the public cloud services were built with the consumer in mind. Consumers don’t typically care where their data resides. So the architecture is optimized for the system, not for the user. For the government, the customer needs to know where the data resides, not only from a security standpoint but from a policy standpoint.

You also have to understand what attestations [or certifications] that service provider gives you about your data and what protections you have in your contract. The security risks of cloud computing are actually no different than a customer running that service himself.

GCN: Some believe large-scale cloud providers are actually more secure because they have the talent, resources and focus that smaller organizations might lack. How do you see it?

We hear that a lot from our customers. There are quite a few smaller or less established companies out there offering cloud services that I don’t know are making the investments in security that they should. But I do think with an established company, you are tapping into security investments and thought leadership. So I agree with that statement.

GCN: What are Microsoft’s intentions as a player in the cloud computing realm?

From our perspective, this is really the future of our company. The software business is a good business, although it presents us some challenges, like getting the latest software out to our customers, making sure we can get real-time feedback from our customers and that it is very easy to use our software. Cloud computing actually solves a lot of those challenges for us. So as a company, this is something that we’re really trying to drive the industry to as fast as possible. Every software product that we sell is also offered as a cloud option today or will be offered as a cloud option in the future.

Part of the cloud computing business model is its low-cost, utility approach. How does a company like Microsoft, selling high-margin software, successfully get into a low-margin infrastructure business?

The thing that gets lost in that is, if you look at total IT spending worldwide — it’s actually a very small percentage that’s spent on software and a much larger percentage spent on hardware and labor. We think we can take down the amount of money that it costs to get software to operate, save the industry money so that can be reinvested, and at the same time, continue to grow Microsoft’s profits. Typically, for every dollar of software spent, it costs $6 to get that software to run. If we can take that $6 and make it $2 and Microsoft keeps a dollar and $3 go to the customer, our profits grow and the customers save money as well.

GCN: How does Microsoft’s launch last year of Azure fit into your plans?

What Azure will provide is a platform that customers — government or even other third parties that serve the government — can develop applications on top of that reside in the cloud, rather than having a platform that’s only there for your particular application. So you get the economies of scale of cloud computing by having that platform.

What’s also unique: we open that platform up to other companies that are selling to the government, so they can develop applications on top of that platform that then they can go sell to the government. Microsoft will also run our cloud services on top of Azure.

GCN: What would you say are the biggest advantages to moving to the cloud sooner than later? And what would you look out for?

Everyone’s looking at cost savings. Until recently, most customers were actually looking [at cloud computing] for other reasons than cost savings. One was to increase the level of capabilities that they have. The second would be redeploying some IT people in their companies. Take e-mail: Some of the best IT people in the world run e-mail systems…because if e-mail goes down, you know that CIO is in big trouble because everyone relies on e-mail. Why not move [e-mail] to the cloud and have that best person create an app that lets them do something much different and unique for their company?

The third one is predictable costs. Right now, you have these spikes whenever you upgrade applications and have to refresh your hardware. Cloud computing allows you to have very predictable costs based on usage or the number of users provisioned on that system.

The reservations? One is it really does change some internal policies and practices. Customers are very used to traditional outsourcing, where you have an outsourcer do anything you want. Whereas to get the benefits out of the cloud, you really want to rely on the cloud service as it exists, because if you get unique in the cloud, all of a sudden it’s not the cloud — it’s your own little outsource bank.

The other would be the migration cost. A lot of times you’ll see an application in the cloud costs X dollars per year per user. But if you look at the cost of actually getting to that point, it often has a very large timeline for a payback.

GCN: What applications are you finding organizations are most likely to migrate to the cloud first?

For us, it’s our e-mail/calendaring solution, our collaboration solution and our communications solution would be the three fastest. E-mail is the first app to really move to the cloud, although even e-mail is not an overnight type of move.

GCN: Can you talk a little about the cloud facilities Microsoft is building?

We are investing heavily, especially in the U.S., for facilities for cloud computing. We have a number of data centers that are world-class, top-of-the-line, very large data centers that have lots of economies of scale and things like low-cost power near them that we do have available to run our online services in. We’ve also talked to the government about is there a way to have something special for U.S. government — it could be a Microsoft-owned data center, a U.S. government-owned data center or third party-owned data center that is only housing the cloud services that we run for the U.S. government.