CLOUD COMPUTING GOVERNANCE ASPECTS LEVELS OF ABSTRACTION: IAAS, PAAS, SAAS AND CLOUD GOVERNANCE ASPECTS. Petruch, K., Stantchev, V., Tamm, G.

Transcription

1 Petruch, K., Stantchev, V., Tamm, G. CLOUD COMPUTING GOVERNANCE ASPECTS LEVELS OF ABSTRACTION: IAAS, PAAS, SAAS AND CLOUD GOVERNANCE ASPECTS 2011, Deutsche Telekom AG

2 TABLE OF CONTENTS 1 Introduction History of Cloud Computing An Overview of Cloud Computing Definitions Cloud Computing Architecture and Deployment General Aspects of Cloud Governance Virtualization, Abstraction and IT-Governance Cloud Governance and Software as a Service (SaaS) Cloud Governance and Infrastructure as a Service (IaaS) Cloud Governance and Platform as a Service (PaaS) Human as a Service (HuaaS) Cloud Issues and Trends on the Cloud Market Conclusion and Recommendations...31 A Works Cited , Deutsche Telekom AG Seite 2 / 34

3 1 INTRODUCTION The development and diffusion of virtualization and cloud computing is changing the ways of deploying IT through the reallocation of technology costs and usage patterns. New ways of how to consume and how to offer goods and services bring up opportunities and threats and lead to new paradigms for business models. Since the demand for IT services and capacity is continually increasing, innovation in the IT sector is also surging. Cloud computing, computing as a time-sharing utility on the web by means of assessing computer resources provided through networks rather than running software or storing data on a computer (Bughin, Chui and Manyika, 2010, p. 10), entered the business world in 2008 to bring a shift in the geography of computation (Hayes, 2008, p. 9): Shrink-wrap software still dominates the market and is not about to disappear, but the focus of innovation indeed seems to be ascending into the clouds. Some substantial fraction of computing activity is migrating away from the desktop and the corporate server room. The change will affect all levels of the computational ecosystem, from casual user to software developer, IT manager, even hardware manufacturer. (Hayes 2008, p. 9). 2 HISTORY OF CLOUD COMPUTING The concept of cloud computing is cited by numerous authors to have its origin in McCarthy s paradigm of public utility computing of the 1960s, based on his prediction that the deployment of time-sharing can lead to providing computing resources and applications as a utility (Mc Carthy, 1983). The utility computing paradigm draws parallels to the service and billing structure of service bureaus to which less technologically adept customers or those of insufficient economy of scale would outsource specific business tasks to (Mc Carthy, 1983). Mc Carthy predicted in a public speech given 1961 that time-sharing may lead to the provisioning of computing resources and applications as a utility (Campbell-Kelly, 2009). This service structure draws parallels to the network organization of companies encountered prior to the introduction of the personal computer, wherein computing tasks were relegated to a central computing center (Hayes, 2008, p. 9). Cloud computing is a reincarnation of the computing utility of the 1960s but is substantially more flexible and larger scale than the [systems] of the past. The ability of virtualization and management software to shift computing capacity from one place to another, is one of the things that makes cloud computing so attractive. (Vint Cerf, Google executive and Internet pioneer, 2009, in: Naone, 2009). The term cloud itself came into more frequent use during shift of telecom companies towards virtual private networks during the 1990s, and delineated the transition between the responsibility domains of provider and service user. The cloud indicated the virtualisation of the telecommunication infrastructure ( telecom clouds ) and to the ability to use dynamic traffic switching in order to balance demand peaks (Jeffery and Neidecker-Lutz (eds), 1993). The term Cloud Computing came... from the early days of the Internet where we drew the network as a cloud we didn t care where the messages went the cloud hid it from us (Kevin Marks, Google, 2008, in: Farber, 2008). Cloud computing by today s definition came into spotlight after the dot-com bubble when companies such as Amazon Corp. sought to re-establish utilization of their computing infrastructure capacity by offering time-share access to these resources to third parties on a pay-as-you-go utility computing basis. The beginning of the new millennium marks also the genesis of numerous web-based services such as Amazon Web 2011, Deutsche Telekom AG Seite 3 / 34

