1 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise David Linthicum
2 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 2 Executive Summary The growth of Software- as- a- Service (SaaS) leads the growth of cloud computing. The SaaS consumption model provides agility and cost efficiencies, in many cases more than traditional methods of consuming software. However, while SaaS is a solid consideration for any cloud computing implementation, there are instances where it s just not the right fit. This is a problem enterprises must wrestle with right now, as cloud computing continues to gather steam. While SaaS is now a viable option, enterprises are faced with the dilemma of how to consume all types of software, cloud or no- cloud. While the hype suggests the SaaS approach, there should be careful consideration of all options, including SaaS and traditional approaches. Which is most cost effective? Which meets the enterprise s core requirements? What about security, governance, and performance? The SaaS model is not always the best fit, and neither are traditional approaches to software deployment and operations. You have to consider many options, requirements, and technologies to understand what s right for your specific needs. In this paper we ll take the mystery out of making the choice between SaaS- delivered solutions, or leveraging traditional on- premise (also known as on- premises or on- prem) approaches. We ll explore the requirements to consider, the types of technologies available, and a path to making the right decision.
3 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 3 CONTENTS Executive Summary 2 Defining the Options The SaaS Option Business Advantages of SaaS Cost Efficiency of SaaS Value of Agility Enabled by SaaS Technology Advantages of SaaS Fit for Purpose The On- Premise Option Cost Advantages of On- premise Technology Advantages On- premise Fit for Purpose Understanding Your Own Requirements Software Patterns Security Considerations Considering your Options Conclusion 13 About the Author 15
4 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 4 Defining the Options Until the concept of cloud computing and Software- as- a- Service (SaaS) came along, organizations solved all IT problems by themselves. SaaS- delivered services are about sharing resources, such as applications and systems management services, but it should really be more about sharing solutions and pushing risk out of the business. These days, cloud computing and SaaS are clear realities for the enterprise, or an option that has proven successful over the last several years. Those charged with building the next generation systems have some alternatives that previously did not exist. Now we must consider the choices. We can leverage software resources on- premise, in the traditional data center, as we have for the last 40 plus years. Or, we can leverage similar or the same software resources that come from a cloud services provider. There are always tradeoffs, and using SaaS or on- premise systems is no different. You need to consider just what those tradeoffs are now, and will be in the future. The trick is to strategically determine the right technological path for your enterprise, and define the more common tactical solutions that solve the day- to- day problems that we deal with as information technology professionals. The choice between SaaS- delivered and traditional on- premise systems seems simplistic in a world where the numbers and types of cloud- based resources and technology are exploding. It appears to be exactly the right question to be asking at this point in time How will we drive our deployment of IT resources this year, and for the next 10 years? At issue is the ability to take advantage of certain tactical and strategic advantages that SaaS may bring, such as cost savings, shifting risk, speed to market, and agility. However, it s also about considering what s right for the business by evaluating what s right for the application, utility, or service that will either run in the cloud as a SaaS- delivered resource, or exist within the traditional data center. This paper is not only about the options of SaaS or on- premise, it s also about setting the stage for the future models of consumption that will make the best sense for the business. It s about understanding the value of SaaS, understanding your own requirements, understanding security, governance, and operations, as well as how to best serve the user, and thus the business. Most importantly, it s about how IT will be able to become a key strategic asset for the enterprise, perhaps even more so than it is today. The SaaS Option Most enterprises leverage cloud- based technology options from vendors who offer SaaS solutions, such as CA Technologies and others. Indeed, most enterprise software players have SaaS versions of their offerings. You can count on it being all provider- supplied by the end of 2015, with only a few exceptions. There are many different definitions of SaaS, but we can categorize SaaS as having a few key attributes: First, the ability to deliver services, including business processes, applications, utilities, and other software services over a network for remote consumption by users and systems. Second, the ability to provide centralized administration and software maintenance, such as automatic updates and patch management. Third, the ability to scale to meet the needs of the business, without requiring local hardware and software resources. Fourth, the ability to provide software services through a pay- per- use model, only charging for the services leveraged, thus aligning costs directly with usage.
