Cloud computing: Australian lessons and experiences

Transcription

1 IT ADVISORY Cloud computing: Australian lessons and experiences ADVISORY

2 Cloud computing: Australian lessons and experiences Cloud computing: Australian lessons and experiences Cloud computing promises to bring sweeping changes to the way organisations use information technology. It is currently a focus of attention in business, government and the IT industry. Despite this, decision-makers are still struggling for insights on what it really means in practice, the benefits achievable today, and the challenges associated with trying to exploit it in large enterprises. To answer these questions KPMG has collected and analysed experiences across Australian organisations identified as aggressive adopters of cloud services. Key findings The cloud computing phenomenon is real, accelerating and to be taken seriously Some Australian enterprises, including large businesses, are already following a zero software strategy, aggressively adopting cloud computing wherever it makes sense. Examples were found of organisations already renting more than 80 percent of their applications as network accessible services from external providers. The biggest benefits are unexpected Decision-makers almost always start with the goal of using cloud computing to improve the cost/efficiency of IT, then progressively discover bigger, strategic benefits in business flexibility, agility, collaboration, improved customer experiences, and reduced time to market for new products and services. Location is important Although the cloud makes it possible to access services located anywhere in the world, there is a strong desire for services located within Australia s borders. A significant barrier to take-up is the wide variation in maturity and quality of cloud services and service providers A particular problem is the inability to get enterprise-grade service level agreements. Common challenges Common challenges include uncontrolled adoption of cloud applications in large organisations, non-compliance with local regulations (especially those that relate to the handling of customer information), concerns about regulations applying to services in other jurisdictions, preparing apples to oranges business cases for cloud computing, and measuring the performance of cloud service providers.

3 Cloud computing: Australian lessons and experiences Part I: Introduction Background Decision-makers are now regularly hearing the term cloud computing, but there is still a great deal of confusion about what it means, and what it can do for business. As happens so often in the computer industry, the language has evolved over time. Cloud computing has only recently been coined as the catchall term describing a range of related phenomena, including: Organisation A Organisation B Organisation C (a) Traditional computing. Owned, installed and operated on the premises by individual organisations the notion of accessing computing resources as external services, instead of as products that are purchased, installed and managed within an organisation the ability to rapidly scale the allocation of computing resources to match up/ down fluctuations in business demand the shift to utility-based pricing, so organisations need only pay for computing resources based on actual usage, as they do, for example, with electricity. Perhaps the most universal way of expressing the transition from traditional, on-the-premises computing to cloud computing is via a visual metaphor, as shown in Figure 1. At the heart of cloud computing lies the notion that the computing resources can be reliably and efficiently accessed, by mainstream businesses, as a pooled resource over networks. That concept has been around in one form or another since the 1960s, but in recent years it has received a boost. This is due to, among other factors, improvements in network infrastructure, self-service Web-based application delivery, and the technologies (especially virtualisation) that enable many disparate computing tasks to be efficiently distributed across a single shared pool of computing resources 1. Organisation A Organisation B Organisation C (b) Cloud computing. Rented and accessed as external, shared services over networks. Figure 1: A visual metaphor for the shift to cloud computing In September and October 2009, KPMG conducted interviews with managers in Australian organisations identified as pushing the boundaries of cloud computing. Our objective was to build a rich picture of experiences in early enterprise adopters, including benefits, challenges and practical lessons learned so far. The research results are detailed in this paper. The methods, including the organisation selection, respondent selection, data collection and a description of the sample are detailed in Appendix 1 on page Above the Clouds: a Berkeley View of Cloud Computing published by UC Berkeley Reliable Adaptive Distributed Systems Laboratory, 10 February This paper provides a thorough exploration of the implications of elasticity and cloud computing.

