@CloudExpo Authors: Liz McMillan, Elizabeth White, Pat Romanski, Yeshim Deniz, Aruna Ravichandran

Related Topics: @CloudExpo

@CloudExpo: Blog Feed Post

Get Your SaaS Off My Cloud

Why architecture matters not only to security but to the future of cloud computing

It seems the phrase “in the cloud”, sadly, has become a marketing-hyped euphemism for “the Internet.” I say sadly because the use of cloud to refer to every and any service delivered over the Internet dirties up the cloud. It obscures the intent of cloud computing and makes it difficult for technologists in the trenches to get a handle on how cloud – both external and internal – can provide benefits and solutions to problems they have right now. The very loose use of the term means that every last little web application on the web could be (and sometimes is) called “cloud computing”.

And while that may be technically true based on the very loose definition of “compute resources”, the problem really is in the use of “cloud” to refer to very different architectural models that just all happen to fit a very broad definition.

Of late, the use of the term “cloud computing” to specifically mean SaaS (Software as a Service) is one that’s not only getting under my skin but causing a great deal of irritation sitting there. Every trade publication, every analyst and research firm has been digging into the adoption of cloud computing and every one of them ends up with essentially the same conclusion: organizations aren’t ready to buy into it. Yet.

But then we see news about “cloud computing” like this report titled, “IT spending on cloud computing up 22% in 2009 to $9.6 billion” on TechRepublic. The entire report is about SaaS. Period. There’s nothing in it about the market for IaaS (Infrastructure as a Service) or PaaS (Platform as a Service). It’s all about SaaS. And SaaS is hardly cloud computing in the same way that IaaS is cloud computing. This lack of qualification between the two makes the market look much more robust, mature, and mainstream than it actually is. It is misleading, and that can eventually backfire by leaving would-be customers to continue to question viability long after maturation because they can’t trust the information.


There is a very real difference between the architectural models and benefits of cloud computing (i.e. compute resources as a service) and multi-tenant hosted software, a.k.a. SaaS. These architectural differences are important to every discussion we have about cloud because they affect the security and costs of cloud computing. Those architectural differences manifest themselves with very different issues surrounding integration, data integrity, internetworking, and efficiency.

Invariably when the question of “cloud” security comes up someone brings up SaaS and the fact that organizations have been safely using it for years. This fact is then used to dismiss the very real concerns surrounding security issues and cloud computing. Let’s take just a moment to consider the differences and why this is such a problem.

  1. SaaS is all about the database The way in which multi-tenant hosted software like Salesforce.com and SugarCRM provide security and services is at the database layer. The software, the interface, is the same for every customer. Customization is accomplished through data-driven layout and field definition. The networking stack, the servers, the operating system is all the same. Every customization, every unique process, every branded page is driven solely through data in the database. Security in a SaaS is inherently tied to the robustness of the security model on the database.

    Database security is well-understood, well-known, and very mature. The ability to restrict access down to a single-cell if necessary has long been available and it is this flexibility in database access security that makes SaaS possible.
  2. Many well-known SaaS offerings are not about customer data Another argument tries to dismiss security concerns by pointing out the widespread use of hosted services like Ceridian (payroll and HR) and Concur (travel, expenses). While it is true that these SaaS vendors have long been popular amongst a wide variety and very disparate set of industries, both are focused on employee data, not customer data. While employers are certainly protective of and concerned with the security of their employee’s data, this data is not a competitive advantage, it is not tied directly to revenue, and it is governed by a completely different set of regulations. It’s a completely different set of risks that are managed in a completely different way.
  3. SaaS has a smaller attack surface IaaS has to expose a lot more of the stack to end-users while SaaS has to essentially expose a web  imageinterface. Even integration with SaaS software is via the web (SOAP, REST, etc…) and in a way that is very well controlled. IaaS? There’s very little control because the provider has no idea what application you’ll be deploying. As Hoff pointed out via Twitter, this does not prove that SaaS is more secure even though it seems logical to deduce that; it’s just a different set of risks that need to be managed. Understanding the differences in what those risks are is important when choosing a provider or implementing a cloud model internally.
  4. IaaS introduces the unknown SaaS is well-understood. It’s software stack and therefore its potential vulnerabilities are well-documented, well-understood, and relatively easy to protect if you know what to look for. SaaS, because it is essentially just hosted software, has been very well exercised over the past decade. Its vulnerabilities and potential points of exploitation have been discovered, tested, exposed, and closed. IaaS, however, introduces a new layer where vulnerabilities are not well-understood, not well-known, and not-well exercised. The virtualization layer is completely new and should be considered an “unknown” risk at this point.

    The “sharing of resources” in a SaaS model is really about sharing the database, and even that is strictly contained by very granular security. Code is shared, but in such a way as to make it less relevant. I don’t have to, as a customer, worry about the quality or security of an application of another organization or individual that may be executing on the same hardware as mine and may, through the exploitation of some yet unknown virtualization vulnerability, cause my application to become another 'bot in a giant distribution network for malware.

