Considerations for Organizations Wanting to Move Services to the Cloud

Transcription

1 WHITE PAPER: CLOUD SERVICES Weathering the Storm Who should read this paper This whitepaper is for organizations who are considering moving services to the cloud but are unclear on the options available. This paper discusses the pros and cons of different cloud models and the steps necessary to implement each type of cloud solution.

2

3 WHITE PAPER: CLOUD SERVICES Weathering the Storm Considerations for Organizations Wanting to Move Services to the Cloud Contents Introduction Private and Public clouds Public Clouds and Software as a Service (SaaS) Private Clouds Choosing Your Cloud Moving to a Public Cloud or SaaS Moving to a Private Cloud SaaS - The Easy Way to Move to the Cloud Criteria for Choosing a Cloud Provider Conclusion More Information

4 Introduction While companies have been carefully evaluating whether or not to move to the cloud, the number of products and services encouraging CIOs to make the leap has continued to grow. There is also evidence of increased spending on the cloud; IDC recently announced that spending on public cloud computing services will rise to $29.5 billion by The pressure on CIOs to move to the cloud is extensive, but many questions remain. Cloud services offer many advantages in terms of flexibility and on-demand resources that can give organizations a competitive advantage. However, CIOs have to balance keeping their companies competitive with maintaining the safety and security of the data and business processes they have been charged with. Cloud services like Salesforce.com can give numerous organizations a feature-rich CRM, but it can also introduce new risks. In April 2011, Amazon s cloud offering, EC2, suffered a severe outage illustrating the precarious nature of cloud based services. 2 Many companies that relied on that service lost a great deal of money and customer trust. Though clients of the EC2 service can be compensated for the downtime caused by the outage, the loss of customer trust is much harder to recoup. This whitepaper is designed to give CIOs and IT Directors a guidebook for evaluating cloud services. It will describe the differences between private and public clouds, give suggestions to help organizations best determine how to move to the cloud securely and provide a checklist of attributes to consider when choosing a provider. Private and Public clouds The first thing organizations need to consider as they look towards the cloud is which approach to the cloud they want to take. It may surprise some to learn that despite all the press and discussions around the cloud, there are only two classes of clouds: private clouds and public clouds. There are significant differences between the two classes and each has its own unique set of advantages and disadvantages. Public Clouds and Software as a Service (SaaS) Public clouds are provided by a variety of well known vendors including Microsoft, Rackspace, Symantec, Amazon, and others. By providing stacks of servers all running virtual environments, public cloud environments are designed to provide the following benefits to organizations: Scalability - users have the ability to access additional compute resources on-demand in response to increased application loads. Flexibility public clouds provide flexible, automated management to distribute the computing resources among the cloud's users. Reliability and fault-tolerance - cloud environments can take advantage of their large number of servers by enabling applications to utilize this built in redundancy for high availability. Utility-basedcomputing - users only pay for the services they use, either by subscription or transaction-based models. Sharedresources - by enabling IT resources to be consolidated, multiple users share a common infrastructure, allowing costs to be more effectively managed without sacrificing the security of each user's data

5 CAPEX savings - because the vendor is providing all the hardware, software, support, security, and high availability for the infrastructure, the organization is only paying to use the service and saves a significant amount of money on capital expenditure. While the above mentioned benefits are the key advantages of a public cloud, organizations still need to be cautious before moving to a public cloud. The primary concerns around public clouds today are: Data Access any time data moves outside the walls of the organization, concerns over the privacy and security of the data will come up. A recent (ISC)^2 survey showed data security is the number one concern of security professionals evaluating cloud services. 3 While many cloud providers have extensive security measures employed in their datacenters, it is important to research potential cloud providers and fully vet their data security practices to ensure they are best of breed. Data Control many IT administrators fear that once an application leaves their environment, they will lose granular control over that application. Historically, cloud applications were not as feature rich as premise based solutions because the service was running remotely, but cloud applications have come a long way in recent years and many cloud applications are just as feature-rich as their on-premise counterparts. Readers should investigate or even demo potential cloud-based solutions to ensure that critical features and controls are available in the offering. Vendor lock in once an organization moves their data and applications to the cloud, it can become very difficult to move away from that provider, setting up the potential for extensive costs to move. To reduce this risk, find out the process for extracting your data from the cloud service provider and understand what the transition plan would be to an alternate service. Difficulties maintaining regulatory compliance Some compliance bodies have not updated their standards with provisions around cloud based data. This does not necessarily prevent organizations from moving data and applications to the cloud. Companies must investigate whether a cloud provider s infrastructure processes and stores data in a fashion that meets their compliance requirements. Another option is to ask a potential cloud provider for references with similar regulatory requirements to understand how those companies have maintained compliance. Reliability in theory public clouds offer higher availability than traditional premise based networks because the vendor is providing Service Level Agreements (SLAs) around this availability and has a vested interest in honoring these agreements. Unfortunately, as seen in the EC2 outage earlier this year, even public clouds, if not designed properly, can fail, leaving customers without access to their own data and applications. Readers should seek to understand how potential cloud providers have built their infrastructure to ensure 100% availability. Ultimately, cloud based services can help organizations better manage their computing resources. There are numerous examples of clients using public clouds to quickly stand up applications requiring varying amount of resources, all without having to plan and invest in their own internal infrastructure. This is exactly what the Red Cross did during the Japan Quake relief effort to handle payments and peak loads of their application. By relying on Amazon, the Red Cross could focus on putting donations to work. 3-2

