Storm Clouds Ahead? A risk analysis of Cloud Computing

Transcription

1 Storm Clouds Ahead? A risk analysis of Cloud Computing Andy Bolton Chief Executive Officer, Capacitas Abstract Many organisations are now considering using 'Cloud Computing' offerings to meet their scalability issues, environmental commitments and cost constraints. This could be a risky approach as many important areas of Cloud computing are yet to be fully understood within IT departments; these include the security model, data protection, resilience and transaction performance. Service management aims to provide consistent, reliable and cost-effective ICT services to its customers. These goals could come under threat as the pressure to adopt Cloud-based services increases unless a thorough understanding of the design and implementation constraints of Cloud computing are understood. Additionally the Cloud business model introduces its own open-ended financial risks to an adopter. This presentation and associated whitepaper will describe a risk analysis of Cloud computing from a Service Management perspective and recommend some mitigation that could be considered to protect adapters. 2

2 Agenda Introduction Risk Management Service Management Service Capacity Service Cost Service Performance Summary 3 Introduction The IT industry has evolved over the last fifty years, changed paradigms constantly: from single, hugely expensive mainframe systems back in the 1960s and 1970s; through the rise of the personal computer in the 1980s; the associated explosion in distributed computing in the 1990s and server sprawl; and through to the new era of consolidation back onto centralised platforms. 4

3 Centralised Computing Paradigm ( ) Files Applications Databases Dial-in or Leased Line Local users Remote user 5 Distributed Computing Paradigm ( ) Application Database Web File Dial-in Local users Remote user 6

4 Distributed Computing Paradigm ( ) Application Database Web File VPN over Internet Local users Remote user 7 Distributed Computing Paradigm ( ) Application Database Web File Web Services Internet VPN over Internet Local users Remote user 8

5 Distributed Computing Paradigm (2005-) Application Database Web File Web Services Cloud Provider Internet VPN over Internet Local users Remote user 9 Cloud: the next step in Virtualisation? We have now virtualised many aspects of computing (i.e. consolidated onto larger platforms): Computing power (e.g. VMware servers) Networks (e.g. VPNs) Storage (e.g. SANs) Desktops (e.g. Citrix) 10

6 Cloud: the next step in Virtualisation? Fibre Channel SystemGuard Environment Storage Array Application A Application B Application VPN Application A Application B Virtual Disk A Virtual Disk B Guest Operating System Virtual Machine Guest Operating System Virtual Machine Virtual Hardware Virtualisation Layer Software Hardware Data (Profile and documents) System Services (Windows services, COM, OLE, printers, etc) Desktop Operating System Configurations (Profile and documents) 11 Typical Cloud Architecture Cloud Provider Web s End-User Services Application s Database s Storage s Authentication s IT Management Billing s Provisioning s Systems Management End-User Contract SLA Billing 12

7 Cloud Service Providers Some of the leading providers of Cloud services are: Amazon Google Microsoft Rackspace Salesforce 13 Some Cloud Services Available Web s (e.g. Apache, IIS) Application s (e.g. Java, Linux, Windows, Solaris) Queue Services Database s (e.g. Oracle, SQL ) Storage Services 14

8 Risk Management Definition of Risk Management: The proactive identification, analysis and control of those risks which can threaten the assets or the earning capacity of an enterprise Institute of Risk Management The art of risk management is to identify all risks and to reduce them to an acceptable level. 15 Risk Management a b Risk Tolerance Limit Impact Do not proceed d Assess & decide Safe to proceed c Likelihood Figure Crown Copyright

9 Service Management Service Management aims to provide to its customers consistent, reliable and cost-effective ICT services. Applying risk management definition to service management: The art of service management is to identify risks to service and provide mitigation to reduce them to an acceptable level. Three aspects will be briefly reviewed here: Service Cost Service Capacity Service Performance 17 Service Management (ITIL V3) Service Strategy Service Design Service Portfolio Service Portfolio Design Service Economics Service Catalogue Management IT Financial Management Service Level Management IT Demand Management Supplier Management Strategies for: Capacity Management Outsourcing Insourcing Co-sourcing Continual Service Improvement Service Operation Service Strategy ITIL Service Design Continual Service Improvement Availability & Service Continuity Management Information Security Management Service Operation Service Transition Service Request Management Event Management Incident Management Problem Management Service Transition Change Management Service Asset & Configuration Management Knowledge Management Service Release Management Access Management Deployment, Decommission & Transfer Figure Crown Copyright

