Basics. AITP Research and Strategy Advisory Group. February 2010

Transcription

1 CloudComputingbestpracticesandcapabilitiesareamovingtargetin Computing Basics termsofbasicconceptsandquestionstoask. today srapidlychangingenvironment.thecontentsofthiswhitepaper consideringcloudcomputingaspartoftheiritstrategyastartingpointin shouldbetakeninthatcontext.thegoalofthispaperistogivepeople PaulF.DittmannCo-Chair RichardBarnier,Co-Chair CharlesL.Brown,CCP PaddySrinivasan DeepakRao WayneJohnson AlChoyna PaulKoziel RayGloor commercialusegranted.whenthepaperisreferencedorquoted,directthereadertowww.aitp.org Copyright2010,AssociationofTechnologyProfessionals.Permissiontocopyforpersonalnon- madeupofforemostexpertsinthefieldandgoeswellbeyondwhatouraitpgroupcouldofferonits oncloudsecurity.asyou llnotefromtheir living WhitepaperreferencedinChapter4 theallianceis ExtraSpecialThankstoJimReavisandtheCloudSecurityAlliancefortheircomprehensiveongoingwork AITPResearchandStrategyAdvisoryGroup own February2010 Page1of27 AITP Research and Strategy Advisory Group February 2010

2 Table of Contents Chapter 1 - Evolving Business Models...3 Chapter 2 - Cloud Vendor Selection...7 Introduction...8 Before Looking at a Cloud Computing Vendor...8 Service Level Agreements (SLA)...9 SLA Vendor Example:...11 Commercial Terms...11 Vendor Openness...14 Skill Sets. Cloud Management Tools...15 Exit/Migration Strategy...15 Application support rd Party Tools and Applications...17 Chapter 3 - Business Strategies...19 Introduction...20 Benefits...20 Caveats...21 Opportunities...22 The Internal Cloud...23 Managing the Cloud...24 Candidate Applications...24 AITPResearchandStrategyAdvisoryGroup February2010 Page2of27 Chapter 4 -Cloud Security...26 Cloud Security Alliance White Paper December Bibliography...27

3 Theonlyconstantinbusinessischange.Thissectiondescribestheshifting Chapter 1 - Evolving Business not. newcomputingparadigmasbusinesscontinuestoevolve. Oritmay modelsforstoringandsharingdata.cloudcomputingmayresultina andchangingbusinessneedsthatresultinseeminglyendlesslyvarying Models DeepakRao AITPResearchandStrategyAdvisoryGroup February2010 Page3of27

4 mainframeandthencametimeshare,supportedbyprimitivepublicnetworking.asthecostof (roughly)50yearhistoryofcomputing.originally,everythingwascentralizedinanon-premise doseofbusinesssense.thetopologyofapplicationdeliveryhaschangedseveraltimesthroughoutthe Likethosebeforeit,CloudComputingisapromisingtrenddeservingattention,--balancedwithagood drivenbytechnologyadvances.eachresultedinamassivechangeininfrastructure,protocols, merelyfashionableinitiatives.eachrepresentedasignificantimprovementincomputingcapability, client/server,remotecomputingviatheinternetandfinally,cloudcomputing.thesechangeswerenot computersdecreased,centralizedminicomputersreigned.thiswasfollowedbydistributedpc-based requiringunderstandingoftheunderlyingtechnology.fromanorganizationalperspective,cloud connectivity,andhardware Fromaclientperspective,CloudComputingprovidesameansofacquiringcomputingserviceswithout helpimprovebusinessperformanceandcontrolthecostsofdeliveringitresourcestotheorganization. acquisitionanddeliverymodelforitresourcesand,ifproperlyusedwithinanoverallitstrategy,can scaleanddifferentiatedqualityofservicetofosterrapidinnovationanddecisionmaking.itisaservice Computingdeliversservicesforconsumerandbusinessneedsinasimplifiedway,providingunbounded withinnovativeideasfornewinternetservicesnolongerrequirethelargecapitaloutlaysinhardwareto moreattractiveasaserviceandshapingthewayithardwareisdesignedandpurchased.developers CloudComputinghasthepotentialtotransformalargepartoftheITindustry,makingsoftwareeven resources,orunder-provisioningforonethatbecomeswildlypopular,thusmissingpotentialcustomers provisioningforaservicewhosepopularitydoesnotmeettheirpredictions,thuswastingcostly deploytheirserviceorthehumanexpensetooperateit.theyneednotbeconcernedaboutover historyofit. hours.thiselasticityofresources,withoutpayingapremiumforlargescale,isunprecedentedinthe programscanscale,sinceusing1000serversforonehourcostsnomorethanusingoneserverfor1000 andrevenue.moreover,companieswithlargebatch-orientedtaskscangetresultsasquicklyastheir CommontermsintheCloudComputingvocabularyinclude: hostingmodel. availabilityofcomputingresourcestoanyoneonapayasyougobasisdeliveredthroughamultitenant Cloud:ThisisthemostcommontermassociatedwithCloudComputing.Itreferstothe Public virtualizationtodeliverondemandservicesinahighlyscalablefashion. singleorganization.anotherwayofthinkingaboutthisisacorporatedatacenterthatusesextreme ItutilizesthesamearchitectureforscalabilityandavailabilityasthepublicCloudbutisrestrictedtoa Cloud:Thisreferstocomputingservicesdeliveredfortheexclusiveuseofasingleorganization. Private AITPResearchandStrategyAdvisoryGroup February2010 Page4of27 Evolving Business Models for Cloud Computing

