Cloud. Seven key questions answered about G-Cloud adoption. Enabling a Platform for 21st Century Service Delivery. Whitepaper.

Transcription

1 Optimise IT Enabling a Platform for 21st Century Service Delivery Whitepaper Cloud Seven key questions answered about G-Cloud adoption Author: Rhys Sharp, Public Sector CTO Date: August 2012

2 Contents Introduction 3 Cloud computing: a brief overview 4 - Essential Characteristics - Service Models - Deployment Models What do I need to know about Information Assurance and the Cloud? 6 - Pan-Government Accreditation: a security guarantee - The Code of Connection: ensuring communications security - Data Aggregation: preserving information safety at high volume - Selecting the right security level at the right price - Reputation Management: gaining strength through collaboration Where do I look for the Cost Savings from Cloud? 8 - Exploiting New Financial Models - Benefiting from Shared Resources - Pooled Security Savings - Reduced Operational Costs - Refocused IT staff Fully accredited Flexible Scalable Shared Pay as you go Secure Sustainable UK based Available now How can a Cloud environment deliver greater flexibility? 10 - Greater Speed to Deployment - Reduced security overhead - Capacity Flexibility - Virtualisation - The end of long-term term contracts Is the Cloud more sustainable than a traditional infrastructure? 12 - The Efficient Data Centre Will Cloud allow access to the innovative solutions of the SMEs marketplace? 13 Who needs to be involved in selecting a Cloud solution? 14 - Infrastructure as a Service (IaaS) - Platform as a Service (PaaS) - Software as a Service (SaaS) Are there Cloud services I can buy today? 15 2

3 Introduction Over the course of 2007/2008, the UK Government looked on as a new generation of Cloud computing services matured to provide the commercial sector with a family of IT solutions that were cost-effective, easy to consume, offered great agility and delivered excellent levels of service. Whitehall recognised that in government the ICT environment was typically slow to change, hard to use, expensive to deploy and dogged by a legacy of high-profile failures that made headlines across the European media. It was apparent that the public sector needed a new way forward, and the Cloud was quickly identified as the most logical route. Pinpointing the need for a framework of Cloud services specifically for public sector use, in October 2009 the government began a major consultation exercise, seeking perspectives from a broad spectrum of the IT supply sector. Companies ranging from enterprise-scale system integrators to tiny SMEs got involved in an effort to find innovative and agile ways of delivering civic solutions, a key strategic tool that had been missing for many years. At that moment, the concept of the Government Cloud was born. Often shortened to G-Cloud, the term is now widely used to reference any capability or service specifically delivered via Cloud computing for the public sector. This paper is the outcome of one company s journey from concept stage to delivery of a G-Cloud platform designed specifically to address the requirements of the UK Government s ICT strategy. It s purpose is to assist public sector managers in ensuring they are aware of the relevant factors and issues that must be considered when planning the migration to Cloud services. Enabling the best value combination of Cloud choices 3

4 Cloud computing: a brief overview As is often the case with new concepts, Cloud is a term that is currently used to describe a vast array of technologies and services. It means many things to many people, so it is always useful to have a common set of terms that can be understood by all when discussing technical solutions. Probably the best description of the various components of Cloud solutions today comes from the National Institute for Science and Technology (NIST). The institute s Cloud model is divided in to three distinct areas: Essential Characteristics Service Models Deployment Models Essential Characteristics The essential characteristics are really what defines a Cloud, and whilst these attributes are typically exhibited by the large Cloud service providers, they are also increasingly being applied to internal systems, effectively turning in-house IT resources into mini Clouds in their own right. The essential characteristics are: On-demand self-service o Service consumers can upgrade or reduce their computing capabilities 24/7 Broad network access o All applications and services can be accessed over a network using standard protocols Resource pooling o Computing resources are pooled to serve multiple consumers, using a multi-tenant model to drive efficiencies Rapid elasticity o Capabilities can be flexibly provisioned and released in line with demand, in some cases automatically Measured service o Cloud systems automatically manage and optimise resource use by using metering to provide a pay-as-you-go philosophy 4

