Often they’ll turn to public cloud providers like Amazon or Google or Microsoft. Those are the three names that usually get mentioned in the same breath whenever enterprise cloud services come up. But what about IT giant IBM? It turns out it’s a significant player in the cloud game, offering both public and private cloud services. Last week I sat down with Ric Telford, IBM’s VP of Cloud Services to talk about how Big Blue’s cloud business is going and what its priorities are in the year just started.

NewEnterprise: Ric, let’s start at the top. Tell me how IBM sees the cloud business right now?

Telford: Initially the cloud is all about doing more with less. Suddenly you could deliver the same IT services for less. Fast-forward to today, and it’s not all about saving money. People are realizing they can do things they never could before with the cloud. I was recently met with a small aircraft engineering company, and the guy running it described how he competes with much larger companies for defense contracts. It used to be that doing all the modeling and simulations he needed required buying hardware and software and running it all on premise. Now he can go out to the cloud, pay for what he uses and be done with it. He can now compete for contracts he wouldn’t have been able to go after before. And we’re seeing a lot of examples like that in industry after industry.

Someone said to me the other day that the cloud is going to have to have all the parts of the mainframe. Do you agree with that?

There’s a lot of parallels between the cloud and the mainframe. IBM’s view is that we have a single-reference architecture. It’s the same whether we’re delivering the service or if we build it for you. We did a deal recently with France Telecom where they are going to be a cloud services provider to their clients. They already have the network connections. But they’re not a cloud company. So they’re using IBM’s cloud architecture to give them all the pieces in one easy-to-consume bite. So we have that architecture and we use the same blueprint in all the various permutations of the cloud. For some people it’s confusing, but for us it’s all the same whether you want to have it inside your firewall or outside.

Which do your customers tend to prefer–a private cloud or a public cloud?

We do surveys every year and right now we’re seeing about a two-to-one preference for private versus public. About 60 to 70 percent of respondents say they’re working on a private cloud, and about 30 to 40 say they’re working on the public cloud. To us it’s all the same. We offer a core set of services from the IBM cloud–development, test, compute, storage, collaborations, desktop. But we can also build the same thing inside your firewall.

How big is your public cloud business?

I can’t give you a revenue figure because different business units take advantage of it to deliver different things. We just opened up a delivery center in Research Triangle Park. It’s probably one of the most advanced data centers in the world. And now we’re rolling out a model that we are cloning around the world. We just opened one in Germany and another in Canada. And then we’ll just keep adding them. We manage about eight million square feet of data centers around the world.

How does a company typically get started with the cloud?

Usually I suggest they start with their develop-and-test operations. It’s usually not mission-critical, and there’s usually a lot of hardware that’s not being used. Usually that’s the group that buys hardware long before it’s needed and it ends up sitting idle 90 percent of the time. At IBM we put our whole research division on the cloud because they were the worst hardware hoarders, putting servers under desks and whatnot. They knew that if they needed a new server it would take weeks to get it. Now they go out to the research and compute cloud, and the services they need are usually ready to use in minutes or at most an hour. It just makes a huge difference in people’s ability to get going.

So what you are your priorities for this year?

One of the big things we started seeing last year was an uptake of cloud delivery in industry-specific ways. We’re working not just on the generic things like email and collaboration, but on the specific applications that are used in various industries. Health care, banking and government are a few that have complicated regulatory needs that vary state by state and country by country, and we have the deep understanding required to work with them. We also built a private cloud to help the 29 countries involved in NATO share data on logistics and troop deployments. We also have an initiative with the consumer electronics industry. Utilities is another, and it gets tied in with our Smarter Planet initiatives.

Will IBM be making deals in the cloud this year?

IBM will make a few billion in acquisitions. Cloud is one of the four key growth areas we’re focused on. The others are Smarter Planet, analytics and the growth markets. We’ve said that in those four growth initiatives we’re going for $20 billion in additional revenue by 2014. Four initiatives, five years and $20 billion dollars. That’s certainly not all going to happen organically.

All the security attention paid in recent years to securing the Windows desktop and the applications running on it have paid off a little, Cisco found, making it harder for computer scammers to successfully carry off their intended crimes on that platform. The trouble is they’re now starting to focus more attention on mobile devices, including Apple’s iPhone and iPad, and devices running Google’s Android operating system, Cisco said.

Meanwhile, the overall global volume of spam, which often contains troublemaking links that are used to deliver attacks, decreased for the first time ever in 2010. Even so, spam still increased in some developed countries where broadband connections are multiplying. In the United Kingdom, spam volume nearly doubled, while the volume in France went up 115 percent. The U.S. saw a slight decline–11.1 trillion messages down from 11.3 trillion in 2009. Spam in Brazil, China and Turkey also declined. Some of the decline can be attributed to last year’s arrest by FBI agents in Milwaukee of a Russian accused of being the “king of spam,” and to the shutdown of a few botnets used by scammers to send spam.

One thing about Cisco’s report that’s likely to draw some attention is its finding that the raw number of vulnerabilities on Apple products appear to be growing. Apple users are usually pretty sensitive about this topic, and any comparison of the Mac to Windows on the security front tends to make them grind their teeth and pound out annoyed comments on tech blogs. I know because I’ve done the same teeth-grinding and have in the past criticized other reports for similar findings.