5 SaaS:Softwareasaserviceisthedeliveryofsoftwareapplications(CRM,ERP, ,collaboration, socialnetworking,etc.)throughthecloudinfrastructure.thekeyadvantagefororganizationsisthe Suite,Facebook,etc. WellknownexamplesincludeSalesforce.com,GoogleApps,MicrosoftBusinessProductivityOnline whichhasbeeninplaceforseveralyearsnowandmostapplicationvendorssupportthisinsomeform. usageofapplicationswithouthavingtodeployandmanagethemonpremise.thisisamaturemodel theeconomicsofitarewellunderstood.popularvendorsinthisspaceareamazon,rackspace,verizon. throughthecloudinfrastructure.theapplicationsthatutilizethesecomputingresourcesarestillowned IaaS:Infrastructureasaserviceisthedeliveryofcomputingresources(hardware,storage,networking) PaaS:Platformasaserviceisthemostrecentdevelopmentanditreferstotheavailabilityofapplication andmanagedbytheorganizationutilizingtheservice.thistoohasbeenaroundaseveralyearsnowand MicrosoftAzure,GoogleAppEngine,Force.com. deploynewapplicationswithouthavingtoinvestininfrastructure.leadersinthisspaceinclude developmentplatformservicesthroughthecloudinfrastructure.thisallowsdeveloperstobuildand Image:acustomizedvirtualserveroperatingsystemthatcanbedeployedtothecloud. 1.TheperceptionthatadditionalCloudComputingresourcesareavailableondemand,thereby Fromahardwarepointofview,threeaspectsarenewinCloudComputing. Machine 3.Theabilitytopayforuseofcomputingresourcesonashort-termbasisasneeded(e.g.,processorsby andincreasehardwareresourcesonlywhenthereisanincreaseintheirneeds. 2.Theeliminationofanup-frontcommitmentbyCloudusers,therebyallowingcompaniestostartsmall eliminatingtheneedforuserstoplanfaraheadforprovisioning. Theconstructionandoperationofextremelylarge-scale,commodity-computerdatacentersatlowcost thehourandstoragebytheday)andreleasethemasneeded,therebyrewardingconservationby lettingmachinesandstoragegowhentheyarenolongeruseful. thatcloudcomputingcanofferservicesatalowcost. locationswasthekeynecessaryenablerofcloudcomputing,forituncoveredfactorsof5to7decrease incostofelectricity,networkbandwidth,operations,software,andhardwareavailableatverylarge Anyapplicationneedsamodelofcomputation,amodelofstorage,andamodelofcommunication.The economiesofscale.thesefactors,combinedwithstatisticalmultiplexingtoincreaseutilizationmeans statisticalmultiplexingnecessarytoachieveelasticityandtheillusionofinfinitecapacityrequireseach thespectrum.anec2instancelooksmuchlikephysicalhardware,anduserscancontrolnearlythe oftheseresourcestobevirtualizedtohidetheimplementationofhowtheyaremultiplexedandshared. AITPResearchandStrategyAdvisoryGroup entiresoftwarestack,fromthekernelupwards.asaresult,amazonisplatformandapplication programmerandthelevelofmanagementoftheresources.forexample,amazonec2isatoneendof Differentutilitycomputingofferingsaredistinguishedbasedonthelevelofabstractionpresentedtothe February2010 Page5of27

