How IT can learn to stop worrying and love the cloud

The business advantages of PaaS are clear -- but not all developers agree

I always enjoy talking to my longtime colleague Sacha Labourey. Sacha is a fellow member of the so-called JBoss Mafia and is now founder/CEO of CloudBees, a public PaaS provider. (Full disclosure: My company just announced a partnership with CloudBees.) Sacha always thinks ahead and sums up elegantly what you have on the tip of your tongue, but can't quite find the words to say.

Recently, we were reviewing some of the challenges surrounding PaaS discussions with what he termed "core IT" -- and the resistance offered by middle and upper management. I asked him how to convince them to consider migrating to PaaS. As usual, his answer shocked me at first, but after the call, I realized he was absolutely right. His take: You don't. PaaS, as it turns out, has other, more willing customers.

The PaaS marketplace

Last year, nearly every PaaS vendor without a production release promised (off the record) that it was about to be announced. I foolishly believed them. Fast-forward a few months short of a year, and they are only starting to announce public availability. There have been some shocking collaborations: Cloudbees and Google, Red Hat and Google, and so on.

The "big boy" vendors who already have a relationship with traditional IT are selling traditional virtualization products that have been cloudwashed and rebranded as "on premise" or "private cloud" offerings, while their private PaaS products are largely vapor. I asked Sacha how smaller vendors like Cloudbees were going to compete against the private-to-public full-spectrum option. His reply: They aren't.

Shadow IT, core IT, and fast IT

As Sacha sees things, IT today breaks down to three categories: shadow IT, core IT, and fast IT. Shadow IT is where departments who can't get core IT to do a project go rogue and accomplish their objectives by making an end run around core IT. In other words, they do an IT project without the participation of IT.

Core IT is traditional IT as it exists in most companies. It protects the assets of the company, from ERP to HR software to accounting systems. According to Sacha, "If you're a young startup, obviously you won't have much core IT, so the best thing to do is not to start building it."

Fast IT is where new projects start. The idea is that a project can be initiated cheaply and shut down cheaply. The basic assumption behind core IT is that every project will be successful and every activity will be ongoing. In reality, fast-moving competitive companies and fast-moving competitive business units must be able to start a new activity before the rivals and be able to shut it down just as quickly if it doesn't work.

Core IT's problem with the cloud

Let's face it: Core IT's major problem with PaaS isn't security or maturity or anything like that. It's control -- and control is often a euphemism for job security. You can't sell PaaS with a pitch like "you won't have to stand around installing server stacks by hand anymore" to the guys who make a living by installing server stacks.

There are also some very legitimate objections. Core IT's job is to protect the business or, more particularly, its data and identity. The last thing anyone wants is a sprawl of PaaS, SaaS, and IaaS that doesn't integrate or has a separate authentication scheme -- and core IT gets stuck maintaining.

The conservative bureaucracy that's grown up around IT isn't driving PaaS adoption. Many CIOs that I've talked to believe it is the future, but at the same time seem to feel that "stewardship" is about slowing adoption to a crawl.

Who's driving adoption?

I asked Sacha who he saw driving adoption. Largely it's sales and marketing, the folks most connected with customers, who feel the need to get something out fast. This tends to produce shadow IT, where an empowered business unit line manager and team of developers buy a PaaS subscription on their company credit card and ask core IT for forgiveness later. To some degree, this is how open source was adopted, but for vendors like CloudBees, it's a business opportunity.

Sacha and I spoke about the pricing model: "If you think about it, with open source and with, it was all the same. You want the friction to be as small as possible. You don't want to have to talk to anybody. You just want to try it and get started and fly under the radar, and that's still how things happen for the most part."

Atlassian was known to have priced its popular issue tracker, Jira, in the early stages by keeping the unit cost (be it monthly or for a few seats of a private install) at what a line manager could throw on a credit card without getting any kind of pre-approval. This results in a short sales cycle that avoids the necessities of selling core IT, getting board approval, or incurring any of the nightmarish issues caused by larger deals. Smaller vendors like Cloudbees can play in this midmarket, where customers tend to be startups and other smaller companies, as well as larger companies with special projects on the sales and marketing side.

