Taking Control of Your Cloud. How to get the best out of cloud providers & ensure cloud success. Powering IT

Transcription

1 Taking Control of Your Cloud How to get the best out of cloud providers & ensure cloud success. Powering IT

2 Executive Summary Pulsant believes that obtaining a consistent high performing cloud platform, which delivers capacity, security and compatibility with guaranteed uptime are the key priorities for anyone seeking to choose a long term cloud provider. Not surprisingly, cloud now represents a huge revenue generator for many would-be cloud providers and IT players. We now see telecoms, internet and IT technology brands competing with traditional enterprise providers. In September 2012, Gartner predicted that by 2016, the entire cloud market will nearly double, representing a $206.6 billion services industry, with IaaS dominating a large part of the marketplace. What is less well publicised is the fact that this upturn in cloud demand will also mean that enterprises and SMBs will experience escalating costs tied to inefficient cloud use where providers implement public cloud applications that are not managed by or integrated into the company s IT infrastructure. While there is no disputing that cloud computing creates great opportunity for innovation, agility, flexibility and often cost reduction, the increasing number of new cloud providers and big brand public cloud platforms is creating a huge disparity in the quality and suitability of outsourced cloud for business. Determining suitability amongst these providers is becoming increasing difficult, particularly in light of recent high profile downtime experienced from consumer services like Tumblr and DropBox, to enterprise services such as Salesforce.com, Google App Engine, Amazon AWS and Microsoft Azure which is proving to be far more than just an occasional blip. When considering any cloud provider it is also extremely important to determine sustainability, as much as platform suitability, as has been highlighted recently, consider the organisations overall stability, and investment programme, and look at how they will ensure the services they offer today will remain current in the future, looking for a platform that can deliver on the evergreen promise is important. There are specialist enterprise-grade cloud providers out there, but businesses need to work hard to find them, and find one that meets their capacity, performance, suitability and availability needs. This white paper provides an overview of the key factors that should help influence the cloud decision-making process, it also reveals how cloud buyers can increase the effectiveness of their procurement procedures by asking tougher and more insightful questions that pay closer attention to their requirements and cloud provisioning in terms of performance, guarantees and SLAs. 2

3 Critically Assessing Cloud Organisations are typically migrating to the cloud to gain competitive advantages around performance, agility and flexibility. In fact, more than 90 per cent of all organisations are at least discussing cloud - up from 75 per cent a year ago - according to a survey released in January 2013 by Symantec. CIOs and other IT decision makers must carefully consider their choice of cloud providers, and actively determine which providers will deliver a quality experience that justifies their long-term trust and investment. In part this means accepting that all clouds are not built equal. It also requires acknowledging that cloud is no longer a new model but now a crucial part of an organisations IT infrastructure. As such it must firstly be critically assessed, and importantly reassessed and not excused in the event of failures. It must also meet the needs of the business, and where necessary integrate seamlessly with on-site applications, or other hosted services. Cloud can no longer sit alone as a development environment, and applications be manipulated to fit it. Cloud must work for you. Additionally as organisations invest more of their IT spend on managed, private and hybrid clouds, no provider should have a get out of jail free card for cloud when it comes to downtime, slowdowns, identity thefts, data loss, and other failures or be allowed to offload the blame of poor performance onto the end users. Pulsant believes that taking control and asking more informed questions at the selection process is the best place for businesses to start. Understanding business priorities is key to cloud success As cloud becomes an increasingly strategic tool within the organisation, more emphasis will be placed on defining the business case for cloud to justify its value and how this can be offset against potential risks. Pulsant believes that, with advance preparation, businesses can shape safer, more agile and efficient clouds that will enable them to meet their business goals safely and securely. Working with over 3,000 clients, Pulsant has identified the following strategic priorities for businesses looking to outsource elements of their data provision and how cloud infrastructure can be used to contribute to their realisation: Encouraging Growth Unlike physical servers that have a storage limit, cloud s virtualised platform is elastic and can be scaled up as your business grows. It removes the constraints of having to add and configure new hardware to accommodate major projects, new applications or expanding digital presence. Look for a platform that offers true flexibility, and one that can meet your capacity and performance needs now and in the future. Ensure the provider is not tied to the current technology deployed, and that they have the means to evolve as technology and service needs change. 3