5 Service Models The service models for Cloud describe the layers upon which Cloud solutions are built, dividing into a trio of as a Service areas. Infrastructure as a Service (IaaS). The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying Cloud infrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls). Platform as a Service (PaaS). The capability provided to the consumer is to deploy onto the Cloud infrastructure consumer-created or acquired applications created using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment. Software as a Service (SaaS). The capability provided to the consumer is to use the provider s applications running on a Cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based ), or a program interface. The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user- specific application configuration settings. Source: nistpubs/ /sp pdf Deployment Models Private Cloud. The Cloud infrastructure is provisioned for exclusive use by a single organisation comprising multiple consumers (e.g., business units). It may be owned, managed, and operated by the organisation, a third party, or some combination of them, and it may exist on or off premises. Community Cloud. The Cloud infrastructure is provisioned for exclusive use by a specific community of consumers from organisations that have shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be owned, managed, and operated by one or more of the organisations in the community, a third party, or some combination of them, and it may exist on or off premises. Public Cloud. The Cloud infrastructure is provisioned for open use by the general public. It may be owned, managed, and operated by a business, academic, or government organisation, or some combination of them. It exists on the premises of the Cloud provider. Hybrid Cloud. The Cloud infrastructure is a composition of two or more distinct Cloud infrastructures (private, community, or public) that remain unique entities, but are bound together by standardised or proprietary technology that enables data and application portability (e.g., Cloud bursting for load balancing between Clouds). Source: nistpubs/ /sp pdf Of the four deployment models, this paper focuses on the Community Cloud model because by definition that is what the G-Cloud is - a Cloud infrastructure designed for the exclusive use of a specific user community, the public sector, and tenanted by organisations with shared requirements, like government data security, and concerns. Enabling the best value combination of Cloud choices 5

6 What do I need to know about Information Assurance and the Cloud? Any government organisation considering Cloud technology as a component of its ICT solution must first address the critical issue of Information Assurance, Security and Data Sovereignty. With the security and integrity of information paramount, the G-Cloud framework has been largely defined by strict requirements for safety, stability and resilience. It is subject to a range of Information Assurance compliance guidelines regulating connectivity, community structure and many of the technical elements supporting service delivery. In order to ensure best practice is followed when approaching information security, any public sector Cloud solution must successfully address five key issues: Pan-Government Accreditation: a security guarantee Cloud service providers must undergo a rigorous accreditation process in order to provide the right level of assurance to government customers. Testifying that the correct levels of security and governance are in place for the requisite Business Impact Level (BIL), these assessments are conducted and monitored by the Communications and Electronics Security Group (CESG). The CESG standard is a pan-government accreditation, meaning that any public sector department may use any solution as long as it has a BIL rating appropriate to the project or function under consideration. The Code of Connection: ensuring communications security There are two key players in the Cloud computing environment; the provider that hosts and maintains the accredited service and the network over which users connect to it. In order to ensure that accreditation rules are not broken by their network, government bodies must ensure they use a service compliant with the Government s Code of Connection. A set of regulations laying out strict conditions on security standards, it ensures that the integrity of functions with specific BIL ratings is not compromised at either end of the operation. Existing government networks such as the GSi, GCSX and the Public Sector Network (PSN) all adhere to a Code of Connection, enabling both providers and consumers to work in an environment where Information Assurance levels are both trusted and sacrosanct. 6