4 Cloud computing: Australian lessons and experiences Part II: Journeys What does cloud adoption look like? In this section we discuss the nature and patterns of cloud adoption in practice, the extent of adoption so far, and strategies and intentions going forward. Spectrum of activity In the IT industry, the following threetiered categorisation is becoming increasingly popular for describing different types of cloud computing activity: Renting access to software as Web-accessed services instead of installing it on the premises (example services include Salesforce.com, SAP Business By Design, RightNow, Google Apps and Intacct). Developing and hosting bespoke software in cloud environments (platforms) that provide all required tools, languages, databases and resources (example services include Force.com, NetSuite Business Operating System, Microsoft Azure, Google App Engine). Renting access to computer processing power and storage over networks (example services include Amazon EC2, Amazon S3). Software Platform Infrastructure These categories have been represented visually in Figure 2. They are sometimes respectively abbreviated to Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). While all three categories were well represented in the activities being undertaken in sample organisations, respondents rarely expressed themselves in these terms. In practice, their focus, and language, centred squarely on business applications. Software development in the cloud tended to be associated with activity to extend the capability of, or build a new module for, an important application. Likewise, computing infrastructure tended to be seen as part of the package for cloud based applications (i.e. the application came with the computers and storage required to run it, so they did not need to be considered separately). Even when respondents did rent cloud infrastructure in its own right, this was usually discussed as part of an initiative to run a specific, key application more efficiently. Managers also did not have fixed views on what constituted cloud computing and what did not. They usually acknowledged that a variety of interpretations existed and that the boundaries could be grey. Significant differences in language existed between the respondents and cloud providers. Managers in the service provider community tended to have black and white views on what was, and was not cloud computing, and to see things in tidy terms, frequently referencing the layers in Figure 2 as if they were activities undertaken in isolation from one another. Classifying cloud computing activity, then, is a useful aid to communication in reports such as this one, and especially as a way to compare the services being offered by individual cloud service providers, but care should be taken to differentiate this from what happens in practice, which is typically a set of interdependent activities centred around key applications. Many paths to the cloud No two organisations had adopted cloud computing in exactly the same way or over the same timeframe. The journeys followed were determined by history and accidents (experiments, unplanned trials, recommendations from peers) as well as variations in the structure, industrial context and computing needs of individual organisations. Figure 2: Common categorisation of cloud computing services

5 Cloud computing: Australian lessons and experiences Two themes, however, did emerge as important, being broadly applicable to multiple cases. In one of these the journey was initiated by the adoption of a cloud-based service for a single, key enterprise application. Good results then led to the adoption of more cloud-based applications, as well as the adoption of cloud-based software development to extend the functionality of standard applications. Salesforce.com was frequently cited as an initial, pivotal application that stimulated broader takeup of cloud computing. In the other, the journey began with efforts to improve the capacity utilisation of computing resources inside the organisation. Servers and computer storage were consolidated around fewer, larger facilities, and some software applications were virtualised so they ran anywhere in these facilities rather than on dedicated machines. Good results saw this expanded into an organisation-wide strategy, followed by a shift of some computing to service providers outside the organisation. There were many other variations. In one case the journey began with adoption of open source software (installed on the premises). The associated shift from up-front software purchasing to pay-as-you-go maintenance led to a broader interest in paying for computer resources using utility-based pricing. In another case, the adoption of Web-based and collaboration tools started the process. In a third case, the journey began with a desire to remove computing equipment from hostile (hot, dusty) work environments. Software Platform Infrastructure Isolated use of tactical, Webbased applications Internal shift to SOA, Web services Virtualisation in internal datacentres Enterprise /collaboration applications Customising cloud apps Move selected infrastructure to managed service providers Figure 3: Example activities in the cloud journey The complex journeys being followed in practice are represented in Figure 3. On the left hand side are some of the activities that are initiating or laying foundations for cloud computing. More sophisticated and pervasive activity is represented as the journey progresses (from left to right). Once again the activities are split into the categories of software, platform and infrastructure, but in practice they were blended together, with many taking place in parallel. Extent of adoption As with the journeys taken, there was a wide variation in the extent of adoption. Three organisations stood out as particularly advanced adopters, with between 80 and 90 percent of the applications used by the organisation now rented as services from external providers. Two of these were large enterprises, although both employed less than 400 people and therefore sat at the lower end of this classification. One was a small business. In five other cases (4 mid-sized, 1 small organisation) the estimates were between 30 and 60 percent. In the middle were five organisations (all large) where between 10 and 20 percent of applications were accessed from the cloud. Less extensive adoption accounting for less than 5 percent of applications characterised the remaining five organisations (all large). During the course of the research, 2 additional Australian organisations (1 large, 1 mid-sized) were identified by respondents as likely to be running more than 80 percent of their software in the cloud, but interviews were not secured to allow verification. t Selected enterprise applications (CRM, Financials, HR) Developing bespoke apps on cloud platforms Use ondemand public infrastructure services (EC2, S3, etc) Enterprise wide zero software strategy Spin-off home grown apps into cloud services Use elasticity to differentiate services The applications accessed from the cloud spanned a surprising range of business functions much wider than anticipated prior to the research including training, human resource management, finance