5 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 5 The many advantages of SaaS are covered below. This becomes the jumping- off- point for the other advantages of SaaS, as we ll cover next. Business Advantages of SaaS The cost advantages of SaaS are similar, if not exactly the same, as the cost advantages of cloud computing in general. The ability to leverage software systems that are maintained and owned by a third party provider means the business pays only for the software services it actually uses. This allows the business to avoid having to purchase and own hardware and software, thus avoiding capital costs. We can call this the cost efficiency of SaaS. However, there are other business advantages to consider beyond simple cost efficiency, including the ability to bring a speed- to- market advantage to the business using SaaS- delivered resources. Because you can stand up (provision) SaaS services as you need them, there is a low latency to get these SaaS- delivered software services into production to support changes in the business. This provides the advantages of agility for the business, which allow you to quickly align the needs of IT to the needs of the business using SaaS as an enabling technology. We can call this the value of agility, enabled by SaaS. Cost Efficiency of SaaS As depicted in Figure 1, for those who maintain software systems on- premise, typically in a traditional data center, as capacity requirements go up, they must purchase waves of hardware and software, which are capital expenditures. Typically, capacity must be purchased ahead of need, which means capital expenditures for the purchase of hardware and software, as well as the acquisition of data center space. Thus, if you need to scale from 100 to 10,000 users in a single year, you need to purchase the hardware and software required to support 10,000 users ahead of the need. This means you re purchasing a great deal of hardware and software resources that sit idle until they are needed. In some cases, when capacity is no longer needed, the capital investment in the hardware, software, and data center space still remains. Thus, as time progresses, the capacity model looks much like a series of stair steps as depicted in Figure 1.
6 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 6 Capacity:)) Compute,) Storage,)) IT)Labor,)) Real)Estate) Not)enough)capacity,) increased)costs)and) dissa;sfied)clients) Capital)Expenditure) Capital)Expenditure) Capital)Expenditure) Capital) Expenditure) Underu;lized)but) s;ll)have)capacity) expenses) Capital)Expenditure) Tradi/onal) Provisioning) SaaS)Provisioning) Actual)Usage) Time) Figure 1: The use of SaaS allows the demand for software resources to align perfectly with capacity using a usage- based model. In a traditional (on- premise) model, you must purchase hardware and software well ahead of demand. This leads to cost inefficiencies. Also depicted in Figure 1 is the use of SaaS and the ability for a SaaS- based consumption model to provide more effective and efficient use of resources. This is due to the fact that the demand for resources is directly aligned with the capacity. This is the wavy line that runs the length of the chart. Thus, unnecessary hardware and software cost are avoided since you re operating at a greater degree of efficiency, with the SaaS resource consumption tied directly to cost. As your need for SaaS- based resources increases, you re able to provision the resources as- needed. As your needs decrease, you re able to de- provision the resources. Since SaaS is usage- based billing, you only pay for the exact capacity you consume. Considering that SaaS better aligns cost management and consumption management, we can assume that SaaS is more cost efficient than on- premise solutions, generally speaking. However, there are some other specific values that those who adopt SaaS should understand, including: The ability to operate at a lower cost of production. We re able to operate applications, databases, and support end- users at a much lower cost of production than before. SaaS, and cloud computing in general, does a much better job of sharing resources, and the more resources that are shared, the lower production costs go. The ability to reduce risk. As mentioned earlier, we have the ability to share risk with the SaaS provider. In the case of public SaaS, we share risk in the same way we push risk onto our power companies and water companies. With SaaS, we only pay for the services we leverage. The ability to shift around technology changes, which is a bit different than business agility. As technology changes over time, we have a much better platform to keep up with those changes, perhaps abstracting enterprise IT from the need to deal with those changes directly. In the case of public SaaS, this is rather obvious. Public SaaS are different each and every time you connect to them for services. They are constantly upgrading software to provide better services, or expanded capacity. This occurs automatically, typically without the involvement of enterprise IT or the cloud user.
