Is cloud security really different than data center security?

Almost every conversation I have had over the past year or so always comes back to security in the cloud.  Is it really secure? Or we are thinking about implementing the cloud but we are worried about security.  There are, of course, good reasons to plan a cloud security strategy. But in a sense, it is no different than planning a security strategy for your company. But it is the big scary cloud! Well, before I list the top then issues I would like to say one thing: if you think you need an entirely different security strategy for the cloud, you may not have a comprehensive security strategy to start with.  Yes, you have to make sure that you cloud provider has a sophisticated approach to security. However, what about your Internet service provider? What about the level of security within your own IT department? Can you throw stones if you live in a glass house (yes, that is a pun…sorry)?  So, before you start fretting about security in the cloud, get your own house in order.  Do you have an identity management plan? Do you ensure that one individual within the data center can’t control all of the data within a single environment to minimize risks? If you don’t have a well executed internal security plan, you aren’t ready for the cloud.  But let’s say that you have fixed that problem and you are ready to really plan your cloud security strategy. So, here five of the issues to consider. If you have others, let’s start a conversation.

1. You need to start at the beginning with understanding the characteristics of your cloud provider. Is the company well funded? Is its data center designed with security at the center? Your level of scrutiny will also depend on how you are using the cloud. If you are using Infrastructure as a Service for a short term project there is less risk than if you are planning to use a cloud to store important customer data.

2. How is your cloud provider implementing security in a multi-tenant environment? How do they ensure that one customer’s data doesn’t impact another customer’s data?

3. Does your cloud provider give you the ability to monitor security of your data in the cloud? This will be important both for compliance and to keep track of your own security policies.

4. Does your cloud provider encrypt your critical data? If not, why not?

5. Does your cloud provider give you the ability to control who is allowed to access your information based on roles and authorization? Does the cloud provider support federated identity management? This is basic security best practices.

Now you are probably saying to yourself that this isn’t rocket science. These are fundamental security approaches that any data center should follow. I recommend that you take a look at a great document published by the Cloud Security Alliance that details many of the key issues surrounding security in the cloud. So, I guess my principle message is that cloud security is not different than security in any data center.  But the market does not seem to understand this because the perception is that a cloud is somehow not a data center that can be secured with regular old security. I think that we will see something interesting happen because of this perception: cloud vendors will begin to charge a premium for really good security.  In fact, this is already happening.  Vendors like Amazon and Salesforce are offering segregated implementations of their environments to customers who don’t trust their ordinary security approaches.  This will work in the short term primarily because during this early phase of the cloud there is not enough focus on security. Long term, as the market matures, cloud vendors will have to demonstrate their ability to provide a secure environment based on basic security best practices. In the meantime, cloud vendors will rake in the cash for premium secure cloud services.

Public versus private clouds: why one size does not fit all

There has been a lot of discussions these days about private and public cloud. More discussion has been generated because  both Amazon.com and Salesforce.com have added a Virtual Private Network (VPN) option to their public cloud services.  What does this mean in the context of how customers will move to cloud computing? It is clear from the research that I have been doing that the private cloud and the hybrid cloud are real and will be part of the computing landscape for a long time.  The emergence of the virtual private cloud is an early indication that customers some customers want a better guarantee of their data. The combination of a public cloud with the privacy offered by a VPN is only going to grow over the coming year.

So, is a Virtual Private Cloud still a public cloud? I particularly found the blog published by Amazon’s CTO,Werner Vogel’s  announcing the virtual private cloud fascinating. On one hand, the private virtual cloud announcement is a proclamation that customers want to be able to have secure access to services on the Amazon EC2 Cloud. On the other hand, he is quite clear that this there is no such thing as a private cloud.  Clearly, it is in Amazon’s best interest for customers to focus on public clouds. Vogel states in his blog that “What is called private clouds have little of these benefits (he means characteristics of the cloud) and as such I don’t think of them as true clouds” The four characteristics of the cloud he points to include:

• eliminating costs – lowering both capital expenses and operating costs
• elasticity – avoiding complex procurement cycles and improving time to market
• and removing undifferentiated heavy lifting by off loading data center operations

While I agree that there are many situations where this is an ideal approach for many businesses, I don’t think the situation is black and white. There are indeed shades of gray. In my view, a private cloud has to be architected to be different than a traditional data center. But like a traditional data center, it is protected by a firewall and sophisticated security.  A private cloud will almost always be combined with some public cloud services (either capacity, software as a service, or platform as a service). So, I’ll take each of the three characteristics mentioned in Vogel’s blog and explain my view based on the fact that customers will make both economic and technical choices.