4 Services, Salesforce.com business applications and the more ubiquitous online services, all of which use the cloud computing concept as basis to offer Software as a Service (SaaS) (Kottyan, 2009, p. 5). The following table (Table 1) summarizes milestones in the history of the utility, SaaS and Cloud computing perspective, offering an overview of the milestones in the history of cloud and SaaS services, reaching from the mid 1950s until today. Year(s) Mid 1950s Event(s) Mainframe Computers come on the scene (IBM, GE) Delivery of the fully transistorized IBM 7090 computer system (in 1959) John McCarthy predicts: "computation may someday be organized as a public utility". Mid 1960s Customers can access a timesharing computer remotely over a regular telephone line and thus get computing power over a computer utility 1969 J.C.R. Licklide introduces the idea of an "intergalactic computer network" he was also responsible for enabling the development of ARPANET (Advanced Research Projects Agency Network) 1970 First timesharing computer recession, due to an economic downturn. Announcement of the cession of the world-wide GE computer business, except time-sharing to Honeywell. 1970s Key players like General Electric and Timeshare Inc. build massive global computer centers which service thousands of users Early 1990s Second death of the timesharing industry: the arrival of the Personal Computer, which liberated programs and data from the central computing center, leading to decentralization and individualization. Distributed computing enabled through Client/Server Systems. cloud comes into commercial use referring to large networks and the advancement of the Internet, 1 st cloud around networking (connectivity utility) -> 2 nd cloud around documents (resource utility) 1999 Salesforce.com is established, providing on demand SaaS (Software as a Service) for Customer Relationship Management Shift in the locus of computation, migration to distant data centers reached through the internet Microsoft uses the term Cloud Computing in public to refer to the infrastructure of the internet in a presentation about the.net framework Microsoft also extends the concept of SaaS through the development of Web Services IBM details the SaaS concept in their Autonomic Computing Manifesto Amazon provides a suite of cloud-based Web Services including storage, computation and even human intelligence through the Amazon Mechanical Turk 2004 Deutsche Telekom/T-Systems launches Dynamic Services for SAP what provides a scalable platform for SAP-Services 2006 Amazon launches its Elastic Compute cloud (EC2) providing access to their excess capacity on a utility computing and storage basis as a commercial web service that allows small companies and individuals to rent computers on which to run their own computer applications and as...the first widely accessible cloud computing infrastructure service (Jeremy Allaire) Google, IBM and various Universities embark on a large scale cloud computing research project Small boom of cloud offerings which mostly consisted in a re-branding of their existent in-house solutions and techniques Eucalyptus becomes the first open source AWS API compatible platform for deploying private clouds. The year of the cloud. IEEE Cloud 2008: 1 st International Conference on Cloud Computing Web 2.0 hits its stride, Google (Google Apps) et al. offer browser-based enterprise applications Gartner declares cloud computing to be on the peak of a hype cycle. For the cloud, we're all in... About 75 percent of our folks are doing entirely cloud based or cloud inspired, a year from now that will be 90 percent. Steve Ballmer, Microsoft s CEO 3 rd cloud around communities (mobile and social interaction utility) Cloud adoption sees increased growth. A variety of conferences, workshops, projects comprising universities, industry associations and governments deal with the topic. In July, HP Labs India announced a new cloud-based technology designed to simplify taking content and making it mobile-enabled, even from low-end devices. SiteonMobile is designed for emerging markets where people are more likely to access the internet via mobile phones rather than computers. [ - cite_note-105 Change we are leading is the theme of IEEE CLOUD Cloud Computing has become a scalable services consumption and delivery platform in the field of Services Computing. Table 1: Milestones in Cloud Computing and SaaS History. Own table, based on: Campbell-Kelly, 2009, p ; Greengard, 2010, p. 18, Jeffery and Neidecker-Lutz, 2010, p. 5-6; Kottyan, 2009, p. 5; Mohamed, 2009; Wikipedia , Deutsche Telekom AG Seite 4 / 34

5 Starting with a Cloud Computing research initiative by Google and IBM in late 2007 which comprised the establishment of remote research data centers at several US elite universities (Lohr, 2007), the topic of cloud computing began to be promulgated in academia as well is the year of the Cloud, and in light of the recent financial crisis and associated cost pressure on adopters, consulting firm Gartner Group declared cloud computing as at the peak of a hype cycle in 2009:...evolving from overenthusiasm to a period of disillusionment to an eventual understanding of the technology relevance and role in a market or domain. (Fenn et al., 2009, p. 2). In 2010, Cloud Computing is still an issue. The cloud benefits are as clear as the problems concerning the secure and trustworthy cloud deployment. Initiatives are multiplying and open source projects are aiming to pave the way for currently missing cloud standards. 3 AN OVERVIEW OF CLOUD COMPUTING DEFINITIONS An internet research about the popular term of cloud computing will lead to vividly frequented blogs, an abundance of white papers, news about expos, conferences and workshop and even titles of magazines, like the Cloud Computing Journal. Too much quantity of information whose quality is partly questionable can lead to a lot of confusion. The interesting thing about cloud computing is that we ve redefined cloud computing to include everything that we already do. I don t understand what we would do differently in the light of cloud computing other than change the wording of some of our ads. (Larry Ellison, Oracle s CEO, in: Armbrust et al., 2010, p. 50). There is a great variety of definitions and approaches of the cloud, as different cloud shareholders define the term from their own perspective be it an academic, architectural, engineering, development, a management, a provider or a consumer perspective. As the cloud comprises a variety of technologies and service models, there is also much confusion concerning the cloud deployment, architecture and standards. The items that form a cloud system cannot all be discussed in one paper. The main categories of items that determine cloud systems are visualised in Figure 1, as identified in the EU Expert Group Report about the future of Cloud Computing in Europe (European Union Research Project aiming at providing recommendations for the future of a European Cloud (Jeffery and Neidecker-Lutz (eds), 2010). Multiple new cloud domains and providers arise and cloud systems are applied for different areas: (1) data centres trying to maintain high scalability and increase availability; (2) web server farms automating and stabilising their servers, respectively the user s website; (3) in house attempts to balance resources over the business solutions; (4) external ASP-type offerings. (Jeffery and Neidecker-Lutz (eds), 2010, p. 5). An overview of some examples of cloud computing can be in order to grasp the variety of offered services: Wordstar for the Web (Google Docs, Adobe Photoshop Express), Enterprise computing in the Cloud (CRM by Salesforce since 1999, Slogan: No Software!), Cloudy infrastructure (Amazon Web Services: data storage priced by the gigabyte-month, computing capacity priced by the CPUhour; IBM: the Blue Cloud ; Google: App Engine ) The cloud OS (For most cloudcomputing applications, the entire user interface resides inside a single window in a Web browser) (Hayes 2008, p ) 2011, Deutsche Telekom AG Seite 5 / 34