7 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 7 Value of Agility Enabled by SaaS Speed to Market supplies an important value when you leverage SaaS- based resources, in that it s easy to allocate the resources you need to get a business moving in the right direction, and do it quickly. This applies to a new start- up looking to get the right systems on- line to support new business processes, as well as to a large enterprise that wants to bring a new product to market. SaaS s value is all about the ability to provision the resources you need now to run the business. We re moving away from the practice of waiting weeks or months for hardware and software to show up, bolt it into the data center, configure it, and then release it into production. SaaS- based clouds have huge amounts of on- demand resources, sharable among those who need to move the business along quickly. This allows SaaS applications to be in production much more quickly, which can translate into millions of dollars in additional revenue, as well as the ability to capture and lead markets. The latency around standing up computing resources has been largely removed. Ability to Adapt is a bit different than speed to market, in that we re talking about the ability to change versus the speed of changing. For years, businesses had to deal with an IT infrastructure that s unable to change. For the most part, the culprit was the layer upon layer of technology. Technology was typically added to solve tactical problems such as a new database for business intelligence, management utilities, or just to get the latest and greatest technology in- house. Integration into the overall system was often more of a patch than a fine mesh. The addition of each layer of technology caused more complexity. More complexity drove more cost, as well as the inability to change the IT infrastructure to adapt to changing business needs. Technology Advantages of SaaS The technological advantage of SaaS means that we can focus more on what the technology can do rather than why we should use it. SaaS, and cloud computing in general, provides some clear technological advantages that many businesses can exploit. We covered some of the advantages above. Indeed, the value of SaaS to the business and the value of SaaS as a technology are tightly coupled. Scalability and elasticity relates to the ability of a public SaaS provider to furnish access to thousands of servers almost instantaneously, as well as de- provision those servers when the processing is complete. You only pay for the time you leverage those servers. After you re done with them, they return to the resource pool to be reallocated again by others who leverage the SaaS- based cloud. This means you can speed up many business processes that were once limited by the hardware you owned. End- of- month processing or seasonal fluctuations in processing are examples of applications where this technology has a clear advantage. Security and governance (discussed later in this paper) are also easily managed with a SaaS- based cloud, as long as good security practices and technology are already understood and in place within the enterprise. Moreover, in many instances, data must be shared between the SaaS- based systems and on- premise systems. Thus, data integration technology should be leveraged, which can be SaaS- based as well. As depicted in Figure 2, there are many core advantages that SaaS brings specifically, and cloud computing brings in general, including scalability and elasticity, as well as advantages of control and productivity. Productivity is enhanced because the SaaS provider can offer common self- service provisioning of SaaS- delivered resources, as well as a catalog of core SaaS services, either as user- facing applications or API/services.
8 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 8 SaaS Users Want Elasticity & Scalability Control Productivity Agility Cost SaaS Providers Deliver Flexible'resource'configura1ons' Dynamic'scale5up'/'scale5down'of'resources'' Seamless'support'of'mul1ple'clouds' Flexible'resource'quotas' ' Role'based'access'controls' Comprehensive'monitoring'and'logging' Image'Lifecycle'Management' Integra1on'into'Incident,'Change,'Patching'Management' Common'Self' 'Service'Provisioning'Portal'into'all'cloud'end'points' Robust'Service'Catalog'meets'all''of'customer'cloud'needs'' End'to'End'Automa1on' Supported'APIs'allowing'the'applica1ons'and'data'sources'to'communicate'with'one' another' ' '''Self' 'Service'Resource''Provisioning' '''Rapid'Elas1city' '''Capacity'on'Demand'insures'resources'are'always'available' '''Rapid'disaster'recovery' 'Ac1ve'/'Ac1ve'applica1on'support' '''Seamless'support'for'different'endpoints' Metering'and'Chargeback' Pay'as'you'go' Consump1on'based'' Reliable'asset'tracking'and'usage'repor1ng' Figure 2: There are many technological advantages for consumers of SaaS- based clouds. As SaaS matures, its providers are meeting more and more requirements of the business. Agility also leads to side benefits such as faster disaster recovery (active/active application support), the ability to better monitor software usage and make the appropriate chargeback and showback to better understand the true costs of SaaS, and allocate the costs among internal organizations. Fit for Purpose Your core business requirements for this technology determine the fit of SaaS for your organization, typically around the needs for specific SaaS services. The attributes considered include: Placing a value on time- to- market and business agility advantages. Cost sensitivity, and thus avoidance of capital costs where possible. Placing more value on software services than control. Considering IT more as an overhead cost than a strategic cost. Understanding data integration services that are available, and can operate using higher latency networks. Having a sound infrastructure in place, including security and governance (discussed below). Having a culture that s able to accept the use of cloud- /SaaS- delivered services. The On-Premise Option The traditional methods of installing and customizing software on the customer s own computers that reside inside their own data center are really what the on- premise option is all about. For most businesses, this means continuing on the existing path of leveraging your own hardware and software to run core enterprise software services, such as applications, middleware, management and administration systems, and so forth.