Here Cisco is addressing vulnerabilities that Apple has itself documented and patched in software updates. One thing that’s not clear to me–though it sure looks like it–is whether Cisco is combining vulnerabilities found on both iOS (iPhone and iPad) and OS X (the Mac). The data it’s using is from its IntelliShield service, which tracks vulnerabilities and security incidents, and shows that over five years Apple’s vulnerabilities rose, from less than 200 in 2006 to more than 350 in 2010. That rate was higher than Microsoft and Hewlett-Packard and Cisco itself, the report found, though it goes on to say that Apple has worked harder than most other vendors to protect its users. Security is one of the reasons Apple imposes such strict rules on what’s available in the App store, though people still jailbreak their phones.

Another trend Cisco found is something called “money muling.” Tom Gillis, VP and general manager of Cisco’s Security business unit, describes money muling as using unsuspecting people who are attracted by “work at home” spam messages and Web ads to participate in money laundering by moving small amounts of money into bank accounts, just a few thousand dollars at a time. He says the operations around this are becoming increasingly elaborate, and criminals will devote a lot of effort to developing it this year.

I talked with Gillis about the report and other security trends that Cisco found. Here are a few highlights from our conversation:

NewEnterprise: So you’re seeing fewer attacks on Windows and more on mobile devices. Is that simply because there are more of them?

Tom Gillis: It’s the simple fact that there’s this new class of mobile device coming into the enterprise that used to be a phone and now it’s a computer, and it can access enterprise information. So what we’re seeing is that the raw number, but not the severity, is down on Windows. Part of this is that Windows 7 was a very good release on Microsoft’s part from a security standpoint. And we’ve got these new devices coming into the enterprise, and so we’re seeing a shift in focus of attacks on these mobile devices. They’re vulnerable to attack and they’re relevant in the enterprise. Two years ago this would have been too small a population to be meaningful.

What kind of attacks are you seeing?

It varies. In some cases there’s a little “phone home” code in a free gaming app. Pretty gentle stuff so far. But as people start using smartphones to access sensitive information we need to start thinking about security considerations on these devices. There’s a larger theme here that the whole nature of attacks is changing dramatically. The fact that spam volumes dropped at all is a big tell. For 10 years this has only gone up. We’re not forecasting a steady decline in spam, but the fact that it slowed down at all is an indicator of the shift in the way that attackers are using email. The attacks are more targeted and personal, for one thing.

Can’t some of this decrease be attributed to some of the arrests that happened last year?

It can. There’s been a handful of arrests. And they went after not only the botnet operators but other parts of the spam value chain. There are firms and entities that build botnets of compromised machines that relay the spam, and then there are other firms and entities that rent time on those botnets that do the merchandising. The biggest category is selling fake pharmaceuticals. Some of these fake pharma operations were shut down and the people associated with them arrested. It’s not an easy thing to do, because they’re global, they move around, and so to make an arrest in this space is a huge accomplishment.

So what is the thinking now about securing the mobile device?

We think there are two ways to make mobile devices work in the enterprise. The flood of devices into the enterprise is huge, and everyone wants to use them to check their email and access corporate directories and other fundamental things. There needs to be some kind of software on the end point–the phone or device. It will have to be light. You can’t have some kind of antivirus suite running on the phone. It would be a little piece of software that’s on all the time that knows when you’re behind the corporate firewall and when you’re not, and manages your connection accordingly. We bought a company called ScanSafe that has 40 data centers around the world. When you’re outside the firewall it connects to you the nearest data center and enforces your corporate policies, but all you as the user know is that it just works. This notion of being on or off the corporate network goes away. And we can do all kinds of scanning for security, independent of the device that’s being used.

This year we also saw the Stuxnet attacks, which we now know for certain were carried out against the Iranian nuclear program. Clearly this is a new kind of attack that can be mounted against industrial control systems via computer networks. Is Cisco researching this?

Massively. Often these types of attacks are targeted against Cisco’s biggest enterprise customers. Who buys Cisco’s infrastructure? The biggest banks in the world, the defense contractors. If the goal of an attacker is to disrupt an economy, their targets will be our customers, and they’re demanding a response from us. I like to call it global threat correlation, but it comes down to taking huge samples of network traffic and picking out good traffic from the bad. Cisco has a good advantage here because our equipment is so widely deployed around the world. As we start measuring traffic we can develop reputation data on every publicly routable IP address on the Internet. As we start putting telemetry info into that equipment–and the customer can choose to enable it or not, and it’s turned off by default. But people turn it on because it helps them against the unknown kind of attacks that are popping up. If a Web server says its a Web server, but you just saw it sending spam three minutes ago, there’s a pretty good chance it’s part of a botnet. Once you know that you know that, you can start to mount a pretty good defense. We’re putting a lot of energy into developing that, and it’s proven to be pretty robust.

Microsoft’s Internet Explorer browser is still the world’s most popular, but its dominance is being steadily eroded by competition from Mozilla, Google and Apple. Can a new, aggressive approach to privacy change that? Can Microsoft really protect users from tracking across the Web–and do users really care?

Dean Hachamovitch, who oversees IE for Microsoft as a corporate VP, gives Walt Mossberg an update on the browser wars.

Greetings! We’ll be starting shortly. If you were in the room right now with our select crowd, you would have just heard some Aerosmith. And now, one of my favorite Van Morrison songs : “Jackie Wilson Said.” Also, we’re not using the classic red D interview chairs for this one. Going with a kind of teal blue. Now you know!