6 AppEngineistargetedexclusivelyattraditionalwebapplications,enforcinganapplicationstructureof theotherextremeofthespectrumareapplicationdomainspecificplatformssuchasgoogleappengine. awellarchitectedcloudenvironmentcantakefulladvantageofamazon sautoscalingfunctionality.at agnostic.eventhoughreplicationandotherstatemanagementissuesarehighlyapplication-dependent, slightlymorefocusedonpythonandjavabasedapplicationplatforms(duetotheavailablesdksfor storageavailabletoappengineapplications,allrelyontheseconstraints.thegoogleappengineis impressiveautomaticscalingandhigh-availabilitymechanismsandtheproprietarymegastoredata cleanseparationbetweenastatelesscomputationtierandastatefulstoragetier.appengine s tothecommonlanguageruntime,alanguage-independentmanagedenvironment.thus,azureis theseapplications).applicationsformicrosoft sazurearewrittenusingthe.netlibraries,andcompiled WeshouldmentionthatAmazonnowstatesthatitisHIPAAcompliantandthatithasmanyclients runninghipaacompliantapplicationsintheircloud.amazonbasesitscomplianceassumptiononits intermediatebetweenapplicationframeworkslikeappengineandhardwarevirtualmachineslikeec2. serversandmanagementhypervisorsandatthispointamazondoesnotprovidethis. requirementsarethathipaaserviceprovidersmustprovideaudittrailsforaccessattemptstovirtual regardingtheircompliancesoyoushouldexercisecareifcomplianceisneeded.otherhipaa supportforencryptingdataintransitandatrest.however,therehasbeennolegalprecedence futurelooksverypromising.goodcandidatesinclude,mobileinteractiveapplications,parallelbatch WhilewehaveyettoseefundamentallynewtypesofapplicationsenabledbyCloudComputing,the Therestofthispaperwillexplorethefollowingtopics. processing,analyticsandextensionofcomputer-intensivedesktopapplications WhattolookforinaCloudComputingVendor SecurityconcernsofCloudComputing BusinessstrategiesguideapplicationsusedinCloudComputing AITPResearchandStrategyAdvisoryGroup February2010 Page6of27

7 Thissectiondescribesthefactorsthatarecriticalassessmentdimensions Chapter 2 - Vendor vendors forpickingtherightcloudvendor.thissectionexploresthevarious parameterssuchasslas,pricing,billing/metering,vendorlockinetcto Selection Althoughspecificcompaniesmaybementionedwhenproviding helpguidebusinessesmakeeducateddecisionswhileselectingcloud technologies,therearemanyvendorsprovidingcompetingsolutions,and others. bymentioningonecompany,wearenotrecommendingitaboveany examplestomakeapointoraspartofadiscussionofspecific AlChoyna PaddySrinivasan AITPResearchandStrategyAdvisoryGroup February2010 Page7of27

8 yoursolution,itisequallyimportanttoensurethattheotherparametersdescribedinthissectionare ThissectiondealswiththevariousaspectsofpickingtherightCloudComputingvendorforyour alsosatisfied. organization.ashardasitistoensurethatthecloudservicebeingevaluatedistherighttechnicalfitfor Introduction evaluationfactorsbeforepickingthecloudvendor. attempttodriveclarityaroundthemainaspectsofthecloudcomputingplatformthatarecritical consequence,therearemajorvariancesintheofferingsfromthedifferentvendors.inthissectionwe CloudComputingisatransformativeparadigmthatisstillinitsformativeyearsandasadirect connectivitybyincreasingtheirbandwidthandimprovingreliability(internetavailability)astheyturnto office(orremoteusers)internetconnectivity.manycompanieswillneedtoupgradetheirofficeinternet Onecriticalitemtorememberisthatacloudbasedserviceofferingwillgenerallyonlybeasgoodyour yourbandwidthneeds,includingtheestimatedbandwidthgrowthoverthefulltermofyourdata Storageservicesandsomeapplicationscanbeverybandwidthintensive.Makesurethatyouestimate relymoreandmoreuponcloudbasedapplications(saas/paas)andservices(iaas). andapplicationexperience. bandwidthcontracttoensurethatyourownnetworkwillnotbethebottleneckinyourcloudservices AITPResearchandStrategyAdvisoryGroup February2010 Page8of27 Before Looking at a Cloud Computing Vendor