• eliminating costs – In reality there are data centers that work pretty well and are core to the business. The company has made an investment and therefore would not necessarily be able to lower costs. However, I expect that even if a company decided to go with a private cloud, there will be good reasons to use capacity on demand to fill gaps and expand for projects. In addition, a very large company will have the financial means to establish its own cloud that will be much more cost effective. A cost/benefit analysis of using a public cloud versus a private cloud is not straight forward. It requires a deep assessment of lots of different factors.
• elasticity – It is quite clear that many data centers do not have an efficient way to procure resources to users. However, if a data center is rearchitected to enable self-service provisioning, it can be transformed to better support users. Again, I expect that customers will take advantage of additional capacity or platform services even if they have private cloud services. This is especially true for companies where their computing infrastructure is the foundation of their business.
• removing undifferentiated services – This will really depend on whether the data center helps a company differentiate itself. There are definitely services that offer no value to the bottom line that should be placed in a public cloud (with a VPN for security, in some cases) such as electronic mail. However,  where these services are at the core of the business and probably need to be in a private cloud. Many companies will select which services are not differentiated and which ones are and create a hybrid environment. Companies will have to do their homework both in terms of focus and costs. It might initially cost more to move a service such as email to a public cloud but will have huge resources in the long run. In other situations, paying per hour, etc. may be a lot more costly than you might imagine.

My bottom line is this. The cloud will continue to evolve over the coming decade and there is no one approach that will become the standard. The cloud is primarily an economic proposition that will require careful evaluation. Companies need to understand what their business is, what the value and role of the data center is and what is the best set of services available. The good news is that with the evolution of the cloud companies will have lots of good options.

The end of maintenance?

I admit that I didn’t read the whole article but then I really didn’t have to. I knew what Marc Benioff, CEO of Salesforce.com was trying to start. I remember many years ago seeing Marc at an industry conference where he proudly announced the end of software.  A nice marketing approach that definitely got everyone’s attention. Of course, at that time Marc was working on a little software as a service enviornment that became Salesforce.com. The rest is history, as we like to say.  Now, Marc is on a new mission to attack maintenance fees. While it is clear that Marc is trying to tweak the traditional software market I think that he is bringing up an interesting subject.

Software maintenance is not a simple topic to cover and I am sure that I could spend hundreds of pages discussing the topic because there are so many angles. Maintenance fees began as a way of ensuring that software companies had the revenue to fund development of new functionality in their software products. It is, of course, possible to buy software, pay once, and never pay the vendor anything else. Those situations exist of course. Ironically, the better designed the software, the less likely it is that customers will need upgrades. But, clearly that circumstance is rare.

There are major changes taking place in the economics of software. Customers are increasingly unhappy with paying huge yearly maintenance fees to software providers. Some of these fees are clearly justified. Software is complex and vendors are often required to continue to upgrade, add new features, and the like. There are other situations where customers are perfectly happy with software as is and only want to fix critical problems and don’t want to pay what they see as exorbitant maintenance fees.

Now, getting back to Marc Benioff’s comments about the end of maintenance. Here is a link from Vinnie Mirchandani’s recent blog on the topic.Marc is making a very important observation. As the world slowly moves to cloud computing for economic reasons there will be a major impact on how companies pay for software. Salesforce.com has indeed proven that companies are willing to trust their sales and customer data to a Software as a Service vendor. These customers are also willing to pay per user or per company yearly fees to rent software. Does this mean that they are no longer paying maintance fees? My answer would be no. It is all about accounting and economics. Clearly, Salesforce.com spends a lot of money adding functionality to its application and someone pays for that. So, what part of that monthly or yearly per user fee is allocated to maintaining the application? Who knows? And I am sure that it is not one of those statistics that Salesforce.com or any other Software as a Service or any Platform as a Service vendor is going to publish. Why? Because these companies don’t think of themselves as traditional software companies. They don’t expect that anyone will ever own a copy of their code.