4 Reducing Cost With cloud you only pay for what you use, and as the service is built on virtualised platforms using the latest server technology and highly capacity efficient storage, it can reduce power consumption and operational costs by as much as 40 per cent compared to a like for like physical platform. If cost is key in the decision, ensure you have absolute clarity in what you are comparing, and what you are getting in terms of capacity, expandability, and service. Improving Service Cloud s flexibility lets you respond faster to the changing digital requirements of your business. Using cloud means you don t have to constantly monitor and manage your servers, allowing you to focus your own IT resources on customer facing activities that improve service. Environment Concerns Often up to per cent more efficient than traditional server solutions, virtualised platforms can reduce power consumption dramatically. Make sure your cloud provider has an environmental policy and is committed to renewable energy sources. Managing Risk There has been much debate about cloud resilience, particularly from large-scale commodity-based public cloud providers. However, if properly managed and supported, cloud offers more resilience than traditional systems. If a server fails, then the load automatically switches to other servers in the cloud to keep your applications live. Ensure the provider you choose provides the appropriate level of service guarantees, and you understand how their platform deals with failures, and recovery. Governance Requirements For businesses working in tightly regulated environments cloud solutions need to be properly assessed in terms of compliance, security and data location. Private cloud facilities are available that provide the flexibility and cost advantages of a virtual platform but in a controlled environment that is specific to that client. Dedicated cloud is capable of delivering PCI compliant platforms for ecommerce. In addition, some cloud providers including Pulsant ensure data provenance to help users conform to European data legislation, consider where your data will be stored, and any impact that may have, whether legal or not your customers may need to know. By understanding how and why you want to migrate to cloud, you can more accurately select a provider that will support you in achieving your operational and strategic priorities. 4

5 Staying Safe in the Cloud Most potential failures lie in how cloud is applied, maintained and supported. It is vital for businesses to ensure that SLAs reflect this and are established at the outset when the right supplier is being sought. Pulsant offers the following guidelines to help define optimum service levels for your requirements: Identify User Access Safeguards Make sure your cloud provider can supply specific information about the privileged administration rights to any information stored within the cloud environment, and can tell you exactly what access controls are in place. Ensure Regulatory Compliance If you re involved in a tightly legislated industry make sure your cloud platform supports any relevant data standards. For example retailers and ecommerce providers are required to ensure PCI DSS compliance. If the hosting platform is already pre-certified it can help reduce scope lessening your operational burden without compromising security. Specify Data Location For certain data applications, particularly those involving financial services or sensitive customer details, organisations may need proof of location. From a legal point of view, this may mean restricting it to certain countries. Some suppliers rely on offshore datacentres for storage provision. Make sure your cloud provider is aware of any location sensitivity and can respond with clear and exact details of where your data is stored. Getting your cloud from an in country local data centre can also help address issues associated with latency if you need to be able to access information in real time. Insist on Proper Data Segregation Firewalls are vital in the cloud. However, some cloud vendors provision the virtual machine (VM) directly on the internet without any form of separate firewall, leaving it up to the business to lock down their data on a local level, either using the capabilities of the OS or implementing other services, which may incur additional costs. Ensure your provider uses virtual data centre technology to provide segregated environments on a shared platform with virtual or physical firewalls as standard and can provide assurances and SLAs that ensure nobody else will be able to access your data. Outline Options for Recovery While not strictly a security concern, back-up is important to safeguard your data. Your cloud provider should be able to counsel you on worst case scenarios to help you ensure that the correct level of replication is built in from the outset and an appropriate backup regime is established. Request Investigative Support to Flag up Risks This isn t always practical in a large multi-tenant cloud environment, as distinguishing each business s traffic from the other customers can be extremely difficult. However, if you require such levels of security ensure your cloud provider can design and deploy additional security services including managed intrusion detection services within the cloud environment. This ensures that all data is passed through a network intrusion detection system (NIDS) device and monitored by support personnel 24/7. You get an instant alert if there is an attack and evidence and monitoring for retrospectively investigation should a breach be discovered. 5