and accounting, supplier management, procurement, customer relationship management, billing, helpdesk, travel management, project management, personal productivity, communications, document management and collaboration. Adoption was by no means limited to packaged solutions: extensive use was made of platforms for developing and running bespoke applications in the cloud. Nor was it limited to nonstrategic applications: there were many instances of strategic and sensitive applications being accessed from the cloud. A strong theme among organisations with less than 20 percent adoption was virtualisation. Four of these organisations were working methodically to create centralised, shared pools of computer hardware inside the enterprise. In two cases this program had been particularly aggressive and more than 80 percent of all applications were now running this way. They had completed a significant internal transition and were well positioned to move computing out of the organisation to external infrastructure providers at any time in future. Intention to adopt Overall there was a strong intention to continue adopting cloud computing. In 10 of the 18 cases a zero software strategy existed, either formally or informally, where there was an understanding that all business computing would be pushed into the cloud wherever and whenever it became practical to do so. In these organisations, managers had come to the conclusion that using the cloud translated to a substantial competitive advantage. When it came to realising their goals, there were different views on what wherever and whenever practical meant. These views depended on management attitudes towards risk, the perceived maturity of cloud service providers, and the complexity of the organisation s existing computing environment. As we have seen, in three organisations the wholesale transition to cloud computing was not only

6 Cloud computing: Australian lessons and experiences seen as practical, it was also largely complete. For most, however, even though convinced that cloud computing would become their dominant model, it was expected to be a transition that took years to complete. Of the other eight cases, the prevailing attitude was that cloud was an important option, to be evaluated on a case by case basis. It was expected to be ideal for some applications but unsuitable for others. A typical comment: I just see [cloud] as one more tool in the toolbox, and just making sure I use the right tool at the right time, but it s a really good tool and it will be getting a lot of use! In one case the intentions were reversed: computing would be transferred out of the cloud over time. This was a small enterprise that had adopted the cloud aggressively, with good outcomes, as a deliberate strategy to support rapid scalability. As the organisation grew and became more established, however, the unique industrial needs of this organisation meant that on-the-premises control would become mandatory, and a transfer back to an on-the-premises model was planned. The targeted organisations were aggressive adopters of cloud computing, so these results cannot be taken as indicators of cloud adoption across all enterprises. Here, the informal data gathered from organisations with an unknown adoption status was most relevant. Executives in these organisations typically considered the cloud to be an important phenomenon and were watching it closely, but they held reservations about its current maturity and applicability to their organisation and were not leading any systematic programs to adopt it. They also reported, however, that cloud computing was frequently being adopted piecemeal, in the form of isolated Web-accessed applications taken up by individual business units (i.e. without going through the IT department). They also made frequent references to programs to consolidate computing facilities and virtualise applications internally, in order to improve capacity utilisation. Although a larger sample would be required to determine the true extent of cloud computing adoption in Australian organisations, we can draw the following tentative conclusions: A small number of Australian enterprises have already embraced a zero software strategy and are aggressively adopting cloud computing wherever it makes sense. This includes large organisations as well as small. Most Australian organisations, even if not pursuing a deliberate cloud strategy, are experiencing a shift of some computing to the cloud by default, through the adoption of tactical, Web-based applications in the business. A significant proportion of large Australian organisations are undergoing internal programs in particular the pooling of computing infrastructure and adoption of virtualisation technologies that are preparing the ground for cloud computing in future (even if the latter step is not currently planned). All of these trends are accelerating. Lastly, based on first-hand observations, respondent comments and US cloud adoption announcements, we can tentatively conclude that Australian organisations lag US adoption by 12 months or more. The key factor here is most likely the US-centricity of early, high profile cloud service providers (for further information, refer to page 14: The onshore imperative). Journey of discovery Respondents consistently described their cloud computing experiences as a journey of discovery, where their understanding of the cloud, what it could do for their business, and how their business could do things differently because of it, was continually expanded. These managers were constantly surprised with new possibilities. Comments like this were typical: One of the things about the cloud is that everyone, vendors, channel partners, people like me, are discovering accidentally new ways of using it I didn t have this vision on a map. Its only coming to me now because I can see what is realistically possible. This was only partly due to the continuing evolution and availability of new cloud services. The stronger message here was that many of the discoveries only came from using the cloud in practice. As another respondent put it: The use of [service] introduced a platform to enable things to be done differently, and in unforseen ways. [It] opens up a little wedge and you take a step, and then take another step, and you take another step. One consequence was that the motivation for pursuing the adoption of cloud computing changed over time. In almost every case the initial drivers were improving cost-efficiency of information technology in the organisation. Later, however, as cloud experiences were accumulated, new opportunities were discovered to do business differently (organisational innovation), and to create new value propositions for customers (product and service innovation). It was clear in the interviews that many of the respondents valued these outcomes far more highly than those relating to cost efficiency. This was an important finding. The shift in emphasis from cost/efficiency to business innovation is illustrated in Figure 4, and described in more detail in Part III. Most Australian organisations, even if not pursuing a deliberate cloud strategy, are experiencing a shift of some computing to the cloud by default.