6 Figure 1: Main Cloud Aspects. Source: Jeffery and Neidecker-Lutz (eds) 2010, p. 8. Cloud definitions and approaches evolve with the cloud development and alter according to which focus the authors or specialists reporting about the cloud scene choose. Looking for a break in the clouds, towards a cloud definition, Vaquero et al. (2009) constructed an overview of experts cloud definitions, which is adapted and upgraded in Table 2, which also contains their proposed definition. Author Year Cloud Definition / Excerpt Klems you can scale your infrastructure on demand within minutes or even seconds, instead of days or weeks, thereby avoiding under-utilization (idle servers) and over-utilization (blue screen) of in-house resources Gaw using the internet to allow people to access technology-enabled services. Those services must be ʼmassively scalable Buyya 2008 A Cloud is a type of parallel and distributed system consisting of a collection of interconnected and virtualized computers that are dynamically provisioned and presented as one or more unified computing resources based on service-level agreements established through negotiation between the service provider and consumers Cohen 2008 Cloud computing is one of those catch all buzz words that tries to encompass a variety of aspects ranging from deployment, load balancing, provisioning, business model and architecture (like Web2.0). Itʼs the next logical step in software (software 10.0). For me the simplest explanation for Cloud Computing is describing it as internet centric software , Deutsche Telekom AG Seite 6 / 34

7 Kaplan a broad array of web-based services aimed at allowing users to obtain a wide range of functional capabilities on a ʼpay-as-you-goʼ basis that previously required tremendous hardware/software investments and professional skills to acquire. Cloud computing is the realization of the earlier ideals of utility computing without the technical complexities or complicated deployment worries... Gourlay the next hype-term...building off of the software models that virtualization enabled... Edwards what is possible when you leverage web-scale infrastructure (application and physical) in an on-demand way De Haff There really are only three types of services that are Cloud based: SaaS, PaaS, and Cloud Computing Platforms. I am not sure being massively scalable is a requirement to fit into any one category. Kepes Put simply Cloud Computing is the infrastructural paradigm shift that enables the ascension of SaaS.... It is a broad array of web-based services aimed at allowing users to obtain a wide range of functional capabilities on a pay-as-you-go basis that previously required tremendous hardware/software investments and professional skills to acquire Sheynkman 2008 Clouds focused on making the hardware layer consumable as on-demand compute and storage capacity. This is an important first step, but for companies to harness the power of the Cloud, complete application infrastructure needs to be easily configured, deployed, dynamically-scaled and managed in these virtualized hardware environments Sultan 2008 In a fully implemented Data Center 3.0 environment, you can decide if an app is run locally (cook at home), in someone elseʼs data center (take-out) and you can change your mind on the fly in case you are short on data center resources (pantry is empty) or you having environmental/facilities issues (too hot to cook). In fact, with automation, a lot of this can be done with policy and real-time triggers... Hartig really is accessing resources and services needed to perform functions with dynamically changing needs...is a virtualization of resources that maintains and manages itself. Pritzker 2008 Clouds are vast resource pools with on-demand resource allocation...virtualized...and priced like utilities Doerksen 2008 Cloud computing is... the user-friendly version of Grid computing Von Eicken outsourced, pay-as-you-go, on-demand, somewhere in the Internet, etc. Sheedan ʼCloud Pyramidʼ to help differentiate the various Cloud offerings out there...top: SaaS; Middle: PaaS; Bottom: IaaS Ricadela Cloud Computing projects are more powerful and crash-proof than Grid systems developed even in recent years Wladawsky the key thing we want to virtualize or hide from the user is complexity...all that software will be virtualized or hidden from us and taken care of by systems and/or professionals that are somewhere else - out there in The Cloud Martin 2008 Cloud computing encompasses any subscription-based or pay-per-use service that, in real time over the Internet, extends ITʼs existing capabilities Bragg 2008 The key concept behind the Cloud is Web application... a more developed and reliable Cloud. Many find itʼs now cheaper to migrate to the Web Cloud than invest in their own server farm... it is a desktop for people without a computer Gruman and Knorr 2008 Cloud is all about: SaaS...utility computing...web Services... PaaS...Internet integration...commerce platforms... Mc Fedries 2008 Cloud Computing, in which not just our data but even our software resides within the Cloud, and we access everything not only through our PCs but also Cloud-friendly devices, such as smart phones, PDAs... the megacomputer enabled by virtualization and software as a service...this is utility computing powered by massive utility data centers. Cerf 2009 Cloud computing is a reincarnation of the computing utility of the 1960s but is substantially more flexible and larger scale than the [systems] of the past. The ability of virtualization and management software to shift computing capacity from one place to another, he says, "is one of the things that makes cloud computing so attractive. Hartig 2009 The term cloud computing probably comes from (at least partly) the use of a cloud image to represent the Internet or some large networked environment. We donʼt care much whatʼs in the cloud or what goes on there except that we depend on reliably sending data to and receiving data from it. Cloud computing is now associated with a higher level abstraction of the cloud. Instead of there being data pipes, routers and servers, there are now services. The underlying hardware and software of networking is of course still there but there are now higher level service capabilities available used to build applications. Behind the services are data and compute resources. A user of the service doesnʼt necessarily care about how it is implemented, what technologies are used or how itʼs managed. Only that there is access to it and has a level of reliability necessary to meet the application requirements. Vaquero et al Clouds are a large pool of easily usable and accessible virtualized resources (such as hardware, development platforms and/or services). These resources can be dynamically reconfigured to adjust to a variable load (scale), allowing also for an optimum resource utilization. This pool of resources is typically exploited by a pay-per-use model in which guarantees are offered by the Infrastructure Provider by means of customized SLAs. 2011, Deutsche Telekom AG Seite 7 / 34

