Slideshow: Cloud Security Pros And Cons
(click for larger image and for full photo gallery)

At Oracle OpenWorld, held Sept. 19-23 in San Francisco, CEO Larry Ellison went from noted critic of cloud computing to definer of what cloud is all really about. And he did it in his own unique way. The bottom line, he said, is Oracle's new appliance, the Exalogic Elastic Cloud, is a good example of the kind of cloud computing that Oracle believes in, just like Amazon's Elastic Compute Cloud (EC2).

He said Oracle's new "cloud in a box" is different from Salesforce.com, which is not really cloud computing because its applications aren't virtualized. Furthermore, he contended, Salesforce.com's use of multi-tenancy represents "a weak security model" and threat to the privacy of its customer's data.

The presentation drew scarcely a murmur from 41,000 attendees. After all, the head of Oracle had offered a clear definition of cloud computing, and then painted a picture of something they knew they wished to avoid, "the co-mingling of GE's data with Siemens' data," in Ellison's example of the Salesforce.com multi-tenant setting.

The only problem with this dichotomy is that few implementers of cloud computing agree with it.

The Oracle appliances, stacked with layers of Oracle software, bear little resemblance to Amazon EC2's data centers filled with plain vanilla servers and storage. Amazon's EC2 is the leader in cloud computing market share because it tells its customers to supply the software that will run on its machines. Customers may choose an operating system available through Amazon Web Services but, from there on out, they build their own workloads. With Oracle, even the version of Linux running on the appliance will be built by Oracle, not to mention the application, database, and middleware.

In another assertion, Ellison said Salesforce.com's customer relationship management (CRM) applications weren't really cloud computing because they weren't even virtualized. But Salesforce, like other software-as-a-service (SaaS) vendors, runs multi-tenant applications that are designed to run in an un-virtualized state. There's no requirement that SaaS be virtualized, nor any general agreement by SaaS vendors that it's better to run applications that way. Most do not; a few offer it as an add-on customer option.

But are SaaS applications really cloud computing? The federal government's National Institute of Standards (NIST), supplier of the best known definition of cloud computing, recognizes SaaS as one of the distinct forms of cloud computing in its latest, Oct. 7, 2009, edition.

Here's what Ellison said about cloud computing, followed by what's on the record about the cloud, or what Salesforce, and a Salesforce competitor, SugarCRM, both suppliers of SaaS, say in response.