7 Cloud computing: Australian lessons and experiences Part III: Benefits What benefits are achievable today? In this section we discuss the benefits reported in practice, how cloud computing relates to IT cost/efficiency, and the bigger, more strategic benefits discovered in business agility and new customer capabilities. Cost / efficiency Capacity utilisation Utility pricing Remove complexity Energy Collaboration Single data footprint Org structure new offices New ventures / spin-offs Mergers & divestitures Time to market New services Service level differentiation Composite services Co-innovation Cost efficiency Business innovation t Figure 4: Changing motivations for pursuing cloud computing In one case a respondent described asking for a quote from a cloud provider to build a new module to connect with their cloud based application, then being impressed when, instead of coming back with a quote, the provider came back a short time later with the completed application. Once in place, the ongoing operational savings were also seen as very significant. Comments like this were typical: We save on labour, we save on training because it s easy to use, but the bigger savings are those invisible ones, the on-going maintenance, the patching and the support. IT cost, efficiency and speed IT cost/efficiency expectations for cloud computing were born out in practice. Respondents reported they were getting very good value for money out of the transitions made so far, especially due to reduced capital outlay on hardware and reduced costs associated with computer operations and software maintenance. Many of the savings were associated with not purchasing more computing capacity than was necessary. We only pay for what we use, not what we re going to need or going to use in 3 years or 5 years time. Labour cost reductions could also be significant: We have been able to reduce headcount in our infrastructure teams by 30 percent. A particularly strong theme was cost avoidance relating to cloud based applications. From the beginning they were seen as much easier and faster to implement and less likely to be associated with cost overruns, as the following comments attest: The quicker [installation] time was a cost saving. It was one of those projects that almost went under the radar; it was so smooth and so low cost. This extended beyond the initial implementation: modifications, new modules and bespoke software development projects were all reported to be faster, and thus cheaper, in the cloud. We did the project in 3 months. It was a fairly big project so I was pretty happy with that result I think the development is a lot quicker. Networking costs always went up, due to additional traffic and bandwidth demands, but where mentioned these costs were always reported as insignificant compared to the savings. Measuring return on investment (ROI) from the cloud, however, was clearly a challenge. Most respondents could not quantify the savings they had achieved. Estimates that were volunteered all clustered around a 30 percent annual reduction in IT expenditure (for hardware, software, network, labour and all other activity associated with the relevant applications). Enterprises that had pursued virtualisation and pooling of computing resources within the enterprise, with relatively little adoption of external cloud services, also reported significant savings. A significant increase in capacity utilisation was achieved in practice. As one respondent described it:

8 Cloud computing: Australian lessons and experiences Previously the majority [of servers] were idling around 5 to 10 percent average utilisation. Now we re seeing 65 to 70 percent average load. The same respondent reported being able to reduce the personnel managing servers by 50 percent. Total ROI savings from this activity were also typically in the order of 30 percent, and in one case the ratio of IT expenditure to total company revenues had been reduced by almost 50 percent. Savings also came through the ability to buy commodity-based hardware. This provided more sourcing options and facilitated volume purchases, all of which contributed to lower hardware prices. As one respondent put it: Our practice has gone from buying individual servers to buying clusters of servers, so now we re talking 35 to 45 percent discount levels. Removing complexity A theme closely related to cost efficiency was that of reduced complexity. Respondents frequently referred to this as an outcome. Cloud computing activities removed many IT operations considerations from the organisation altogether. This not only reduced overheads associated with day to day operations of computer equipment, but also simplified procurement, the need to plan for updates and patches to software, management of software licensing, and facilities management. Typical comments: From a management point of view [the cloud] is just so much simpler. The cloud offered us a simple path to rationalise all this complexity. A sub theme here was that moves to cloud computing were often associated with the consolidation of a number of IT systems into one: This gives us the opportunity to consolidate and standardise from an application point of view. This type of consolidation was still seen to be difficult, but cloud services were perceived to be making it easier than it otherwise would have been. In one case the consolidation process spanned many systems and was considered the most challenging part of the cloud computing journey. Reallocating IT people Removing information technology complexity from the organisation freed valuable personnel that had been occupied with day-to-day technology operations. In most cases, managers did not seek to translate this into a reduction in overall headcount, but instead chose to reallocate people to higher value projects. As one respondent described it: The people here are not spending all day writing procedures to load something from a database or put it back into a database. They re actually working on building business logic. Personnel were typically reallocated to activities with a much more direct contribution to the bottom line, such as the design