Cloud Hosting

A lighthouse project that will shine a light to guide both users and providers towards more trustworthy and transparent adoption of cloud computing in Europe and beyond.

Thats the bold claim made for the new EU Cloud Code of Conduct (CoC), the result of over four years of collaboration between the European Commission and suppliers from the cloud computing industry. Its stated mission is to make it easier for customers to determine whether cloud services from various providers are suitable for their designated purposes, as well as creating an environment of trust that adherence to its terms will result in a default level of data protection, built, of course, around GDPR (General Data Protection Regulation).

This is a very important moment for the industry, argues Agnieszka Bruyere, VP, IBM Cloud EMEA:

Up to now, we have been missing a reliable, easy tool to assess the compliance of cloud computing services with data protection regulations. This created an uncertainty for users and also cloud providers that slowed down the adoption of cloud computing all over Europe. This period has now come to an end.

This is the first tool in Europe that allows us to demonstrate not only compliance, but also to bring proof of compliance for cloud users and cloud providers all over the Europe. It's also very important because for the first time we have an independent monitoring body that has been accredited.

So whats actually in the Code? As per the CoCs own descriptor, the Cloud Code of Conduct:

The Code is a voluntary instrument and service providers demonstrate compliance through self-evaluation and self-declaration and/or through third-party certification, attaining one of three levels of approval.

Providers have to:

convincingly explain how the requirements of the Code are met. The Monitoring Body will refer to questionnaires. First set of questions is a derivative of the Controls Catalogue. Depending on the information provided there will be follow-up questions or requests; questions are mostly related to better understand the actual measures; requests are mostly related to further evidence and samples. In case provided information leave doubts of a CSPs compliance requests may also be related to particular remedies and or confirmations.

Once a cloud service has been verified as compliant, it will be listed in the Public Register where customers can view the results. To date, a number of vendors have gone through or are in the process of going through the certification procedures. For example, SAP, Google, Workday and Microsoft already boast some level of compliance, while Oracle and Salesforce are completing their respective certifications.

Workday has been involved in the CoC collaboration since early 2018, says Barbara Cosgrove, the firms Chief Privacy Officer, attracted in part by its broad focus on all types of cloud services:

As a cloud provider, we continue to look for innovative ways to demonstrate to our customers that we meet our obligations. We think that you must have that 'trust, but verify it' approach. We have binding corporate rules for processors, we use that as a data transfer mechanism, along with other mechanisms. But we really thought that the Code of Conduct was a unique mechanism under GDPR where, in addition to having a contractual mechanism, you were able to tie it to much more detailed audits and monitoring.

The fact that the CoC covers SaaS, PaaS and IaaS offerings is being pitched as a significant differentiator compared to other similar initiatives. As Jo Copping, Salesforces EMEA Senior Director of Privacy, explains:

That makes it a very unique proposition and a really all-encompassing solution. The Code does bring really an unprecedented level of certainty and coherence to the market. Its a really robust tool of reference that can be used by cloud providers and cloud users alike to ensure that data protection standards really are high. As cloud providers, we get a robust tool that we can use to demonstrate our commitment to EU privacy principles and also to fundamental EU values.

European customers are very highly-sophisticated when it comes to their privacy and security requirements and they have very high expectationsMore trust leads to more cloud adoption which leads to more efficiencies and ultimately more benefits for European customers, citizens and also for the economy as a whole.

Another appealing aspect of the CoC is the existence of an independent body to monitor its operation and future development, argues Karine Picard, Vice-President of Business Development EMEA, Oracle:

It was absolutely key for us as well to have an authority, like SCOPE Europe, that can monitor and and drive continuous innovation of the Code. It's the first code, but it's not going to be the only one. Actually it's an evolutive code. With cloud and innovation, things are moving very fast, so to have this authority to monitor the code and to make it evolve in the right direction is really important as well.

The CoC sets a high bar for other parts of the world to emulate, suggests Nathaly Rey, Head of Data Governance EMEA, Google Cloud:

Normally our privacy programs are developed to scale globally. The things that you do - the product changes, the engineering changes, many of the contractual changes and the operational changes - not only impact Europe, but they impact your services globally. So, by virtue of adopting the Code, you're raising the bar for the industry and many times you're raising the bar for your compliance program globally.

GDPR and European privacy is inspiring what you do in other jurisdictions, in other countriesOther jurisdictions have taken the European model as an inspiration in terms of the principles that govern data protection. We're seeing many of the processes and provisions inspired by GDPR and the previous [EU Data Protection] directive. So, definitely there is a trend hereCodes of conduct like this are helpful to help operationalize high level principles into the state of the art for an industry.