9 Implementsomeformofofficeordatacenterbandwidthmonitoringtomeasureyournetwork Thismonitoringwillalsobeusefulformonitoringactualbandwidthconsumptiontomatchagainst availability(uptime)andbandwidthutilizationtoensureyouaregettingtheavailabilityandbandwidth estimatedcurrentandprojectedbandwidthconsumption. (MegaBitspersecond)thatyou vecontractedfor. SLAsareanessentialcomponentfordrivingforwardenterpriseadoptionofCloudComputing. AsCloudComputinggoesmain-stream,assessingthelevelofcommitmentfromtheCloudvendorisa criticalfactorintheprocessofdeterminingtheoverallfitofthesolution. Service Mostapplicationsdon thavetobeavailable24/7with59 suptime.inaperfectworldwewouldlike Level Agreements (SLA) trackrecordofavailability. themtobeavailablelateatnight,butthecostsassociatedwithproviding59 savailabilityremain prohibitiveforcompanieswithlessthan employees.iftheapplicationyou relookingto SLAsareessentiallycomprisedofthefollowingcomponents: implement/replacehasveryhighavailabilityrequirements,gowithalargercloudproviderwithagood Serviceguaranteesaretypicallythe%oftimetheserviceswillbeavailablefornormalcommercialuse. meansisthatamazonexpectsitsservicestobefullyfunctionalformorethan99.95%ofthetime.inits Forexample,Amazonprovidesaguaranteeof99.95%foritscomputeandstorageservices.Whatthis Guarantees WhilemanyCloudservicesareoffering %uptime,manyofthesecompanieshaveexperienced demandeda99.95%slaguaranteethusestablishingabenchmarkforthisevolvingindustry. recentcloudcomputingrfq,thegeneralservicesadministrationofthefederalgovernment coreworkinghoursintheu.s.thismustbeincludedinyourevaluationofacompany sprojected outagesofgreaterthan2-3hours(googleenterprise andsalesforce.comforexample)during vendor? IfandwhentheCloudservicegoesdown,whatarethefailoverproceduressupportedbytheCloud transitionfromthefailedinfrastructuretothenewone WaitandTwiddle Thisistheworstpossiblescenarioandsomecloudofferingsstillfitintothis mirroringofservicesovertootherservers.thiswillallowthebusinesstoseamlesslymakethe Failoverstootherservers:Inthebest-casescenario,thevendorshouldhaveautomatic AITPResearchandStrategyAdvisoryGroup categoryduetolackoffailovermechanisms February2010 Page9of27 availability. Disaster Recovery and Continuation of Operations Procedures ( CooP )

10 Somecloudvendorshaveverycomplicatedwaysofdefininganoutage,whilesomemaketheclient Forexamplelet slookatsomeiaasvendors; provetherewasanoutagebeforeacreditisgiven. Outage theoutage.amazonreservedinstancesdonotqualifyforcreditsregardlessoftheoutage. therewasanoutage,andmakeyoujumpthroughpaperworkhoopstodefineanddocument andautomaticallycalculatesandappliesthecredit. Somevendorsdefinetheautomated thatgetsgeneratedbythesupportrequestasaresponseto differs. Mostvendorsstatethattheywillrespondtoanissuewithin15minutes;butit showtheyrespondthat entirely. anissue.whentheyactuallygetaroundtodedicatingresourcestoresolvingtheissueisanotherthing guaranteesandfailoverplans ItisimportanttounderstandhowtheCloudVendorisplanningtocompensateforservicedowntime ofidentifyingandreportingoutages WATCH OUT FOR theoutagesaresubstantialtheycanaddup. beyondacceptablelevels. LookcarefullyatthecreditcomponentoftheSLA.Hopefullyyouneverhavetoclaimanycredit,butif Compensation Terms YouknowhowseriousacompanyisaboutitsavailabilityandSLAbythegenerosityoftheoutagecredit. Seehowmuchtheywillcreditfora1houroutage,foran8houroutage.Somevendorswillprovide1 dayofcreditsforeachhourofunscheduledoutage,someless. Amazonhasaverycomplicatedoutagedefinition.Theyplacetheonusontheclientforproving contactwithsupport),andthecreditwillonlybeappliedafteryouaskforit. 3Terraautomaticallyidentifiestheoutage(throughtheirmonitoringsystems),timestheoutage RackSpaceissomewhereinthemiddle;whereyouhavetoprovetheoutage(bygettingin Response SLAsshouldhighlightservice Demandtransparencyintheprocess AITPResearchandStrategyAdvisoryGroup February2010 Page10of27

