Enterprises have been extremely reticent to explore cloud computing as serious concerns about security have not yet been addressed.

VMware, with its vSphere 4 announcement,  has tried to address some of those concerns by laying the foundation for what it hopes will be a central role for VMware technology in enterprises using public and private cloud computing systems.

So, how well does vSphere address the key worries that enterprises have about cloud computing?

First, a bit of definition on what VMware rolled out today: VMware is positioning vSphere 4, which replaces its current Virtual Infrastructure 3 (VI-3) product, as the "first cloud OS platform."

"It enables enterprises and service providers to take their data centers and turn them into a private cloud," says Raghu Raghuram, VP and general manager of VMware's server business unit. "We are enabling companies to deliver IT as a service."

Keep in mind that the term "private cloud," which is very much in vogue these days, has a different definition depending on what vendor is using it. At its simplest, analysts say, a private cloud can just mean a large number of virtualised servers in a data centre. Salesforce, Google and Amazon, for example, all have their own take on the matter.

VMware's definition: "Step one is you virtualise," Raghuram says. "The next part of it is how do you provide capacity to end users?" In VMware's view, Raghuram says, a highly-virtualised data centre does not become a "private cloud" until the IT group can provision services and capacity to users on a self-service basis, automate management tasks and chargeback billing to the business.

Today's vSphere news is the first in a two-part rollout to help customers achieve that private cloud vision. But it won't be until later this year that VMware will launch the products that address the management, automation and chargeback parts of the picture, Raghuram says.

The remaining question, however, is will IT departments buy into VMware's vision?

At a big-picture level, IT knows it needs to consider and plan for the private and public cloud, says Forrester senior analyst Glenn O'Donnell. "IT is in a crisis of credibility right now," O'Donnell says, noting the wide gulf between the business goals and IT processes at many large enterprises. "All of this is being exacerbated by economic conditions."

If IT does not figure out how to cut costs and improve service to the business via cloud and other virtualisation technologies, he says, IT groups will face what he calls "punitive outsourcing," where the business side of the company decides to cut IT out of the picture by shipping the IT work out of house.

VMware currently dominates the virtualisation market and will certainly be among the top contenders for IT groups examining the notion of private cloud computing. But some of the key concerns that enterprise IT leaders have about cloud computing remain beyond VMware's control, analysts say.

Here's a breakdown of six key hurdles to cloud adoption in the enterprise and where vSphere delivers and does not.

1. Burst-up Capability Far From Real for Most Enterprises

One of the sexiest lures of cloud computing for enterprise IT is the ability to "burst up" to a public cloud provider and tap into its computing power when the company's data center needs extra compute capacity on demand-say, at key sales or end-of-quarter times.

IT commits a cardinal sin if it lets the business down at these high-demand periods. Unfortunately, this burst-up capability remains far off in the future for most enterprises, though some early-adopter companies are able to tap into it now via Amazon's EC2 cloud services, for example.

vSphere 4 lays foundation for VMware customers who want eventual burst-up capability, but even VMware doesn't estimate exactly when this burst-up scenario will be a real option for most enterprises. "Tools and simplicity have to happen," says VMware's Raghuram.

He says virtualization open standards such as OVF (Open Virtualisation Format) will help make burst-up more practical with what VMware calls "federated" public-cloud providers, with whom VMware is now cultivating business relationships.

"Bursting up to the cloud is a nice thing to eye for the future and may be something that gets folks excited at conferences, but most enterprises aren't even close to considering it for production workloads today out of concerns of regulatory and security compliance," says Burton Group senior analyst Chris Wolf. "In cases of dev, test, and training, there are some fits, but that's it. The average enterprise has a number of business process issues (such as chargeback) to resolve before adopting an internal cloud model. I see mainstream external cloud adoption as happening a few years down the road."

"Still," Wolf says, "it's important for organisations to begin architecting for external cloud today and VMware is betting that by getting organizations to deploy vSphere 4.0, they'll stay on VMware as they move to leverage external cloud resources in the future."

2. Fear of Vendor Lock-In

Enterprise IT groups, long stung by expensive lock-in deals with ERP software vendors such as SAP and Oracle, say they're loath to lock themselves into any one vendor's cloud vision or technology.

And the industry has given IT little assurance that once a company's data sits in say, Amazon's cloud, that IT will someday be able to port that data to another cloud. Architecture and storage issues abound. Moreover, vendor partnerships remain fluid at this point.

For its part, VMware has publicly announced that its customers will eventually be able to work with public cloud providers, including AT&T, Verizon, Rackspace and BT-but Amazon remains notably absent from VMware's list of cloud business partners.

"We want to make available the widest choice of service providers," says VMware's Raghuram. The Open Virtualization Format standard could help with moving data between providers as well, he notes, adding that OVF will offer a way to share service-level attributes among applications.

But he doesn't sugar coat the customer lock-in worries, either. "Don't get me wrong," he says. "There's a lot of work to be done. Customers are right to be worried about being locked in, which is why we're putting an emphasis on federation among cloud service providers."