10 Service Management & Risk Management Demand-side risks Risks acceptable to the supplier Business Operations Customer assets Service assets Service Operations Risks acceptable to the customer Supply-side risks Service Management as a risk filter Figure Crown Copyright Managing Service Capacity One of many reasons for companies to adopt Cloud computing is the difficulty in forward planning of service capacity to meet demand. This has many repercussions. These include: Inability to reduce or prevent capacity-related service outages; Inability to accurately forecast when additional capacity is required; Inability to identify when capacity can be reduced; Inability to plan capacity purchases in advance preventing cost-effective procurement; Inability to forecast costs of the infrastructure and provide accurate budgets; Inability to relate customer-driven demand units to capacity required. Too many organisations therefore undertake easier, reactive capacity management activities. 20

11 Managing Service Capacity Managing Service Capacity Managing Demand Managing Supply Developing Complementary Services Partitioning Demand Sharing Capacity Increasing Customer Participation Developing Reservation Systems Offering Price Incentives Cross-Training Employees Scheduling Work-Shifts Promoting Off- Peak Demand Using Part-Time Employees Creating Adjustable Capacity Service Management: Operations, Strategy and Information Technology. 2 nd Edition, 1998, Fitzsimmons and Fitzsimmons Yield Management 21 Managing Service Capacity Where is Cloud? Managing Service Capacity Managing Demand Managing Supply Developing Complementary Services Partitioning Demand Sharing Capacity Increasing Customer Participation Developing Reservation Systems Offering Price Incentives Cross-Training Employees Scheduling Work-Shifts Promoting Off- Peak Demand Using Part-Time Employees Creating Adjustable Capacity Service Management: Operations, Strategy and Information Technology. 2 nd Edition, 1998, Fitzsimmons and Fitzsimmons Yield Management 22

12 Relationship between Demand, Supply & Cost Capacity Plans Demand Forecasts Finance 2. Capacity Planning translate demand forecasts into capacity plans identifying the financial costs Capacity Planning 1. Marketing & Sales provide forecasts of customer demand in order that sufficient capacity is available when needed Marketing & Sales Budget 3. Finance approve or deny budgets required to meet the forecast business demand 23 Cloud Service Costs The comparative cost advantage of the Cloud business model is contentious at best. There are many reports that claim Cloud is less expensive than conventional in-house computing. However there are also reports that claim the opposite. The answer is not in this presentation I m afraid! Some contradictory resources: Forrester report: The ROI Of Software-As-A-Service, by Liz Herbert and Jon Erickson CMG MeasureIT 8.2: Capacity Concerns in a SaaS and Cloud World 24

13 Cloud Service Costs Pricing Models Pricing tend to be based on utility models, often comprising a mixture of the following methods: a subscription fee (e.g. monthly) a resource usage fee (e.g. CPU seconds, GB storage, GB I/O) a transaction fee (e.g. # of transactions processed) This pricing structure is comparable to buying utilities, such as gas and electricity, hence the term utility computing. 25 Cloud Service Costs Example Pricing An example pricing model is described below: Processing: 0.10 per CPU available per hour Storage: 0.12 per GB stored per month Storage transaction: 0.01 per 5,000 transactions Data transfers: 0.05 in / 0.10 out / GB 26

14 Cloud Service Costs: Pricing A Case Study So, using an example of the following IT user company who are investigating pricing based on their current key online service: Resource Pricing Volume Unit Rate per Unit Per month Processing 4.8 Cores per hour Storage 2,000 Avg GB per GB per month Storage Transactions 12,000 Avg / hr per 5, Data In 150 Avg Mb/s GB , Data Out 150 Avg Mb/s GB , Assumes 30 days / month TOTAL 6, Cloud Service Costs: Pricing A Case Study The pricing on the previous slide compares favourably to buying server hardware, the appropriate licensed software and paying a recurring fee to host in a shared data centre with the appropriate network bandwidth. Also as this is operational expenditure, it is tax efficient, like leasing, compared to purchasing hardware and software. However, the hosted solution has one advantage. The cost is predictable every month. The cost of the Cloud solution is variable based on its usage. 28