11 SLA Vendor Example: Note:Anexampleonly,checkwithvendorsforcurrentSLAs Vendor Uptime Guarantee Compensation Amazon 99.95% Uptime Windows Azure 99.95% Uptime Google App Engine defined thecommercialtermsoftheofferings.thoughthisdependsonthetypeofcloudservicethatisbeing Commercial understandingofthecommercialterms,let sbreakitdownintospecificareasofinterest. evaluated,itisimportanttounderstandthedifferencesofthecommercialterms.forclearer OneofthefirstthingswhenitcomestoevaluatingaCloudVendorisgainingastrongunderstandingof Terms Introduction AITPResearchandStrategyAdvisoryGroup February2010 Page11of27

12 Servicesetc.Forexample,hereisabriefcomparisonofthepricepointsoftheplatformandstorage costsoftheleadingcloudproviders. PricingdependsonthetypeofCloudServiceinquestion.Forex:ComputePower,Storage,Platform Resource Unit Amazon Google Microsoft featuresetratherthanonusage.forexample,salesforce.comhasnumerousofferingsstartingfrom SoftwareasaService(SaaS)vendorshaveamoretraditionalpricingmodelwhichisbasedonamore Note:Anexampleonly,checkwithvendorsforcurrentpricing Outgoing bandwidth GB $ $0.17 $0.12 $0.15 Incoming bandwidth GB $0.10 $0.10 $0.10 Compute Time Instance Hours $ $ $ $ $125/user/month(andanevenmorecomprehensiveversionat$250/user/month). $5/user/monthforjustcontactmanagementatoamorecomprehensiveEnterpriseversionat Stored Data GB per $0.10 $0.15 $0.15 Storage Transaction Per 10k requests $0.10 $0.10 Therearetwomajorcategoriesofpackages: TypicallyCloudVendorsoffermonthlypackagestopromotethenotionofasubscriptionbasedlicensing. Packages 1.Monthlypayasyougo SubscriptionPackagesthatcannotbe ThisismoretypicaloftheInfrastructureandPlatformCloudvendors.Thismodelisattractivefor buildingandhostingapplicationsthatareseasonalorcyclicalinnature. Insistonabilitiestomeasure,monitor andrestrictmonthlyusagecharges amendedwhen#userschange Thisenablesthebusinesstorealizesubstantialsavingscomparedtobuildinginhouse 2.Monthlysubscriptionwithmultiyearlicenseagreements infrastructureandplanningforpeakcapacity. theircashflows.thepackageisusuallycomputedperuserpermonthandanannualdiscountis ThismodelispreferredbytheSaaSvendorsasitenablesthevendortodrivepredictabilityin applied.forex,salesforce.comoffersdiscountsformultiyeardealsformorethan50users. reasonablepredictabilityintheirworkforceprojections. Thismodelworksoutwellfororganizationsthathaveafixednumberofusersandhave AITPResearchandStrategyAdvisoryGroup February2010 Page12of27 Pricing WATCH OUT FOR