The bottom line is that software will never be good enough to never need maintenance. Software vendors — whether they sell perpetual licenses or Software as a Service– will continue to charge for maintance. The reality is that the concrete idea of the maintenance fee will evolve over time. Customers will pay it but they probably won’t see it on their bills.  Nevertheless, the impact on traditional software companies will be dramatic over time and a lot of these companies will have to rethink their strategies. Many software companies have become increasingly dependent on maintenance revenue to keep revenue growing.  I think that Marc Benioff has started a conversation that will spark a debate that could have wide ranging implications for the future of not only maintenance but of what we think of as software.

Why did CODA move to Salesforce.com?

After meeting Steve Pugh, CEO of CODA Financials, Inc., I wanted to understand why this mid-market financial applications vendor decided to build its next generation infrastructure on Salesforce.com’s infrastructure. I found the decision making to be quite interesting. First, for some background, CODA decided that it was time to move. The company has a habit of migrating to the next big platform of the day. The company started out writing its applications for the HP 3000 in the late 1970s and then moving to Digital Equipment’s VAX platform in the 1980s. After that CODA moved its code to the AS/400. The next platform was client/server in the 1990s – which was basically a browser-based environment. Now fast forward to the current decade. CODA decided to build the platform on top of salesforce.com. CODA was familiar with Salesforce.com because the company is a Salesforce customer.

The objective of the movement to a new platform was based on the ambitious plan to do for financial products what Salesforce has done for CRM. Needless to say, it is quite an ambitious goal. CODA management began to appreciate the potential for Software as a Service as a way to build customers faster than the sales process of on premise software. Before making the decision to use sforce (salesforce’s development platform), the company performed an ROI analysis. The challenge for the company was the cost of writing the code from scratch internally. Basically, development management realized that they would have to write for a multi-tenant environment that would have required several years of work to get the right infrastructure services in place. They simply couldn’t justify the expenditure or the time lag required for development. Without having to worry about any specific software infrastructure, CODA’s developers focused on customer facing features.

Unlike some of the companies that have built on top of sForce, CODA is a large company that serves mid-market companies. Salesforce needs CODA as much as CODA needs them. Salesforce needed to prove to the market that its platform could support a major application. CODA’s application is starting into the beta stage. So far, the company is happy. It has saved time and money. Now the proof will be to see if customers adopt its new SaaS platform.
CODA wrote its application with Salesforce’s Java like language called Apex. Therefore, the company is locked into the Salesforce platform. While there are always choices to be made and perhaps CODA is making the right one. It is clearly right from an ecosystem perspective since Salesforce will help CODA sell into its customer base. Long term CODA will have to read the tealeaves, just like it did when it committed to platforms such as the AS/400 and the VAX.

Is there beef behind SalesForce.Com?

I have been following Salesforce.com since its founding in the mid-1990s. Initially the company started by creating a contact management system which evolved into the sales force platform it offers today. Last month I attended a small dinner meeting in Boston hosted by Marc Benioff, Chairman and CEO of SalesForce.com, for some partners and customers. I met the Steve Pugh, CEO of CODA Financials, a subsidiary of Coda, a UK based developer of accounting software. I was intrigued that the company had built its new generation financial application on top of Salesforce.com’s infrastructure. In my next post, I’ll talk about Coda and why they made this decision. But before that I wanted to take a look at the Salesforce platform.

What is most interesting about Salesforce is that it intended to build a platform from day one. In my discussions with Marc in the early days he focused not specifically on the benefits of CRM but rather on “No Software”. If you think about it that was a radical concept ten years ago.

