AARNet submission to the Australian Computer Society Cloud Protocol Discussion Paper. James Sankar, Alex Reid August 2013

Transcription

1 AARNet submission to the Australian Computer Society Cloud Protocol Discussion Paper James Sankar, Alex Reid August 2013 AARNet, Australia's Academic and Research Network (AARNet) is the not- for- profit company that operates Australia's National Research and Education Network (NREN). Our shareholders are 38 Australian universities and the Commonwealth Scientific and Industrial Research Organisation (CSIRO). We provide high capacity, leading edge internet and other advanced communications services to the nation's universities, health and other research organisations, schools, vocational training providers and cultural institutions. AARNet serves over one million end users who access the network and services for teaching, learning and research. Background AARNet understands that The Australian Computer Society has taken a lead role to coordinate industry and government consultation to fast track access to high quality, highly available, high performance cloud services. AARNet welcomes the opportunity to respond to the Australian Computer Society (ACS) Cloud Protocol Discussion Paper (July 2013). Cloud Computing has the potential to reduce costs by sharing expensive IT service platforms to deliver online services that can increase enterprise productivity and competitiveness. For cloud computing to be successful a combination of services need to be provided. These include: Access to high speed, reliable and secure data (Internet) network connectivity; Integration of suitably priced cloud services packages with business processes and systems; Appropriate regulation (especially for security and privacy); and Access to a competitive market of service providers for enterprise services and data storage solutions on a pay as you use basis. Under an appropriate framework, AARNet believes that cloud computing services should be embraced by Australian enterprises to complement local IT service and support delivery, via local and global providers. This will create new IT roles and innovation directly within Cloud Service Providers and indirectly through the business service productivity that cloud computing will offer. Strictly Commercial in Confidence Page 1 of 5

2 Question 1. Do you believe a voluntary protocol in which cloud suppliers provide undertakings and information about their services would improve confidence in the market and increase the adoption and take- up of cloud computing services? AARNet believes a protocol that embodies industry best practice is important for Small to Medium sized Enterprises (SMEs) and Not- For- Profit organisations (NFPs) to embrace the benefits of cloud computing. However the protocol needs to ensure Cloud Service Providers furnish open and transparent reporting of their service operations, so that customers are able to evaluate (or rank) product and service offerings, ideally employing assessments made by an independent organization. Page 10 of the ACS Cloud Protocol discussion paper suggests referencing cloud service resources as a one- stop shop for consumers, SMEs and NFPs. In order to achieve this goal, we would recommend results be provided online in an easily digestible format, with regular testing and ranking of service offerings, performance and cost as opposed to large often outdated reports. We believe that this will go furthest in improving confidence in the Cloud Computing and Services market. Regular independent audits of Cloud Service Provider contracts and hosted environments, to either meet an industry quality standard or a yet to be defined ongoing operational standard, would also be welcomed. Question 2a. If you are a potential user of cloud services, do you now have a better understanding of cloud computing and its benefits for your business or operations? What further information do you need to feel confident in deciding to adopt cloud services into your business? The table of benefits of Cloud Computing is a good start, and should help to improve enterprise appreciation of these benefits. We believe it could be enhanced with the addition of (a) some commentary on the potential dangers of Cloud services (with suitable rejoinders, of course), and (b) some real case studies. AARNet recommends enterprises undertake a cost benefit analysis of migrating services to cloud computing service providers. The total cost to purchase, deploy, operate, maintain and support a service and the degree of customization, flexibility, data provenance, security and privacy controls should be carefully examined. Should the provider be based outside Australia, the impact of the Australian dollar against other currencies such as the United States dollar and its fluctuation need to be accounted for, as well as the legislative jurisdictions in force in those countries, and any impact of increased network latency. Question 2b. If you are a provider of cloud services, is the description above of cloud services and the outline of its benefits accurate and comprehensive for prospective users who may know little of the details of cloud computing? We believe that the descriptions of Cloud services given in the Consultation paper represent a good starting point. See comments under Questions 1 and 2a. above as to how these descriptions can be improved. AARNet further believes that highly reliable, highly available and secure end- to- end network connectivity from the enterprise to cloud services is paramount, and that this has perhaps not been emphasized enough in the descriptions. We also believe that the customer will need to understand how to prioritize resources for specific service components (compute, storage, backup). These services can be provided to the enterprise as service packages (minimum, typical, premium), or as service components to activate as needed using a customer dashboard. Of course, customers may be tempted to adopt the minimum service levels, whilst expecting high performance or support for growth. Without careful configuration and tracking of usage, the enterprise may experience a sub- optimal experience based on its purchasing decisions. As enterprises move from fixed upfront capital costs for their computing services that can offer some buffer for the future growth, to pay as you use operating costs (often based on complex pricing models), the adage of you get what you pay for will become a more familiar one for cloud services. AARNet recommends that enterprises be mindful of the consequences of a growing dependency on Cloud Service Providers. They need to be able to forecast the growth of service consumption by customers, staff, and suppliers to determine a return on investment. They should be encouraged to establish a risk register and put in place a disaster recovery and data migration plan (for risk mitigation), which is regularly audited and tested to ensure any unforeseen service outages outside their control can be managed effectively. Data Sovereignty, Security and Privacy also need to be better understood so that enterprises can decide on whether to migrate to cloud services hosted in Australia or to other jurisdictions, in order to make realistic comparisons with current in- house solutions. Page 2 of 5