So, thumbs up from all round from the supplier perspective, but what about the other side of the coin - will buyers really care about this or dismiss it as gesture politics from the sell-side? After all, every cloud services provider talks up trust and transparency and adherence to the likes of GDPR as a de facto part of their outreach already.

Oracles Picard argues that one obvious appeal for buyers is simplification:

If a customer already has multiple clouds in their landscape, they have to manage multiple SLAs (Service Level Agreements), and of course there will be interoperability of those clouds. We have to simplify their life and having IaaS, PaaS and SaaS under one code is really an asset for the customer. For a provider like us, because we cover all of these elements, it would have been very complex for us to have to follow up different codes. Our customers already know that we are following and committed to follow GDPR and ISO and SOC, but the Code is really providing another layer of insurance for them...It's really simplifying our life internally and the life of our customer.

And customers are, to date, taking note, suggests Workdays Cosgrove:

We've definitely had conversations with our customers about it. It helps pull together that entire picture. It helps us to not send them three different documents, to try to look at one place, to be able to have one mapping that we didn't do ourselves that's coming from an approved source. GDPR can be complex and [when you try] to apply it to different cloud industries, everybody starts to have different interpretations. Its so detailed and so having a place [customers] can go to and have this controls catalog and have an overall one stop to take a look and be able to review, has been really helpful. Then they can look at our other [corporate] resources and they can look up all of our audits and third-party certifications, but having one place that does that overall kind of mapping and expectation has been really helpful in the conversation.

It is that sort of ambition that makes this EU CoC so important, concludes Matthias Cellarius, Head of SAP Data Protection & Privacy:

It's not just one code of conduct, it's the Code of Conduct as I would put it. It's the first code that's been fully acknowledged by the European Data Protection Board, and it's operational as of today. I think that's the big, big difference. It's a role model for other codes of conduct. It's a lighthouse project and it'll be something that will transform the entire industry and from which all of our customers can benefit.

Cynics observe that the great thing about having a standard is there are so many to choose from. My own personal experience of standards bodies has been to observe years and years of collaboration and co-operation as the detailed work gets done, only for participating bodies to end up fighting like a bag of cats before the ink is even dry on the press release that work is complete on the first version of the standard.

This looks different. The SaaS, PaaS and IaaS remit overview is hugely welcome and the existence and involvement of SCOPE bodes well. There are some impressive supplier testimonials to back the Code up as well assome notable omissions to date. (Amazon - can you hear me?).

Critical here will be to watch how this EU initiative does or does not influence similar movements in other parts of the world. For all the fine words that get expressed about GDPRs impact, the harsh reality is that were a long way from beating down the vested interests at play in stopping a GDPR-US avatar from taking shape.

That said, this is impressive work to date. Its also important to recognize that it is ongoing work and work on which suppliers must be held to account moving forward. As SAPs Cellarius puts it:

We have made it the lighthouse project with the potential to transform the industry. It's now on us to actually fill it with life, to make sure that all the merits that are perceived today are actually going to turn into reality, and that we all show that we can comply and that we continue working on the Code and keeping it relevant, not only for now, but for the future.

Definitely something that we'll be keeping an eye on.

Read this article:
Conduct most becoming - Europes new Cloud Code of Conduct shines a light on trust and transparency between buyers and sellers - Diginomica

Elevate your enterprise data technology and strategy at Transform 2021.

Companies are grappling with the rapid migration to cloud computing, which opens a Pandoras box of problems at a time when technology talent is at a premium.

Internal development teams are already stretched thin and are often focused on core product development. This can leave a vacuum when it comes to building robust cloud-native applications that rely on application programming interfaces (APIs), the glue that holds modern software together. The API economy is powering digital transformation across the spectrum, helping companies improve their efficiency and profitability by funneling into the expertise of the wider digital ecosystem.

This is where Terazo comes in. The five-year-old Virginia-based company helps everyone from stealth startups to large publicly traded companies integrate and automate their internal systems by providing the tech talent (or engineering rockstars, as Terazo calls them) companies need to flourish in the cloud era. While Terazo sometimes serves as a simple outsourced software development team, it also works with internal development teams in what Terazo CEO Mark Wensell calls a blended team model, with Terazo bringing its experience in API management to the mix.

Internal development teams are often focused on the core business systems and software development initiatives of a company, with large product development backlogs that theyre assigned to, Wensell told VentureBeat. When strategic API integration or API publishing opportunities come along, using internal teams for that work often means their focus attention to core product development is taken away.

To help with this, the company today announced it has raised $10.5 million in a round of funding led by Tercera, an investment firm specializing in cloud services companies. Cloud communications API giant Twilio also participated in the round, a notable strategic investment for a company that relies on consultancy companies such as Terazo to help businesses deploy and manage their APIs.