Therefore, It goes without saying that Salesforce has been a Software as a Service pioneer. For example, in June 2003 launched sforce, one of the first web services based SaaS platforms. It offered partners a published SOAP-based API. Rather than viewing Salesforce as an application, it views it as a “database in the sky.” It interprets this database as an integration platform. Likewise, from a customer perspective, Salesforce has designed its environment to “look like a block”. What does that mean? I would probably use a different term maybe a infrastructure blackbox.

Salesforce’s approach to creating its ecosystem has been incremental. It began, for example, by allowing customers to change tabs and create their own database objects. Next, the company added what it called the AppExchange which added published APIs so that third party software providers could integrate their applications into the Salesforce platform. Most of the applications on AppExchange are more like utilities than full fledged packaged applications. Many of the packages sold through the AppExchange are “tracking applications” for example, there is an application that tracks information about commercial and residential properties; another application is designed to optimize the sales process for media/advertising companies; still another package is intended to help analyze sales data.

But this is just the beginning of what Salesforce has planned. The company is bringing in expertise from traditional infrastructure companies like Oracle and BEA — among others. It’s head of engineering came from eBay. Bringing in experienced management that understands enterprise scalability will be important — especially because of Salesforce’s vast ambitions. I have been reading blogs by various Salesforce.com followers and critics. Josh Greenbaum, whom I have known for more than 20 years has been quite critical of Salesforce and has predicted its demise (within 18 months). He makes the comparison between Salesforce.com and Siebel. While any company that has risen as fast as Salesforce.com has will be a target, I do not believe that Salesforce.com is in trouble. There are two reasons I believe that they have a good chance for sustainability: their underlying SOA architecture and the indications that ISVs are beginning to see the company as a viable infrastructure.

So, what is the path that Salesforce is following on its quest for infrastructuredom (is that a real word — probably not). One of the primary reasons for my optimism is that Salesforce.com has a combination of traditional development through a procedural language it calls Apex that is intended to help developers write stored procedures or SQL statements. While this may disappoint some, it is a pragmatic move. But more important than Apex is the development of a standard XML based stylesheet interfaces to a service designed for use with Salesforce applications. This allows a developer to change the way the application looks. It is, in essence, the interface as a service. A third capability that I like is the technique that Salesforce has designed for creating common objects. In essence, this is a basic packaging that allows a third party to create their own version of Salesforce for its customers. For example, this has enabled Accenture to create a version of Salesforce for its customers in the health care.

But what is behind the curtain of Salesforce? First, Salesforce uses the Oracle database as a technique for serving up file pages (not as a relational database). But the core Intellectual Property that sits on top of Oracle is a metadata architecture. It is designed as a multi-tenancy service. Salesforce considers this metadata stack as the core of its differentiation in the market. The metadata layer is complex and includes an application server called Resin. The Resin Application Server is a high-performance XML application server for use with JSPs, servlets, JavaBeans, XML, and a host of other technologies. On top of this metadata layers is an authorization server. The metadata layer is structured so that each organization has a unique access to the stack. Therefore, two companies could be physically connected to the same server but there would be no way for them to access each other’s data. The metadata layer will only point to the data that is specific to a user. The environment is designed so that each organization (i.e., customer) has a specific WSDL-based API. In fact, the architecture includes the approach of access APIs through the WSDL interface. There are two versions of WSDL — one general and one for a specific customer implementation. If a customer wants to share data, for example, they have to go through the general WSDL interface.

Salesforce’s approach is to use XML based interfaces as an integration approach. It has used this to integrate with Google Apps. Salesforce has already begun partnering with Google around Adwords. This move simply deepened the relationship since both companies are faced with competitive threats.

The bottom line is that I think that Salesforce.com is well positioned in the market. It has an underlying architecture that is well conceived based on a SOA approach. It has created an ecosystem of partners that leverage its APIs and rely on its network to build their businesses. Most importantly, SalesForce.com has created an application that is approachable to mortals (as opposed to software gods). Companies like Siebel, in contract, created a platform that was complicated for customers to use — and therefore many purchased the software and never used it.