8 Brunette and Mogull (eds) CSA Jeffery and Neidecker- Lutz (eds) EU Expert Group 2009 Cloud computing (ʻcloudʼ) is an evolving term that describes the development of many existing technologies and approaches to computing into something different. Cloud separates application and information resources from the underlying infrastructure, and the mechanisms used to deliver them. Cloud enhances collaboration, agility, scaling, and availability, and provides the potential for cost reduction through optimized and efficient computing. [C]loud [computing] describes the use of a collection of services, applications, information and infrastructure comprised of pools of compute, network, information, and storage resources. These components can be rapidly orchestrated, provisioned, implemented, decommissioned and scaled up or down; providing for an on-demand utility-like model of allocation and consumption In its broadest form, we can define a 'cloud' is an elastic execution environment of resources involving multiple stakeholders and providing a metered service at multiple granularities for a specified level of quality (of service)...clouds as we understand them... are primarily platforms that allow execution in various forms across multiple resources (and potentially across enterprise boundaries)... a cloud is a platform or infrastructure that enables execution of code (services, applications etc.), in a managed and elastic fashion, whereas managed means that reliability according to pre-defined quality parameters is automatically ensured and elastic implies that the resources are put to use according to actual current requirements observing overarching requirement definitions implicitly, elasticity includes both up- and downward scalability of resources and data, but also load-balancing of data throughput. Armbrust et al Cloud Computing refers to both the applications delivered as services over the Internet and the hardware and systems software in the data centers that provide those services......the data center hardware and software is what we will call a cloud. M. Otey 2010 Cloud computing is an umbrella term for an Internet-based service that provides some type of essential service to the organization. The specific types of services vary widely. Common cloud computing services include Microsoft Exchange Server hosting, application offerings such as Google Docs, the lease of backup storage, and even relational database services such as SQL Azure. Typically, the vendorʼs servers entirely host these services, which you access over the Internet. However, some vendors including Microsoft have attempted to push a Software Plus Services model, in which locally installed software (e.g., Microsoft Office) interacts with a web-based service (e.g., Windows Live Office). Customers typically pay the cloud computing vendor for the use of these services. Vendors usually offer some type of SLA guaranteeing specific levels of uptime and often a range of acceptable service-level performance. Table 2: Definitions of Cloud Computing. Own table, based on: Geelan, 2008; Vaquero et al., 2009, p. 52; Hartig, 2009; Jeffery and Neidecker-Lutz, 2010, p. 5-6; Naone 2009; Otey, CLOUD COMPUTING ARCHITECTURE AND DEPLOYMENT While sometimes partially referred to as internet-centric software (Cohen, 2008) or as a user-friendly version of grid computing (Doerksen, 2008), Mell and Grance (2009) of the US National Institute of Standards and Technology (NIST) provide one of the most comprehensive definitions of cloud computing as well as its subsequent service and deployment models henceforth described in the following sections: Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models. (Mell and Grance, NIST, 2009, p. 1) Mell and Grance (2009) note that, although the NIST Cloud Computing Definition Version 15 is an attempt to encompass most of the various cloud approaches, the definition can evolve; as cloud computing is still an evolving paradigm whose...definitions, use cases, underlying technologies, issues, risks, and benefits will be refined in a spirited debate by the public and private sectors. These definitions, attributes, and characteristics will evolve and change over time. The service models, deployment models and essential as well as common characteristics of the cloud are visualised in Figure 2. Depending on the type of service, a distinction is made between Infrastructure-as-a-Service (IaaS rent processing, storage, network capacity, 2011, Deutsche Telekom AG Seite 8 / 34

9 and other fundamental computing resources, e.g. rent of space on the Internet), Platform-as-a-Service (PaaS deploy customer-created applications to a cloud, e.g. provision of developer tools on the Internet) and Software-as-a-Service (SaaS use provider s applications over a network, e.g. use of an application via the Internet). Examples for IaaS and PaaS offerings from Deutsche Telekom / T-Systems include Hosting Services Industrialized Platforms, more specifically the Dynamic Services for Infrastructure. Other offerings that can be provided dynamically within Dynamic Services include Hosting Services Mainframe Platforms, Hosting Services Midrange Platforms, Managed Archiving & Document Services, Managed Workplace Services, and Mobile Enterprise Services. Typical communication infrastructure offerings are Advanced Network Services, Corporate Video, Corporate Voice, Direct Network Links, Ethernet VPN, Inhouse Infrastructure Internet Access & Bundles, IP-VPN, Managed Inhouse, Mobile Enterprise Services, and Unified Communications. Based on operational, ownership and organizational aspects, private clouds (enterprise owned or leased, for a closed user group) are distinguished from community clouds (shared infrastructure for specific community) and public clouds (sold to the public, mega-scale infrastructure for a large number of different users). In reality, there mostly exist hybrid clouds, as compositions of two or more clouds, like combinations of private clouds, public clouds and traditional IT environment. A specific strength of the Deutsche Telekom / T-Systems corporate offerings is the ability to provide private cloud solutions. This strength is typical for companies with roots in the traditional IT environment. Figure 2: The NIST Cloud Definition Framework NIST, Source: Mell and Grance 2009a, p , Deutsche Telekom AG Seite 9 / 34