Above: Terazo CEO Mark Wensell

In many ways, Terazo is analogous to APIs themselves. Rather than having to build a robust communications infrastructure from scratch, tech companies can leverage the expertise of third-party specialists and integrate with their smarts through an API. For example, why would Box develop and maintain its own two-factor authentication (2FA) system when it can use Twilios infrastructure instead?

Terazo and its ilk fulfill a similar role, but from a human resources perspective.

For us, things like REST API integrations are a relatively repeatable pattern across our client portfolio, whereas for an internal team, there might be a much larger learning curve to learn the necessary patterns and practices and get it right, Wensell said. That becomes even more true when a client is building on a technology platform like Twilio. We have deep experience and a lot of reusable assets that mean our clients spend is focused on the customization unique to their business process.

While Terazo generally works under tight NDAs and cant disclose its clients, it did reveal that real estate platform PrimeStreet is one of its customers and that Terazo has helped it build a more cohesive, unified digital platform powered by APIs.

Rather than just building a collection of mobile apps and websites, we helped them make the core of their business a platform in and of itself, Wensell added.

All of this feeds into a trend that has been touted as the third wave of cloud computing, with some estimates predicting cloud spending could hit $1 trillion in 2030. This opens the door to third-wave consultancies such as Terazo, which can plug a gap with specialized skills and let in-house developers focus on what they do best.

We define a third-wave consultancy as a cloud-focused professional services firm whose business values, delivery, go-to-market models, and talent are optimized for the clouds next wave of growth, Tercera partner Dan Lascell told VentureBeat. The cloud has matured over the last 20 years, and the attributes that made services firms successful in the first two waves wont necessarily cut it in the next decade.

See original here:
Twilio backs Terazo to power the API economy and third wave of cloud - VentureBeat

As humans and our billions of devices become increasingly dependent on digital systems, computers are running out of processing power to keep up.

Fortunately, writes Darshika Perera, assistant professor of electrical and computer engineering, there is a solution: customized and reconfigurable architectures that can bring next-generation edge-computing platforms up to speed.

Perera published the research in a feature story for the spring edition of the Institute of Electrical and Electronics Engineers Canadian Review. In it, she describes a key concern for those of us living in the Internet of Things era: as more systems process massive amounts of data in the cloud, the cloud is facing serious obstacles to keeping up. Poor response times, high power consumption and security issues are just a few of the challenges it faces when transmitting, processing and analyzing the enormous burden of global data.

Pereras research, conducted with a team of ten graduate students in the Department of Electrical and Computer Engineering, highlights a twin path forward.

First, Perera writes, data processing must move away from its reliance on traditional cloud infrastructures and towards a complementary solution: edge computing.

Non-computer scientists can think of edge computing like a popular pizza restaurant opening new locations across town. A pizza that travels 20 miles from the restaurant will be cold by the time it reaches the customer. But a pizza cooked right down the street will arrive faster and reduce the strain on the original restaurants kitchen.

Similarly, edge computing processes data nearer to its source on phones, smart watches and personal computers rather than farming the job out to the cloud. Perera writes that edge computing addresses nearly all of the challenges faced by cloud computing, from speed and bandwidth to security and privacy.

But edge computing is still in its infancy, and most of the edge-computing solutions currently being visualized rely on processor-based, software-only designs.

At the edge, the processing power needed to analyze and process such enormous amount[s] of data will soon exceed the growth rate of Moores law, Perera writes. As a result, edge-computing frameworks and solutions, which currently solely consist of CPUs, will be inadequate to meet the required processing power.

Thats where Pereras second conclusion comes into play. To process and analyze ever-increasing amounts of data and to handle associated problems along the way the next generation of edge computing platforms needs to incorporate customized, reconfigurable architectures optimized for specific applications.

What does this mean? It means that computer processors will no longer perform one dedicated job. Instead, like shapeshifters, they will configure themselves to perform any computable task set before them.

The flexibility of these systems put them head and shoulders over general-purpose processors. Perera writes that reconfigurable computing systems, such as field-programmable gate arrays (FPGAs), are more flexible, durable, upgradable, compact and less expensive, as well as faster to produce for the market all of which helps to support real-time data analysis.

As Perera envisions the future of edge computing, her analysis shows that multiple applications and tasks can be executed on a single FPGA by dynamically reconfiguring the hardware on chip from one application or task to another as needed.

These kinds of improvements from traditional computing processes, Perera writes, will make next-generation edge-computing platforms smart and autonomous enough to seamlessly and independently process and analyze data in real time, with minimal or no human intervention. In the future, they could allow technologies that rely on lightning-fast edge computing, like self-driving cars, to become ubiquitous and they could certainly enable technologies in the future that are unimaginable today.