6 Grilling Cloud Providers For businesses who take the strategic decision to move some or all of their entire infrastructure to a third party cloud provider, finding the perfect partner can be a complex process. The myriad of players, solution types and SLA scopes can lead to much confusion and make it difficult to compare like for like. Lack of Regulation Calls for Greater Care A lack of industry standards means there are no regulations around the provision and supply of cloud services, so users have no rubber stamp to certify cloud or service quality. As the cloud standard debate goes on, there exists a temptation for businesses to postpone their cloud investment through fear of poor provisioning. Internal IT may also consider to go it alone without the specialist infrastructure design and support they need, Pulsant cautions against this. Rather it s time to take better control of the selection process by obtaining more comprehensive details on cloud propositions early in the selection processes, not just something tackled at the contract stage. Here Pulsant offers seven key questions that will help grill your potential providers more effectively and ensure their cloud is the best fit for your business. Pulsant s 7 Questions for Wiser Cloud Provisioning 1 What is the real cost of cloud, in terms of support, provisioning, and risk? When it comes to enterprise provisioning, cloud should not be seen as purely a cheap or commodity option where capacity can be priced up wholesale. Cost is not the same as value which requires an inherent consideration of the benefits and also the risks. Additional costs can include charges for bandwidth and connectivity between your own servers, overage charges when you exceed expected use or a support charge every time you call an engineer. Assessing hidden costs should also include things such as hiring staff with specific knowledge of developing and supporting your apps, or using the tools to provision and manage the capacity of certain cloud providers; the potential cost of an outage; and the cost of rebuilding a customer relationship if you aren t supported correctly. When assessing the cost of Cloud, don t just look at the on-going capacity and service costs, consider the cost of getting on the cloud, both in terms of any application development and migration. Ideally choose a provider who does not need you to re-write or change you applications, and one that can provide the professional services to help get you into the cloud. How will you manage data migration, and access to the services during migration, co-existence can be complicated, cloud should not make it more so. 2 What resources am I guaranteed? Cloud performance is governed by availability of the platform resources at any given time. It is the measure by which requirements are often scaled and which, ultimately, is used to calculate the price for the service. While various providers have created ways to measure performance, such as CPU time, this doesn t necessarily give an accurate indication of the performance of business applications. Within a shared cloud other businesses users may commandeer resource at the same time as you need it, dramatically reducing your resources. It is, therefore, important to know, in real terms, what the availability and capacity figures you are quoted mean in terms of: Infrastructure response time CPU usage (all CPUs, per CPUs and delta between CPUs) Disk latency Disk usage (total, free, used) Percentage busy and ready Memory percentage used and swap activity Network (bytes in/out) Host system state Host system resource usage Virtual machine configuration Virtual machine state 6

7 3 Where is my cloud hosted and my data stored? And where could it be replicated to? Cloud computing s very nature implies a certain vagueness as to where systems and data reside both physically and legally. A physical data storage in the UK but owned by a US entity, for example, raises significant questions as to how secure data is see the Patriot Act s impact on data security as an example, also consider any potential security and privacy implications that may apply through FISA if your data is stored within the US. Knowing where data is, as well as where it could be, is very important for retail, financial service and any business that is required to safeguard customer data. To protect their interests, more and more companies are seeking to use UK cloud providers with wholly owned data centres and those who can guarantee the exact location of their servers whether real or virtual. 4 What network separation and security protects my services and data from the cloud provider s other customers? Some wholesale cloud providers use a combination of cheap server technologies and heavily automated IT processes to keep costs down. While this may be fine for some basic enterprise requirements, it restricts configuration potential and provides limited support for critical applications. It also means some fundamental infrastructure concepts are not included in the service e.g. physical firewalls, logical network separation between customers or being able to deploy genuine multi-tiered, secure web applications. In these cases,the responsibility for basic security remains with the customer. While more comprehensive enterprise cloud services, which allow bespoke tailoring and managed infrastructure, may seem more expensive, they can actually work out more cost effective as they not only boost performance and enhance security but also free internal IT resources from on-going cloud provisioning tasks. 5 What resiliency features does the cloud platform provide and how do they work in the event of a failure, will I suffer from data loss or corruption and what is the recovery time? There are a whole raft of strategies to creating resilient infrastructures. Where requirements are business critical and need a high level of reliability, customers need to understand the resiliency features of both the business application and the cloud platform, as well as how they work. For example, building application resiliency across multiple virtual servers on the same cloud platform is pointless if a single problem on the cloud platform itself takes out both. Likewise, relying on cloud platforms that claim failover capability can also be ineffective if the failover mechanisms take several hours to restore service and create an inherent risk to data integrity. Consider the level of availability you need when choosing a cloud platform, some providers state a headline figure of 100% availability, ensure they can provide this through their chosen platform and configuration, check the SLA will actually guarantee this. Consider recovery time, and what you require for Disaster Recovery. Having 100% availability may on the surface seem perfect, but delivered in a single datacentre with an 8 hour recovery time objective and a 24 hour recovery point objective might not actually deliver what your business needs. You don t always need such high levels of availability, but make sure that in the effect of an outage, you are able to be back online within your business requirements. 7