"I think vSphere addresses cloud better than most platforms," Burton Group's Wolf says. "Compared to cloud options with proprietary programming interfaces, there is less risk of lock-in associated with the vSphere platform."

3. Migrating Existing Apps to the Public Cloud Ain't Easy

It's just plain hard to envisage migrating many existing enterprise applications to the public cloud today. For starters, cloud technology providers such as Amazon, Salesforce, Google and Microsoft all have their own architectures, and these may not match up to the architectures of a customer's enterprise apps.

This is a significant problem with the public cloud that's beyond VMware's control at the moment.

For instance, VMware's technology can help a midsize manufacturing company with custom, in-house developed applications run those apps on virtual servers. The new and upcoming vSphere technology can help that company run those apps in a private cloud that allows self-service provisioning.

In fact, VMware's Raghuram says that home-grown apps are among the first applications he's seen VMware customers running in the private cloud, along with development and test workloads, web workloads, and database apps that need to scale quickly.

But neither vSphere nor other VMware technology can today help that company modernize those apps to the point where they become practical on public servers. Plus, IT groups don't have many employees with skills sets around migrating apps to the cloud because it's such an emerging area.

4. Security, Compliance and Quality-of-Service Fears

Many enterprise IT groups are still labouring to ensure that their virtualised environments meet security and regulatory compliance requirements. Virtualisation security and compliance experts say that the issue often boils down to a complicated truth: How compliant you are today may come down to how much your auditor understands virtualisation.

Throw in cloud to your enterprise infrastructure, and you're asking for compliance trouble, said many respondents to CIO.com's most recent survey of IT pros on cloud computing.

While 58 percent of those survey respondents said cloud computing will cause a radical shift in IT and 47 percent say they're already using it or actively researching it, 54 percent say that cloud computing is an evolving concept that will take years to mature. Also according to the CIO.com survey, the number-one factor stopping IT leaders from tapping into the cloud right away is security worries.

A whopping 59 percent of our survey respondents say vendors have not adequately addressed security concerns related to cloud offerings.

So which is the bigger hurdle for VMware with its customers right now: compliance worries or fears that even a private cloud arrangement will lead to quality-of-service problems (application slowdowns) for end users? "Both of them are issues," says VMware's Raghuram, noting that compliance and security usually come out of customers' mouths first, but that quality of service isn't far behind.

vSphere does build on some of what VMware is trying to do with virtualization security, for instance helping customers keep virtualised applications and data contained in distinct zones, and keep apps and data from distinct business groups logically separated.

vSphere's forthcoming automation capabilities will address some of the QoS fears for private clouds as well, says VMware.

But the loss of control that many IT people feel regarding public clouds is a hurdle that VMware can't jump directly. It will be the public cloud providers themselves who have to convince enterprise customers on the security, compliance and QoS fronts.

5. Cloud TCO Is Hard to Calculate

As CIO blogger Bernard Golden has pointed out, most people, including IT professionals, do not yet understand how to properly estimate the costs of cloud computing. The starting problem: Many IT shops do not have an accurate figure on what their data centers are costing them right now and don't understand the capital versus operational expenses part of the equation.

And a chorus of industry analysts has been warning IT leaders that cloud computing done badly will cost more, not less, than today's data-center arrangements. Just last week, McKinsey put out a report to this effect, warning that cloud cost-savings estimates look too rosy. (It's worth noting that some cloud industry watchers are debating McKinsey's calculations and questioning the report's conclusions.)
VMware can't leap this key hurdle to enterprise cloud adoption with vSphere or any other technology. That said, VMware can and certainly will try to clarify the cost questions around private and public cloud via conferences, whitepapers and the like.

6. Cloud Management Tools in Their Infancy

Enterprise IT will need new management tools to monitor, optimize and automate virtualized private clouds. "You can't do virtualisation effectively without applying some automation to it," says Forrester's O'Donnell.

IT groups already understand that they need to change some of their processes due to virtualisation; for example, he says, they're showing a lot of interest in using ITIL with virtualization. "But process alone doesn't do it," he says. IT will need automation tools to apply to the processes.

2009 will be an "inflection point" for automating virtualisation and data centre tasks, O'Donnell adds, because many enterprises are moving their virtualised workloads from test environments to production environments this year. "Now it's in production," he says. "We can't afford to have people twisting knobs and pulling levers."

This is the area where VMware is perhaps best positioned to help enterprises deal with the problem: The vSphere automation tools from VMware coming later this year will tackle this concern head-on.

VMware is not alone. A crowd of start-up vendors continues to chase the virtualisation management tool market as well; these firms will not ignore the cloud management angle, either. While these tools are far from mature, enterprises will have many choices and competition in the space.

There is a twist, however: VMware has yet to agree to help those enterprises manage virtualisation technology from multiple vendors, including rival technology from Microsoft.