10 Cloud Key Features NIST Definition Explanations On-demand self-service A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each serviceʼs provider. Broad network access. Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).. Resource pooling. The providerʼs computing resources are pooled to serve multiple consumers using a multi-tenant model, (location independence and with different physical and virtual resources dynamically assigned and reassigned according to consumer multi-tenancy) demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, network bandwidth, and virtual machines. Rapid elasticity. Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time. Measured Service. Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported providing transparency for both the provider and consumer of the utilized service. Table 3: Essential Characteristics of Cloud Computing according to according to the NIST V15 definition. Source: Mell and Grance, NIST, 2009, p. 1. Key cloud features listed as essential characteristics in Figure 2 are on-demand selfservice, broad network access, resource pooling (location independence and multi-tenancy), rapid elasticity and measured service, are explained in Table 3. These features ensure the unilateral provisioning of computing capabilities by the consumer over a broad network access enabling both thin and thick client platforms. On the provider side, the service is adapted to serve multiple users while associated resources may be rapidly and automatically adapted to a changing scaling of the customer basis using constant utilization metering and monitoring. Further common cloud characteristics identified in the NIST framework, also shown in Figure 3, are: massive scale, homogeneity, virtualization, low cost software, resilient computing, geographic distribution, service orientation and advanced security. Mell and Grance (2009) also note that Cloud software takes full advantage of the cloud paradigm by being service oriented with a focus on statelessness, low coupling, modularity, and semantic interoperability (Mell and Grance, 2009, p.2). In the EU Report about the Future of Cloud Computing (2010), cloud characteristics are also regarded as Cloud Capabilities and classified in non-functional, economic and technological aspects. Non-functional aspects that express qualities or properties of a system, rather than specific technological requirements, and are the main reason why clouds differ from each other: Elasticity, Reliability, Quality of Service, Agility and Adaptability, Availability Economic aspects that express considerations about the cost efficiency of introducing cloud systems in a business environment: Cost reduction, pay per use, improved time to market, return of investment (ROI), turning CAPEX into OREX, Going Green Technological aspects that express desiderata from computing and cloud technologies that shall serve to realize 2011, Deutsche Telekom AG Seite 10 / 34

11 the non-functional and economic aspects: Virtualization, Multi-tenancy, Security, Privacy and Compliance, Data Management, APIs and / or Programming Enhancements, Metering, Tools. (Jeffery and Neidecker-Lutz (eds), 2010, p ). The analysis of technical gaps (Manageability and Self, Data Management, Privacy and Security, Federation and Interoperability, Virtualisation, Elasticity and Adaptability, APIs, Programming Models and Resource Control, p ) and non-technical gaps (Legislation, Government and Policies, Economic Concerns, p ) concerning the capabilities of the European Cloud leads to conclusions about measures to be taken (Jeffery and Neidecker-Lutz (eds), 2010). Thus, the basis for a European cloud strategy is built by means of recommendations for further joined research and consulting projects and programmes. The features of cloud computing from the NIST framework and in the EU report definitions and approaches also partly embody the core objectives and principles that Werner Vogels, vice president and CTO at Amazon.com, already identified in 2008 as success factors of Cloud Computing: Security Scalability Availability Performance Cost-effective Acquire resources on demand Release resources when no long needed Pay for what you use Leverage other's core competencies Turn fixed cost into variable cost (Werner Vogels, 2008, in: Farber, 2008). Important cloud computing issues, as identified by Hayes (2008), are scalability of time-and locus-sharing computing resources, functionality of applications, information exchange between different languages and layers, open source issues, and, at last but not least, privacy, reliability and security (Hayes 2008, p. 11) Security is an important and very complex cloud issue, based on determinants such as availability, integrity and confidentiality (Mell and Grance, 2009a, p.10). It challenges the cloud market with legal, adoption and trust problems but also offers opportunities for competitive advantages through intelligent solutions. In this chapter, a broad comprehensive view of the cloud from the service and the deployment perspective will help to illuminate the dimensions of the security problem. Different levels of security capabilities are required to realize the varying service architectures as alternating virtualization layers are required. The complexity and security importance rise with the cloud layers. IaaS cloud services are based on common virtualization technologies and rather easy to deploy. As shown in the Cloud Reference Model by CSA (2009) (Figure 3), IaaS forms the basis for all cloud services. The Cloud Reference Model offers quite an abstract view on the architectural toolkit needed to build a cloud.the IaaS model is the infrastructure resource stack providing the basic APIs, requiring less security capabilities than PaaS, which builds on IaaS, integrating application development frameworks and middleware capabilities. SaaS builds upon PaaS, offering a self-contained operating environment and delivering user experience... including the content, its presentation, the application(s), and management capabilities (Brunette and Mogull (eds), 2009, p. 19). SaaS provides the most integrated functionality but also demands the highest security level, for which the provider bears the responsibility. 2011, Deutsche Telekom AG Seite 11 / 34

12 Figure 3: Cloud Reference Model CSA, Source: Brunette and Mogull (eds), 2009, p. 18. There are also other possibilities to offer Services, e.g. Storage as a Service would be a sub-service from the IaaS domain. The cloud computing concept is also a model about how to flexibly support Everything-as-a-Service (XaaS) in the Internet of Things. The Cloud Taxonomy by OpenCrowd Cloud Solutions offers an overview of sub-classes of Cloud Services. This Cloud Taxonomy, which also takes another main class into consideration, the class of Cloud Software, is shown in Figure 4. Not only the ways to apply services in a cloud, also the ways to deploy them have common characteristics and lead to a taxonomy iof cloud deployment models. The four types depicted in the NIST framework (Figure 2) are also explained in Table 4. Public Clouds, like those offered by Amazon, are freely accessed, while private clouds deploy cloud infrastructure within a company. As public and private clouds mostly share the same interface, some projects, like Eucalyptus and Nebula, try to create hybrid clouds, adding public cloud resources to the private cloud in order to serve high peak demand (Metsch et al., 2009, p.255). 2011, Deutsche Telekom AG Seite 12 / 34

13 Figure 5: Open Crowd Taxonomy Open Crowd, Source: Brunette and Mogull (eds), 2009, p. 20. Deployment Model Characteristics Private Cloud Community Cloud Public Cloud Hybrid Cloud The cloud infrastructure is operated solely for an organization. It may be managed by the organization or a third party and may exist on premise or off premise. The cloud infrastructure is shared by several organizations and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the organizations or a third party and may exist on premise or off premise. The cloud infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services. The cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., cloud bursting for load-balancing between clouds). Table 4: Deployment Models of Cloud Computing according to the NIST V15 definition. Source: Mell and Grance, NIST, 2009, p. 2. When broadening the Cloud concept to human beings who also form the cloud through their participation in crowdsourcing activities, a new highest level can be defined: Human as Service (HuaaS), as also demonstrated in the cloud stack by Lenk et al. (2009), shown in Figure 6. This stack by Lenk et al. (2009) aims at facilitating communication between providers of technologie and services and to try to understand them not only from a technological and architectural but also from a social and business perspective. The architectural mindset used when designing solutions has clear implications on the future flexibility, security and mobility of the resultant solution, as well as its collaborative capabilities. (Brunette and Mogull (eds), 2009, p. 17.). 2011, Deutsche Telekom AG Seite 13 / 34