13 importantthatthecloudplatformprovidescomprehensivemeasurementcapabilitiesoftheresource Inscenarioswherethecustomerisexpectingtoconsumetheresourcesatasubstantiallevel,itis followinginformationinapseudorealtimebasis: consumption. Forexample,an InfrastructureasaService providerisexpectedtoprovidetransparentaccesstothe Measurability 1.Computeresourcesutilized 2.Storageutilization dashboardandprogrammaticaccesswhichwillenableintegrationwithothermanagementapplications IdeallytheCloudVendorshouldprovideaccesstothisinformationboththroughaselfservice 3.Bandwidthconsumption thatthecustomermightbeusingintheirenvironment. forconsumption APIs availablethroughdashboardsand WATCH OUT FOR SomeCloudVendorshavestartedprovidingfunctionalitywhichenablescustomerstospecificdailyand equivalent.thisfacilityisveryusefulfororganizationsthatareinpilotstageswiththecloudcomputing exceeded.forexample,thecustomercanmandateamonthlyusagelimitthattranslatesto$1000 monthlybudgetsforresourceconsumptionandfacilitiesforremedialactioniftheselimitsare factorsofinertiawhenitcomestocloudadoption.manycloudservicevendorshaverealizedthisand havefocusedresourcesonprovidingbettersecurityoptionsfortheirsystemsoverthelast12months. Complianceisaveryimportantrequirementformostbusinessorganizationsanditisoneofthemajor AmazonEC2forexamplehasimplementedVPNtechnologyintoitsIaaSofferingstoprovidethesecurity HIPAAandPCIcomplianceregulations. inachievingsas70typeiicomplianceinnovember2009;acriticalbenchmarkinconformingwithsox, EC2computecloudtojoinothercloudvendorssuchasGoogleApps,Rackspace scloudsitesandgogrid levelneededbymanycompanies.thisandothersecurityfocusedendeavorshaveenabledamazon s partyservicesmaybeabletohelpyoumeetsomeorallofyoursecurityneeds,suchasvpn-cubedby Evenifyourcloudvendordoesnotprovidethesecurityfunctionalityyouarelookingforcurrently,3rd cohesiveft. technologyandwanttolimittheirexposureandwanttobuildaslowonrampstrategy. Compliance Abilitytosetdaily/monthlythresholds ConsumptionStatisticsshouldbe AITPResearchandStrategyAdvisoryGroup February2010 Page13of27

14 Compliancecomesinmanydimensionsandlet strytooutlinethevariousrequirements: Howcanthecompanydemonstratetheeffectivenessofitscontrolsfor authorization,authentication,segregationofduties,programdevelopment, Arerecordsretentionandrecordsdestructionstandardsconsistentwithyour andprogramchanges? IstheAccesstodatasecure,encryptedandauthorized? Isthedatasegregatedfromothercustomer sdata? Compliance industry? Doyouhavecontroloverwherethedatawillreside?Canyouspecify? Records OneofthemaintenetsofCloudComputingisthenotionofmultitenancy.ThefabricofCloud Management tenants.differentvendorshavevaryingdegreesofmultitenancy.mostofthemhavevirtualization softwarerunningonthehardwarethatisolatesthehostoperatingenvironmentfromtheunderlying multipleapplications.thisistypicallyachievedbysharingtheinfrastructureamongmultipleclientsor Computingisitsabilitytoprovidemassiveinfrastructurebysharingtheavailableresourcesacross getaccessto isolationenoughinmostcases.thistypeofsetupmakesitnexttoimpossibleforrougeapplicationsto hardware.thisensuresthatthecustomeralwaysgetstheirprivateexecutionenvironmentwhichis WATCHOUTFOR fordataandapplicationportability. Vendoragnosticismisnotarealisticonebutitisimportanttounderstandthevendor sstrategytoallow Asthesearestillearlydaysofthecloud,standardsandopenintegrationofcloudsarestillininfancy stages.cloudofferingsareveryvendorspecificintheircurrentincarnations.havingagoaloftotal BusinesseswhoareevaluatingthisCloudVendorshouldinvestigatethefollowingparameters: Let sconsiderascenarioofacloudvendorwhoisofferingahumanresourcessaasapplication. Audit Trails Data Security Data Segregation Geographic Affinity Privacy Vendor Openness Introduction Factors AccesstoAuditTrailofallinformation AbilitytoSpecificGeographicAffinity AITPResearchandStrategyAdvisoryGroup February2010 Page14of27

