Kiran Kulkarni

Security beyond the Network

By Kiran Kulkarni on June 13, 2021

“Sicher ist sicher” is a common german expression that roughly translates to “better be safe than sorry”.

That’s what my polite, 50 year old german colleague told me as he held up his electronic chip that controlled access to the datacenter that stood in front of us. For him I was this young, immature guy that trusts a public cloud provider without knowing where his data is.

Is a physically secured data center safer than the cloud?

Data centers were built for the pre-digital era. Most of the users were employees and most of the work happened from offices. They were built to trust the employees and trust the network. Once the employees were in the office and their password checked-out, they were given a very broad access. For those exceptions where remote access was needed, employees were provided a VPN (virtual private network) access.

Over the years, work has become more collaborative – requiring contractors, vendors and suppliers to come together and on various projects. In some cases, the work has left the corporate premises. Take for example call center employees – outsourced or not – who work from home but need to access sensitive information to answer customer questions.

Covid-19 just just accelerated this trend of remote, collaborative work. The exception has become the norm.

My previous company had me create a complex password of 10 characters every few months. We all know how that goes. We have a limited number of family members, pets and birthdays to make up our passwords.

Cloud security on the other hand is built with the understanding that networks are unreliable. It works on what we call the “zero trust” principle. This principle has 3 main components.

Security is based on the devices and the identity of the user (not the network): Devices are secured by corporate software and identity is verified through multi-factor authentication.
Once in, the access to the cloud is controlled at a very granular level based on the user’s role. A developer may have access to create and edit a report but his manager may only view the report. One can even control what rows and columns can be accessed by which person based on their role.
Security is based on the computing resource access: Every interaction is authenticated, authorized and encrypted.

Us human beings are not good judges of risk. About a decade ago, the book “Freakonomics”, showed that more people die of accidental drowning in their home pool than accidental gunshots.

Phishing websites have caused more data breaches by stealing passwords.

From 10% to 10x

By Kiran Kulkarni on June 5, 2021

About a decade ago, the startups embraced the cloud because it helped them with speed, agility and cost.

The big enterprises took note of their success.

Under an IT led, top down strategic push, they took some of their existing servers, storage and processing and moved it to the cloud. When that worked, they moved a bit more. And then a bit more. With each iteration they shaved off a few percentages from their infrastructure costs.

This is what I call the 10% thinking.

Today’s economy provides multiple digital touch points. This includes the social media, online advertisement, e-commerce, audio files from call center logs as well as thank you letters received by post. The data is varied (scanned letters, audio/video files, website logs etc). The quality of the data is not uniform. The biggest challenge is that the data cannot be easily connected. You cannot map the cookie data with purchase data with your traditional tools.

The cloud offers you tools to combine this data, clean it and make predictions on it.

Some companies have created specialized data science teams to analyze the different data sources and build new products or features.

I call them the 100% thinkers. They combine 10% bottomline cost savings with 90% topline revenue growth.

The true winners of tomorrow are a step further ahead. They have understood that specialised data science teams are important, but not scalable. That the biggest benefit of the cloud is in the democratisation of analytics and machine learning. They have enabled every single team to use the power of data. These teams are running multiple predictive experiments using readily available autoML features and when somethings work, they quickly roll them out through continuous integration and delivery (CI/CD) features of the cloud.

An elite commando unit will be able to make some quick strikes but a better equipped army with modern tools will win many more battles and gain much more ground (or marketshare).

That, to me, is 10x thinking.

A case for transformation

By Kiran Kulkarni on May 28, 2021

In my previous post I argued that executives make the cloud cost assessment reports to suit their agenda.

My argument here is that the question – “what does it cost to run this application in the cloud” is in and of itself the wrong question to ask. It comes from a myopic vision of the cloud as another place to run applications. One needs to move away from the trees and look at the forest. i.e. look at the platform, the applications and the nimbleness required to adapt to the market.

Let’s start with the platform.

First, the cloud removes the traditional trade-off between availability and cost. A company does not need to buy additional hardware in anticipation of peak demand. Second, the cloud radically skews the traditional DevOps (development and operations) role in favour of more development by automating a lot of regular maintenance work.

At the level of applications, they are smaller, loosely coupled microservices which are more fail-tolerant and thereby increasing uptime. Secondly, new application deployment is much faster because developers can work on the same platform versions as in production

This results in a quicker transition from ideas to PoCs (proof of concept) followed by an accelerated path to production and quicker releases once in production. These are small improvements individually but combined together, they allow the company to grow the business exponentially.

A few years ago, the pharmaceutical company moderna built its mRNA research platform in the cloud. When Covid-19 hit the world, moderna was in a position to massively accelerate its vaccine development process.

The rest – as they say – is history.

Costs are in the eyes of the beholder

By Kiran Kulkarni on May 22, 2021

As a cloud architect, I often get asked by executives if moving a certain application to the cloud would save them money.

There was a time when I used to think about RoI (return on investment) calculations, find out break-even points and so on. I often asked them what their current costs are. To date, I have not found an executive who had the faintest idea of the cost of running his application on-premise. Not even a ballpark figure.

The cost of running an application on-prem can be divided into two parts – the datacenter costs and the application costs.

The true cost of a datacenter includes the cost of the hardware, the licensing and maintenance cost of the operating system, the personnel costs required to maintain them, the support personnel (procurement team, for example) the electricity, the cost of the land and so on. These costs are to be proportionately allocated to all the apps running in the datacenter.

Nobody knows these costs because they do not show up on any reporting tool every month. They are not tracked because they do not change and they cannot be optimized. They are sunk costs.