14 Figure 6: Cloud Stack. Source: Lenk et al., 2009, p. 25., p companies with large batch-oriented tasks can get results as quickly as their programs can scale, since using 1,000 servers for one hour costs no more than using one server for 1,000 hours. This elasticity of resources, without paying a premium for large scale, is unprecedented in the history of IT... (Armbrust et al., 2010, p. 50). Armbrust et al. (2009) discuss and illustrate the pay-per-use outsourcing CapEx to OpEx concept in combination with elasticity from risk management perspective. Assume our service has a predictable daily demand where the peak requires 500 servers at noon but the trough requires The consumer-customer perspective and the responsibilities about governance, security and compliance with standards and policies should be taken into careful consideration when building a cloud business model, as the differentiation between internal and external, refering to the physical location of assets, ressources and information, which naturally affects the security and risk posture of an organisation, is not the only main cloud deployment aspect. Risk posture also depends on The types of assets, resources, and information being managed Who manages them and how Which controls are selected and how they are integrated Compliance issues. (Brunette and Mogull (eds), 2009, p. 17.) Finally, the economical aspects of the cloud should not be neglected. As described by Armbrust et al. (2010), the cost reduction combined with elasticity is the greatest advantage of cloud computing: only 100 servers at midnight, as shown in Figure [7](a). As long as the average utilization over a whole day is 300 servers, the actual utilization over the whole day (shaded area under the curve) is 300 _ 24 = 7200 server-hours; but since we must provision to the peak of 500 servers, we pay for 500 _ 24 = server-hours, a factor of 1.7 more than what is needed. Therefore, as long as the pay-as-you-go cost per server-hour over 3 years4 is less than 1.7 times the cost of buying the server, we can save money using utility computing. (Armbrust et al., 2009, p. 11). 2011, Deutsche Telekom AG Seite 14 / 34

15 This example is illustrated in Figure 7. Figure 7: (a) Even if peak load can be correctly anticipated, without elasticity we waste resources (shaded area) during nonpeak times. (b) Underprovisioning case 1: potential revenue from users not served (shaded area) is sacrificed. (c) Underprovisioning case 2: some users desert the site permanently after experiencing poor service; this attrition and possible negative press result in a permanent loss of a portion of the revenue stream. Source: Armbrust et al., 2009, p. 11. Business continuity and service availability is the most important issue of the cloud. In 2008, some outages caused a lot of confusion and distrust towards the cloud, as they were a manifestation of poor infrastructure and bad security standards. These outages and the errors that caused them are shown in Table 5. One current example for service outage occurred during April It involved the Amazon Elastic Compute Cloud (EC2). According to Amazon the issues affecting EC2 primarily involved a subset of the Amazon Elastic Block Store (EBS) volumes in a single Availability Zone within the US East Region. They became unable to service read and write operations. This caused instances trying to use these affected volumes to also block when they attempted to read or write to them. In order to restore these volumes and stabilize the EBS cluster in that Availability Zone, Amazon disabled all control APIs for EBS in the affected Availability Zone for much of the duration of the event. For two periods during April 21, the degraded EBS cluster affected the EBS APIs and caused high error rates and latencies for EBS calls to these APIs across the entire US East Region. In addition to the direct effect this EBS outage had on EC2 instances, it also impacted the Relational Database Service (RDS) of Amazon. According to Amazon, the trigger for the whole event was a (planned) network configuration change (see Service and Outage Duration Date S3 outage: authentication service overload leading to unavailability 2 hours 2/15/08 S3 outage: Single bit error leading to gossip protocol blowup. 6-8 hours 7/20/08 AppEngine partial outage: programming error. 5 hours 6/17/08 Gmail: site unavailable due to outage in contacts system. 1.5 hours 8/11/08 Table 5: Outages in AWS, AppEngine, and Gmail. Source: Armbrust et al., 2009, p , Deutsche Telekom AG Seite 15 / 34