15 Data Extraction policies determininghowavendor sofferingwillbeabletosupportyourgrowth. Everybusinessapplicationneedscustomizationinoneshapeorform.Thisneedstobefactoredinto databaserunningonacloud,interoperabilitymaynotbeaconcern.however,inspiteofeffortssuch Ifyourorganizationonlyneedsonecloudvendor,e.g.youhaveaselfcontainedapplicationand you. theindustry,onlylimitedprogresshasbeenmade.whenevaluatingcloudvendorsyoushould groupsasthecloudforumandthecloudmanifestowhichhavetriedtoencouragestandardizationin determinetheirpositiononinteroperabilityanddetermineifinteroperabilityislikelytobeanissuefor Whatskillsetsandtoolsdoyouhaveinhouse?Canyourorganizationmanagethecareandfeedingof cloudapplicationsordoyouneedhelp? that3rdpartymanagementanddeploymentservicecompaniessuchasrightscale,scalr,eucalyptus, uponeitherhasverygoodmanagementtoolstomanageyourcomputeinstancesandstorage,orensure Managingcloudinfrastructurecanbechallenging,somakesurethatwhichevervendoryoudecide etc.areavailabletoabstracttheiaasapilayerviaauserfriendlywebinterface. youriaassystemsregardlessofwhichsupportedvendortheyresideon. IfyouwishtousemultiplecloudserviceproviderstherearemanagementtoolssuchasDeltaCloudthat havearestapithatsupportmanyiaasvendorapi s,andwillgiveyouacomprehensiveviewofallof worse,youcan texportyourdataatall.justlikeanyothertypeofapplicationorsoftware,vendorlock Acloudservice(IaaS)orplatform(PaaS)maysoundperfectuntilonedayyouneedtomigrateand inissomethingtowatchoutfor. realizethatthereisnocosteffectiveoreasywaytomoveawayfromthatserviceorplatform,oreven AITPResearchandStrategyAdvisoryGroup February2010 Page15of27 Not all Vendors are equal in terms of costs or capabilities should you need to extract the data being stored there. Make sure you understand the process or processes available for extracting data in terms of costs, formats available, committed turnaround times and any other restrictions that may exist. It is your data. Make sure your vendor s contract recognizes that. Business Process extensions Interoperability Skill Sets. Cloud Management Tools Exit/Migration Strategy

16 toeasilymigrateyourapplication,platformorinfrastructuretoanotherprovider(lowercost,improved Vendorlockisafearforanycompany.Therearemanyreasonsthatasacompanyyouwanttheability platform.therearemanytoolsandprebuiltfunctionsthatcanbeutilizedtodramaticallyloweryour reliability,supportorsecurity,etc). Forexample,it sveryeasytoimplementafairlysimpleapplicationonsalesforce.com sdevelopment needtoscaleuptoapointwheresalesforce.comisnolongercosteffective,youwillhavetore-writea costanddevelopmenttime. HoweverifonedayyouwishtoaddsomefunctionalitythatSalesforce.comdoesnotsupport,oryou whowantstheirapplicationtocreateacompetitiveadvantageandintendstoswitchtoanother Thiscouldbefineforastartup,whoneedstobeupquicklyandcheaply,butnotfineforacompany majorportionoftheapplicationcodeinordertodoso. ThisisnotmeanttobenegativeaboutSalesforce.com;theyhaveanexcellentapplicationplatform. platform. platforminafewyearswithouthavingtoincurbigdollarstoredeveloptheapplicationonanother thenvendorlockinisaconcern.willmymachineimagerunonjustoneplatform?whatifiwishto We rejustusingthisasanexampletohighlighttheportabilitychallengesofsomeofthecloudofferings. Ifyou relookingtoutilizeavendor siaasofferingandintendtouseyourowncustommachineimages systemssuchas DeltaCloud thathavearestapithatsupportsmanyiaasvendorapis,andwill itwouldbeaburdentocreateandmanagesmultiplemachinesimages.thankfullyinthiscasethereare migratetoanotherplatform?eachiaasvendorhasit sownrequirementsandapineeds,andtherefore cannotonlyrunyour1machineimageonmanyclouds,butalsomanagethemallfromoneinterface. convert/migrateyourmachineimagesfromonevendorscloudtoanother.usingtoolssuchasthisyou product),ensurethattheinfrastructureofthevendorsupportsyourcurrentapplicationneeds. Ifyou relookingforsomewherenewtohostacurrentapplication(customdevelopedorcommercial session.mosthighlyavailableenvironmentshavemultiplewebserversandthereforewoulduseaload initiatedon,andthereforeneedstokeepgoingbacktothesameserverforeachrequestduringthe Forexample,manycurrentapplicationskeepsessionstateonlyonthewebserverthesessionwas Amazon sec2loadbalancerinstancefunctionalitycanonlyperformroundrobinloadbalancing,which servertomaintainthesessionusingthe stickysession loadbalancingparameter. balancertoensurethatalltrafficfromaparticularip,orcookieidwouldberoutedbacktothesame Theworkaroundforthisscenariowouldbetoeither: applicationwouldbreak. cannotensurethesamesessionwouldbehandledbythesamewebserverinstance.thereforethe AITPResearchandStrategyAdvisoryGroup SpendtheextramonthlycosttouseacustomAMI(AmazonMachineImage)thatcanperform February2010 sticky loadbalancingusingcommercialsoftwaresuchas zeus ortheopensource haproxy. Page16of27 Application support

