@CloudExpo Authors: William Schmarzo, Elizabeth White, Mauro Carniel, John Worthington, Pat Romanski

Related Topics: @CloudExpo

@CloudExpo: Blog Feed Post

Get Your SaaS Off My Cloud

Why architecture matters not only to security but to the future of cloud computing

It seems the phrase “in the cloud”, sadly, has become a marketing-hyped euphemism for “the Internet.” I say sadly because the use of cloud to refer to every and any service delivered over the Internet dirties up the cloud. It obscures the intent of cloud computing and makes it difficult for technologists in the trenches to get a handle on how cloud – both external and internal – can provide benefits and solutions to problems they have right now. The very loose use of the term means that every last little web application on the web could be (and sometimes is) called “cloud computing”.

And while that may be technically true based on the very loose definition of “compute resources”, the problem really is in the use of “cloud” to refer to very different architectural models that just all happen to fit a very broad definition.

Of late, the use of the term “cloud computing” to specifically mean SaaS (Software as a Service) is one that’s not only getting under my skin but causing a great deal of irritation sitting there. Every trade publication, every analyst and research firm has been digging into the adoption of cloud computing and every one of them ends up with essentially the same conclusion: organizations aren’t ready to buy into it. Yet.

But then we see news about “cloud computing” like this report titled, “IT spending on cloud computing up 22% in 2009 to $9.6 billion” on TechRepublic. The entire report is about SaaS. Period. There’s nothing in it about the market for IaaS (Infrastructure as a Service) or PaaS (Platform as a Service). It’s all about SaaS. And SaaS is hardly cloud computing in the same way that IaaS is cloud computing. This lack of qualification between the two makes the market look much more robust, mature, and mainstream than it actually is. It is misleading, and that can eventually backfire by leaving would-be customers to continue to question viability long after maturation because they can’t trust the information.


There is a very real difference between the architectural models and benefits of cloud computing (i.e. compute resources as a service) and multi-tenant hosted software, a.k.a. SaaS. These architectural differences are important to every discussion we have about cloud because they affect the security and costs of cloud computing. Those architectural differences manifest themselves with very different issues surrounding integration, data integrity, internetworking, and efficiency.

Invariably when the question of “cloud” security comes up someone brings up SaaS and the fact that organizations have been safely using it for years. This fact is then used to dismiss the very real concerns surrounding security issues and cloud computing. Let’s take just a moment to consider the differences and why this is such a problem.

  1. SaaS is all about the database The way in which multi-tenant hosted software like Salesforce.com and SugarCRM provide security and services is at the database layer. The software, the interface, is the same for every customer. Customization is accomplished through data-driven layout and field definition. The networking stack, the servers, the operating system is all the same. Every customization, every unique process, every branded page is driven solely through data in the database. Security in a SaaS is inherently tied to the robustness of the security model on the database.

    Database security is well-understood, well-known, and very mature. The ability to restrict access down to a single-cell if necessary has long been available and it is this flexibility in database access security that makes SaaS possible.
  2. Many well-known SaaS offerings are not about customer data Another argument tries to dismiss security concerns by pointing out the widespread use of hosted services like Ceridian (payroll and HR) and Concur (travel, expenses). While it is true that these SaaS vendors have long been popular amongst a wide variety and very disparate set of industries, both are focused on employee data, not customer data. While employers are certainly protective of and concerned with the security of their employee’s data, this data is not a competitive advantage, it is not tied directly to revenue, and it is governed by a completely different set of regulations. It’s a completely different set of risks that are managed in a completely different way.
  3. SaaS has a smaller attack surface IaaS has to expose a lot more of the stack to end-users while SaaS has to essentially expose a web  imageinterface. Even integration with SaaS software is via the web (SOAP, REST, etc…) and in a way that is very well controlled. IaaS? There’s very little control because the provider has no idea what application you’ll be deploying. As Hoff pointed out via Twitter, this does not prove that SaaS is more secure even though it seems logical to deduce that; it’s just a different set of risks that need to be managed. Understanding the differences in what those risks are is important when choosing a provider or implementing a cloud model internally.
  4. IaaS introduces the unknown SaaS is well-understood. It’s software stack and therefore its potential vulnerabilities are well-documented, well-understood, and relatively easy to protect if you know what to look for. SaaS, because it is essentially just hosted software, has been very well exercised over the past decade. Its vulnerabilities and potential points of exploitation have been discovered, tested, exposed, and closed. IaaS, however, introduces a new layer where vulnerabilities are not well-understood, not well-known, and not-well exercised. The virtualization layer is completely new and should be considered an “unknown” risk at this point.

    The “sharing of resources” in a SaaS model is really about sharing the database, and even that is strictly contained by very granular security. Code is shared, but in such a way as to make it less relevant. I don’t have to, as a customer, worry about the quality or security of an application of another organization or individual that may be executing on the same hardware as mine and may, through the exploitation of some yet unknown virtualization vulnerability, cause my application to become another 'bot in a giant distribution network for malware.