7 Data Aggregation: preserving information safety at high volume As consumption of a Cloud service grows it may become subject to the third Information Assurance dynamic data aggregation - which can increase the levels of security accreditation required by the services supporting it. Public sector organisations likely to encounter this situation need to ensure that their Cloud service provider has given careful consideration to the architecture needed to support any increased security requirements. In some cases data aggregation may result in a scenario where different layers of infrastructure may conform to varying levels of security, driving the requirement for a complex, strategically planned approach. Selecting the right security level at the right price As organisations begin to understand the relative costs of Cloud services delivered at each security level, they need to put in place policies designed to optimise their budgets. By ensuring that every function is hosted at the security level required of it and no more, departments can effectively minimise their infrastructure spend. In SCC s experience, many public sector bodies fail to do this, often securing everything at the highest level. While this may be comforting, paying for additional security around data that does not require it has an unnecessary inflationary effect upon the public ICT spend. The process of moving data and systems to the Cloud should include a detailed assessment of the compliance requirements surrounding it to ensure the most appropriate and cost-effective level of security is bought. An additional benefit of this type of assessment is that duplicated data is frequently identified, further reducing storage costs, as the capacity required is better understood. Reputation Management: gaining strength through collaboration The power, scalability and utility of the G-Cloud is founded on a philosophy of allowing government bodies to work with multiple gold-standard providers. Creating solutions that draw upon the best available technology to address specific departmental requirements, these partnerships are key to delivering effective operational and public services. Confidence is a key component of successful collaboration, and public sector bodies should have complete trust in any third-party service provider. Their reputation should be staked on maintaining a secure, accessible Cloud service because to a certain extent, their customers public image is also on the line. G-Cloud service providers should also be assessed on their ability to work with multiple customers, as this is a key factor in achieving the Cloud s potential efficiencies. It is precisely because multi-tenanted systems host many customers that they can afford to invest in more expensive and sophisticated technology, reducing costs for each organisation and providing access to an infrastructure superior to anything they could individually afford. The long-term performance and security offered by a Cloud solution could therefore be directly relative to the size of the community using it, and planners should make this a factor in any strategy. Enabling the best value combination of Cloud choices 7

8 Where do I look for the Cost Savings from Cloud? While driving down costs is a prime motivator in the move towards Cloud services, reduction in overall IT spend can be measured in many different ways. The move from capital expenditure to operational expenditure in itself amounts to adopting an alternative financial model, while the fact that solutions are typically shared by many customers means that each optimises their spend, paying only for the precise amount of resource they consume. Organisations should consider four potential areas in which cost savings can be generated: Exploiting New Financial Models Because Cloud solutions are sold as a service, any charges are classified as operational expenditure, effectively setting them apart from traditional projects where hardware, software and implementation costs must be met up front. Operational charges can take on a multitude of forms. Many Cloud software (SaaS) solutions are sold on a per user per month basis, and this is particularly appropriate for reducing any budgetary waste consuming services like , where it is clearly understood how many users an organisation has connected to a solution. However, organisations also need to consider that as Cloud software becomes more pervasive, there will be alternative billing models such as paying per transaction or by the total resources consumed. These models are likely to be more appropriate where transactional applications are being used and the number of users may fluctuate by the day or hour. Another significant benefit of Cloud delivered solutions is they are typically billed on a pay as you go (PAYG) model where resources costs may fluctuate as demand for hardware or software changes. This model can make seasonal changes in ICT consumption very efficient, allowing systems to expand and contract on demand, optimising expenditure and eliminating the need to buy enough hardware for peak levels, leaving it idle for the rest of the time. Benefiting From Shared Resources In order to make the most of the systems that deliver the Cloud, a G-Cloud service provider will architect the solution to allow the pooling of resources, maximising economies of scale. It is the shared environment in which servers and storage in the IaaS layer exist that defines SCC s name for it s G-Cloud platform Secure Multi-Tenanted Cloud (SMTC). Multi-tenancy can also be achieved at the software layer, further improving the efficiency of the solution, such as when a single mail solution allows multiple customers to use the same software costeffectively. By using shared hardware resources coupled with the extensive use of automated technologies through an optimised service provider, government organisations can access considerable savings. The existence of open markets on G-Cloud like Cloudstore also ensures that vendors are compelled to constantly seek ways of ways improving solutions and increasing automation in order to remain competitive. 8

