Despite incursions from the likes of Google Apps, bring your own device (BYOD) policies and prosumer tools like DropBox, the trusty virtual private network (VPN) has managed to find ways to keep the WAN relevant in a world that increasingly favors its data, apps and access in the cloud.
Like many IT managers, James Gordon, vice president of information technology at Needham Bank, has a healthy distrust of the latest cloud offerings from the likes of Microsoft and Google. In his heavily regulated world of financial institutions, "not my servers" does not mean "not my problem."
That attitude has not stopped Gordon from welcoming a wave of employee-owned iPhones, iPads and Android devices from flooding his offices, however. Instead, he has been helping his users to tap into the latest and greatest technology toys out there, loading up critical business data alongside their high scores on Angry Birds and pictures of the kids.
He has become comfortable with the enterprise BYOD trend by tapping into one of IT's old favorites, the trusty VPN, coupled with some new tricks that reduce user gripes while boosting productivity.
All in all, VPN management has a healthy future ahead of it, at least when it comes to protecting and managing an enterprise's crown jewels outside of the LAN.
Old VPN dog learns some new tablet tricks
In Needham Bank's case, that means using Array Network's remote desktop tools, which are tailored to help users access their corporate desktop on a variety of mobile devices. This allows IT to keep control and ensures that no critical data is stored locally, in case a device is lost or stolen.
As more businesses like Gordon's are lured by the likes of Google, Salesforce.com and even Microsoft to embrace the cloud, IT managers have to make tough calls: Who can they trust with their data? Are frustrated users going to route around IT's security policies? What tools can help build a productive, secure and future-facing organization so that it can be ready to tackle tomorrow's challenges -- without breaking today's constrained budgets?
For better or worse, the answers are different for almost every business, and very rarely will those answers be simple, one-size-fits-all solutions.
Enterprise BYOD means your network meets anytime, anyone, anywhere
"We've now entered this realm of users connecting into the enterprise from anywhere at any time on their own terms," wrote information security consultant Kevin Beaver in an email. "I certainly don't envy those network admins who are tasked with getting this under control."
And the dangers of not getting it under control -- of either simply banning cloud and consumer tools and sticking with the '90s-era VPN setup -- are too real to ignore.
"Users have higher expectations that they bring to IT now," said Gordon. "They say if the IT department isn't going to do it, I'll bring my corporate credit card and figure it out myself."
Scott Gode, vice president of product management and marketing at Azaleos, has an almost opposite mandate compared to Gordon's: His company provides remote IT support services for a variety of mid-sized enterprises looking to offload management of Exchange, SharePoint and other complex business packages.
But the concerns around security, accessibility and agility remain the same.
Azaleos relies on software agents sitting on their customers' servers to send back the data they need to manage, an inversion of the typical cloud model: The customer hosts the hardware, while the people are outsourced.
That's also given Gode some insight into what concerns businesses have with giving remote individuals access to mission-critical resources in a safe, secure and reliable way. And, he said, his pointers might be helpful to others weighing the relative benefits of cloud services versus extending the network through VPN or other technologies.
Surprisingly, Gode said security was not at the top of his cloud concerns.
"Security is a bit of [a] perception thing," he said.
Oftentimes, depending on the size of the business and the experience and focus of the cloud provider, the cloud provider might have even stricter or more accountable security best practices in place.
But like with every rule, there are exceptions: In this case, tightly regulated industries like healthcare and finance might find getting the right cloud services provider is a little like fitting a round peg in a square hole. Sometimes it's better just to pick a different tool.
"If they look purely at cost, for a cloud solution it might be cheaper," said Gode. "But when it comes to security, they're skittish about what a public cloud solution can provide them, or about what their internal IT regulations allow them to sign up for."
But even in less-integrated environments, many cloud solutions lag behind their IT-controlled brethren in terms of deep integration with years of corporate tradition, whether that means syncing CRM and help desk data in Outlook or ERP software into every tentacle of a multinational's business empire.
Dropbox in any color you want, as long as it's blue
Another potential strike against many cloud services, to quote Henry Ford, is their often proud stance of offering their services "in any color you want as long as it's black."
The famously simple and beautiful business-to-business SaaS company 37signals is a perfect example.
Co-founder Jason Fried blogged that many customers were approaching them to evolve the 37signals product line meet growingly complex needs.
"We’re saying no," he wrote. "And here’s why: We'd rather our customers grow out of our products eventually than never be able to grow into them in the first place."
While that is welcome wisdom to entrepreneurs looking to avoid endless complexity, the fact that the philosophy has been emulated from the smallest SaaS startups all the way to Google means many cloud services are culturally attuned to not matching existing business processes -- and aren't particularly interested in changing.
The attitude goes beyond integration, too.
"A lot of cloud solutions are one-size-fits-all in terms of not only features but also planned downtime and upgrades, which are just done across the board," said Gode.
In the end, Gordon, a veteran of the field's various technology holy wars, emphasized that IT has one real prerogative in terms of which technologies to adopt.
"IT departments need to embrace reality," he said. "Users will get things done. [If] a company has a policy against social media, and their competitor doesn't ban it, then it won't be long before the company that has the ban against it will have a whole lot of people violating policies."
That realpolitik approach to IT extends to decisions about what to send to the cloud, and what to keep on your own network to make sure security threats from the open Internet don't scuttle critical data and processes.
"Understand that if it is just farmed out to the cloud, it doesn't take off their responsibility," Gordon said. "I've always said I've given my CEO plenty of reasons to fire me if something goes wrong: I don't have Office 365 or Dropbox. [The role] has stopped being IT professionals and started being an IT management guru. There's still the responsibility, but they're managing technology vendors, and that's a job that shouldn't be taken lightly."
This was first published in July 2012