and implementation of new systems to service customers. Clearly, this was considered a very valuable outcome indeed, as demonstrated in the following remark: We couldn t even start putting a dollar value on now being able to utilise our own internal people, to use their time in generating revenue and working on core business issues. That s almost as valuable [as the financial savings from the cloud]. Elasticity The promised on-demand up/down elasticity of cloud-based computing services was an important theme in practice. Most significant was the ability to quickly scale computing resources to match business growth while minimising downside risk (i.e. by preserving the ability to release resources if a new venture faltered or failed to get traction), as in the following case: We were very concerned that our business wouldn t be able to cope with the potential growth that was there going to the cloud enabled us to focus on the business, not on whether or not we could sustain the growth. The same applied at a lower level, with the ability to try new services and business ideas without having to worry about the scaling issues: [Capacity] is one less thing you need to worry about. Normally if you re doing an in-house application and want to expose it to more users, I d need to sit down and do calculations: how many users we re expecting, how many transactions, how much storage. [Now] there s a lot less risk. Once again, this accessing of elastic computing resources was only rarely done independently of the application. For the most part, businesses are simply increasing or decreasing their utilisation of a cloud-based business application. The hardware it runs on comes along for the ride and is rarely a consideration in its own right. Adopters used elasticity to indirectly improve customer and staff experiences by guaranteeing service levels (i.e. the extensive computing infrastructure owned by the service provider ensured service levels were sustained during big fluctuations in activity). Much of the public discourse on elasticity and cloud computing has focused on the opportunity to rent very large amounts of computing power on a very short term basis (e.g. 1,000 servers for 1 hour). This could, for example, be used to quickly execute a one-off computing task of great complexity, or to greatly accelerate responsiveness and transaction turnaround times for customers for the duration of a single promotion. Short term rent and release approaches like this, however, were not in evidence. Despite the more limited scale of computing resources on offer, organisations that had pooled their hardware internally also reported significant flexibility benefits in being able to reallocate internal computing resources in tandem with cyclical demands for different business applications. Previously the majority [of servers] were idling around 5 to 10 percent average utilisation. Now we re seeing 65 to 70 percent average load.

9 Cloud computing: Australian lessons and experiences Business agility All of these outcomes faster implementation times, the removal of complexity and elasticity in computing resources contributed to a much broader, and more important capability to implement business change more rapidly. Business changes required less consideration of installed technology, and could be implemented without the need for capacity planning or new technology purchases. More decisions could be taken without involving the IT department at all. Translated into business outcomes, respondents described the ability to open offices, move staff and operations around without compromising access to business systems, put new ideas into practice, and to meet new business requirements more quickly than they could do before. The following comment was typical: It s scalability and agility. [People] will be up and running in 10 minutes because the deployment cost is light, any additional revenue we earn doesn t attract a similar cost of IT associated with it. Cloud computing opened up more options to reorganise the business. One respondent commented that it was allowing his organisation to reduce its reliance on programming and to avoid dependence and lock-in to solutions from established solutions from companies like [vendor] for the next 10 years. Cloud computing was also allowing new ventures and business experiments to be undertaken with far less risk. [The cloud] enables us to scale big projects out very quickly and roll them back if necessary. All these advantages also translated into more rapid time to market for customer-facing activity. New services were built, and existing services adapted, more rapidly in response to feedback or changing customer requirements. In some cases the improvements were very significant, coming down from months to weeks or from weeks to days. Agility is an overused term in the IT industry, with countless claims of technologies conferring this attribute on organisations. In the context of cloud computing, however, it is a most appropriate word to describe the outcomes achieved. Many of the respondents felt that the use of cloud computing was directly translating to a more responsive, adaptive and competitive business. Mergers and divestitures At a higher level, respondents reported that cloud computing prompted more expansive thinking about where business operations and support functions were best located, including across international boundaries, and about what functions constituted core business versus functions that were better placed outside the boundaries of the organisation. In one case, the shift towards cloud computing was viewed as a strategic advantage for future mergers, acquisitions and divestitures. Management had already learned that the cost and time taken to integrate, or separate, IT systems was sometimes the difference between success and failure. The removal of complexity associated with their adoption of cloud computing for key applications was expected to make future mergers and divestitures considerably less costly, and easier to execute, thus creating more options for the future. The cloud fundamentally allowed us to change our value proposition.

