In the cloud, everyone's a power user

Much has been written about how mobile computing and the cloud has led to a shift in power dynamics within the IT/user relationship, and usually the IT department comes out in second place.

Google CIO Ben Fried discussed this recently in the Harvard Business Review, talking about the fundamental changes, both in systems and also attitudes that an IT department must undergo to remain relevant. Fried was right, and echoed by analysts and CIOs across the industry, but the citizens - the users - need to take a bit of responsibility too.

There is a definite lack of discipline among users, and the term "power user" has never been more appropriate. Drunk on our newfound power, we seize the initiative at every opportunity, cocking a snook at the hapless IT department at the slightest provocation. Can't give us seamless access from the outside? We'll install remote control software. File sharing not up to snuff? Dropbox. E-mail server playing up? Gmail!

It goes beyond the personal, of course. Can't get IT to spin up a test server for your department? Do it yourself at any of dozens of cloud hosts, and sneak the tiny cost through your corporate credit card.

Need project management, but can't get software purchase approval? Sign up for a free cloud service and recommend it to your colleagues.

BYOD and cloud services have put a world of technology into the reach of users, and the steady focus on ease of use has meant even the most technology-shy smartphone user can roll-out his very own CRM-in-the-cloud with a couple of clicks.

That's empowering, certainly, but it's also a real problem for companies, and not just the IT departments. And while IT has to change to proactively encourage empowerment - those users aren't doing it to be spiteful; after all, they're trying to be productive and that is worth nurturing - it simply can't compete. Face it: you can't be better at cloud than Amazon. You can't be better at e-mail than Google. And you can't be better at CRM than salesforce.com. As the cloud matures, that gap is widening, not shrinking, which means the pressure is only going to increase.

On one hand, security is relevant, but it's just not a message that resonates with users. Remember the days of the Loveletter virus, in 2000? That was a widespread outbreak, because it targeted not only insecure systems, but insecure people. Users, newly exposed to this Internet e-mail thing, were also newly empowered with desktop software capable of embedding logic into documents - a powerful tool, but one which (Microsoft realised belatedly) needed some training wheels.

A new wave of security technology resulted, but also an understanding that user awareness was vital too - IT could no longer be an omniscient presence, the rise of client-server, desktop computing and Microsoft Windows had seen to that. So we trained users. And 14 years later we're still training users, telling them that they have not, in fact, won the Nigerian lottery and should think twice about clicking suspicious-looking links in Twitter.

Whether you call that "risky" or "edgy" probably depends on which decade you were born.

And security should be the easy part, because the user has a vested personal interest - "pay attention or your bank account will be emptied" is a lot more compelling than "don't do this because Sarbanes-Oxley requires you to jump through hoops first".

There are concerns beyond security too. When several departments have their own cloud service but now want to collaborate, it's the IT department which is going to get the call, and cloud today is like client-server 10 years ago: siloed to wall in users. Or a cloud storage host goes dark, and users lose data... it's the disaster recovery team that has to point out the hard reality. The user who leaves without handing over social media credentials, the cheap cloud services which, in bulk, suddenly start to add up to substantial monthly costs, the costly duplication of effort of having several enthusiastic departments solve the same problem in parallel... there are dozens of solid reasons why unchecked mobile and cloud "solutions" are a problem for corporate IT, and security is only one small part of it.

And so many companies are at the "block it first, think about it later" stage, which is a natural reaction and one which is guaranteed to fail. If nothing else, cheap mobile data puts cloud services forever beyond corporate IT control, and all the policies in the world won't change that. Some turn a blind eye, hoping the problems will not affect them. Whether you call that "risky" or "edgy" probably depends on which decade you were born.

In theory, the happier middle-ground would be for IT departments to reinvent themselves as facilitators - not competing with the cloud, but helping users understand it, embrace it and leverage it for the advantage of the company. And users would be taught to overcome the urge for instant gratification, to work with the responsive new IT team to identify prospective services, evaluate them against other projects in place, consider the risks, and for the team to make an informed, considered opinion.

But just as security awareness has taken many years (and still struggles!), cloud awareness will probably lag similarly. There is just too much consumer pressure from the smartphone/app/cloud ecosystem, and users are too busy revelling in their newfound power to pay attention to the spoilers in the boardroom. So that happy medium is only theoretical, and possibly fantastical: this is a problem which is going to get worse before it gets better. Knowing that, we're back to reinventing IT in the face of BYOD and cloud, and having to go a lot further than we'd like.

Some of the problem may solve itself - cloud services are getting better at integration because that's a sellable feature, for example, and federated sign-on is making password leakage less common. But we're still in for a tough time.

Suddenly, everyone's a power user, but most are power users without discipline, awareness or restraint. We're in for an interesting ride.