NAREIM Session: Dangers and challenges of The Cloud. President, NiceNets Consulting, LLC

Transcription

1 Main Types of Cloud Environments: - Public Cloud: A service built on an external platform run by a cloud service provider such as IBM, Amazon Web Services or Microsoft Azure. Subscribers can get access to a specific application such as Salesforce.com, Sungard Investran, VTS, Hightower, etc. Subscribers can also get access to a complete compute, storage and networking environment through the cloud service provider s portal. This online environment can expand and contract as needed by automatically adding more computing resource and storage space. The network bandwidth from each of your office locations is typically fixed. Planners must make sure that their internet connection is sufficiently large to accommodate the demand. Caution: If you set up a business critical application with customizations and modifications, it could break when cloud service providers apply upgrades or patches to their hosted systems. You could also be faced with penalties and fees if your application must be maintained in a separate environment due to the fact that it cannot be upgraded. - Private Cloud: A platform own with your own hardware and software. It could be in your onsite server room or in dedicated servers in your cabinets at a data center. Since a private cloud is managed by your own internal IT team, it is ideal for businesses that want exclusive access, more flexibility and greater control. Because it is your servers and your IT team, this can be a more costly solution. However, it could be the best stepping stone in your IT strategy for conditioning your organization to a cloud environment. It may be necessary to take this step first due to application modifications, compliance and/or security concerns. - Hybrid Cloud: This service uses both private and public clouds. In a hybrid system, your internal IT would manage in-house servers and storage while the rest is hosted off-site. This is perfect for a company that wants to control sensitive information in house while taking advantage of other hosted services. Experts predict this will be the most common strategy for cloud computing. Integrating your onsite ERP or GL system with data from a hosted solution would be a good example. Main Categories of Cloud Computing Services: - Software-as-a-Service (SaaS): SaaS is a software delivery method that provides access to software and its functions remotely as a web-based service. It can transfer capital expenditures for software licensing to operational expenditures. Salesforce.com, VTS and Hightower are good examples. - Infrastructure-as-a-Service (IaaS): IaaS is a computer infrastructure, such as virtualization, Windows Servers, SQL Database servers, or expandable storage, that is delivered in a public cloud. IaaS platforms offer highly scalable resources that can be adjusted up/down on-demand. This makes IaaS a good choice for applications that are temporary, experimental or could change unexpectedly. IaaS subscribers pay by the drink, typically by the hour, week or month. This pay-as-you-go model eliminates the capital expense of deploying in-house hardware and software. Business cases that plan to use this option should monitor their subscription closely to avoid being charged for extra services.

2 - Platform-as-a-Service (PaaS): PaaS is a cloud model used primarily for software development, so if you re not doing a lot of that, you probably don t need this. Developers typically access PaaS through a web browser. Providers charge for that access on a per-use basis. Some providers charge a flat monthly fee to access the platform and the applications hosted within it. It is important to discuss pricing, service uptime and support with the PaaS provider before engaging their services. Since developers rely on the provider s infrastructure and software, vendor lock-in can be an issue in these environments. Other risks associated with PaaS are provider downtime or provider changing its development roadmap. If a provider stops supporting a certain programming language, developers may be forced to change their programming language, or the provider itself. Both are difficult and disruptive steps. Enterprise Cloud Report: Cloud Sherpas ( Cloud Adoption and Strategy: - Q4: responses from executives (director and above) in IT, Marketing, Sales, Biz Dev - Participating sectors include: Financial, Real Estate (among others) - Although 82% of survey respondents identified cloud technology as a key part of their organizations IT strategy, 41% of those organizations do not have a formal cloud strategy or plan in place to accomplish their cloud technology goals and growing business needs. o They know they need it or feel that it is inevitable, but they don t really understand why yet - Half of Real Estate and Financial view cloud software as central to their business strategy. - Around 1/3 use multiple applications regularly. The rest are just starting or still thinking. - Performance is one of the most important criteria behind cost and security. However, with poor preparation, performance could get worse! - What is stopping companies from being more aggressive to move to the cloud? o Environment complexity (62% agree or strongly agree) o Security (59% agree or strongly agree) o Privacy (63% agree or strongly agree) o Training (53% agree or strongly agree) o Compliance (48% agree or strongly agree) Organizational Technology and Staffing - Public cloud is the most widely used, but the trend is toward Hybrid - Major cloud functions of data center management, software development and consulting o Split between in-house and outsourced staff Cloud Trends: - Annual budget devoted to cloud software. 88% indicated less than 50% of budget to cloud o Of these, network (voice and data) will likely go up when moving to the cloud - Applications mostly focused on and office productivity using multiple applications - Main business drivers are toward agility and business growth