Salesforce.com is not without challenges. It needs to continue to innovate on its platform so that it does not get caught off guard by large (Microsoft, SAP, and Oracle) players who aren’t happy with an upstart in a market they feel entitled to own. They are also at risk from upstarts like Zoho and open source CRM players like SugarCRM. If Salesforce.com can collect more packaged software vendors like Coda to build their next generation applications on top of Salesforce’s environment, they may be able to weather the inevitable threats.

How Amazon cashes in on its Cloud

I had a very interesting conversation with Jeff Barr, the senior web services evangelist at Amazon. I have known Jeff for almost 15 years. In those days Jeff was one of the architects at a company called Visix, an early graphical development environment that was ahead of its time. Visix’s software development environment was designed as an abstraction of the underlying infrastructure. Visix came into the market before the Internet infrastructure became the defacto standard. But for me, it set the vision for where we are today. Jeff started at Amazon in the summer of 2002 with the Visix and some Microsoft experience in his consciousness.

Amazon’s business model is different than a traditional software company that often spends 18-24 months convincing customers to adopt new hardware/software or services. Amazon is leveraging a different computing model based on providing customers will a set of predefined services that can be bought without making a long term commitment. In a sense, Amazon has had the luxury (or good sense) to roll out service after service and see what sticks. As Jeff sees it, “people’s brains light up. They can build their business and applications in a positive way without having to worry about bandwidth, power and cooling.” His perception is that customers don’t think about whether the cloud provided by Amazon will support their needs. Clearly, he is able to talk this way because Amazon has made the investment in a scalable architecture to support an infrastructure that is designed for massive scalability. The other issue is that having built this architecture for its own retail requirements, Amazon had the foresight to exploit the technology to create a new line of business — in essence, a compute cloud based on providing a set of tools and product offerings to the market. The message to the market is straight forward, use these services so that you can innovate quickly without having to build from scratch. In taking this approach, Amazon creates both a test bed that allows the company to collaborate on new functionality with partners. In addition, and perhaps most importantly, it allows customers to buy incremental capability so they can scale up and down when they need to. According to Jeff one of the benefits of the cloud is that it isn’t dominated by the needs of one customer. In other words, one customer may have a spike in demand while another has less need at that point in time. Over the years, Amazon is able to understand usage patterns that are predictable.

Amazon’s business model follow this approach. A customer creates an account with Amazon that in essence gives them a charge account with Amazon. Customers get access to all of the Web services APIs. Their usage is tracked and they are billed for what they use. The business model is quite straight forward. Amazon charges 15 cents per gigabyte per month — not a lot of money even when you scale. What is interesting to me is there is no contracts to negotiate — everyone understands the rules. I asked Jeff if customers ever ask to buy a “private cloud”. While Amazon has been asked by customers, Jeff felt that because of the amount of experience that Amazon has with its hosted services discourages customers from explaining, “This is a business we want to be in. We have a lot of experience in our organization. We build highly cost effective data centers and sophisticated monitoring and operations.” He contends that Amazon has the expertise based on its 13 years in the business is enough to keep customers from walking away from its cloud. If you do the math, it would be difficult to argue. For example, if a customer needed 500GB of storage for two years, the cost would be $1800. In addition, it avoids the requirements for managing that environment.

Jeff makes a good point. If a customer needs to scale from 10GB to 100 TB in a month it might be hard to pull off. “This is routine for us,” Jeff claims. From his vantage point, the cloud changes the relationship between the customer and their hardware vendors. In effect, customers are sharing hardware resources with lots of other customers. So, the question becomes, who is your partner? It is no longer the provider of the hardware or the operating system. You probably still have a relationship with your software provider.

So, Amazon’s view of the cloud is pretty straight forward — it is a way to get value out of virtualization. Jeff points out that if developers uses Amazon’s elastic cloud service, for example, they pay to access servers on an hourly basis. Amazon allocates server to that account, provides a copy of the operating system they need to get started. That process takes a few seconds.