9 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 9 While most in the world of cloud computing and SaaS don t believe that on- premise is ever a good choice over cloud- based resources, the reality is that cloud is not a fit for every application and/or service. To that end, let s take much the same approach as we did above, and look at both the cost and technology advantages of taking a more traditional approach to consuming software. Cost Advantages of On-premise The advantages of leveraging on- premise systems over SaaS are that you maintain complete control over those systems, including where they physically reside, who maintains them, and how they are secured, maintained, and governed. Whether or not these are true cost advantages are left up to the business itself, as part of the core requirements of the business. We ll talk about that in the next section. Other cost advantages of keeping systems on site include avoiding the profit margin of a SaaS vendor, and depreciation of existing assets over time. Over a long enough cycle, public cloud can be more expensive when considering the bigger picture. Thus, planning and running the numbers is key. Generally speaking, there is a cost advantage to leveraging on- premise systems, but only for a few organizations. These include: Organizations that have pre- invested in a large amount of hardware and software, without any way to recover that capital. Organizations under regulations that require that information reside on private and tightly controlled hardware and software. Organizations where the cost of SaaS services for comparable on- premise systems are exorbitant. Organizations that do not have a culture that will readily accept the use of software systems not owned and controlled by the company. While SaaS is typically a good fit for many businesses, it s not the right fit for all businesses. It s important that you understand your own requirements, which we ll cover later in the paper. Technology Advantages On-premise As with the cost advantages, there are a few technology advantages to consider as well when evaluating our on- premise options. These include: Lower network latency considering that these systems typically reside on the local network. Greater control over security and governance operations, including the ability to remove the physical systems, if needed. On- premise software may be better aligned with the needs of the business than software that can be SaaS- delivered. Full control over the upgrade cycle and functional improvements. Prioritization options for resourcing, performance, recovery, etc.. Ability to provide deeper integration in the service for management and security. Fit for Purpose Again, your core business requirements determine the fit of on- premise systems for your organization, based upon what we know about the advantages of owning the hardware and software. Typically speaking, on- premise is a fit for organizations and service requirements that: Place little value on time- to- market and agility advantages. Are not sensitive to capital costs.
10 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 10 Have already pre- invested in hardware, software, and data center resources. Have no SaaS- delivered system to meet their core business requirements. Cannot address regulatory or security requirements with SaaS. Need tightly coupled data integration between the on- premise and SaaS- delivered systems, where latency needs to be kept to a minimum. Have a culture that is not yet able to accept the use of cloud- /SaaS- delivered services. Understanding Your Own Requirements Now that we understand the basic advantages and disadvantages of leveraging both SaaS and on- premise software services, it s time we took a closer look at what it takes to understand your own requirements. We suggest organizations follow a step process. The first step in moving through this process is to determine your own enterprise vulnerabilities, and thus the risk of moving toward SaaS. These vulnerabilities are: Governance. This involves the people, processes, and technology used to monitor, control, and manage the SaaS- based assets. This includes services, applications, devices, etc.. Regulatory compliance. This refers to the laws and regulations that surround the use of the data that will be contained in your SaaS- based platform. In some instances, heavy fines and even jail time can result from mishandling some types of data. You need to be aware of the laws. Security & identity management. The ability to deal with most cloud components, services, applications, devices, and people through the use of unique identities gives us control of what each identity can do, including access to data, services, and applications. Business continuity. In the world of SaaS, there are many options to meet business continuity requirements, which is the ability to keep things running. There are also cloud outages to deal with. You must understand your requirements for business continuity, and how to meet those needs. Process and services. Defining core business processes and the SaaS services that work within these core business processes would include defining the process for building, selling, and shipping a product, and all of the services that make up that process. Data management. You need the ability to manage enterprise data assets in the move to a SaaS- based platform. For instance, most enterprises have many silos of data, and some of that data will be moving to SaaS- based platforms. System integration. This is the ability to sync information between existing and new SaaS- based systems. If some of the data resides within the enterprise, some in private clouds, and some on public clouds, how do you keep that information in sync? Resource skills & knowledge. How many people in the organization are ready for SaaS, and do they understand it? You could build or migrate to a perfect SaaS- based system, but if the humans are unprepared to understand and support it, SaaS will fail. Application readiness. What is the current state of an application and its readiness to move to a SaaS- based platform? This includes the data, the code, the existing platform, security, usability, etc.. Some applications simply won t work on the cloud, or will require too much work for migration. You need to figure that out before you begin.