Sacha is looking forward to the end game: "Once people have committed to it and see interest, what you typically see is they're going to sell this solution inside their company and try to make it more formal. That's kind of the coming out, if you will, where they say, 'Well, we've tried this service for a while. You know what? It's pretty good. We should definitely look at it more seriously and see whether we could expand usage.' That's when typically the move away from credit cards takes place."

I asked Sacha whether developers are a driving force toward adoption: "It depends. If you look at who the big proponents of PaaS are, they will all be developers. Now that doesn't mean that all developers are big proponents of PaaS, and the reason for that is, again, you have to look at how people behave. And I think a lot of developers are kind of control freaks. They've been used to using Tomcat 7.0.36 with that JVM, with this, with that, and then suddenly you're telling them: 'Well, you can still control that issue, but really that's more of an exception. The default is to trust us, to focus on your application, and close your eyes, it's gonna be fine.'

"That freaks out a number of people, so typically it takes them to try a few projects, see where it works, where it doesn't work, why it doesn't work, could it be improved, but it takes a bit of learning to kind of relax and let it go."

All of this reminds me of the late '90s when marketing would outsource Microsoft ASP projects that were a royal mess -- then dump them on core IT for maintenance. I asked Sacha how we can have our PaaS and faster IT without ending up with a tangle of an architecture -- basically a bunch of disparate PaaS and IaaS deployments that don't share data, require separate logins, and reflect no coherent picture of the business.

Sacha's answer: This is where core IT comes in. "To me, this is a new role of IT. I know IT is not going to be focused on cabling systems and setting IT addresses tomorrow. What I also know is that IT is not going to disappear. What is the job of IT? The job of IT is to step up and defend the assets of the company, and they have to make sure they keep a well-architected map of our system. They are the maintainer of that map."

Defeating the legions of the Bastard Operator from Hell

I like getting Sacha's goat. It has something to do with his thick Swiss accent and tendency to be politically correct. I asked Sacha how developers can help drive cloud adoption and defeat the evil forces of the Bastard Operator from Hell.

"I think the first thing to do is to just give it a try. I'm surprised and amazed at how many people have an opinion on this without even trying it. They're like the best conspiracy theorists out there, right? 'I'm sure you can't do that' -- why not just give it a try? Also, maybe this is a European behavior, but I see a lot of people trying to take a horribly sophisticated project. 'OK, to make sure it works, I'm going to take a project with that type of database, with that type of high-level requirements, that piggybacks...'

"Forget it. Take a basic application, no corner case, no sophistication, and give it a try -- because the most important thing is to get up to speed. You need to learn. So don't muddle that experience with some corner case. Those will be obvious to solve once you get past the initial hurdle. Take an easy project and get started."

Then, says Sacha, if your policy permits, take a real project, push it to production (or pre-production) on a PaaS, and try it there. "What you want to do is to get back to IT with factual information about how this is a good option. You don't want to have a theoretical discussion with IT as to whether it is a good option or a bad option. You're gonna lose in that case."

Nothing succeeds like success. For example, if you can create a project and push it to production with complete test coverage in under a month, IT is going to like that. "That's where you need to turn the tables," says Sacha. "Then you say: 'I'd like you to give me a competitive offering where I can get started on the project in under a day. I want to be able to go to production without having to talk to you guys, I want to be able to push an iteration by some set date. I don't want to pre-pay for my machine, because maybe the project will turn out to be a bad idea.'"

According to Sacha, as developers work in the cloud, grow their expertise, and get what they need, they'll be its staunchest defenders. Eventually, core IT itself will start defending the use of PaaS.

In the near term, a lot of PaaS will be adopted through the usual channels, such as sneaking in via shadow IT projects. Only the best-run companies will come to terms with shadow IT and formalize it as fast IT and control it with core IT. As for the rest, well, as a consultant, I make a lot of money on server stack buildouts.

This article, "How IT can learn to stop worrying and love the cloud," was originally published at Keep up on the latest developments in application development and read more of Andrew Oliver's Strategic Developer blog at For the latest business technology news, follow on Twitter.

This story, "How IT can learn to stop worrying and love the cloud" was originally published by InfoWorld.