Why would the state build a data center when the private sector can provide data center hosting as a service to the state? This is what many private sector companies do. It is available now, it works, increases availability, increases security, can address disaster recovery issues, reduces facilities and personnel costs. If the state wants to operate more like a business, then it needs to look at what the private sector is doing, and adopt those practices.

Additionally why not seriously consider moving agencies to open source solutions, for example Google Docs which would provide word processing, spreadsheets and presentations for significantly lower cost than Microsoft. Additionally email, shared calendaring, web sites, blogs and many other services are available.

The legislature needs to require state agencies to use open source solutions, or provide justification as to why open source would not work before purchasing commercial software.

Why is the State Department of Information Services (DIS) brokering telecommunications services to agencies at a marked up price? DIS is acting as a middle man to itself … this does not make any sense.

The knee jerk reaction to this would be “rewrite the applications!” that wouldn’t be the most prudent thing either, as that takes a lot of time, and depending on how many applications could cost well over the $300MM earmarked for a datacenter. Rewrites open you up to endless headaches from contracting organizations that don’t fully understand what it is they’re rewriting. Introducing bugs, downtime, blame games and subsequently causing heads to roll.

I might also add that I have not yet heard of any major corporation wholesale (or even piecemeal for that matter) moving their entire operations to the cloud. It’s just not something that is going to happen any time soon, no one wants to trust the backbone of their business to anyone whose sole purpose is not (i.e. dedicated staff) is to ensure that the interests of their business are protected.

I can’t get a handle on how actively the state has embraced true virtualization models and systems, so that’s something I need to learn from DIS more thoroughly.

Does the cloud have some potential benefits? Sure. But like every miracle touted IT technology, it’s not going to solve every problem and slice bread more cleanly. Right now – today – it’s still immature, a bunch of vendor promisses and pretty marketing PowerPoints about what will “be in the next release, real soon now”. So while there are some benefits, you are not going to gain every bit of the hype in cold $ savings – and you take on a lot of risk.

It’s worth asking the question – but it is not a step to be taken lightly – beyond the same security risks you have with any data center, there are new risks and a lot of unknowns.

A substantial part of the state infrastructure that I’m aware of is moving to virtualized machines. “Moving to the cloud” is often seen as equivalent, but it’s not. These are two interrelated but different steps.

Purely in the virtualization world, the tools and technologies are immature. If it’s all in-house, you can manage it, but you lose a certain level of information about the innards of the network. That’s a risk tradeoff that has proven acceptable because of the benefits of virtualization.

For example – most data centers deploy a set of tools, services and equipment to protect and monitor traffic. These tools – Intrusion Protection Services (IPS), Firewalls, etc. – are crtical to the security of the data center. The virtual network traffic is invisible to these tools. There are work-arounds (what you do is create multiple networks, run the traffic OUT of the virtual world into a physical switch you can connect your monitoring tools to and then run it back into the virtual world).

BUT:

Taking the next step and moving those processes to a public utility model (“moving to the cloud”) exposes you to these risks, doesn’t allow you to deploy the work-arounds and adds even MORE risk. Why? Because there are now other peoples processes running along side yours – and you can’t see what they are doing.

You would not just let anybody walk into the data center and plug their laptop into the network. You wouldn’t let the execute systems administration tasks on your computers.

With a cloud model, you can’t prevent it…

So you contractually require all your processes run on an isolated set of machines, on a separate network. And then all you’ve really done is outsource the ownership and maintenance of the data center.

Does that offer savings, scalability and benefits … depends on a lot of things.