3 Considerations for evaluating a Cloud-based Project Business Case Governance and Executive Support IT Steering Committee: If your company does not already have one, leveraging an IT Steering Committee (ITSC) (or similar governing body) is highly recommended when it comes to reviewing financially significant business cases for technology projects especially those that must align with the business strategy in order to enable its success. The decision to move business critical processes to the cloud should definitely be among those evaluated by this group. Allowing the committee to set the priority and determining the order removes any conflict with the senior IT person and his or her peers. It also ensures that the business drivers for moving to a cloud solution are well understood by senior leadership and department heads. Business drivers typically include (refer to Cloud Sherpas survey results): - Provide agility - Reduce IT expenses - Customer experience - Business growth - Business cost reduction - Capital expenditure change (including cost avoidance) Finally, allowing members of the ITSC to weigh in on project prioritization will give you a good sense of company readiness. If more members are concerned that IT fundamentals (Cybersecurity, Backup/Recovery, Reliability, etc) are not up to par, taking on a cloud project is premature. It will also determine if there is a visible and understood published strategy that identifies why and how the company will embrace this new technology. Data Governance: - Adding interdependent cloud-based applications one at a time will never achieve what a wellintegrated environment can deliver. The strategy of a cloud project business case must include a future state description. Any business case that is piecemealed by a series of disjointed steps to move one (or a few) business applications at a time should be red flagged. - Developing a cohesive strategy is paramount in realizing efficiencies between applications that should be sharing data. If this requires a consultant, these costs should be reflected in the business case. Aligning with a trusted third party: Business cases must identify which cloud service provider has been selected and why they were picked among several competitors. - Operating costs: If a bulk of the operations responsibilities are going to be handled by the cloud vendor, does that business case identify head count reduction in Network Operations? If not, how will those resources be leveraged? - Vendor Lock-in: Be sure to find out the policy for getting your data back if the relationship with this vendor does not work out well. What is the estimated cost if a roll-back plan has to be initiated due to unforeseen issues? The business case must clearly outline costs associated with data ownership and retrieval. It should also reference a fall-back plan.

4 - Ensure your web provider guarantees 100% uptime. A good cloud host uses one or more data centers and load balancers that provide immediate failover whenever a server is lost. - Check support reviews and the references of your selected host vendor. - Check to see if the host is financially stable. Small web hosts go out of business every year. If you re lucky, you may be able to get a backup of your website or hosted application. - Determine if the cloud service provider has included the cost of migrating all data and applications to host servers. If you are going to migrate a few applications to a private cloud and internet services to the public side, determine that ahead of time to avoid costly do-overs. - For applications that need to be accessed by geographically dispersed offices, does the cloud provider already have cloud systems hosted in those regions? - Do you have specific business applications that require a.net framework or other specific plugins to operate correctly? Be sure the selected vendor supports any special coding requirements that have been integrated within your applications. If you find this out after the move, starting over with a new cloud vendor or updating your application can be costly. - Make sure the cloud project business case addresses any compliance-related issues with the cloud vendor. If auditors will need to see SOC1 and SOC2 reports, get copies of these before migrating anything. Managed Services and Support - Even if you get a 100% uptime guarantee, you will need technical support. Be sure the business case includes that option to provide emergency assistance. There is a cost associated with this. - If your business case s ROI formula uses headcount reduction in Network Operations, be sure you are not cutting out all avenues for updating operating systems, checking for malware, updating antivirus and firewall software as well as 3 rd -party software version upgrades. Training Considerations - Cloud host providers offer a control interface that allows you to manage your cloud host preferences, data, web files and backups. Someone (or a few people) will need to be trained on how to manage all of that. Be sure to build training costs into the business case. - End users will need to know what is going to change. If you are using a consultant to provide training sessions or lunch & learns, those costs should be included. - Educating staff about new processes and tool sets, or hiring staff with new skills may be necessary. Business cases should include these costs in their ROI formula. Network Connectivity - If you have data intensive applications that are already struggling on your in-house network, moving them to the cloud will make matters much worse. To compensate for this, larger circuits with greater bandwidth are required. If the business case does not address the capacity of the network connection at all locations required to use the application, it should be red flagged! - Build the added cost of bandwidth for all locations into the overall strategy. Make sure that increased costs are communicated to every cost center that will be impacted. Property Managers who receive larger network charges that were never communicated will not be happy with IT!