11 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 11 Network readiness. This is the state- of- the- network, in terms of its ability to support the extra infrastructure requirements for public and private cloud computing. Attempting to build clouds on an older and slower network will result in lackluster performance, unhappy users, and, ultimately, the failure of the cloud computing migration. The idea here is to get an initial assessment of the readiness of the enterprise to move toward SaaS (see Figure 3). Notice that the graphic on the right depicts sample rankings of each concept, and thus provides you with a framework to understand the tradeoff between the risk to the enterprise and the complexity of mitigating the risks. The idea here is for you to pick a point on the chart in terms of Risk to Organization and Complexity of Mitigating Risk. Thus, you ll be able to access the risk around each concept, and make better decisions about how and what to move to SaaS- based platforms. Figure 3: Enterprise vulnerabilities should be considered part of defining requirements as you consider the move to SaaS or on- premise systems. Software Patterns Beyond the consumption patterns, there are several software patterns to consider, including: Utility Services Management Services Middleware Services Business Services Security Services Utility services are services that perform specific tasks related to the management of computer functions, resources, or files, memory management, virus protection, file compression, etc., and these utility software services can be delivered using a SaaS model. Management services are SaaS services that focus on managing software systems, either those that exist on public or private clouds, or traditional systems that exist on- premise. Examples include, performance monitoring backup and recovery tools, perhaps tools that manage provisioning and de- provisioning of SaaS- based services.
12 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 12 Middleware services are software services that are built specifically to facilitate communications with one or more on- premise or cloud- based systems or data stores. Examples including message queuing systems, message brokering systems, transaction management systems, etc.. Business services are true applications that are delivered as a service. This is what most people think of when they consider SaaS- based providers. Typically this means the SaaS provider furnishes a fully functional enterprise application over the open Internet, typically using a browser- based application. However, they can also be mobile devices, and some SaaS business services are delivered using APIs. Examples include sales management, service desk management, and human resources management, all delivered from the SaaS- based public cloud. Security services are services such as encryption and identity management that allow you to manage access to the SaaS- based system. Typically, these exist within the SaaS- delivered software, as well as where the services are consumed (the client). Security Considerations There are myths out there that SaaS is inherently less secure than traditional approaches. This is due largely to the fact that just the approach itself, where your data is stored on servers and systems you don t own or control, feels insecure. The bottom line is that control does not mean security, as we ve discovered through incidences over the last several years, as cloud and SaaS have grown in popularity. Where your data exists matters less than the ways your data can be accessed. This is the case for both SaaS- based systems, and on- premise computing. You also should consider data sovereignty. This means that SaaS providers are storing and maintaining data at different locations, and there could be legal and management issues around that type of data distribution. There is a lot to consider on the regulatory compliance front. Many SaaS providers have data centers scattered across the world. This creates jurisdictional issues that must be understood and managed. The path to security for SaaS is not much different than the path to security for internal systems. The reason many SaaS- based systems seem to actually do better in these studies is that more planning and technology typically goes into securing public SaaS- based systems because everyone assumes that security will be an issue. On- premise systems may not get the same amount of planning and resources, and thus they can actually be more vulnerable. All things considered, enterprises considering cloud computing should follow a well- defined path to secure SaaS. This includes: Understanding your security requirements for a specific system and/or data store. While you can create enterprise- wide strategies that encompass many different systems, it s a much better approach to consider each system as separate and distinct. Understanding that controlled access is much more important than the location of the data. Identity- based security systems seem to be a good fit for SaaS- based systems. However, you need to consider your own security and compliance requirements. Vulnerability testing is an absolute necessity. It doesn t matter if you re testing the security of SaaS- based or on- premise systems. The assumption that public SaaS providers are always less secure is something that will take time and new data to dispel. As the more innovative enterprises find success in the public SaaS space, and that success proves to be an obvious business advantage, the laggards will certainly follow. Considering your Options