6 Software as a Service (SaaS) SaaS is the best known example of public clouds. SaaS provides a ready-made application platform for users to start using once they sign up for the services. Because SaaS is still a public cloud infrastructure, all the same benefits and cautions apply. However, there are some additional advantages that organizations gain from using SaaS compared to traditional application development. Eliminates the need for patching because the cloud provider is responsible for the patching of the system, this eliminates the need for a patch management system by the client. Automatic upgrades SaaS applications are automatically upgraded by the cloud provider. This ensures that users are always using the latest builds of a given application solving many issues around security and help desk calls that plague traditional applications. Broader community for support and development because the vendor is supporting one application for a large set of customers, that vendor will have a larger community to provide insight, support, and push for more features. Private Clouds As the name suggests, private clouds are designed to be visible only to the organization that creates them. They are essentially private datacenters that an organization creates with stacks of servers all running virtual environments, providing a consolidated, efficient platform to run applications and store data. Private clouds provide a lot of the same benefits to the organization that a public cloud does, but still allows the organization to maintain ownership of the data and equipment. The benefits include scalability, metering and flexible resource allocation, without exposing any of the organization s assets to the public Internet. Private clouds also address some of the top concerns that prevent organizations from moving to the cloud such as vendor lock-in and regulatory compliance in third party infrastructure. However, where private clouds differ from public clouds is that private clouds can require a significant investment. The following are all costs that should be considered by organizations looking to create a private cloud: Hardware and software purchases to create a private cloud, the organization much purchase all the servers, virtualization software, application licenses, and networking hardware to create the private cloud. Additional system administration costs the organization must also bear the costs of upgrading and adding resources as the cloud grows. Additionally, all the traditional costs of managing servers must be considered. Specialized IT skills needed - the skill set required for the IT department to deploy, manage, and maintain a cloud environment will be different from the skill set they utilize for their on-premise systems. This could require hiring a consulting firm, training existing staff, or hiring new employees to manage the new infrastructure. High availability and disaster recovery the organization will have to invest in additional resources to ensure that the private cloud maintains full-time availability and is fault tolerant. 3

7 Reduced economies of scale Although a large organization will reap the benefits of scalability and flexible resources using a private cloud, the efficiencies and cost savings will be limited by the company s size. The more users that are on a cloud environment, the higher the efficiencies will be. Despite these challenges, private clouds can provide significant advantages to organizations that need the flexibility and on-demand resources offered by the cloud, but cannot move the data outside of the organization. Choosing Your Cloud For an organization that is evaluating the different cloud options, the next step is to understand the process of moving to the cloud. Each class of cloud requires unique steps for migration. Moving to a Public Cloud or SaaS Since public clouds are set up to be open to the general public, acquiring the initial resources is straightforward. Public clouds are designed in a way that make it very easy for IT departments to start small and expand to more users, making public clouds ideal for testing. The steps required for an organization to move to a public cloud are: 1. Choose a provider 2. Create the infrastructure on the cloud platform 3. Create the applications on the cloud platform and migrate data 4. As the organization s use of the cloud grows, simply pay incrementally for the increased usage Moving to a Private Cloud Moving to a private cloud is a more involved process than moving to a public cloud. The private cloud has to be created before any data or applications can be migrated to it. The steps required to create a private cloud are: 1. Acquire the hardware and virtualization software 2. Create the infrastructure 3. Add security, high availability, and disaster recovery 4. Migrate applications and data 5. Provide ongoing maintenance to the cloud, buy new hardware and software as needed 6. Expand the infrastructure as usage grows 4