9 Pooled Security Savings Deploying a traditional on-premise or private solution in the public sector can become very costly to build and secure due to the multitude of accreditation requirements set down in the Code of Connection and BIL regulations. By pooling security resources and securing pangovernment accreditation for the IaaS platform, there are now significant savings to be achieved around the deployment of software. SCC estimates that dividend to be close to 70% of the cost of accrediting a solution, with additional efficiencies to be gained from an accelerated project completion time. This saving also has a positive impact upon SMEs, allowing them to reduce their accreditation costs and more easily sell the solution to government. In turn, this enables state departments to work with a wider range of suppliers, accessing a market where a wider array of services is available at even more competitive prices. Reduced Operational Costs Organisations should also look to derive significant cost benefits from the move to a Cloud environment. With the infrastructure maintained externally and no longer the direct responsibility of the internal IT operations team, resources can be redirected to focus on projects that deliver greater value to the organisation. The cost of operations can be further reduced as different levels of Cloud solution are bought. With IaaS platforms there will still be the need for technical knowledge and an operational capability, but no requirement for hardware skills. At the PaaS level there is no need to be concerned with operating systems and complex architectures, while with SaaS all operational considerations are removed from the buying criteria. This reduces the IT burden on organisations to the alignment of business processs with software capability. Undoubtedly the most efficient way of using ICT, all activity is focused on what really matters - the effective and robust provision of core services. Refocussed IT Staff While some in-house IT departments have expressed concerns over the potential impact upon jobs of handling infrastructure management and maintenance externally, experience so far suggest such fears are misplaced. More typically, the removal of this burden frees up staff to concentrate on developing advanced, bespoke solutions designed to improve organisations unique operational processes. The Cloud is indeed forcing the IT role to evolve, but it is just one of a number of drivers for change. Advances in mobility are presenting today s technical support teams with a raft of challenges, as is the social media phenomenon, and these developments are highly likely to be in turn supplanted by a whole new set of issues when the next breakthrough technologies emerge. A large proportion of the IT department s work is therefore already spent on managing change, and the Cloud is unlikely to alter that. Organisations preparing for migration to the new platform can begin to start proactively carving out new areas of expertise, establishing the skills required to implement new security policies to address issues such as those raised by the rise of social media and the explosion of mobile devices within the workplace. IT s role won t disappear, but it will be different.with a proliferating range of automation processes now replacing an array of old computing skills, departments will become more business-savvy - focusing on the commercial elements of comparative applications rather than the technical ones - while evolving to create new skill sets designed to maximise the security and impact of the Cloud platform. Enabling the best value combination of Cloud choices 9

10 How can a Cloud environment deliver greater flexibility? While improving the flexibility of its ICT infrastructure has been a major public sector goal for some time, many organisations have been hamstrung by existing infrastructures that have evolved over time. These systems have typically become difficult to develop or upgrade with the latest technologies, while many of the technical solutions in use have not kept pace with the innovations that have made commercial systems much simpler to upgrade. G-Cloud provides a means by which these legacy issues can be swept away, providing five critical benefits capable of radically improving the flexibility of an organisation s infrastructure. Greater Speed to Deployment Improving the speed at which software solutions can be deployed can have significant impact on any organisation, enhancing business process, accessing new markets and improving customer interaction. The flexible nature of Cloud solutions means that new capabilities can be deployed quickly and easily using the very latest solutions and techniques. Reduced security overhead Another significant factor impacting upon the delivery of new capabilities within public sector computing is the overhead of cumbersome security. While it should always be recognised that security plays a critical role at the heart of any government ICT project, pre-built solutions effectively remove this barrier. It is anticipated that up to 70% of the cost and time associated with accrediting a software Whereas in the past the public sector has earned a reputation for the slow delivery and high cost of ICT projects, Cloud platforms offer an alternative that can speed delivery through flexible infrastructure, the latest software tools and the re-use of standardised software matched to best practice process. It is widely predicted that adopting this approach will be a key driver behind a major shift in the capabilities and reputation of the public sector s approach to services delivery. solution may be removed when utilising a Pan- Government accredited IaaS. While this means that solution delivery becomes faster and cheaper for the customer, the reduction in security overhead does not come at the expense of lowering its capability. Quite the opposite occurs, with Cloud service providers often deploying significantly better security capabilities that organisations do internally. 10