    The “sharing of resources” in cloud computing is about sharing everything – from the network to the operating system to the infrastructure. Every aspect of cloud computing is about sharing and reusing resources in a way that makes it efficient for both the provider and the customer.

The goal of SaaS is to deliver software. But the software it is delivering is pre-defined. It’s a constrained set of features/functions that are designed to perform a specific task. IaaS, on the other hand, is about delivering on-demand computing resources for use in whatever way the end-user/customer wants to use it.

They are not the same – not architecturally, not in implementation, and not in the issues they bring to the table.


NIST has recently published a working definition of cloud that takes pains to distinguish between the various subtypes of cloud computing:

Cloud computing is a pay-per-use model for enabling available, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is comprised of five key characteristics, three delivery models, and four deployment models.

The document goes on to describe, succinctly and with what I think is more than good enough accuracy the characteristics, delivery and deployment models. I could (and may in the future) argue against the inclusion of “applications” in the definition of “computing resources” and am fairly certain it is included solely because people assume SaaS is cloud computing but for now I’ll let sleeping dogs lie. The important part of the definition, I think, is the separation and qualification of each type of “cloud computing”. NIST provides this type of delineation because architecture matters when you’re discussing things like security, reliability, and data integrity as well as who the end user of the cloud service really is.

When organizations ask for direction and guidance on building their own “clouds” they aren’t asking about deploying a SaaS. They want to create an on-demand, dynamic data center that affords them many of the same benefits as “cloud computing” – efficiency, sharing of resources, automation. They want the IaaS version of cloud computing, not SaaS or PaaS. But the lack of qualification around the term “cloud” confuses the issue and makes it difficult to have a conversation about specific models.

No wonder people aren’t flocking to “the cloud” – they aren’t even sure what the heck we mean when we say it because we use it as a broad brush with which to paint every service on the Internet these days.

The more I hear and the more I read and the more I see the dismissal of very real issues with IaaS cloud computing that need solutions because of the successful adoption of SaaS the more I think that SaaS either needs to be excluded from discussions of “cloud computing” or that we need to do a better job qualifying the term “cloud” when we discuss it.

The issues with SaaS are not the issues with “IaaS cloud”; they are very different simply because they are two different architectural models with two very different goals. Applying the success or failure of one to the other isn’t realistic, nor is it benefiting cloud computing as a paradigm in any way to mix them up.


Follow me on Twitter View Lori's profile on SlideShare friendfeedicon_facebook AddThis Feed Button Bookmark and Share

Related blogs & articles:

Read the original blog entry...

More Stories By Lori MacVittie

Lori MacVittie is responsible for education and evangelism of application services available across F5’s entire product suite. Her role includes authorship of technical materials and participation in a number of community-based forums and industry standards organizations, among other efforts. MacVittie has extensive programming experience as an application architect, as well as network and systems development and administration expertise. Prior to joining F5, MacVittie was an award-winning Senior Technology Editor at Network Computing Magazine, where she conducted product research and evaluation focused on integration with application and network architectures, and authored articles on a variety of topics aimed at IT professionals. Her most recent area of focus included SOA-related products and architectures. She holds a B.S. in Information and Computing Science from the University of Wisconsin at Green Bay, and an M.S. in Computer Science from Nova Southeastern University.