8 6 How should I best design my application to maximise availability? Some providers may advise that solutions need to be doubled up across multiple zones to reduce risk of failure. This has a significant cost impact, which needs to be offset against the inherent risk and subsequent cost of failure to the business. The nature of reliability capabilities is normally clear in the SLA being offered - be sure to check the fine print for details of any exclusions. 7 Do you provide 24 hour direct access to knowledgeable technical support staff and what additional technical services do you provide to ensure my continued effective use of your service? Support for cloud infrastructure is critical. While working hours support with a four hour turnaround is all very well for reducing costs, at a real time of crisis it may not provide the support you need to provide a fast fix or help you deal confidently with the situation. For critical applications, direct access to knowledgeable support, 24 hours a day is essential. By moving to the cloud you shed the responsibility for running the underlying infrastructure but that comes with a price. You place complete reliance on external technicians to keep it running, make sure they can deliver. A 24 hour outage for an ecommerce presence can be ten times more costly than paying for a hosting service that wouldn t have broken or would have been fixed faster. Beyond direct technical support, strategy and architectural support can also be valuable resources. From some providers this is just part of everyday operation, ensuring their customers are making the most of the platform. For the more hands-off commodity cloud providers, this is left entirely in the hands of the customer. 8

9 Conclusion While some still see cloud infrastructure as a utility-based resource, many more now appreciate its role as a strategic business tool which can be fine-tuned to address specific operational agendas. Consequently, CIOs seeking to enhance their business contribution, are now taking a more proactive stance in building successful cloud outcomes by shaping storage provision in line with their commercial priorities. Those who do can create a more effective roadmap for growth, risk reduction and competitive success. Pulsant wants to make it clear that just as all clouds are not the same public, private, managed or enterprise - not all cloud providers or their SLAs are the same. While cloud technology helps unlock cost, scale, efficiency and performance returns, it is the service and care that is wrapped around the cloud provisioning that ensures it really delivers. To make sure that their enterprise cloud provides a perfect fit, Pulsant recommends the following: Before specifying your cloud type or provider, understand clearly what you want cloud to achieve for your business. Whether you want to be faster, leaner or greener, cloud can be shaped around your key strategic goals to deliver better value and return on your investment. Seek partners that are able to secure your cloud and offer long term viability and a good attitude. Make sure your cloud computing vendor is stable and that your contract covers every eventuality. Be sure it offers a safeguard should the provider be acquired by another company; and that it includes ways of getting your data back. Select a provider with open, helpful and customer-focused support staff because, at the end of the day, security is about being able to rely on people you can trust. Don t be afraid to ask questions that are important to your business. And demand answers. A reputable cloud provider will happily share information in terms of location, platform and infrastructure. The most flexible ones will be prepared to shape their cloud solution service models to suite your specific requirements. It s about taking control of cloud and not letting it drive you. With so much choice on offer, there is no excuse for settling for an unreliable and inflexible cloud that simply doesn t live up to your operational or performance goals. By refusing to compromise on basics and insisting that cloud providers accommodate specific enterprise requirements, Pulsant believes that all businesses can get the scale, security and support they need to reap the broadest benefits and achieve the best cloud experience possible. About Pulsant: Experts in cloud, data centre and infrastructure services, Pulsant specialises in highly resilient, high quality IP network, colocation, managed application and cloud hosting. Pulsant supports more than 3,000 mid-tier and enterprise customers from its ten UK-based ISO compliant data centres. We provide world class technology and exceptional people creating advanced and innovative solutions that optimise performance and cost effectively manage, store and safeguard data. Pulsant s Triple-A service models ensures the right Access, Ability and Action to deliver 24/7 support from multiple UK-based operation centres. 100% of the energy used within our data centres is from renewable sources. Pulsant is an HP Cloud Agile partner. For more information, please visit or sales@pulsant.com 9