Another dimension of Amazon’s business revolves around the companies that actually build applications that sit on its infrastructure. Amazon has built a bunch of its own applications that it offers as services. In addition, there are a number of application companies that are building applications on top of the Amazon platform. One that Jeff mentioned to me is called RightScale, an automated cloud computing management system intended to help customers of Amazon’s Elastic Compute Cloud with issues such as load balancing. In addition to this type of company there is a community of 370,000 developers. Because Amazon sets the barrier to use so low, it is easy for a developer to try a service without making a long term commitment.

The more I think about Amazon’s platform and business model, the more sense it makes to me. I believe that Amazon and others such as Google, Salesforce.com, and eBay are a peak into the future of the new generation computing. In a sense, this model breaks every rule that the traditional computing industry has been built on. This movement towards enterprise software as a service and utility computing is beginning to redefine hardware, software, management and services. I predict that this new business model is going to slowly but surely turn the industry upside down. It isn’t only that the business model is different. The underlying technology platform based on standards and a service oriented architecture is propelling this change. The only thing that will slow this transformation is fear of change. But what else is new.

Is Infrastructure moving to the clouds?

Now that I am back from my trek to Redmond, I have time to come back to earth and think about what I heard. I think that several issues surfaced in my mind. Here are the three key issues that I think are worth more time:

1. We are at a turning point in enterprise computing. I predict that we are moving into the cloud as the focal point for enterprise infrastructure.

2. How much complexity do customers need to be exposed to? Distributed computing is hard and requires a new level of complexity that we haven’t seen before outside of small implementations and experiments.

3. What does it mean for the balance of power in the software industry? Whenever there are monumental changes in technology and customer strategy the shape of the industry changes.

Here’s my quick take on these issues. I’ll keep writing about this. In the meantime, I would love to start a dialog with you on these issues. So, if you agree, disagree or just think this is irrelevant, I would like to hear from you.

What about that cloud? What is an infrastructure cloud? Without getting into too much detail..it is a complex computing infrastucture that is hosted by an infrastructure provider that provides access to services ranging from access to storage, electronic mail, applications, etc. In some cases, this infrastructure can be well designed and scalable; in other situations the provider can cobble together a mess that is hidden from customers.

I don’t think that anyone owns this model yet but some company will. It will be the company that provides a scalable, well-designed, distributed infrastucture. This is what Amazon.com is trying to do with its Elastic Compute Cloud (Amazon EC2). It is what Google will pursue with all of its applications. However, Google’s first “official” cloud computing announcement is a joint educational venture with IBM. It is also at the heart of Microsoft’s Oslo initiative via its “Internet Service Bus”. I also expect that IBM, Oracle, and HP will get into the mix. Is there room for Apple with a Google partnership? How about Salesforce.com?

I am not ready to pick a winner(s). That is what makes this transition so interesting. A vendor doesn’t necessarily need a massive set of packaged applications or a huge sales force to gain traction. Does it avoid questions about operating systems? Does it matter if the software in the cloud is proprietary or open source? How much will the customer care? Maybe a lot right now. But who knows what we will think five years from now.

The one thing that I will predict is that the software industry is about to be turned upside down. Now, isn’t that fun?

The Future of Enterprise Software: who gets the power?

I recently attended an industry conference called Software 2007 and was struck by the different approaches articulated and advocated by three very different industry leaders. What stood out from the conference and from the discussions by the leaders of these three companies were the dramatic changes happening in enterprise software. In this column I will use presentations by leaders of SAP (Hasso Plattner), Microsoft (Steve Balmer), and Salesforce.com (Marc Benioff) to explain the nuances that are impacting enterprise software. Each of these companies represents an inflection point of an era. Each of these companies gained leadership by innovating in a specific area that defined its market dominance.

• SAP gained market dominance by creating a complex all encompassing enterprise process environment that gave birth to the tight partnership between enterprise software and systems integrators

• Microsoft transformed the desktop and the office application into a dominant development and runtime platform for the masses

• Salesforce.com took the idea of timesharing applications from the 1960s and 1970s combined with the Application Service Providers (ASP) of the 1990s and brought a new level of commercialization leading to a new generation — software as a service.