    The “sharing of resources” in cloud computing is about sharing everything – from the network to the operating system to the infrastructure. Every aspect of cloud computing is about sharing and reusing resources in a way that makes it efficient for both the provider and the customer.

The goal of SaaS is to deliver software. But the software it is delivering is pre-defined. It’s a constrained set of features/functions that are designed to perform a specific task. IaaS, on the other hand, is about delivering on-demand computing resources for use in whatever way the end-user/customer wants to use it.

They are not the same – not architecturally, not in implementation, and not in the issues they bring to the table.


NIST has recently published a working definition of cloud that takes pains to distinguish between the various subtypes of cloud computing:

Cloud computing is a pay-per-use model for enabling available, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is comprised of five key characteristics, three delivery models, and four deployment models.

The document goes on to describe, succinctly and with what I think is more than good enough accuracy the characteristics, delivery and deployment models. I could (and may in the future) argue against the inclusion of “applications” in the definition of “computing resources” and am fairly certain it is included solely because people assume SaaS is cloud computing but for now I’ll let sleeping dogs lie. The important part of the definition, I think, is the separation and qualification of each type of “cloud computing”. NIST provides this type of delineation because architecture matters when you’re discussing things like security, reliability, and data integrity as well as who the end user of the cloud service really is.

When organizations ask for direction and guidance on building their own “clouds” they aren’t asking about deploying a SaaS. They want to create an on-demand, dynamic data center that affords them many of the same benefits as “cloud computing” – efficiency, sharing of resources, automation. They want the IaaS version of cloud computing, not SaaS or PaaS. But the lack of qualification around the term “cloud” confuses the issue and makes it difficult to have a conversation about specific models.

No wonder people aren’t flocking to “the cloud” – they aren’t even sure what the heck we mean when we say it because we use it as a broad brush with which to paint every service on the Internet these days.

The more I hear and the more I read and the more I see the dismissal of very real issues with IaaS cloud computing that need solutions because of the successful adoption of SaaS the more I think that SaaS either needs to be excluded from discussions of “cloud computing” or that we need to do a better job qualifying the term “cloud” when we discuss it.

The issues with SaaS are not the issues with “IaaS cloud”; they are very different simply because they are two different architectural models with two very different goals. Applying the success or failure of one to the other isn’t realistic, nor is it benefiting cloud computing as a paradigm in any way to mix them up.


Follow me on Twitter View Lori's profile on SlideShare friendfeedicon_facebook AddThis Feed Button Bookmark and Share

Related blogs & articles:

Read the original blog entry...

More Stories By Lori MacVittie

Lori MacVittie is responsible for education and evangelism of application services available across F5’s entire product suite. Her role includes authorship of technical materials and participation in a number of community-based forums and industry standards organizations, among other efforts. MacVittie has extensive programming experience as an application architect, as well as network and systems development and administration expertise. Prior to joining F5, MacVittie was an award-winning Senior Technology Editor at Network Computing Magazine, where she conducted product research and evaluation focused on integration with application and network architectures, and authored articles on a variety of topics aimed at IT professionals. Her most recent area of focus included SOA-related products and architectures. She holds a B.S. in Information and Computing Science from the University of Wisconsin at Green Bay, and an M.S. in Computer Science from Nova Southeastern University.

