ING is just the type of large user organization that cloud vendors want signing up for their various online business services. But while Boehme, senior vice president and head of IT strategy and enterprise architecture at ING, is excited about the potential of cloud computing, he says the industry needs to get a few things in order before this outsourced model fulfills its potential.

Boehme's biggest concern is that software licensing policies haven't caught up to the cloud. The cloud lets customers buy computing power on an as-needed basis, but software licenses for products that could be used in the cloud typically must be purchased up front, he says. Software licenses should also be available on an as-needed basis, he says.

"I haven't seen any vendor with flexibility in software licensing to match the flexibility of cloud providers," says Boehme, who is based in Windsor, Conn. "This is a tough one because it's a business model change. ... It could take quite some time."

ING, which boasts an IT infrastructure featuring 2,900 to 3,000 servers and 900-plus network devices, has been using software-as-a-service for several years for needs such as sales automation, CRM, human resources, and succession planning. Now ING is evaluating hosted application building platforms as well as online storage and compute services.

"We are literally testing everybody. We have things running across multiple providers," Boehme says.

Boehme says ING's policy is not to discuss specific vendors, but the players in this space include Amazon, GoGrid, Google, and Salesforce. ING is not yet ready to move from test to production.
"We have not put any of those services in production but we are testing the viability of all these types of services," Boehme says. "I know of very few large organizations that are doing these things in production. I know of a lot of small and medium-sized businesses that are."

Boehme has found that cloud services make it easy to scale resources up and down. But to build a business case for the cloud, companies need to look at the services' technical viability, security, manageability, and the ability to move applications from one cloud to another.

Boehme is a founding member of the Cloud Security Alliance, a group formed last month to promote best practices in cloud security. The Alliance will release a white paper at the upcoming RSA security conference advocating a set of security standards for use in the cloud market. Ideally, security will be built into every application, and portability of applications across clouds is also important, Boehme and the alliance say.