Cloud computing promises sourcing flexibility for hardware and software, variable (as opposed to fixed) costs for IT, continuous (as opposed to step) upgrades for mission-critical enterprise software, centralized management of user software and arguably better security against malicious attacks and data theft.

Computer geeks are not generally known for colorful metaphors. But “cloud computing,” a metaphor that captures the imagination as well as the essence of an emerging computing paradigm, may be one of those rare exceptions.

Among other things, cloud computing promises sourcing flexibility for hardware and software, variable (as opposed to fixed) costs for IT, continuous (as opposed to step) upgrades for mission-critical enterprise software, centralized management of user software and arguably better security against malicious attacks and data theft. Although the phrase “cloud computing” is somewhat new, many of the underlying technologies are relatively mature and available.

Cloud computing refers to the sourcing of some capability – hardware, software, execution of a business process – from somewhere “out there.” The users of the capability don’t know and don’t care exactly where it comes from or how it’s put together, much the same way a grateful farmer in a drought doesn’t know or care which cloud a given raindrop comes from. Within this rather broad definition, there are at least three discernible categories of cloud computing.

A hardware cloud is a very large and very sophisticated data center that lets you use its hardware – servers, storage, network – for a use-based charge. You can, among other things, run your enterprise applications, store your data or execute e-commerce transactions.

Need more processing power, storage or bandwidth during crunch time? No problem. The hardware cloud infrastructure expands or contracts to accommodate your need, and you pay only for what you use. Exactly how the provider does this or precisely where the computing takes place, you don’t know and, theoretically, you don’t care. Amazon’s Elastic Computer Cloud (EC2) is an example of a hardware cloud.

A software cloud – also known as Software as a Service (SaaS) – is specialized software (say, for customer relationship management) that runs on a hardware cloud somewhere, typically (although not always) someplace other than your own data center. Your employees use a Web browser to access it; typically, you pay by the number of users or seats.

The provider manages the hardware and software capacity needed to support the required number of seats and the service level you want. Exactly where the hardware resides or how the software is configured, the users don’t know and again, theoretically, don’t care. Salesforce.com is an example of a software cloud.

Desktop clouds run the desktop applications you’d normally install on your home or office computer – such as word processing or spreadsheets – from a hardware cloud via the Internet, yet provide you the same experience as if the application ran locally. A complex caching mechanism distributes the computation across your computer, the Internet itself and remote data centers, so you literally cannot know exactly what computation takes place where. Google Docs, Yahoo’s Zimbra and Microsoft Live are examples of desktop clouds.

Data
If you have just one SaaS provider – say, Salesforce.com for customer relationship management – the theory is that you’d locate your CRM data with Salesforce.com. In practice, however, you’ll probably have some proprietary applications running in your own data center that use the same CRM data. Furthermore, if you use one provider for CRM, another for human resources and yet another for enterprise resource planning, there’s likely to be considerable overlap across the data used by the three providers and the proprietary applications that run in your own data center. So where do you locate the data?

•  The platform scenario – Some SaaS providers are morphing from providers of a single vertical capability (such as CRM) into providers of SaaS “platforms” that bundle their vertical capability with a development environment and an integration environment. The theory is that while you may use multiple SaaS providers and proprietary applications, one of the providers will be the first among equals, hosting all your data and providing you with a development environment where you can integrate your data with all the applications (including other SaaS) that use the data.
• Database-as-a-service scenario – One provider – which could be your own data center – only hosts the data and provides “database as a service” to all the applications. Although this model has yet to emerge, it’s a distinct possibility and would have the advantage of not tying you to a single SaaS provider for all your data and integration needs.

Security
When it comes to using third-party hardware and software, security is perhaps the single biggest issue for most companies. While this is likely to be a significant near-term concern, one could argue that a large SaaS provider whose entire business is predicated on securing its clients’ data and applications would be in a better position to do so than the IT organization of a single company.

In fact, Citigroup recently purchased 30,000 seats from Salesforce.com for its CRM needs after extensive evaluation of the latter’s security infrastructure. With respect to desktop clouds, it’s noteworthy that, last year, Google acquired Postini, a company specializing in enterprise security and regulatory compliance. The point is that all providers are endeavoring to improve their offerings to meet clients’ enterprise-grade security needs.

•  Gated-community clouds – In much the same way that gated communities are designed to keep out the riffraff, highly selective private clouds or consortia are likely to emerge with dedicated networks that connect only their members. Unlike a single company’s data center, a private cloud can consolidate the hardware and software needs of multiple companies, provide load balancing and economies of scale, and still alleviate many of the security concerns.

Performance
Although the Internet is fast enough to transmit data to a user from a remote server, it’s not fast enough to handle large transaction volume with stringent performance needs if the applications have to access their databases through the Internet.

•  Ecosystem clouds – To solve the performance problem, yet another type of computing cloud is likely to emerge – a full ecosystem of enterprise SaaS plus database as a service, all within a single hardware cloud.

In fact, besides performance, an ecosystem cloud has the added advantage of better integration across the different providers that are part of the same ecosystem.  

Experimentation – For Now
For small and large companies alike, cloud computing provides several potential benefits, including lower IT costs, faster deployment of new IT capabilities, an elastic IT infrastructure that can expand or contract as needed and, most important, a CIO freed from the more mundane aspects of managing the IT infrastructure.

Consequently, companies that take a tactical approach of experimentation – moving aging, non-strategic applications to a hardware cloud; using SaaS for processes that don’t have a significant data overlap with other critical processes; experimenting with a network-based desktop for small, deskbound work forces – can gain valuable experience and insight into how to take advantage of cloud computing as it matures.

As this paradigm evolves and matures (to solve the data, security and performance issues), there will ample time to develop a long-term strategy. For CIOs, that may be the silver lining in cloud computing.

Kishore S. Swaminathan, Accenture’s chief scientist, is based in Chicago. He can be reached at This e-mail address is being protected from spam bots, you need JavaScript enabled to view it