10 10 Cloud computing: Australian lessons and experiences Product and service innovation As they learned more about cloud computing, decision-makers reported identifying opportunities to closely couple their own front end services to customers with the back end services they were renting from the cloud. This meant computing costs could be tied directly to customer and revenue based activity: We can let [customers] provision themselves over the Web eventually, so they can choose our offerings, pick the one they want, get billed on a recurring basis... In one case lower operational costs enabled by cloud computing had been passed directly on as lower prices to customers. Several organisations had progressed to building entirely new customer services on cloud platforms taking full advantage of the centralised data, easy scalability and Web accessibility. One respondent pointed to this as the most significant outcome of all for his organisation: The cloud fundamentally allowed us to change our value proposition. The benefits of using cloud platforms to build new customer services were seen as relatively greater when servicing widely dispersed (especially global) customer communities. Most of this activity was associated with organisations that were early adopters of Salesforce.com, and had progressed to building their own applications on the Force.com platform. It was frequently pointed out that the customer-centricity of the original core application made building customer services on the cloud platform, where they could be easily integrated with the back-end system, a natural progression. A few respondents had gone further and identified opportunities in externalising their own best-of-breed systems as cloud-based services, to be rented out to other organisations, including competitors, in the same industry, and in making accumulated information assets accessible as cloud services. None, however, had implemented on these plans. In all these cases cloud computing could be described as coming full circle as adopters became builders and providers of new cloud services (on the back of cloud platforms) in their own right. As one respondent put it: The organisation as a whole is now on a journey the business is in a transformation to move to an online delivery model for customers. This appears to be one of the natural end-points in the discovery process, and has been included on the right hand side of Figure 3. Collaboration Cloud-based applications were reported in 11 cases to be adding value by facilitating collaboration. This was happening at a number of levels. At the person-to-person level, cloud applications were making it easier for geographically distributed personnel to collaborate by offering a single data footprint (a single source of truth ) for calendars, s, documents and projects. Co-workers always accessed up-to-date information, could work on the same document or project simultaneously with others, and no longer needed to spend time sending, receiving, or synchronising. Anywhere around the world they ve got live, useful information. That for me is the most important aspect of [cloud computing]. One respondent pointed out the contrast in efficiency compared to the ingrained routines in many organisations where information is synchronised by all employees each day: they go to the office every morning, plug in their device, do a calendar replication or synchronisation, then go away with a synchronised calendar! Not surprisingly, this was a relatively stronger theme for global organisations with offices in many locations. Where cloud-based services were being used for front office customer applications, or were shared by organisations in the same value chain, the same benefits applied to collaboration with customers and trading partners. In this context, simultaneous real-time visibility to the same information, projects or transactions was even more valuable. Co-innovation The simultaneous and continuous visibility described above, coupled with the agility and service innovation outcomes described earlier, were observed to be facilitating a deeper type of collaboration with customers. Organisations that had deployed front office services on cloud platforms were reacting more quickly to customer activity. The customer feedback loop had, in effect become shorter. Similarly, adopters reported frequent interaction with providers of cloud applications and platforms, with a relatively higher degree of responsiveness compared to suppliers of on-the-premises computing solutions. Adaptations and enhancements, in response to customer feedback, were more frequent. Through these mechanisms cloud computing is fostering co-innovation, and accelerating the overall rate of innovation, for both customers and providers. Anywhere around the world they ve got live, useful information. That for me is the most important aspect of [cloud computing].