16 5 GENERAL ASPECTS OF CLOUD GOVERNANCE VIRTUALIZATION, ABSTRACTION AND IT-GOVERNANCE Governance of cloud computing should regard different deployment models. They require different ways of abstracting services (Mesch et al., 2009, p ). Abstracting services at the level of infrastructure (IaaS) allows comparatively easy virtualization the user organization can configure and customize the platform and the services within the virtual image that is then being deployed and operated. This includes the definition of performance parameters for specific services (e.g., parameters of a Web Service Container as specified in Stantchev, 2008), the security aspects of service access, and the integration of services within the platform. When using a standardized platform (the PaaS approach) the user organisation deploys the services in a virtualized operating environment. This operating environment is typically provided as a service - the virtualization technology and the operating environment are managed by the provider. Integration capabilities are always provider-specific and there are currently no commonly accepted industry standards for integration between services operated in different PaaS environments. The usage of software services itself (the SaaS approach) precludes fine-grained control and enforcement of non-functional aspects (e.g., QoS, response time) and security parameters of the service by the user organization. These different levels of virtualization require different levels of security and abstraction. The grade of control and responsibility for security aspects declines with higher levels of abstraction in IaaS the configuration is generally in the hand of the user organisation, while in SaaS it is primarily a responsibility of the Cloud provider. There are several emerging patterns for cloud usage. The first one is a natural consequence of the trend to outsource IT-Operations (aka. IT- RUN functions) to external providers and results in demand for IaaS. IaaS is typically used for the implementation of test projects and as a way to overcome underprovisioning in onpremise infrastructures. The second one is coming from the SaaS area and focuses on the provision of Web 2.0 applications. Some wellknown sites offer the user the chance to develop simple applications (a la PaaS) and offer them in a SaaS-like manner later on. This usage pattern could also be called extension facilities. PaaS is an optimal environment for users seeking testing and development capabilities, these are two new emerging use patterns which are gaining popularity. Probably, gaming will be one of the most remarkable usage patterns for Cloud technologies, due to an inherent scalability, endowing such applications with virtually unlimited graphical power and players. Also the rise of netbooks in the computer hardware industry triggered the development of Clouds. These slim devices depend on services being deployed in remote Cloud sites since their own capacity is limited. Behind this stand the idea of getting access to everything, from anywhere, at any time. A set of general Corporate Governance rules has to be specifically refined and targeted for every operational area in an enterprise. The idea of manageability in Cloud Computing is closely related to the operationalization of Corporate Governance in the different phases of the use of a Cloud Computing offering. A specific manifestation of such operationalization can be the introduction of SLA-based Governance. This would mean that the organization has to incorporate specific governance requirements as part of a service level agreement for a Cloud Computing offering. Suitable examples include the so called four-eyes-principle that can be part of the SLA for a SaaS offering, or data availability 2011, Deutsche Telekom AG Seite 16 / 34

17 requirements that can also be part of the SLA for a SaaS offering. In order to introduce such transparent Cloud Governance mechanisms an organization has to consider all phases of the usage of a Cloud Computing offering. During the first phase of requirements identification and elicitation (often called the Plan-Phase) these requirements need to be specified and formalized. This allows addressing them already within a first assessment of the Cloud Computing market for the specific offering. Potential Cloud Computing providers can then be specifically evaluated with respect to the requirements and specific SLAs can be negotiated with them during the second phase. The third phase can focus on the transparent communication of values and benefits of the SLA during start of production for the specific business unit. The fourth phase would deal with performance monitoring and assessment of SLA fulfillment and associated bonuses or penalties. These phases and their associated activities can be introduced as specific Cloud Computing extensions to more traditional IT-Governance approaches such as CObIT and ITIL. This introduction is typically non-trivial, as there are significant differences between the abstraction levels and the semantics of Cloud Computing and IT-Governance. In the specific area of SaaS a more straightforward approach can focus on the introduction of a more specific approach from the area of SOA Governance the SOA LifeCycle (see the SOA Governance Document). It describes a governance approach for software functionality as provided by web services which makes its paradigms and concepts more applicable to the aspects of SaaS Governance. On the other side, the SOA LifeCycle can be incorporated as part of a general IT-Governance strategy based on CObIT and ITIL. In the context of the DTAG these activities should be focused on the specific parts of the PSO Governance the strategic business units. The indicators that are part of the PSO Governance model - Key-Performance- Indicators (KPIs) for measuring process efficiency and Key-Goal-Indicators (KGIs) for measuring process efficacy can be incorporated as part of the service level requirements (SLR) or service level objectives (SLO) of the DTAG. These requirements should be defined with respect to the three general PSO services: the Architecture-Service, the Aggregation-Service und the Production-Service. The overall view of the Cloud Governance concept for PSO is presented in Figure , Deutsche Telekom AG Seite 17 / 34

18 Figure 8. An overall view of the Cloud Governance Concept for PSO The PSO Governance Service would cover Cloud Computing aspects for all phases of the usage. Extending the internal CObIT view these can be refined in the critical processes PO1, PO4, PO6, AI6, DS3, ME2 and ME4. Within the Architecture-Service the focus can be on the critical processes PO2, PO3, AI3, AI4, AI5, DS1, ME1 and ME3. Within the Aggregation-Service the focus can be on the critical processes PO8, PO10, AI4, AI5, AI6, DS1, DS2 and ME3. Within the Production-Service the focus can be on the critical processes AI4, AI7, DS2, DS5 and ME2. These aspects are relevant for a wide range of Deutsche Telekom / T-Systems offerings. In the area of IaaS and PaaS these include Hosting Services Industrialized Platforms, Hosting Services Mainframe Platforms, Hosting Services Midrange Platforms, ICT Security Services & Solutions, Managed Archiving & Document Services, Managed Workplace Services, and Mobile Enterprise Services. In the area of SaaS relevant offerings from Deutsche Telekom / T-Systems include Service Desk Services, Standard Application Operations, and Application Operations for SAP Solutions. Aspects of technical SLAs should always be considered in conjunction with communication infrastructure offerings such as Advanced Network Services, Corporate Video, Corporate Voice, Direct Network Links, Ethernet VPN, Inhouse Infrastructure, Internet Access & Bundles, IP-VPN, Managed Inhouse, Mobile Enterprise Services, and Unified Communications. Depending on the type of the Cloud Computing offering whether it is a IaaS, PaaS, or SaaS offering the specific aspects can differ. The following Sections 6, 7, and 8 of this document provide the specific details that can be considered with respect to SaaS (Section 6), IaaS (Section 7), and PaaS (Section 8). 2011, Deutsche Telekom AG Seite 18 / 34