11 Capacity Flexibility Cloud infrastructures offer unprecedented capacity flexibility at all levels of adoption. With variants including the so-called Burst and Elastic approaches, these systems allow for the customer to easily consume additional resources - either automatically or on request while also releasing unused capacity to ensure that solutions remain efficient and costs optimal. SCC designed its SMTC solution to offer both bursting and elasticity. When an application is deployed each virtual machine is able to automatically burst to consume more resource if it is available. When those limits are exceeded additional resource can be requested (elasticity), and when not required is either released or switched off. A major advantage of this mechanism is that it allows organisations with seasonal or periodic fluctuations in the amount of ICT resource to consume only what they require, operating at minimum capacity when appropriate to reduce the burden created by over-resourcing. Virtualisation The flexibility offered by Cloud is predominantly due to the use of virtualisation technologies, and whilst G-Cloud may be the ultimate destination for the deployment of ICT services, getting there will be a multi year journey. One common starting point for public sector bodies moving to the Cloud will be the physical infrastructures of servers and storage, and the first stage of the journey is to virtualise the physical servers each organisation has. By doing so, the movement of those virtual servers from the existing infrastructure to a Cloud-based one becomes significantly easier to accomplish. Organisations would do well to consider their readiness for this. Although VMware has a 95% penetration of its server virtualisation technology in large enterprises today, research shows that those operations have only applied it to an average of 50% of their servers. The end of long-term term contracts Restrictive long-term service deals have often been accused of stifling innovation and an organisation s ability to deploy new or revolutionary new technology. Multi year contracts - often in excess of five years are traditional in the public sector, and these can prevent significant change taking place. The Cloud platform changes that position, with providers typically offering minimum contract terms by the month, hours or even minutes. This flexibility means that organisations can move solutions from one Cloud service to another when appropriate without the fear of being financially penalised. In this model the consumer can easily consume new innovations whilst the suppliers are incentivised to maintain the introduction of fresh initiatives in the market. Enabling the best value combination of Cloud choices 11

12 Is the Cloud more sustainable than a traditional infrastructure? With environmental sustainability high on the public sector agenda, no organisation can afford not to consider the merits of migrating to the Cloud. Cloud computing drives the efficient use of ICT and, in turn, the efficient use of resource results in more effective use of power. Locating servers and storage in a modern, energy-efficient data centre can boost these savings even further. There are also additional sustainability advantages to be gained from using the technology to mobilise staff and enable practices such as home working thus minimising the environmental impact of commuting and business travel. The Efficient Data Centre This paper has already discussed the manner in which shared infrastructure, multi-tenancy and virtualisation all contribute to the efficient operations and reduced hardware footprint of Cloud computing. All of these factors will lead to a reduction in the consumption of energy on a per-customer basis, but these benefits are further amplified when the servers and storage exist in an energy-efficient data centre. The latest data centres are typically designed with efficiency in mind, the key challenge being improving the efficiency of cooling the servers while keeping overall energy consumption down. Despite hardware manufacturers efforts to reduce power consumption and heat generation, the servers and storage used still output significant amounts of heat that needs to be removed and replaced with cold air to maintain efficient running. There are now many proven techniques for removing that heat but most are typically either too hard or impossible to deploy retrospectively, putting them beyond the reach of by many organisations. SCC recognised this problem when it opened its latest data centre in October At the core of a highly efficient complex is a system called free air cooling, which drastically reduces power consumption whenever the ambient temperature outside is below 12 degrees centigrade - a common occurrence in Birmingham, UK. Other techniques have also been used to impact the overall sustainability of the SCC data centres. Each is fed from a green energy electricity tariff to support the expansion of sustainable power generation in the UK, which while more expensive will contribute to longterm benefits that will be delivered back to the community as more clean energy becomes available. The final area to consider in sustainability relating to the Cloud provider is that of carbon offsetting and the quality of the offset used by the provider. Carbon offsetting is often seen as a trivial solution to reducing overall carbon footprint but there are different grades of offset available, with Gold Standard being the highest rated as they offer the best long-term sustainability future. By embracing all of these sustainability techniques SCC gained the Green Grid Award for Sustainability 2011 at the Data Centres in Europe Awards. 12