3 Question 3. If you are a potential or current user of cloud services, do you have other concerns about cloud computing that have not been outlined in this section? What are they? There are several aspects of Cloud Services that we believe need further elaboration, some of which we have included above under Questions 1, 2a. and 2b. We also raise a few more below. Cloud Service Performance the network access to and performance of Cloud Service Providers in the end- to- end delivery of services to end users is critical to the successful implementation and uptake of Cloud services within enterprises to support both the producers and consumers of content and services that rely on the cloud service platform. Availability of Services Cloud Providers, especially those in the US, tend to undertake scheduled maintenance outside US business hours that may impact Australian business hours. Furthermore, enterprises often have no opportunity to challenge or delay maintenance or any upgrades that may impact on the service interface or workflows. This may then require test and systems integration work, staff, supplier or consumer training and documentation changes at relatively short notice. Therefore the level of service integration with business processes may determine a greater or lesser impact of any such changes. AARNet recommends enterprises or third parties independently monitor the availability and performance of cloud services on a 24x7 basis to ensure Service Level Agreements are met. Copies of data data should be stored on multiple storage nodes with access to that data restricted to the customer. Backups of the data including versioning control should be supported to enable the rollback of data should data corruption occur. Termination of data Cloud Service Providers should provide enterprises with details of the process to be followed to migrate data away from the Provider s platform. They should also clearly state the time allowed for data to be migrated in the event that the either party chooses to do so. Security and Access Control - Cloud Service Providers should provide full details of the levels of physical and online access control, and of any supported data encryption capability available to prevent unauthorized access of username and passwords or any personal information, including credit card numbers. Cloud Service Providers may want to consider a loosely coupled model where the Cloud Service Provider operates the service platform, the platform accesses customer data hosted on the customer premise in a secure way and other data can be supported too, such as the services of a merchant bank to authorize credit cards, or the querying datasets hosted by a separate institution to provide a result. The decoupling of service from data that the enterprise staff, supplier or customer has requested may add complexity and integration challenges, but it does offer greater security and data ownership control back to the enterprise. Uncertainty about long- term service continuity many potential users of Cloud Services may be deterred by uncertainty about the long- term viability of Cloud Service Providers. Australian enterprises may well prefer to use Australian Cloud Service Providers (for instance, because they are worried about their data being held off- shore, or simply for network latency issues), but these local providers may not survive the intense competition (lower prices, stronger marketing) from bigger international providers, and may be forced out of business. This places enterprises in an invidious position: they have moved to the Cloud precisely to avoid having to worry about how well their data is being stored (for example), but suddenly they do have a very serious worry about the future of their data. This scenario has already been played out in the Australian research sector, where a Cloud storage service ( Data Fabric ) was fairly abruptly terminated when funding ceased in early 2013, leaving researchers who had relied on it having to discover alternatives for themselves. This does not induce confidence in moving to the Cloud. The same may be in the minds of enterprises considering moving to the Cloud. Page 3 of 5