15 Cloud Service Costs: Pricing A Case Study Imagine a doubling of transactional demand. This would impact processing, transactions and I/O (though not necessarily the total storage): Resource Pricing Volume Unit Rate per Unit Per month Processing 9.6 Cores per hour Storage 2,000 Avg GB per GB per month Storage Transactions 24,000 Avg / hr per 5, Data In 300 Avg Mb/s GB , Data Out 300 Avg Mb/s GB , Assumes 30 days / month TOTAL 12, This results in a near doubling of costs 29 The Implication of Utility Pricing While there are many advantages with adopting a Cloud model, there is a risk of this uncapped pricing scheme resulting in unexpectedly large bills. IT organisations like budgets! These are designed so that the company knows in advance what the annual ICT expenditure is likely to be. Cloud introduces a completely variable cost item into the financial model. This doesn t mean it s unpredictable, but unless there is some way contractually to cap the volumebased fees this is a risk. 30

16 The Implication of Utility Pricing on Outsourcers The variability of the utility pricing model can have a considerable impact on Outsourcers. Their customers expect a fixed price for their contracts, especially in the public sector. The public sector often plans budgets out as far as 3 or 5 years, so cost variability is unwelcome. They frequently specify caps for transaction volumes. An outsourcer who wants to provide or use a Cloud-based infrastructure may have to carefully structure contracts to avoid paying for its customers excess demand. 31 Financial Risk to Outsourcers Jan-09 Feb-09 Mar-09 Apr-09 May-09 Jun-09 Jul-09 Aug-09 Sep-09 Oct-09 Nov-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Oct-10 Nov-10 Dec-10 Jan-11 Feb-11 Mar-11 Apr-11 May-11 Jun-11 Jul-11 Aug-11 Sep-11 Oct-11 Nov-11 Dec-11 32

17 Financial Risk to Outsourcers Service cap is breached Unexpected leap in demand Jan-09 Feb-09 Mar-09 Apr-09 May-09 Jun-09 Jul-09 Aug-09 Sep-09 Oct-09 Nov-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Oct-10 Nov-10 Dec-10 Jan-11 Feb-11 Mar-11 Apr-11 May-11 Jun-11 Jul-11 Aug-11 Sep-11 Oct-11 Nov-11 Dec Financial Risk to Outsourcers Service cap is breached Outsourcer liable for this cost Unexpected leap in demand Jan-09 Feb-09 Mar-09 Apr-09 May-09 Jun-09 Jul-09 Aug-09 Sep-09 Oct-09 Nov-09 Dec-09 Jan-10 Feb-10 Mar-10 Apr-10 May-10 Jun-10 Jul-10 Aug-10 Sep-10 Oct-10 Nov-10 Dec-10 Jan-11 Feb-11 Mar-11 Apr-11 May-11 Jun-11 Jul-11 Aug-11 Sep-11 Oct-11 Nov-11 Dec-11 34

18 Service Performance When IT infrastructure is kept in-house monitoring and measuring service performance at each step of a transactional path is achievable, though it is not frequently not undertaken. However as more companies adopt formal Service Management processes such as ITIL there is the need to establish Service Level Agreements (SLAs). One key aspect of a Service Level Agreement is the monitoring, measurement and reporting of aspects of service performance such as transactional response times, availability and batch run times and end times. Moving to a Cloud model can make this more difficult. Some commercial Cloud SLAs are a retrograde step from current commercial outsourcers SLAs, simply containing statements like: we guarantee [ ] external connectivity 99.95% of the time. 35 Service Performance In-house Local Office Data Centre End-User Web s Application s Database s Storage s Measurable End-to-End Transaction Response Time Measurable Local Response Time Measurable Remote Response Times 36

19 Service Performance Cloud Customer Demarcation Supplier Demarcation Local Office Cloud Provider End-User Web s Application s Database s Storage s Measurable End-to-End Transaction Response Time Measurable Local Response Time Immeasurable But Derivable Supplier Response Times 37 Service Performance Service Level Agreements The Service Level Agreement defines the service that the customer expects from a supplier Key Points: Do not rely on Service Credits to guarantee performance; often it is cheaper for the service provider to pay the service credit than resolve the problem Ensure the SLA is achievable, watertight and equitable; one-sided SLAs help neither party in the long-term Unless the SLA has a Service Bonus for exceeding performance do not expect anything more than achieving any targets; this is the service provider s margins at stake! 38

20 Summary Cloud is a new computing paradigm that is here to stay As with any new technology or business model it has its pros and cons Before adopting Cloud it requires careful consideration of: Service Management aspects, such as capacity, performance and resilience Security and Data Protection compliance The financial model 39