8 While private clouds are a necessity for some organizations, they require dedication and strong upper management support to ensure that the whole process is followed through from start to finish. As mentioned earlier, private clouds eliminate many concerns around security, but do require extensive CAPEX to be realized. SaaS - The Easy Way to Move to the Cloud There s no doubt that a company contemplating the move to the cloud faces some difficult challenges. However, the cost benefits and advantages provided by a cloud infrastructure have been shown time and time again. As a result, companies wanting to stay competitive need to evaluate cloud services. The simplest and easiest way for a company to begin testing the cloud is with SaaS. There are many SaaS services that can be moved to the cloud. CRM and are some of the best known examples but there are a number of other services such as messaging and Web security, archiving, and backup that can also be moved to the cloud. Starting the cloud journey with security services is ideal because organizations can get a feel for how cloud services operate while offloading time intensive tasks. Consider the management of endpoint security for your organization and the challenges involved in that process. It requires dedicated servers, patching, managing version control, computing resources and system administrator time in order to make endpoint security run reliably. Using cloud services to offset the challenges of endpoint security is a great option. Symantec Endpoint Protection. cloud allows you the deployment simplicity of out-of-the-box AV while still giving you management over the agents thanks to the hosting of the management infrastructure. 4 Criteria for Choosing a Cloud Provider Now that you have made the decision to move to the cloud, how does one choose a provider? Given the number of vendors offering cloud solutions, organizations have more than enough options to choose from. There are some key attributes one should consider when evaluating cloud service providers: Reputation. How long have they been offering cloud services? Security is key. Really understand how secure your data needs to be, and ask the vendor how they would solve your security problems. Backing up and Moving Your Data. Investigate how the cloud provider makes back-up copies of your data, how you can move the data to another provider. Service Level Agreements. Work hard to get a good service level agreement with clear financial penalties to ensure a good service. Be Careful of Certifications. Certifications capture just a moment in time. Do your own research on how the vendor is performing. Ask questions of other customers. Try Before You Buy. The beauty of cloud computing is that it's easy to switch on and off. Obviously don't start your cloud adventure with confidential data or mission-critical systems, but if the service works for you, you can expand

9 Conclusion Moving to the cloud can seem overwhelming, and there are numerous options to consider. However, by taking incremental steps into the cloud with a trusted provider, organizations will realize significant benefits in terms of cost savings and efficiencies gained by moving to the cloud. Organizations need to realize that they control their own destiny in moving to the cloud. Ultimately the choice to start with a public cloud, private cloud, or SaaS comes down to the specific requirements of the organization. 6

10 More Information AMERICAS UNITED STATES 512 Seventh Avenue 6th Floor New York, NY USA Toll-free CANADA 170 University Avenue Toronto, ON M5H 3B3 Canada Toll-free : EUROPE HEADQUARTERS 1270 Lansdowne Court Gloucester Business Park Gloucester, GL3 4AB United Kingdom Tel +44 (0) Fax +44 (0) Freephone LONDON 3rd Floor 40 Whitfield Street London, W1T 2RH United Kingdom Tel +44 (0) Fax +44 (0) Support +44 (0) NETHERLANDS WTC Amsterdam Zuidplein 36/H-Tower NL-1077 XV Amsterdam Netherlands Tel +31 (0) Fax +31 (0) BELGIUM/LUXEMBOURG Symantec Belgium Astrid Business Center Is. Meyskensstraat Wemmel, Belgium Tel: Fax: DACH Humboldtstrasse 6 Gewerbegebiet Dornach Aschheim Deutschland Tel +49 (0) Support :+44 (0) NORDICS St. Kongensgade Copenhagen K Danmark Tel Fax Support +44 (0) ASIA PACIFIC HONG KONG Room 3006, Central Plaza 18 Harbour Road Tower II Wanchai Hong Kong Main: Fax: Support: AUSTRALIA Level Kent Street, Sydney NSW 2000 Main: Fax: Support: SINGAPORE 6 Temasek Boulevard #11-01 Suntec Tower 4 Singapore Main: Fax: Support: JAPAN Akasaka Intercity Akasaka Minato-ku, Tokyo Main: Fax: Support:

11

12 About Symantec.cloud Symantec.cloud, a division of Symantec Corporation, offers customers the ability to work more productively in a connected world. More than 31,000 organisations ranging from small businesses to the Fortune 500 across 100 countries use Symantec.cloud to administer, monitor, and protect their information resources more effectively. Organizations can choose from 14 preintegrated applications to help secure and manage their business even as new technologies and devices are introduced and traditional boundaries of the workplace disappear. Services are delivered on a highly scalable, reliable and energy-efficient global infrastructure built on fourteen datacenters around the globe. Symantec.cloud North America 512 7th Ave. 6th Floor New York, NY USA 1 (646) (866) Symantec helps organizations secure and manage their information-driven world with managed services, exchange spam filter, managed security services, and antivirus. Copyright 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. 6/