All three companies are now at a cross roads. The question in my mind is how will these companies transform themselves to adapt their platforms and strategies for the next generation of computing? We are at a new inflection point for software that will test these and other industry leaders to adapt to the new economic and technological challenges that are starting to impact the market. The speeches by these three executives were emblematic but for what they said and what they did not say.

SAP’s journey to a flexible platform

Let’s start with Hasso Plattner, the co-founder of SAP who has been instrumental in proposing new thinking about enterprise computing. SAP was a revolutionary departure when it sprang onto the market. SAP took the concept of packaged enterprise applications and turned it on its ear. Rather than creating a package with a model for a single industry, SAP created an extremely complex and detailed model-based packaged environment that supported a broad set of enterprise functionality with more depth and breadth than other packages of its day. It offered two innovations – first, its software enforced predefined processes and second, it relied on systems integrators to do the implementation. With predefined processes, customers let SAP determine many of their business processes. Rather than following the traditional approach of owning both the applications and the implementations, SAP partnered with the big systems integrators that it trained to deliver services to its prospective customers. The depth and complexity of the environment combined with the business process reengineering wave catapulted SAP into a leadership role. It was a new and revolutionary model.

Over the years, SAP has moved to create much more than a collection of packaged applications. It has attempted to lead the enterprise software market by creating an underlying enterprise infrastructure — a middleware platform (NetWeaver) to create a platform that would serve a broad partner and customer ecosystem.

Plattner, one of the founders of SAP, is fully aware of the dramatic changes happening in enterprise computing and he is trying to ensure that his creation remains a major player as we move into the later half of the decade. His vision is good. He proposes a next generation platform that includes a modular design where there are exposed interfaces to the more-than-2000 services that define the SAP environment. Each service is a closed black box. The objective is clear: keep the inside functionality intact but make it easier for customers to use the services they need. While the process of modularization will help SAP’s complex development process, it will not dramatically change the complexity of the environment for customers.

While the modularization of SAP is designed to keep current customers leveraging the existing platform, Plattner understands the need to adapt to changing enterprise software requirements. Rather than trying to reconcile the existing platform with a radically new one, a new proposed software as a service model, the foundation for SAP’s future direction, will be targeted at an untapped market for SAP – the mid-market. In addition, he advocates for such innovations as in memory databases, incremental software releases, and a variety of user interfaces and navigation choices. All of these are good ideas and will help SAP to some extent compete in the future.

However, there is a catch. First, SAP’s installed base is a leg iron that will hold the company back. The company’s installed base of customers has invested a fortune in implementing and more importantly customizing its mammoth application environment. Each new release often involves a six months to upgrade, because of the complexity of the environment. This is despite the fact that SAP has done much work over the past decade to add more modularity to its code base. However, at the end of the day, the SAP environment will continue to be a complex and tightly integrated set of capabilities. I am skeptical that SAP can make enough progress in the mid-market with its next generation to make up for the complexity of getting a large installed base to move.

Microsoft: evolution not revolution: can it hold onto the franchise?

Like SAP, Microsoft is at a turning point. It came into the market as a maverick, attacking the status quo by pushing its dozens of office computers off the cliff and establishing its operating system platform as a defacto standard for end users. At the time that Microsoft began its climb; the traditional computing platform was monolithic and inflexible. Microsoft offered a level of accessibility and pricing that helped revolutionize the market. As the years have past, Microsoft has taken advantage of emerging technology trends and has managed to continue to assert its market might into areas ranging from database, to collaboration, and of course the office and windows franchise. But like SAP, Microsoft is at an inflection point.

During his talk, Steve Balmer, Microsoft’s CEO seemed to recognize the impact of this transition time in the industry. Balmer admitted that the company is in the process of an important change. The original desktop-based model is evolving to encompass online services. This is where Balmer departs from some of the upstarts: he predicts that it will not be based on a pure Software as a Service model but rather a software plus services model. It is not surprising that Microsoft holds onto the desktop franchise model for both pragmatic and financial reasons. First, until we have a model where applications that live on the web can be used without connectivity, the desktop model will be essential. But, at the same time, it is clear that Balmer is feeling the pressure of both Google and Salesforce.com. Ironically, both companies look a lot like the Microsoft of the 1980s as it challenged IBM’s dominance in computing.