11 Cloud computing: Australian lessons and experiences 11 Part IV: Challenges and other themes What challenges are associated with trying to exploit the cloud? In this section we discuss challenges reported in practice, gaps between initial perceptions and real experiences, and how risks are shaping strategy and demand for onshore services. Security and resilience Respondents universally reported that security had been a critical concern in the initial phases of cloud adoption, and had prompted careful assessment. The use of a cloud provider was seen to introduce a potential risk if the provider was unable to provide adequate protection of commercially sensitive information, especially customer information. There would also be serious consequences if cloud providers failed to maintain adequate service levels or experienced service outages. Security concerns were also at the forefront of conversations with managers in organisations with an unknown adoption status. These managers almost all thought that the benefits of cloud computing were, at least for the time being, more than offset by the introduction of new threats, dependencies and exposures for their organisations. Such concerns were top of mind and clearly a significant barrier to adoption. Frequent questions and references were made to the risks of placing sensitive data with offshore providers, and highprofile cloud computing service providers being attractive targets for hackers and distributed denial of service attacks. After evaluating the security capabilities of providers, however, the management in adopting organisations had come to different conclusions. They typically articulated the security issue in relative terms. On the one hand there was a consistent message that on-the-premises computing was not always as secure as people believed. As one respondent put it: People are under the illusion that because it s sitting behind the company firewall its safe. On the other hand, they believed the key cloud service providers they were using had invested heavily in the infrastructure, skills and practices to maximise resilience to attack, and therefore were offering more security than they could build themselves. The same risks, in other words, existed in both scenarios, but they saw the risks as lower, on balance, under their cloud arrangements. Comments like this, from two different respondents, were common: We actually think our security has been improved as a result of [cloud computing]. I m fairly certain that we re getting a better service level through an on-demand platform like [vendor] than we would on an internally hosted application. Of particular interest here was that three organisations had gone further, with management employing cloud computing as part of a deliberate strategy to increase organisational security and resilience. They saw advantages in shifting computing away from homegrown facilities, which they considered an obvious target today, to in-the-cloud facilities that could be located anywhere, making it difficult, if not impossible, for attackers to identify. Using multiple cloud providers, each with secure computing facilities in different locations, reduced risk and provided additional disaster recovery capability. The key is both an offshore and onshore presence. We reduce our risk by having many sites there is no way of destroying the infrastructure. Contrasting views between adopters and non-adopters also characterised discussions of latency, integration and customisation. On each of these subjects, adopters reported that nonadopter fears were exaggerated, that their experiences in practice had been positive, and that their perceptions of suitable business applications for cloud computing had been expanded accordingly. People are under the illusion that because it s sitting behind the company firewall its safe.

12 12 Cloud computing: Australian lessons and experiences Latency There was a general recognition among adopters that there would always be a subset of applications (e.g. where very fast response time is especially critical, or where transactions would require rapid transportation of large amounts of data) where the cloud would be unsuitable because of latency issues. For those applications that they had adopted, however, latency of information moving back and forth over public networks had not caused problems. Depending on the geographic distribution of operations, and the time critical nature of applications, latency had sometimes been an initial issue, but this had never been insurmountable. Some organisations, for example, had found the need to rent access to local points of presence to resolve this. There were no complaints about latency issues with known providers, which seemed to be delivering on their promises and, by and large, to be improving service levels over time. Additional questions on this subject were asked of respondents in organisations using cloud based office productivity applications (i.e. for word processing and spreadsheet work), which would appear to have a relatively greater sensitivity to keystroke latency. Here latency was described as having been noticeable to end users when they first transferred across from on-thepremises applications, but respondents did not report ongoing concerns, and any issues were apparently not significant enough to inhibit further adoption. Integration Managers in organisations with an unknown adoption status consistently expressed reservations about the ability to connect cloud-based services with other applications, either in the cloud or on the premises. It was pointed out on more than one occasion that large organisations have hundreds of applications that need to be connected up, and a great many established processes that must be accommodated. Any cloud service that could not be properly connected into these systems would have limited value. Once again, however, respondents in adopting organisations reported good experiences in practice. Key cloud service providers had provided them with appropriate interfaces to integrate and exchange data with other systems, both on and off the premises. They would typically brush off integration concerns: [integration is] extremely straightforward you can integrate at the data layer or the service layer. Adopters also reported some advantages. Cloud providers tended to use Web-based standards for integration. Where the organisation had already undertaken work to make its on-the-premises applications comply with a service oriented architecture (an approach that typically prescribes consistent, Web-based standards for integration) this had proved to be helpful groundwork for integration with cloudbased services. We ve integrated our internal applications with our external applications using SOA and Web services Integration requirements had also naturally been reduced when organisations used cloud services to replace and rationalise multiple existing applications. Overall, the cost and complexity of integrating applications did not come across as significantly different in the cloud. This type of work continued to be time and labour intensive. Cloud based applications were sometimes considered easier to integrate than on-the-premises applications, but were not reported to be harder.