13 Will Cloud allow access to the innovative solutions of the SMEs marketplace? It is a stated strategy of the public sector to engage more with the SME business community, enabling it to take advantage of much of the innovation that originates from that business sector. However the challenge has always been that it is often expensive for companies to bid for Government work, and the terms and conditions are often too onerous for smaller firms to consider viable. Whilst the G-Cloud Framework and Cloudstore have opened up the market for the SME community in terms of making it less expensive to enter the market and providing a medium through which products can be sold, there are still some technical and governance barriers that are hard for the SME to address. SMTC and the fact that it is Pan Government accredited is a big step forward in addressing those issues around the technical and governance aspects that have to be looked at for any software solution that the Public Sector will consume. SCC, a company that was once an SME itself, has a long track record of enabling small companies to transact with government by shouldering some or all of the bidding costs and reducing the burden of some of the more onerous terms and conditions. Bringing together technical capability and commercial willingness, the SMTC platform now offers an ideal solution by which the Public Sector can consume risk free, well governed but innovative solutions. Delivered on an infrastructure operated by a big company, but propelled by the enthusiasm offered by the SME sector. Enabling the best value combination of Cloud choices 13

14 Who needs to be involved in selecting a Cloud solution? When buying into a Cloud platform, the decision needs to come from across the organisation, and should not necessarily be driven by the ICT department. Stakeholders need to consider carefully what their future requirements will be, remaining aware that the process may lead to a reduced requirement for in-house technical support. Infrastructure as a Service (IaaS) IaaS is a highly technical solution that still requires professional expertise to implement internally. As such, the decision to purchase this sort of Cloud capability would typically reside with the ICT department as they will be involved in some of the configuration and on-going operations, Finance will also need to be involved however, as by moving to a Cloud platform there will be a shift from capital expenditure (CAPEX) to operational expenditure (OPEX) which can have significant implications on finances. This shift may also instigate a move towards the chargeback of ICT services to individual departments as the granular level of accounting information need for that model will become available. Platform as a Service (PaaS) PaaS is only really used by developers, so is an area where the primary decision to purchase would come from the development team. As with IaaS, however, there will be a requirement to involve Finance departments in the shift from CAPEX to OPEX and possible move to the chargeback of ICT services. Software as a Service (SaaS) Given the requirement to improve operational efficiency or communication with customers, decisions on SaaS are typically made by business units or departments, without the need to consult ICT. A key area that will need to be involved however will be Information Assurance and Governance - usually the Senior Information Risk Officer or SIRO - who will need to be in a position to assess the suitability of the Cloud platform for the data the department is intending to use. 14

15 Are there Cloud services I can buy today? The Cloud marketplace is simultaneously both maturing and expanding rapidly. For the public sector this process is being driven by G-Cloud s Cloudstore, providing a platform through which organisations can find and compare the various services provided by the supplier community. While there are a wide variety of solutions available in the public Cloud space, with multiple solutions for most business processes and requirements, these pose many challenges to government bodies. The first hurdle is in the Information Assurance challenges, raising questions over what level of security is available and where the data is held. Then there are the specific requirements around business processes, which are typically different to those in the private sector. Cloud services designed specifically for Government are limited, but the market is growing. As more solutions become accredited they will become available to the public sector who will have the confidence that they comply with the right levels of Information Assurance. SCC s SMTC will be one of the first such solutions and will be followed by a roadmap of further accredited capabilities scheduled to expand over time, delivering a new generation of solutions specific to the UK public sector. Public sector organisations entering this market must bear in mind that these services should only be deployed where appropriate. The ICT industry always does an excellent job of building a great story around new technology, but it should be recognised that despite its multiple benefits, the Cloud might not always be the best solution. Enabling the best value combination of Cloud choices 15

16 Scan to access SCC s latest Cloud news within the Public Sector James House, Warwick Road, Birmingham, B11 2LE Tel: +44 (0) optimisecloud@scc.com Web: 16 Copyright Copyright SCC. SCC. SCC, SCC, the SCC the logo SCC and logo OptimisedCloud and OptimisedCloud are registered are registered trademarks trademarks of SCC. of SCC.