What will distinguish Microsoft in the emerging world of software? If you listen to Balmer, the differentiation will be on two fronts: providing customers with what he calls the “rich customer experience” – based on the requirement for a familiar and comprehensive end user desktop platform (i.e., Microsoft Office). Integration between Microsoft Office applications and back end applications has been a Microsoft’s objective since the mid-1990s when it began proposing that office applications become the integrated platform for a variety of desktop and server applications. This strategy has continued to evolve. For example, the joint venture with SAP has produced a front end environment called Duet that ties Microsoft applications into SAP’s backend platform. In essence, Office becomes a very rich and very expensive runtime environment for enterprise applications. The next frontier for Microsoft is trying to take this franchise and expand it to process and collaboration. Balmer sees this area as the white space in the market that Microsoft can call its own. Creating an environment that allows for ad hoc business process collaboration between the rich client environment and the backend business applications. Balmer points to the value of SharePoint and Exchange as Microsoft’s foundation platforms for collaborative business process management. And of course, Microsoft hopes to win some of that back-end application business with its Dynamics Platform (including offerings in ERP, CRM, and finance).

Like SAP’s Plattner, Balmer is focusing his strategy on evolution – not revolution. Balmer needs the Microsoft office and windows platform to remain strong and dominant to keep the revenue machine moving in the right direction. A radical departure would not be in the best interest of shareholders.

Salesforce.com’s goal of world dominance

While I saw many direct similarities between the positions of Plattner and Balmer, Marc Benioff comes at the software market from a totally different perspective. Simply put, he has nothing to lose. In 1999, Benioff left a comfortable position at Oracle to make his solo journey in the world of enterprise software. Benioff focused his aim at the idea of “no software” which of course isn’t true – it is very much software – just a different platform and business model. What made the SalesForce.com model was a combination of a different model for software that appealed to smaller companies that were happy not to have to buy a server and worry about support combined with the ease of use and navigation that set this software apart from other low end CRM products such as Act that had dominated the market for years. Without a legacy to protect, Salesforce.com was free to move in a revolutionary direction. Ah, but things have changed since those early revolutionary days. Now that Salesforce.com is a public company with revenues over $500 million, it is a solid and growing presence in the market. Benioff made it very clear in his sales pitch that he wants to follow in the footsteps of Microsoft and begin building a franchise around the Salesforce.com platform.

Watching Benioff at this stage in the company’s evolution was fascinating. The road forward is quite clear: Benioff is encouraging software vendors to build their own software on top of Salesforce.com’s infrastructure (why reinvent the wheel). The benefit to software vendors is clear to him – the vendor does not invest R& D in infrastructure or distribution. The vendor then markets its software from within the Salesforce.com ecosystem and pays a percentage of revenue back to Salesforce.com. The implication is quite significant for the independent software vendor who might use the Salesforce.com development environment including a language that looks like a traditional procedural programming language. It is no coincidence that Benioff’s ambition is to build a platform for computing that would rival Microsoft’s own. The danger, of course, is that Salesforce.com moves to fast out of its niche while reaching for the highest levels of platform leadership. Clearly, Salesforce.com has made a remarkable climb through its business model. However, it is still early days for the Software as a Service model. I expect that the company will face a broad set of competitors – both the traditional platform vendors as well as the revolutionary players who have nothing to lose.

So, who gets the power?

I was struck by the commonality of these three software power houses and how they each see their future. Although no one would mistake SAP with Salesforce.com or Microsoft, the companies are more similar than different. Each has created a dynamic franchise based on shrewd business planning and a little luck. All have recognized the value of their platforms and the potential for world dominance. The same power and depth that has led to their dominance can challenge their future. It is not easy to be revolutionary while keeping an installed base happy.