13 Cloud computing: Australian lessons and experiences 13 Customisation On the subject of customisation there was, once again, a strong contrast between perceptions of non-adopters and respondent experiences in practice. Many non-adopters thought that cloud computing represented a cookie cutter approach to business computing. The advantages, in other words, were predicated on cloud providers offering the same highly standardised service across all customers, with severely limited scope for modifications, new functions or customised workflows (essential elements in differentiating a business) lest these break the service model. Early adopters, however, told a different story. They reported having more than enough scope to customise workflows and connect cloud services with other business applications in unique ways. Extensive modifications did not appear to compromise any of the advantages of the cloud, and any modification limits were seen as no worse than those imposed by suppliers of on-the-premises software packages: We ll get the [cloud solution] upgrade every 6 months without touching a button [and] our customisations will work with those upgrades if we went for [on the premises vendor], the moment we start making the kind of customisations any business needs to make, you d lose their direct support. You d get upgrade risks, upgrade testing. In these organisations, managers had long abandoned the notion that the cloud would force any uniform approach in business computing. Furthermore, as we have seen, many of them were building their own bespoke applications on cloud platforms. Cloud platforms did reduce programming flexibility compared to developing software on-the-premises, from scratch, but this was seen to be more than offset by the advantages of removing all of the complexity of the programming environment from the organisation. Service provider maturity A universal theme was the wide variation in maturity of cloud services and service providers. All the positive experiences in security, service, integration and customisation described in the preceding sections were associated with cloud services that has been adopted and were still in use by the respective organisations. By definition, management had concluded that they were sufficiently developed, and backed by sufficiently trusted providers, for enterprise use. At the same time, all respondents, even those in the most aggressive cloud adopters, thought that many cloud services were wholly unsuitable for enterprise adoption. This was partly due to the gold rush effect. Hundreds of new service offerings were being launched and many were from new providers with no experience. Other providers had successfully provided self-service Web applications to individuals and small businesses, but still had everything to learn about servicing the needs of larger organisations. Variable results were also associated with some experienced and wellintentioned vendors, with long histories of dealing with big business. Their services, respondents noted, were sometimes little more than a hasty Webaccessible conversion of their flagship, on-the-premises software application, with insufficient attention to optimising the network access experience, and no offer of elastic, utility-based pricing. There was a powerful message that every provider had to be carefully evaluated, on a case by case basis, as captured in the following comments: [cloud computing] is not a winner on its own. It s who is providing the hosting services and what s behind the scenes. In my experience [provider] was a very motivated company. For this specific vendor I do [have enough confidence] they publish information about their storage and their security model and they also publish uptime statistics, so things like that give me a certain level of confidence. But I wouldn t have that confidence with any random vendor. For the larger organisations in the sample, cloud computing decisions merited the same detailed due diligence, and attention to risk management, as any other large-scale IT outsourcing arrangement. For the most part, respondents had been careful with their selections and had avoided trouble, but in pursuing their strategy to seek out cloud based options it was clear that some had taken risks when selecting suppliers. This had sometimes led to bad outcomes. In one case a manager described getting very poor support from a cloud service provider that, in his estimation (and despite the provider s claims), had really been set up to support domestic US customers only. In this case the provider had actually lost some of its customer s data, a scenario of which non-adopters are particularly fearful. The organisation, in this case, was forced to disengage and re-select an alternative solution. There were no other cases reported with that level of severity. Much more common was the acceptance of compromises in cloud services on the basis that a provider was making constant improvements and current limitations were expected to be addressed. A typical example was the acceptance of some limitations in the programming and debugging tools on cloud development platforms: Debugging is a real pain its really like you ve got one hand or both hands tied behind your back, trying to debug the old-fashioned way so that s a pain point. Issues like this one were viewed as minor annoyances that would eventually be addressed, and which were far outweighed by other advantages. In the above case rapid application development was reported to be delivering significant benefits. There was a general recognition that cloud computing was fast moving, that services were evolving and maturing, and that the learning curve for all parties made some compromises inevitable. Even the most aggressive cloud adopters thought that many cloud services were wholly unsuitable for enterprise adoption.