5 Business Processes Optimization: Cloud infrastructure and software-as-a-service providers are anxious to show you how easy it is to set up your new environment in their cloud-based servers. However, some of your old business process will not translate well if you don t invest time in redesigning them and training everyone on the changes. Consider the cost of this process with respect to the time required and any consulting hours needed to complete it correctly. - If several of your key financial business processes are still being done in stand-alone spreadsheets with referential links, trying to migrate those to the cloud could be problematic. - Does the business case consider applications that need to be run in offices that are geographically separated? The cost to train new processes should be included. - A critical business application that is performing poorly will most likely run no better in the cloud than on your onsite servers. It may perform worse or not at all. Some applications were not written for a virtualized, multi-tenant, highly scalable cloud computing environment. Modifying or tuning critical applications should be built into the preparation steps for a cloud project. Customized and Licensed Software - If the business case assumes that all of your critical business applications will move to the cloud and all of those in-house servers will be shut down, be sure that all highly customized applications have been evaluated by your application developer and are cleared to run in the new environment. If costly updates and additional modifications are required to prepare each application to run on a new operating system, those costs should be included in the ROI calculations. Most cloud vendor allow for a free trial period to test applications. - Not all application vendors are ready or willing to have their software deployed to a cloud environment. Before you decide to migrate applications to the cloud, review your licenses and check with your vendors first to see if they offer cloud support. If not, those applications will likely have to stay in-house, which changes the ROI on the business case. This is especially true if those servers were ready to be retired and now need to be replaced. Security and Compliance: Companies state that security is the biggest reason they fear migrating their business processes and data to a cloud environment and for good reason! - Cloud hacking will become an unavoidable problem as more companies invest in this solution. Any business case proposing a move to the cloud should be accompanied by a thorough review of all aspects of network security. This should include an independent vulnerability and penetration test by a 3 rd party provider. If you carry weak security policies or network administrative procedures with you, you could be increasing your risk to a data breach. - Develop a Cybersecurity breach response plan before you need it. Knowing where your confidential or personal/private information is on your network and how much of it exists is critical in determining the most appropriate breach response. - Have the IT leadership explain how your current firewall protections will translate to what is being offered by the cloud provider. If your employees who work from home, travel or otherwise connect remotely are already frustrated, be sure the cloud project business case includes licensing for any new firewall application, virtual private network (VPN) client or Citrix expansion requirement.

6 - Examine your on-boarding / off-boarding processes. If old accounts left behind by employees who no longer work for your company are still active, you are at risk! If incoming employees get more access to critical business systems than they need, you are at risk! Moving to the cloud does not improve this situation. Correct all of these problems before making a move! - Clean up who has administrative access to your servers. You don t want to carry over security exposures from your current systems. All of the sophisticated security measures in place by your cloud service provider will be completely thwarted by a hacked account with elevated permissions! The cloud makes this problem significantly worse since administrative access to the cloud management platform can be devastating to your business! - Consider what data or applications your organization will never feel comfortable letting out of your sight. It is a major point of competitive differentiation between cloud vendors. - All compliance documents will need to be revised to include the updated business processes, security controls, disaster recovery and business continuity solutions. Will that be done inhouse or by a consultant? Will administrators in the cloud environment require administrativelevel access to your data? If so, your compliance documents must reflect this. Cost Transfers: The business case should clearly outline which costs currently exist within the onpremise solution that will simply transfer to the cloud-based solution. The top five priorities in most IT budgets are: - Network voice and data communications (which will likely increase in a cloud solution) - Business Intelligence / Analytics - Infrastructure / data center (which will change depending upon the cloud implementation) - Security (which will change in the cloud implementation) - Customer Relationship Management (which will change if included in the cloud implementation) Recommendations: - Start with a solid Governance strategy in place - Carefully select a cloud implementation partner to guide you through this process. The planning phase cannot be underestimated. - Spend time, effort and money on tuning your security practices before attempting a cloud migration. Hiring a partner who can provide independent security assessments, vulnerability and penetration testing and a thorough controls review is well advised. - Invest in training the in-house staff who will be responsible for managing the cloud solution well in advance. - Spend time up front analyzing the network bandwidth requirements from all business locations. Ordering, installing and testing larger circuits can require months of lead time. Don t allow your IT group to transition applications before this step is done. - Transitioning some processes and applications to a cloud environment while leaving others on in-house servers can make a lot of sense. This hybrid solution allows you to pick and choose which ones are ready and which ones need more preparation. - Start with a pilot project and a trial team. If your company is geographically separated in multiple states or countries, having a dispersed team is highly recommended.