@CloudExpo Stories
First generation hyperconverged solutions have taken the data center by storm, rapidly proliferating in pockets everywhere to provide further consolidation of floor space and workloads. These first generation solutions are not without challenges, however. In his session at 21st Cloud Expo, Wes Talbert, a Principal Architect and results-driven enterprise sales leader at NetApp, will discuss how the HCI solution of tomorrow will integrate with the public cloud to deliver a quality hybrid cloud e...
Is advanced scheduling in Kubernetes achievable? Yes, however, how do you properly accommodate every real-life scenario that a Kubernetes user might encounter? How do you leverage advanced scheduling techniques to shape and describe each scenario in easy-to-use rules and configurations? In his session at @DevOpsSummit at 21st Cloud Expo, Oleg Chunikhin, CTO at Kublr, will answer these questions and demonstrate techniques for implementing advanced scheduling. For example, using spot instances ...
SYS-CON Events announced today that Yuasa System will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Yuasa System is introducing a multi-purpose endurance testing system for flexible displays, OLED devices, flexible substrates, flat cables, and films in smartphones, wearables, automobiles, and healthcare.
SYS-CON Events announced today that Taica will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Taica manufacturers Alpha-GEL brand silicone components and materials, which maintain outstanding performance over a wide temperature range -40C to +200C. For more information, visit http://www.taica.co.jp/english/.
As hybrid cloud becomes the de-facto standard mode of operation for most enterprises, new challenges arise on how to efficiently and economically share data across environments. In his session at 21st Cloud Expo, Dr. Allon Cohen, VP of Product at Elastifile, will explore new techniques and best practices that help enterprise IT benefit from the advantages of hybrid cloud environments by enabling data availability for both legacy enterprise and cloud-native mission critical applications. By rev...
When it comes to cloud computing, the ability to turn massive amounts of compute cores on and off on demand sounds attractive to IT staff, who need to manage peaks and valleys in user activity. With cloud bursting, the majority of the data can stay on premises while tapping into compute from public cloud providers, reducing risk and minimizing need to move large files. In his session at 18th Cloud Expo, Scott Jeschonek, Director of Product Management at Avere Systems, discussed the IT and busine...
Organizations do not need a Big Data strategy; they need a business strategy that incorporates Big Data. Most organizations lack a road map for using Big Data to optimize key business processes, deliver a differentiated customer experience, or uncover new business opportunities. They do not understand what’s possible with respect to integrating Big Data into the business model.
Companies are harnessing data in ways we once associated with science fiction. Analysts have access to a plethora of visualization and reporting tools, but considering the vast amount of data businesses collect and limitations of CPUs, end users are forced to design their structures and systems with limitations. Until now. As the cloud toolkit to analyze data has evolved, GPUs have stepped in to massively parallel SQL, visualization and machine learning.
Recently, REAN Cloud built a digital concierge for a North Carolina hospital that had observed that most patient call button questions were repetitive. In addition, the paper-based process used to measure patient health metrics was laborious, not in real-time and sometimes error-prone. In their session at 21st Cloud Expo, Sean Finnerty, Executive Director, Practice Lead, Health Care & Life Science at REAN Cloud, and Dr. S.P.T. Krishnan, Principal Architect at REAN Cloud, will discuss how they b...
Enterprises have taken advantage of IoT to achieve important revenue and cost advantages. What is less apparent is how incumbent enterprises operating at scale have, following success with IoT, built analytic, operations management and software development capabilities – ranging from autonomous vehicles to manageable robotics installations. They have embraced these capabilities as if they were Silicon Valley startups. As a result, many firms employ new business models that place enormous impor...
The next XaaS is CICDaaS. Why? Because CICD saves developers a huge amount of time. CD is an especially great option for projects that require multiple and frequent contributions to be integrated. But… securing CICD best practices is an emerging, essential, yet little understood practice for DevOps teams and their Cloud Service Providers. The only way to get CICD to work in a highly secure environment takes collaboration, patience and persistence. Building CICD in the cloud requires rigorous a...
SYS-CON Events announced today that Dasher Technologies will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. Dasher Technologies, Inc. ® is a premier IT solution provider that delivers expert technical resources along with trusted account executives to architect and deliver complete IT solutions and services to help our clients execute their goals, plans and objectives. Since 1999, we'v...
SYS-CON Events announced today that MIRAI Inc. will exhibit at the Japan External Trade Organization (JETRO) Pavilion at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. MIRAI Inc. are IT consultants from the public sector whose mission is to solve social issues by technology and innovation and to create a meaningful future for people.
Data scientists must access high-performance computing resources across a wide-area network. To achieve cloud-based HPC visualization, researchers must transfer datasets and visualization results efficiently. HPC clusters now compute GPU-accelerated visualization in the cloud cluster. To efficiently display results remotely, a high-performance, low-latency protocol transfers the display from the cluster to a remote desktop. Further, tools to easily mount remote datasets and efficiently transfer...
In his session at 21st Cloud Expo, Raju Shreewastava, founder of Big Data Trunk, will provide a fun and simple way to introduce Machine Leaning to anyone and everyone. Together we will solve a machine learning problem and find an easy way to be able to do machine learning without even coding. Raju Shreewastava is the founder of Big Data Trunk (www.BigDataTrunk.com), a Big Data Training and consulting firm with offices in the United States. He previously led the data warehouse/business intellige...
SYS-CON Events announced today that TidalScale, a leading provider of systems and services, will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 - Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. TidalScale has been involved in shaping the computing landscape. They've designed, developed and deployed some of the most important and successful systems and services in the history of the computing industry - internet, Ethernet, operating s...
SYS-CON Events announced today that TidalScale will exhibit at SYS-CON's 21st International Cloud Expo®, which will take place on Oct 31 – Nov 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA. TidalScale is the leading provider of Software-Defined Servers that bring flexibility to modern data centers by right-sizing servers on the fly to fit any data set or workload. TidalScale’s award-winning inverse hypervisor technology combines multiple commodity servers (including their ass...
Gemini is Yahoo’s native and search advertising platform. To ensure the quality of a complex distributed system that spans multiple products and components and across various desktop websites and mobile app and web experiences – both Yahoo owned and operated and third-party syndication (supply), with complex interaction with more than a billion users and numerous advertisers globally (demand) – it becomes imperative to automate a set of end-to-end tests 24x7 to detect bugs and regression. In th...
Amazon is pursuing new markets and disrupting industries at an incredible pace. Almost every industry seems to be in its crosshairs. Companies and industries that once thought they were safe are now worried about being “Amazoned.”. The new watch word should be “Be afraid. Be very afraid.” In his session 21st Cloud Expo, Chris Kocher, a co-founder of Grey Heron, will address questions such as: What new areas is Amazon disrupting? How are they doing this? Where are they likely to go? What are th...
SYS-CON Events announced today that IBM has been named “Diamond Sponsor” of SYS-CON's 21st Cloud Expo, which will take place on October 31 through November 2nd 2017 at the Santa Clara Convention Center in Santa Clara, California.