EMC Closes Cloud: Atmos'phere has changed says analyst

As they close almost without warning their Atmos storage cloud, it seems that EMC has woken to the fact that the cost of infrastructure in any telecommunications project is unbearable for a company that makes it's money from selling products. Read EMC announcement here.

The announcement is bad PR not just for EMC but for Cloud computing in general as it leaves customers in a position where they have no support, no service level agreement and no guarantees that their data will be there tomorrow!

If you have five minutes it's worth reading the critique by cloud blogger Nicole Hemsoth over at her Behind the Cloud blog where she takes to task the analyst who just a few months ago rated him seize Atmos storage cloud has one of the rising stars of Cloud Computing.

Having spent many years working for, or with, service providers of all types & sizes it's very clear to me that the financial model required to deliver Cloud computing environments runs counter to that of a hardware or software manufacturer no matter how big they are. Infrastructure is by definition “a massive upfront investment funded by debt paid back over many years that generates cash flow which is used to fund operations, pay back the debt and pay dividends to investors, which is about as far as you can get away from the model of a company that sells product.

You can't blame EMC for wanting to be at the forefront Cloud computing wave as is a defining period for the industry in which EMC is an undoubted leader, I think they have done the right thing in stepping back before it impacts their core business as I foresee that a number of other companies who have jumped too early with too little consideration of the financial model that needs to be employed following suit, or the conflicts of interest that may arise with customers who can 'do it better'.

My advice to anybody thinking of moving to cloud infrastructure is to proceed with caution:

1) Look at whether it is a core element of their business, is it what they do all day every day?
2) Look at the providers ability to sustain the business model; 'can they stand the level of long term' debt?

Do this “before” deciding who to trust your precious data to.

Breaking news: VMCo offers embedded Check Point VPN-1 VE security

Working together Virtual Machine Co and CheckPoint remove the final barrier to virtualization of enterprise-wide, tier-one computing. This is a new and unique offering

June 29, 2010 Cambridge, UK

Read more here

The Great Server-Centricity Con Job

Hardware today allows for higher and higher consolidation ratios “even if it is not our hardware”. More and more dense ram configurations are available but according to IDC the average number of VMs run on a single piece of physical hardware remains stubbornly at 'seven'.

Economics means we're incentivised to increase this ratio but fear stops us from doing so.

The concentration of risk that comes from the consolidation of more and more applications/ workloads/ services, call them what you will, onto fewer and fewer machines runs completely contrary to everything we have learnt to do in the last 20 years.

But, to our predecessors in the 80's and 90's this was considered normal everything ran on the Mainframe, a Couple of SuperMini's or on half a dozen VAXs.

What's happened is that we have been fooled into believing that the answer to needing to run a new application or service is to buy a new cheap server, and lets face it it's never been cheaper to buy servers - it's the spiraling cost of running them that is killing us!!

Do you think that the major Cloud providers are using 10's of thousands of those hot little 2CPU 16GB systems that DELL & HP are shoving down everyones throats?

No, they are built on RAM heavy, massively scalable 'custom designed hardware' with 'custom designed' capacity management software. With, of course, 'custom designed support'.

Just what we're offering to you, everyday... only with the Virtual Machine Company it's our standard design..!

A straightforward DR configuration

In a virtualised environment DR is always top of the agenda.

One of the pre-sales team put together this simplified network infrastructure overview of a DR config' that he recently installed at one of our customers.
The diagram shows the logical networks in both office and the DR site. IP addressing provided for illustrative purposes and simplicity of understanding only. In practice certain aspects of IP addressing will have to be changed to fit in with the clients pre-existing international office to office VPN.

Failover modes with this config'

In the event of Internet connection failure in the office, the default route for traffic will be via the DR site. Should two shared storage drives fail in one storage device, there is no interruption to service (Raid6). Should one physical Xen server node fail in the office, the other office node can continue running workloads. Should both virtualisation platforms fail or their storage then DR VMs can be accessed at the DR site.

If the entire office fails (both links down because of complete power outage, building on fire or whatever) DR is accessed over the Internet via VPN. Normally, the public Internet Router (or its firewall) provide the default route.

Should the Internet connection fail, the default route is the LAN extension service router. This fail-over routing can be achieved manually or automatically via technologies like HSRP/VRRP.

Hope you find this useful and I'm sure we'll post other snippets and suggestions in future.

Citrix XenServer & VMware ESX Common Criteria Certification

As some of you already know, Citrix have sponsored XenServer, XenDesktop, XenApp, and Netscaler into the Common Criteria program for Information Technology Security Evaluation (CC). We have had several questions about the announcement and what it means for both VMware and XenServer in particular. Since 1 or 2 of us at VMCo were there way-back when Common Criteria & ITSEC first started seeing mainstream IT products submitted for evaluation, we thought we would take this chance to answer some of your questions in this posting.

What is Common Criteria (CC)?
CC is an attempt to reduce duplication of effort of the IT security evaluation functions of several governments (6 in all). CC is an international standard that describes how product vendors may make claims about their security software or hardware, and have independent laboratories investigate these claims and certify the product has been designed and built in a way that meets the vendors claims and can be relied upon to function as described.