One thing is for certain: they will make computing faster, more autonomous, and more adaptive than ever before.

Read Pereras full article for IEEE Canadian Review online.

Darshika Perera is an assistant professor of electrical and computer engineering in the College of Engineering and Applied Sciences at the University of Colorado Colorado Springs. She has extensive experience in embedded systems, digital systems, data analytics and mining, hardware acceleration and dynamic reconfiguration and machine learning techniques. Her research is conducted with a team of graduate students in the Department of Electrical and Computer Engineering at UCCS. Learn more online.

See original here:
Perera envisions the future of edge computing: faster and more adaptable than ever before - Communique

This content is provided byRed Hat.

Serverless computing is having a moment. Although its been around for several years, recent shifts away from proprietary models toward open source have built momentum. Similarly, the standardization of containers, especially with Kubernetes, has opened up new possibilities and use cases, as well as fueled innovation.

Its really this iteration on this promise thats been around for what seems like decades now, which is if you outsource to, for instance, a cloud provider, you dont necessarily have to know or care or manage things like servers or databases, said John Osborne, chief architect for North America Public Sector at Red Hat. A couple of the key traits of serverless are that the code is called on demand, usually when some event happens, and that the code can scale down to zero when its no longer needed. Essentially, youve offloaded part of your infrastructure to a platform or public cloud provider.

The term serverless is a little misleading. There are actually servers, of course, you just dont have to know or care about them, because theyre owned and managed by the platform. Osborne likens it to the term wireless because a laptop isnt plugged into a wall, we call it wireless, even though the signal may travel 10,000 miles via fiber optic cable. The only part thats actually wireless is your living room, but thats really the only part you have to care about.

One of the main benefits of adopting serverless is that it facilitates a faster time to market. Theres no need to worry about procurement or installation, which also saves cost. Devs can just start writing code.

Its almost seen as a little bit of an easy button, because youre going to increase some of the velocity for developers, and just get code into production a lot faster, Osborne said. In a lot of cases, youre not necessarily worried about managing servers, so youre offloading some liability to whoevers managing that serverless platform for you. If your provider can manage their infrastructure with really high uptime and reliability, you inherit that for your application as well.

The main roadblock to adoption thus far has been that the proprietary solutions, while FedRAMP certified, just havent done a good job of meeting customers where they are. These function-as-a-service platforms are primarily just for greenfield applications, Osborne said. But the public sector has a lot of applications that cant just be rewritten. It also breaks existing workflows, and theres a high education barrier.

Containers have now become the de-facto mechanism to ship software. Its easy to package apps, even most older applications, in a container. Kubernetes will then do a lot of the heavy lifting for that container based workload such as application health and service discovery. And with Kubernetes, it will run anywhere: in a public cloud, on premise, at the edge, or any variation thereof. This makes Kubernetes an optimal choice for users that want to run serverless applications with more flexibility to run existing applications in any environment. While Kubernetes itself isnt a serverless platform there have been a lot of innovations in this area specifically with the knative project which is essentially a serverless extension for Kubernetes.

The idea is that you can run these kinds of serverless applications in any environment, so youre not necessarily locked into just what the public cloud is giving you, but anywhere Kubernetes can run, you can run serverless, Osborne said. And since its running containers, you can take legacy workloads and run them on top as well, which opens the door for the public sector to a lot of use cases. Traditionally, public sector IT orgs have handled applications with scaling requirements by just optimizing for the worst case scenario. They would provision infrastructure, typically virtual machines, to handle the highest spike and leave those machines running 24/7.

Serverless can help alleviate some of this pain; the application can spin up when its needed, and spin back down when its not.

Osborne said hes seen use cases at some agencies where they receive one huge file say a 100G data file each day, so they have server capacity running all day just to process that one file. In other cases, he said hes seen agencies that bought complicated and expensive ETL tools simply to transform some simple data sets. Both of these are good use cases for serverless. Since serverless is also event-based it makes a great fit for DevSecOps initiatives. When new code gets merged into a repo it can trigger containers to spin up to handle tests, build, integrations, etc.

Once you go down the serverless path you realize that there are a lot of trickle down ramifications from using existing tools and frameworks up through workflows and architecture models. If youre using containers, its just a much better way to meet you wherever you are in terms of those tools and workflows, such as logging operations and so forth, Osborne said. Open source is really where all the momentum is right now. Its a big wave; I tell customers to get ahead of it as much as they can. At least start to look into this kind of development model.

Read the original:
Serverless computing goes open source to meet the customer where they are - Federal News Network