13 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 13 So, how do you make the decision to move to a SaaS- based solution, or traditional on- premise? As we discussed in the paper, it s really a matter of understanding your own requirements, and the opportunities and downsides to leveraging SaaS or on- premise systems, or both. We suggest that you go through a 6 step process: Step 1: Compare Costs Step 2: Understand Use Cases Step 3: Consider Security Step 4: Consider Time- to- Market and Agility Step 5: Execution Step 6: Consider Operations Compare costs, meaning that you create a relevant business case and cost model that is reflective as to how you would leverage software services, SaaS or on- premise. Consider the topics covered in this paper. Look at the value drivers of SaaS, which include understanding the potential cost efficiencies, or hard savings, as well as the strategic value of time- to- market and agility advantages, or soft savings. Understand use cases, meaning that you determine exactly how the software systems will be leveraged by the business. This typically means gathering use cases. The cases will determine usage patterns, and provide clear requirements. Consider security as covered in the previous section, means that we define our core security requirements as to how it drives our decisions to leverage SaaS- based resources, or not. Moreover, look at the consider time- to- market and agility advantages of SaaS, and figure out how to measure the value. Finally, execution. Make a call as to the best approach; SaaS- based software solutions, or those that are locally hosted (on- premise). This means that we understand most of the technology and business considerations, and we re committing to a path for a particular software service, or a group of services. Consider operations, meaning that we look at the processes and resources required to operate the solution over time, including security, governance, administration, software maintenance, etc.. Even if you ve moved in a SaaS direction, there are still operational considerations, such as security and user administration. In many instances, integration of SaaS- based systems and on- premise systems needs to occur, and that requires operational attention as well. Vendors like CA Technologies recognize that neither SaaS nor on- premise is always the best answer. That is why we see more and more software being made available through both consumption models. Organizations can choose the model that best suits their needs without compromising on functionality. It s important that you consider this option when you select a provider, no matter where your software will run. Conclusion Going forward, the choice between SaaS- based or on- premise systems will continue to be a fundamental decision in most IT organizations. While it would seem that the decision would always sway toward cloud and SaaS, the reality is that organizations should always do the analysis and planning to make sure they are making the right choices. All enterprises are different, and all services are different. Each gains different degrees of value from the use of SaaS- based systems. The key to most of this is to understand what that value actually is, and make sure to factor that into the selection of the right software consumption model.
14 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 14 The starting point is always your business requirements. The next step is how the technology works into those requirements. However, also a consideration should be the strategic path of the business, and how to leverage technology to enhance that path. Using SaaS, while not always indicated, is revolutionizing the way enterprises consume software services. It s changing the game as to how we consider solving problems, and removing the latency in changing the core business around new opportunities. What s critical now is that you consider how much, or how little, it will benefit you.
15 SaaS or On-Premise? How to Select the Right Paths for Your Enterprise 15 About the Author Leading technology publications frequently name David S. Linthicum among the top 10 enterprise technologists in the world. He is a true thought leader in the industry, and an expert in complex distributed systems, including cloud computing, data integration; service oriented architecture (SOA), and big data systems. As the author of over 13 books on computing with over 3,000 published articles, as well as radio and TV appearances as a computing expert, he is often quoted in major business and technology publications. In addition, David is a frequent keynote presenter at industry conferences, with over 500 presentations given in the last 20 years.