19 6 CLOUD GOVERNANCE AND SOFTWARE AS A SERVICE (SAAS) Closely related to the Cloud Computing concept itself, and as the Cloud paradigm historically evolved through a number of phases which include grid and utility computing, application service provision (ASP), and Software as a Service (SaaS), the latter is stands for a service architecture that also gets confused with the cloud as a whole. The first and most important milestone in the history of SaaS after the era of Timesharing (1960s-1970) is the establishment of Salesforce.com as a company with the business idea to diminish software in the sense that it used to exist, providing on demand SaaS (Software as a Service) for Customer Relationship Management of enterprises through the utilisation of many technologies developed by companies such as Google and Yahoo! for business applications. SaaS is customizable by adopters with limited technical support: no infrastructure, no software upgrading, no data synchronization is necessary, as a shift in the locus of computation and migration to distant data centers reached through the Internet takes place (Campbell- Kelly 2009, p. 28). In 2000, Microsoft also extended the concept of SaaS through the development of Web Services. In 2001, IBM published a detailled SaaS / Cloud concept in their Autonomic Computing Manifesto, describing advanced automation techniques such as self-monitoring, self-healing, self-configuring, and self-optimizing in the management of complex IT systems with heterogeneous storage, servers, applications, networks, security mechanisms, and other system elements that can be virtualized across an enterprise (IBM, 2001). Amazon provided a suite of cloud-based Web Services including storage, computation and even human intelligence through the Amazon Mechanical Turk (Mohamed 2009) in 2002 and launched its Elastic Compute cloud (EC2) in 2006, providing access to their excess capacity on a utility computing and storage basis as a commercial web service that allows small companies and individuals to rent computers on which to run their own computer applications and as...the first widely accessible cloud computing infrastructure service (Jeremy Allaire, CEO of Brightcove, 2009, in: Mohamed 2009). In 2009, Web 2.0 hit its stride and Google and other companies started offering offer browser-based enterprise applications (Google Apps). Such killer apps from Microsoft and Google made the most important contribution to Cloud Computing, according to Dan Germain (2009), CTO at Cobweb Solutions. When these companies deliver services in a way that is reliable and easy to consume, the knock-on effect to the industry as a whole is a wider general acceptance of online services, he said. Optimization of virtualisation technology, universal high-speed bandwidth and universal software interoperability standards also belong to key factors which enabled SaaS and Cloud Computing to evolve, according to Jamie Turner, a UK computing pioneer. As cloud computing extends its reach beyond a handful of early-adopter Google Docs users, we can only begin to imagine its scope and reach. Pretty much anything can be delivered from the cloud., Turner added (Mohamed, 2009). According to the NIST definition of Cloud Computing (Mell and Grance, 2009), Cloud Software as a Service (SaaS) stands for: The capability provided to the consumer is to use the provider s applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based ). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited userspecific application configuration settings (Mell and Grance, NIST, 2009, p. 1). IaaS and PaaS systems have a common aim - to be a platform for user organisations to deploy and operate software. Such software can be application software used by the organisation itself. It can also be operated for another 2011, Deutsche Telekom AG Seite 19 / 34

20 organisation (in an IT-RUN outsourcing agreement) or even operated as a SaaS offering by the organisation as part of its business model. SaaS, in contrast, groups together these underlying systems and creates a packaged aggregated service. Such offerings are often software products that can be in the interest of a wide variety of users. In other words, they can offer a complete turnkey application as a service via the Internet. (see also Mesch et al., 2009, p ). Examples for such SaaS offerings include online alternatives of Office Information Systems (OIS) such as Microsoft Office Live. Other examples include SaaS offerings from Oracle, SalesForce Automation, and Google Apps. A main distinguishing factor of SaaS offerings is that they constitute Cloud applications with direct end-user access. They can be developed and operated within a PaaS layer or directly on an IaaS layer. Furthermore, SaaS can be provided using an on-premise infrastructure (and there can be a variety of business models where such provision makes sense). When developing SaaS applications providers can use PaaS services in two general flavours - Basic Application Services and Composite Application Services (Lenk et al., 2009, p ). The former provide general services such as user identification and location (e.g., OpenId, Google Maps). The latter include mash-up support systems (e.g., Opensocial as a composite service that allows entire social networks like MySpace to be used as Basic Services). Table 6. includes a list of typical SaaS offerings as an example. Organization Service or Tool Description Layer Google Google Docs Online office suite SaaS Google Maps API The Google Maps API lets developers embed Google Maps in their own web pages with JavaScript. SaaS > BAS OpenSocial A common API for social applications across multiple websites SaaS > CAS OpenID Foundation OpenID Distributed system to allow users to have a single digital identity across the Internet. SaaS > BAS Microsoft Office Live Online office suite SaaS Salesforce Salesforce.com Customer Relationship Management SaaS Table 6: Software-as-a-Service providers. Source: Lenk et al., 2009, p. 31. Security Aspects of SaaS consider primarily data transmission via the SaaS platform and authentication / authorisation. External applications can send/receive data through the APIs, which the SaaS platform usually provides. Data transfers through the SaaS platform s external APIs are subject to existing organisational security policies and standards for any type of external data exchange. Such data can have applications within the enterprise or applications running on another cloud platform as source/ destination. It is important that such interactions are secured using appropriate controls for the classification of data and that such security is not a standard offering of a SaaS provider. It is a typical aspect of Integration of a Service (INTaaS). Federating identity between two sites is a common best practice. It can also be facilitated by services such as OpenID. For sensitive data, the exchange should be protected using cryptographic controls, such as a combination of encryption and secure hashing, to assure the confidentiality and/or integrity of the data. (CSA, 2010, p. 17). Again, such assurance is not part of the typical SaaS offering but a specific aspect of integration as part of INTaaS. Security aspects of SaaS should also address the software development methodology of the SaaS vendor and the customer organisation. The task is to align processes and reference models within the two organisations. A detailed review of approaches in this area is out of the scope of the current study. An important aspect that is introduced in an IT-organisation with the first decision for a SaaS offering is a change in trust boundaries being operated in an external environment, this offering requires the codification of trust between the user organisation and the SaaS 2011, Deutsche Telekom AG Seite 20 / 34