@CloudExpo Stories
In his session at 21st Cloud Expo, Carl J. Levine, Senior Technical Evangelist for NS1, will objectively discuss how DNS is used to solve Digital Transformation challenges in large SaaS applications, CDNs, AdTech platforms, and other demanding use cases. Carl J. Levine is the Senior Technical Evangelist for NS1. A veteran of the Internet Infrastructure space, he has over a decade of experience with startups, networking protocols and Internet infrastructure, combined with the unique ability to it...
"MobiDev is a software development company and we do complex, custom software development for everybody from entrepreneurs to large enterprises," explained Alan Winters, U.S. Head of Business Development at MobiDev, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Vulnerability management is vital for large companies that need to secure containers across thousands of hosts, but many struggle to understand how exposed they are when they discover a new high security vulnerability. In his session at 21st Cloud Expo, John Morello, CTO of Twistlock, addressed this pressing concern by introducing the concept of the “Vulnerability Risk Tree API,” which brings all the data together in a simple REST endpoint, allowing companies to easily grasp the severity of the ...
Agile has finally jumped the technology shark, expanding outside the software world. Enterprises are now increasingly adopting Agile practices across their organizations in order to successfully navigate the disruptive waters that threaten to drown them. In our quest for establishing change as a core competency in our organizations, this business-centric notion of Agile is an essential component of Agile Digital Transformation. In the years since the publication of the Agile Manifesto, the conn...
In his session at 21st Cloud Expo, James Henry, Co-CEO/CTO of Calgary Scientific Inc., introduced you to the challenges, solutions and benefits of training AI systems to solve visual problems with an emphasis on improving AIs with continuous training in the field. He explored applications in several industries and discussed technologies that allow the deployment of advanced visualization solutions to the cloud.
Enterprises are adopting Kubernetes to accelerate the development and the delivery of cloud-native applications. However, sharing a Kubernetes cluster between members of the same team can be challenging. And, sharing clusters across multiple teams is even harder. Kubernetes offers several constructs to help implement segmentation and isolation. However, these primitives can be complex to understand and apply. As a result, it’s becoming common for enterprises to end up with several clusters. Thi...
While some developers care passionately about how data centers and clouds are architected, for most, it is only the end result that matters. To the majority of companies, technology exists to solve a business problem, and only delivers value when it is solving that problem. 2017 brings the mainstream adoption of containers for production workloads. In his session at 21st Cloud Expo, Ben McCormack, VP of Operations at Evernote, discussed how data centers of the future will be managed, how the p...
"NetApp is known as a data management leader but we do a lot more than just data management on-prem with the data centers of our customers. We're also big in the hybrid cloud," explained Wes Talbert, Principal Architect at NetApp, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"Space Monkey by Vivent Smart Home is a product that is a distributed cloud-based edge storage network. Vivent Smart Home, our parent company, is a smart home provider that places a lot of hard drives across homes in North America," explained JT Olds, Director of Engineering, and Brandon Crowfeather, Product Manager, at Vivint Smart Home, in this SYS-CON.tv interview at @ThingsExpo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
The question before companies today is not whether to become intelligent, it’s a question of how and how fast. The key is to adopt and deploy an intelligent application strategy while simultaneously preparing to scale that intelligence. In her session at 21st Cloud Expo, Sangeeta Chakraborty, Chief Customer Officer at Ayasdi, provided a tactical framework to become a truly intelligent enterprise, including how to identify the right applications for AI, how to build a Center of Excellence to oper...
"IBM is really all in on blockchain. We take a look at sort of the history of blockchain ledger technologies. It started out with bitcoin, Ethereum, and IBM evaluated these particular blockchain technologies and found they were anonymous and permissionless and that many companies were looking for permissioned blockchain," stated René Bostic, Technical VP of the IBM Cloud Unit in North America, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventi...
Coca-Cola’s Google powered digital signage system lays the groundwork for a more valuable connection between Coke and its customers. Digital signs pair software with high-resolution displays so that a message can be changed instantly based on what the operator wants to communicate or sell. In their Day 3 Keynote at 21st Cloud Expo, Greg Chambers, Global Group Director, Digital Innovation, Coca-Cola, and Vidya Nagarajan, a Senior Product Manager at Google, discussed how from store operations and ...
"Infoblox does DNS, DHCP and IP address management for not only enterprise networks but cloud networks as well. Customers are looking for a single platform that can extend not only in their private enterprise environment but private cloud, public cloud, tracking all the IP space and everything that is going on in that environment," explained Steve Salo, Principal Systems Engineer at Infoblox, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Conventio...
Large industrial manufacturing organizations are adopting the agile principles of cloud software companies. The industrial manufacturing development process has not scaled over time. Now that design CAD teams are geographically distributed, centralizing their work is key. With large multi-gigabyte projects, outdated tools have stifled industrial team agility, time-to-market milestones, and impacted P&L stakeholders.
"ZeroStack is a startup in Silicon Valley. We're solving a very interesting problem around bringing public cloud convenience with private cloud control for enterprises and mid-size companies," explained Kamesh Pemmaraju, VP of Product Management at ZeroStack, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"We're focused on how to get some of the attributes that you would expect from an Amazon, Azure, Google, and doing that on-prem. We believe today that you can actually get those types of things done with certain architectures available in the market today," explained Steve Conner, VP of Sales at Cloudistics, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
"Codigm is based on the cloud and we are here to explore marketing opportunities in America. Our mission is to make an ecosystem of the SW environment that anyone can understand, learn, teach, and develop the SW on the cloud," explained Sung Tae Ryu, CEO of Codigm, in this SYS-CON.tv interview at 21st Cloud Expo, held Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA.
Data scientists must access high-performance computing resources across a wide-area network. To achieve cloud-based HPC visualization, researchers must transfer datasets and visualization results efficiently. HPC clusters now compute GPU-accelerated visualization in the cloud cluster. To efficiently display results remotely, a high-performance, low-latency protocol transfers the display from the cluster to a remote desktop. Further, tools to easily mount remote datasets and efficiently transfer...
High-velocity engineering teams are applying not only continuous delivery processes, but also lessons in experimentation from established leaders like Amazon, Netflix, and Facebook. These companies have made experimentation a foundation for their release processes, allowing them to try out major feature releases and redesigns within smaller groups before making them broadly available. In his session at 21st Cloud Expo, Brian Lucas, Senior Staff Engineer at Optimizely, discussed how by using ne...
Gemini is Yahoo’s native and search advertising platform. To ensure the quality of a complex distributed system that spans multiple products and components and across various desktop websites and mobile app and web experiences – both Yahoo owned and operated and third-party syndication (supply), with complex interaction with more than a billion users and numerous advertisers globally (demand) – it becomes imperative to automate a set of end-to-end tests 24x7 to detect bugs and regression. In th...