What is EAL?
Within CC, products are examined to an Evaluation Assurance Level (EAL). EALs are numbered currently from 1 to 7, with 7 being the most detailed, most stringent level of scrutiny that a product is put under. VMware ESX and ESXi 3.5 were certified to EAL4+ in February 2010. Citrix have submitted their products for the EAL2 process this month.

So An EAL4 Product Is More Secure Than An EAL2 Product?
No. This is probably the most common misconception about CC. A higher EAL number means only that the product passed a deeper level of scrutiny of the vendor's claims. For example, I might have a simple weak encryption application that passes EAL7, because it was found to meet my claims without fault, and its design and execution was found to be exemplary even when "put under the microscope" of EAL7. A much stronger encryption application, that would protect my data better using a strong algorithm, might only be submitted for EAL2, because I want to get some kind of basic certification quickly so I can sell to my government customers. There are also a number of misconceptions around how vendor claims are tested. In our experience, code review is only done at EAL 6 or 7 for example.

What Claims Might A Vendor Make?
The scheme allows for vendors to tailor their claims based upon their product and the way it is to be used. This means that a Firewall is not subject to the same investigation as an Email system or a Desktop OS. A vendor with a Firewall might claim that in order to administer the device you must pass 2-factor authentication, and can only do so over a strongly encrypted connection, and that there are no other possible way of gaining admin access. Such a claim would be investigated to the required depth as part of the CC certification. Another example of a popular claim might be "the admins can't automatically read everyones Email". CC tests these claims are true to a certain depth. Documentation is a vital part of passing an evaluation.

Does It Matter What Version Gets Certified?
Yes. It matters very much. Just because version 1 of a product received certification, it doesn't mean that v2 or even v1.0.1 is certified. The product must be resubmitted into the evaluation process for it to be re-assessed. This is because CC evaluates vendors claims for a given version and even a given configuration of the product. It is normal for a product to be obsolete by the time it passes certification. You could argue this is made worse by the pace of change in commercial software, with many companies pushed to make 1 major release per year and 2 functionality patches, alongside the 4 critical security related hotfixes, all of which take a product outside its certified condition.

How Long Does It Take?
For product of similar size/complexity, the higher the level of assurance the longer the evaluation takes. Expect to see an XenServer (we presume v5.0 or v5.5) certified within the next 6 months. A CC certification can be an expensive business, in our experience of the process (mainly CheckPoint-FW1 and Harris CyberGuard) the cost is £200K-£400K.

Who Cares If A Product Is Certified?
Mostly it is government buyers or those who have to work closely with government agencies, exchanging information with them, or connecting directly to them. Often such customers are restricted to choosing products from the catalogue of evaluated solutions. However, depending on the sensitivity of the information being handled by the IT, an EAL certified may not even be required.

Where Can I Find Out More?
As ever, Wikipedia is a good start.
Check the Portal for certified products.

Hot as Hell Data-Centers Impact Business Values

With energy consumption from ICT systems now accounting for over 40% of average office energy bills it is essential for business to consolidate their computing requirements through virtualisation of resources onto fewer more powerful systems.

The UK’s new Carbon Reduction Commitment (CRC) Energy Efficiency Scheme came on line on the 1st of April - but according to consultancy Pricewaterhouse Coopers (PwC) this is no joke.

As energy costs for business already set to soar over the next 5 years PwC suggest that the CRC could act as a costs multiplier - with poorly managed energy systems adding up to 20% to those increased energy costs.

As part of the governments scheme, participants will have to purchase allowances to emit CO2 and report their emissions. On the back of this reporting scheme, results will be published in a league table with bonuses paid to the best performing companies, and fines for the profligate.

PwC estimates that 5,000 businesses with energy bills in excess of £500,000 p.a will be affected with a typical company with a £1m p.a. energy bill seeing an additional £500,000 added to the already increasing energy bills over the next 5 years.

Bottom line for investors is that with CRC adding 2-6% to the annual operating costs, a large power hungry data-centers directly impact the companies value.

VMware slashes price of vSphere Essentials

VMware has announced that they have halved the price of vSphere Essentials, the entry level version of their core virtualisation product. Which is effectively a license for upto three Dual CPU machines.
Pitched as being ideal for small IT environments with fewer than 20 physical servers, the Essentials editions of vSphere includes the ESX and ESXi hypervisors which provide the virtualization layer that allows multiple virtual machines to share the computing, networking and storage resources of a single physical server.

If you're looking for more advanced features like High Availability or Data Recovery you'll need to dig a bit deeper, with VMware US prices list remaining stubbornly high.

With more focus from Microsoft & Citrix and a greatly improved products; the fact that Hyper-V is free and Citrix Essentials for Hyper-V is quite cheap- the get what you pay for argument can only hold up for so long. See Register article.

In an effort to remove barriers to it's use Microsoft recently confounded pundits by embracing a range of Linux guest OS's including the previously verbotten Red Hat widening it's appeal to enterprises, and particularly service providers who need to run mixed environments

So in-spite of all the marketing hyperbola what's going on in the field? Well,
Virtual Machine Company makes a High Performance Virtualization hardware appliance and we ship with either VMWare, XenServer or Hyper-V pre-installed, and our experience of late is that whilst 9 out of 10 installs are VMware - 75% of customer meetings I have attended this year also ask us about Hyper-V.