4 Question 4. Are there other disclosures from cloud vendors that have not been outlined in this section? What are they? Disclosures are an important indicator of the ability of the Cloud Service Provider to meet their Service Level obligations. Whilst consumers and relevant authorities need to be informed, it remains unclear how prospective customers can make an informed choice without relying on the media and online discussion forums for publicly available data. Should a provider consistently fail in meeting their obligations (in ways such as listed below), should Australia consider a level of national accreditation? The performance of network, compute, storage components against Service Level Guarantees should be disclosed. Statistics should be provided on the mean time to repair for both scheduled and unscheduled outages. Any breaches or loss of any customer data should be revealed (in case the mandatory legislation is not in place by March 2014). Question 5. Can you outline any experiences you have had with cloud computing which illustrate issues such as data security, data location, privacy or vendor lock- in? Whilst we are unable to provide hands on experiences, we can share how AARNet has attempted to address the issue of data location to deliver a shared storage service. AARNet provides a Cloud- based file transfer service (called CloudStor ) and a Cloud storage service (called CloudStor+ ) that offer uniquely high speed data throughput rates of an order of magnitude greater than available elsewhere. AARNet is able to support these speeds due to the operating infrastructure being hosted directly onto the AARNet4 network at various locations in Australia to which AARNet s Research and Education customers directly connect. The service supports direct high- speed network access data replication. The cost to develop the storage infrastructure and application was considerably lower than if customers had built their own. Furthermore, The Government- funded Research Data Storage Infrastructure (RDSI, which is a national storage array, is likely to be integrated with the CloudStor+ application further leveraging ICT investments for the Australian Research community. Australian located Cloud Service Providers are likely to offer greater network access and cloud service performance levels than overseas counterparts should customers, staff and suppliers be based here. For globally located businesses, the global Cloud Service Provider footprint offers new operating models that are worth exploring. Question 6. If you are a provider of cloud services and products, what is the current state of market confidence in cloud computing, and are there any outstanding transparency issues that concern users? If so, what is the best method of addressing these concerns? AARNet believes that enterprises may move to cloud computing without a comprehensive assessment of the end- to- end costs and benefits for the short, medium and long term. Cloud computing can indeed offer cost effective solutions for operating online services, without the need to manage in- house legacy equipment and services. Cloud computing can enable the re- deployment of staff from back- room tasks to customer focused high touch support and development. However, the costs of end- to- end network access and systems integration and growth in use of services, the degree of dependency on third parties, the effort required to manage third parties, contracts, data ownership and data migration need to be taken into account. We propose two ways to address these issues: (a) establish a best practice cookbook for enterprises, and (b) establish independent and regular audits of cloud service operation and customer services along with service rankings, so that enterprises can decide whether to adopt, continue with or migrate to a Cloud provider. Establishing and maintaining these rankings could require significant effort, and some providers may choose not to participate; those that do may benefit and the market should grow based on quality, flexibility and not just price. Page 4 of 5

5 Question 7. If a voluntary protocol is introduced, do you have any comments on potential compliance costs, jurisdictional complexities and the interaction between the Protocol and other cloud standards currently being developed globally? Compliance costs may be difficult to ascertain, however a community informed living cookbook document of best practice would be a cost effective first step. Reliance on community input may require diligence to ensure feedback is not tainted with a bias. Enterprises or Regulators may want to consider automating the remote monitoring of cloud services for real time and historical trend analysis of cloud service performance. Should a regulator or independent organisation choose to provide this monitoring service, it may be possible to cover costs by offering a snapshot overview to the public, followed by a more detailed paid report for interested enterprises. Question 8. Using the New Zealand Code as an example, are there changes or improvements that could be made which would improve the efficacy of that process in an Australian context? Are there other issues not addressed in the New Zealand Code that need to be considered? The New Zealand CloudCode presents an excellent template for Cloud Service Providers to self- certify their services within an industry brand. What may be lacking is the ability to address compliance outside New Zealand or third party service reviews/audits, monitoring, ranking as a regular activity. AARNet recommends that as cloud computing is so dynamic, that regular monitoring is undertaken to ensure competition and growth does not erode the quality of the services being delivered. About AARNet Pty Ltd AARNet is Australia's Academic and Research Network (AARNet) is the not- for- profit company that operates Australia's National Research and Education Network (NREN). Our shareholders are 38 Australian universities and the Commonwealth Scientific and Industrial Research Organisation (CSIRO). We provide high capacity, leading edge internet and other advanced communications services to the nation's universities, health and other research organisations, schools, vocational training providers and cultural institutions. AARNet serves over one million end users who access the network and services for teaching, learning and research. For more than 20 years, we have shared and exchanged expertise with our customers in many ways, supporting collaboration and innovation in research and education. We have also been effective in making representations to government on policy, legislation, strategy and programs to improve the telecommunications facilities and services available not only to the education and research sector, but to all Australians. Our Board of Directors is responsible for the overall direction of AARNet and for providing benefits to the shareholders as required under the AARNet Constitution. The AARNet Advisory Committee (AAC) provides technical and policy advice to the Chief Executive Officer (CEO). Our team is a small effective group of highly motivated, dedicated and expert staff. AARNet's CEO, together with the Senior Management Team has transformed the strategy of the organisation, enabling one of the largest operational footprints of any national research and education network in the world. Page 5 of 5