Manage cloud services, and make peace with rogue IT

You can fight rogue IT until you're blue in the face, but if you want to win, learn to manage external cloud services as part of your overall IT deployment.

Before the cloud came into the picture, most technological things revolved around IT -- because they had to. Now, IT has to manage cloud services that well-meaning users chose, with or without IT's approval.

Before external cloud service providers emerged, IT services and infrastructure were simply too expensive and complex for users to embark on technological projects. Cloud services removed the complexity and capital costs -- to a degree.

Business units, developers and other non-IT employees paid attention to cloud's potential as a way around IT, which they viewed as a barrier to the latest technology.

The argument as to whether IT was in fact a barrier to adoption of technology can be viewed multiple ways, in which everyone has some valid points -- but that is a different subject.

Rogue IT exists today because cloud services make it possible. In reality, it's needed. But with more services being offered online, IT finds itself pitted against a competitor that it simply cannot beat head to head. External cloud services can scale and adapt at speeds inconceivable to the average enterprise data center. However, not all is lost, provided you know how to compare and manage cloud services openly and honestly.

This flexibility seems a little odd to IT operations professionals. Depending on management support, it's possible to issue broad statements about external services that your company classifies as rogue. But if IT suddenly removes or restricts external cloud services and applications, it can devastate existing projects, development efforts and overall morale. The effects on running projects can be obvious, but the damage to morale runs deeper and lasts longer than expected. Workers are simply trying to get their jobs done. If the IT operations team or management pulls the plug on external services, it could be considered an assault on the company's goals. This does not mean that everyone should have open access to services outside of the normal IT channels. Using cloud services without proper vetting can cause security and compliance issues, coupled with reliability and cost concerns. Relationships among infrastructure, ops and dev are critical to the overall success of the data center and its applications -- additional tension will not help the cause. Removal of cloud services can restrict even internal IT services, where staff might be investigating external technologies to implement as part of the IT estate.

If IT suddenly removes or restricts external cloud services and applications, it can devastate existing projects, development efforts and overall morale.

The model of instant IT, on demand, is turning traditional IT services upside down, and it should be a wake-up call. Reexamine internal processes. For example, have deployment windows shrunk with the introduction of virtualization, or are deployment times the same, a holdover from physical deployments?

I remember a networking team that required seven business days to get a static IP address -- it took weeks to get a physical server, so what's the rush? But when virtualization came along and server deployment went from weeks to minutes, it still took seven days to get an IP address from networking.

From the rogue's perspective

The key to reining in rogue IT is to understand why end users want it. The reasons will not always make sense, but often, a business driver motivates it. Embrace the reasons to find a middle ground. External resources are not a bad thing; over time, they may become assets. Look at cloud infrastructure, cloud-hosted tools and other services in a controlled manner without frustration toward end users circumnavigating normal channels. Be open to their rationale, and give the tool or resource an honest look.

The investigation doesn't have to be exclusively done by ops -- involve the end user. It's easier for ops to manage cloud services suggested by an employee if admins have the eventual users' input throughout the acceptance and adoption processes. When the group using rogue tools has a role to play, they take partial ownership of the issue, making the chosen setup as beneficial as possible. In one organization I worked in, we found a business unit ran unauthorized VMware host servers in several people's cubicles for test and development VMs. Several of these VMs had connections to production data, and the users were expanding the VMs beyond their original test and dev functions. Running production data through an unsecured area was already problematic, but the hosts were licensed with 60 trial keys that expired every other month, causing all kinds of issues. We put two different solutions on fast track: one on premises and one in the cloud. Shutting the rogue virtual setup down 100% would have affected the development cycle too much for that to be an option. The challenge became migrating to a stable and secure platform first, and then, IT could teach a lesson on rogue IT after everything was in place.

Since today's tech-savvy end user prevents IT ops from a simple stop-and-seize approach to rogue IT, IT is in an ideal place to help guide these unauthorized setups and cloud services toward successful use or removal with an alternative presented to the users. Going to war over rogue services will result in a disaster with no winner. IT ops has to accept this is a new world. They can help to lead these efforts and end up with cloud services managed under their rules and best practices, or be the speed bump that gets run over.

Next Steps

If you can't beat cloud services, join them -- with a cloud career

Are you ready for the future of IT?

What abstraction means for the IT operations team

Dig Deeper on Matching IT Resources to Application Requirements