17 EitherwaytheseworkroundswilladdcosttodeployingtheapplicationonAmazon.Thisissueisn t Amazon ssimpledb)tohandlesessionstate. Re-engineerthesessionmanagertomakeuseofdatabasesessionmanagement(suchas toensuretheirinfrastructureisfullycompatiblewiththeapplicationsyouintendtorunfromallaspects. Thelessonhereisdon ttakeanythingforgranted.bedetailorientedwheninvestigatingiaasvendors uniquetoamazon. Youmayfindonevendorthatalmostfitsyourneedsperfectly.Don tthrowyourhandsinfrustrationat Astechnologiesmatureandthesophisticationofeachcloudsystemriseseachyear,therewillbemore thatonelittlegotcha(whateveritmaybe).withabitfurtherinvestigationyoumayfinda3rdpartytool 3rdpartyserviceprovidersthatwillofferyouwithcuttingedgeoptionstohelpyoumanageandsecure orvendorthatwillhelpyoufillthatgapandhelpcompleteyourcloudimplementation. Party Tools and Applications yourcloudimplementationsbetter,andhelpfurtherloweryourtco. foryoursituation. weaknessofthevariousoptions.it suptoyoutodeterminewhichcharacteristicsaremostimportant Thatdependsonyourparticularcomputingneeds,butthefollowingcomparesthestrenghtsand Which Computing Environment is Right for You? Cloud Computing Risks AITPResearchandStrategyAdvisoryGroup February2010 Page17of27

18 Cloud Computing Platform Strengths AITPResearchandStrategyAdvisoryGroup February2010 Page18of27

19 opportunitytolowertheircostsandincreasetheirproductivity?we ll Chapter examinereal-lifeexamplesinthissection. computinggamedramaticallyandforever.howcanbusinessesleveragethis Newcomputingcapabilitiesandhugebandwidthavailabilityhaschangedthe 3 - Business Strategies ChuckBrown AITPResearchandStrategyAdvisoryGroup February2010 Page19of27

20 Forbusinessandgovernment,thecoreofthe CloudComputingRage laysanage-old(oratleastit-old) generallyincorporatescombinationsof SoftwareasaService(SaaS),PlatformasaService(PaaS)and Webhosting rolledintoone.italsocomeswiththesamebenefitsandcaveatsthat,ofnecessity,drive searchforthe PromisedLand cheapcomputingpower.it s TimeSharing and Outsourcing and InfrastructureasaService(IaaS).Whatthisreallymeansis: ITmanagementtotakeahardlookatmorecomputingforlessmoney.TheCloudComputingconcept CanIbuyan XYZ package(e.g.payrollor )andhavesomeoneoperateandsupportit havesomeoneoperateandsupportitwhilemycompanyusesit? CanIbuyasetofhardwareandsoftware(e.g.softwaredevelopmentordisasterrecovery)and CanIbuydatacenterandnetworkservices(e.g.anti-virusprotectionordiskstorage)andhave today sbusinessclimate. Thereisnothingnewhere,exceptthetechnology andthetechnologyiscentraltotheproposition.as ITexecutivesandmanagersconstantlystrivetocutcostandimproveservice,CloudComputingoffersa newopportunity,withmanybenefitsandmanycaveats,andavarietyofsolutionsthatareimportantin Then,wecanexploremitigationofrisks.Determiningthe opportunities forapplicationsandplatforms Regardlessofcompanyorgovernmentagencysize(amultinationaloranationtoastartupora canthenbeconsidered. andgreen.allthisisboundedbyregulatorycompliance.first,we llexplorethebenefitsandcaveats. MayberryRFD ),thedriversofthetwenty-firstcenturyarethesame:cheaper,faster,morereliable ThebenefitsofCloudComputingrevolvearoundthoseofpreviouscomputinggenerations,primarily systems,forexample,maynotbeamplyprovidedforinthecloudenvironment,butmanywill. applicationwillfitintothecloudcomputingconstruct.mission-criticalandbusinessintelligence ensuringanorganizationhasaniron-cladcontractandcantrustitsserviceprovider.notevery Benefits Cloudtechnologyispaidincrementally,savingorganizationsmoney.Costsforserverandapplication acquisition,construction,deployment,andoperationarereduced,alongwithpower,airconditioning andspaceplanning. AITPResearchandStrategyAdvisoryGroup February2010 Page20of27 Introduction Reduced Cost