The application costs are relatively simple. They include licensing costs and the operational costs of running it. For the executive, the datacenter is a free, shared resource. There are no metrics on how efficient his application is in terms of computing resources, because the old technology did not allow for such cost breakdown. I have seen the most inefficient use of computing resources in a datacenter.

The huge fixed (sunk) costs coupled with opaque operational costs for the application means that the cost assessment is either over-indexed on the cloud migration costs or on the transformation benefits in the cloud. There is nothing objective about it.

All cloud RoI calculations are therefore, at best a point of view — a statement of intent of the executive running the program. How then, should a CXO frame the app migration question? Here is my take on it.

For the CXO, a €5 million cheque every 3 years for a datacenter seems like the cost of doing business. But a €5000 monthly cloud bill is something that one can see and try to optimize.

What gets tracked, gets improved.

Creating a culture of transparency and accountability will help cost control more than the technology in itself.

The Status Quo argument

By Kiran Kulkarni on May 15, 2021

A very senior leader once asked me why he should consider the cloud at all. After all, his team was delivering all of its projects without the cloud. Moving to the cloud would entail migration costs and operational risk when he could preserve his political capital for other projects.

I pointed out another technology that came about roughly at the same time as the cloud — the smartphone. One could argue that the previous generation of phones did the job of calling and texting just as well. We already had a camera for our vacations. And why would anyone want to know where they are currently located anyway?

Bringing the phone, the camera and the GPS was an incremental next step in technology, but it enabled us to leverage the improved data infrastructure in ways nobody could have imagined. We used the phone to order taxis, make video calls, post geo-tagged pictures and listen to podcasts.

The first smartphone was launched in 2007. It enabled the launch of Uber in 2009 and it caused blockbuster to close shop in 2010.

The cloud is enabling a change in the business model much like the smart phone did. It’s not enough to say that you can continue to deliver the status quo. Status quo was what blockbuster chose in 2007.

The gravitational force acting on the Cloud

By Kiran Kulkarni on May 12, 2021

We don’t think of gravitational force when we think of the cloud. Maybe it’s time to rethink gravity when it comes to cloud computing.

The three big cloud providers recently announced their quarterly results.

AWS had a revenue of 13.5 Billion and a growth rate of 30%.
Microsoft Azure had a revenue of 14.5 Billion and a growth rate of 23%
Google cloud (GCP) had a revenue of 4 Billion, and a growth rate of 45%.

Most CEO’s, boards and investors would give an arm and a leg to get these revenue and growth numbers. The overall public cloud market is expected to be around 330 Billion by the end of 2021.

According to Gartner, the total IT spend is expected to be 4 Trillion USD and growing at 8.5% annually. i.e. the cloud market is still only 10% of the overall IT spend. One could argue that this is good news. Cloud computing is growing 5 times the pace of overall IT and it has another 90% of the available market.

I ask a different question. It was way back in 2008 that AWS was launched. For something that is such a clear differentiator, why is the cloud still a meagre 10% of the overall IT spend?

I believe the answer lies in data gravity.

Data gravity is a term coined by Dave McCrory, a VP of engineering at GE Digital almost a decade ago. Data pulls everything towards itself. Applications are most efficient and cost effective when they are closest to the data.

It’s slow and expensive to move the data into the cloud.

In fact, if one breaks down the current 200 Billion cloud spend, my guess is that we will see a 80-20 distribution. It’s the digital natives – the Netflix, Spotify, Twitter etc. that drive 80 or even 90% of the cloud spend, followed by a long tail of enterprise customers. They will need a booster rocket to overcome the data gravity.

Why industry cloud is the next thing

By Kiran Kulkarni on May 7, 2021

Several people ask me what exactly is an industry cloud and more importantly, why do I say that it’s the next iteration in the cloud evolution. A definition of the industry cloud is here.

The underlying concept can be explained as follows.

As we already know, a typical car manufacturer designs the car and buys the components from specialist providers. For example he could buy the wheel from a specialized firm A, the tyres from firm B and brakes from firm C. The manufacturer is required to ensure that the components work together.

On the other hand, the vendor could offer customers a packaged “movement” solution, which includes the wheel, the tyres and the brakes integrated with each other. That’s a vertically integrated solution.

In a mature industry where standards are relatively stable, horizontal specialisation brings efficiency. After all, there are only a few standard size tyres available. The manufacturers don’t reinvent the wheel (pun intended) every few years.

In comparison, the computing industry is still the wild west for standards. The fast pace of innovation means that the standards keep evolving. It makes a lot of sense to buy (or subscribe to) a packaged solution and focus on the core business.

The next iteration in cloud

By Kiran Kulkarni on May 2, 2021

When the cloud industry first started, it was all about computing infrastructure. The value proposition was – Why buy datacenters when you can rent them on demand. It allowed AWS to open up an entire industry and it continues to dominate it a decade later. This first phase is generally referred to as the “Infrastructure Cloud”.

Then came Microsoft. It was already established with large enterprises with its software applications. These included amongst other things database applications (MS SQL server), ERP applications (Microsoft Dynamics), and of course, its Email and office applications (MS Office). It started offering these applications on its Azure cloud. The value proposition was – Why buy an application license when you can subscribe to it on demand. This phase of cloud computing is called the “Application Cloud”

Each successive iteration provided more and more horizontal solutions as a service. For example, there is the “Platform Cloud”, the “Software Cloud”, the “Security cloud” and so on.

So what next?

I believe the next iteration is not another horizontal offering but a vertical offering. Some people call it the “Industry cloud”. In this phase it is about understanding industry specific needs and packaging an offering suited to that industry. The focus is on the seamless integration with other components and reducing operational overheads to maintain it. It aligns much better with the C-level business executives whose priorities are speed, resilience and efficiency in their journey towards digital transformation.