A Guide to. Cloud Services for production workloads

Transcription

1 A Guide to Cloud Services for production workloads

2 Intro Workload Requirements Matter Intro With the benefits of the cloud supported by both research and case studies, a growing number of cloud service providers (CSPs) are inundating the market with a wide range of cloud services. However, some of them are not appropriate for all workloads or use cases. Many can accommodate low-risk workloads but lack the security and performance levels required for legacy production workloads. While great at scale for an enterprise, legacy applications can bow under the weight and complexity of a cloud service provider s horizontal scale and multi-tenancy. These applications may also require compliance and access controls which newer cloud service providers often can t provide. For companies in heavily regulated industries such as healthcare and finance, compliance concerns cast doubt on using cloud solutions for their mission-critical applications and for good reason. Only a limited number of data centers offer colocation services that meet the regulatory demands of HIPAA, HITECH, PCI DSS and other standards; even fewer cloud services meet the stringent requirements. Heavy fines, penalties and other damaging effects await organizations subject to regulatory requirements that put data and applications into the cloud without the mandated protections. So how do you find a cloud environment suitable for complex enterprise applications that require high availability, compliance-grade security and performance? How can you find a CSP capable of delivering the requisite cloud infrastructure? This guide covers several considerations to help you do both.

3 No. 1 Know Your Workloads No. 1 The type of workload that you want to move to the cloud legacy or cloud era can help you determine the requirements of a suitable cloud environment. Legacy workloads can serve anywhere from a few to thousands of users and hundreds of concurrent sessions, and achieve scale by increasing the size of the application and database infrastructure. They require agile infrastructure so that resources can be added or removed, or moved between workloads to compensate for changes in demand. The applications that comprise legacy workloads are built to run on a single server or on a cluster of front-end and application server nodes backed by a database. They rely on technologies such as enterprise middleware clusters and vertically scaled databases. Examples include ERP systems, CRM, messaging and collaboration applications. These applications are generally customer-facing and/or have high performance and availability expectations. Many are commercial-off-the-shelf (COTS) applications and are designed to run on reliable hardware with near 100 percent uptime. Backup and disaster recovery processes have been relegated to corporate IT to determine, implement and manage in order to accommodate potential hardware failure. In contrast, cloud era workloads typically serve millions of users, and employ technologies such as database sharing. Examples include customer-facing web applications and applications in which businesses are investing their innovation dollars. Developed with the idea that the underlying infrastructure could fail or that human error could occur, cloud era applications are designed to withstand failure. Many incorporate multisite geographic failover into their design. They also can make efficient use of infrastructure resources, easily adding or removing resources without much impact.

4 No. 2 Think High Performance & Customization No. 2 Production workloads are typically highperformance applications that experience large variations in their usage patterns, yet are required to deliver excellent response times to customers and end users. Multi-tenant environment must be configured to ensure capacity and resources can be scaled up or down as needed and when needed. services with a robust portfolio of services that covers everything from the virtual machine down to the application level. [I have no issues with you saying this, but Peak 10 doesn t get down to the application level, correct?] These services should be based on proven processes for production workloads and facilitate fast service delivery. Environments should be carefully engineered, ensuring that other applications or customers won t negatively impact performance or capacity. Cloud resources must be capable of being deployed quickly to hasten your time to value. Reserve capacity via a self-service portal helps ensure that the necessary resources are available. While not required, Service Level Agreements (SLAs) specifying availability are highly desirable. Many CSPs manage the hypervisor and leave additional service management tasks to you. For production workloads, however, it is far more desirable to have a CSP that offers managed cloud The CSP should also understand your business needs and have the ability to tailor solutions to your specific requirements including choices of cloud deployment models private, hybrid or public and managed services to meet specific needs such as compliance or security. In addition, the CSP should offer businessaligned SLAs that cover service times, production workload response times and availability. Support should be available year-round, 24 hours a day, seven days a week. On-site technical expertise is a definite plus.

5 No. 3 Insist on Multi-level Security No. 3 While cloud era workloads require varying levels of security, production workloads almost always require consistent, enterprise-class security and isolation protocols. This can be accomplished in a public cloud model by employing security best practices in the infrastructure architecture. A public cloud should employ the same design principles as used in a private cloud, including appropriate isolation between the customers sharing the multi-tenant environment. Dedicated servers and storage that are physically isolated can be used for highly sensitive data and applications. Visibility into activities and threats to your servers is a must. The CSP should have skilled professionals monitoring the cloud infrastructure for security threats around the clock. Secured virtual private networks and additional managed and customer-managed security services should be available to further enhance data protection and privacy. A public cloud should employ the same design principles as used in a private cloud, including appropriate isolation between the customers sharing the multi-tenant environment.

6 No. 4 Set Compliance Expectations No. 4 Many enterprise applications involve confidential or personal data with governmental, industry or legislative requirements regarding privacy and security. It is also increasingly common for IT organizations to require that key processes be fully monitored and logged to satisfy both internal and external audits. For example, provisions in the Sarbanes-Oxley act dictate that IT management be able to produce and retain reports that monitor job scheduling processes. To help meet these requirements, you should only use cloud services that meet or exceed your own security standards. Keep in mind that many CSPs claim to offer compliant cloud services. These claims may not be true. Even if the CSP is compliant with governmental or regulatory requirements, they still may not meet your organization s own compliance requirements. Due diligence is a must in assessing any CSP, particularly when it comes to compliance matters. Consulting with a legal professional is highly recommended. For example, provisions in the Sarbanes-Oxley act dictate that IT management be able to produce and retain reports that monitor job scheduling processes.

7 No. 5 Back Up Required, Not Specialization No. 5 A cloud environment that can accommodate production workloads must be capable of ensuring that your data is stringently protected. Backups should be used for long-term retention of data (for which there are state laws regarding healthcare and record retention). If a disaster is declared at a particular site, application services must be capable of being restored in a safe, predictable and timely manner. For most companies, mission-critical applications are essential to business operations and customer/ end-user satisfaction. The CSP should have a tested disaster recovery plan in place to help minimize potential down time and to help ensure that your data and applications are available. It may also be worthwhile to consider a CSP that isn t overly specialized and can accommodate a large range of applications. This is important for avoiding cloud sprawl, as well as for simplifying management oversight and logistics. In addition, you should be forward looking as you consider cloud services. One-size-fits-all offerings may appear more affordable than tailored solutions built on a reliable, consistent infrastructure. However, these generic cloud services will likely not offer the flexibility to accommodate the different workload requirements driven by changing business needs or allow you to tailor operations and operational expenses based on business and/or application requirements. While compliance-grade security, customization and high-level performance may seem like nice-to-haves, they are actually attributes of a cloud environment that will be more likely to accommodate workloads today and in the future.

8 End Peak 10 Enterprise Cloud Conclusion Designed for stability, growth and bursting, the Peak 10 Enterprise Cloud exemplifies the kind of cloud service that can handle production workloads while being cost effective enough to handle all application tiers. Idle development staff or a sluggish cloud environment translates into waste and unnecessary costs. The Peak 10 Enterprise Cloud provides an efficient use of resources with high availability, flexible storage options and managed services, all which can help keep your IT staff and developers productive. Offering compliance-grade security and performance, the Peak 10 Enterprise Cloud is unique among public cloud services in that it is annually assessed by independent auditors to ensure it meets the requirements of a number of regulatory bodies and standards including HIPAA/HITECH, PCI DSS, [Peak 10 is not annually assessed by independent auditors to ensure Safe Harbor compliance.]and others [I think it s pretty much just HIPAA and PCI DSS, so if that s it, please also remove and others.]. It is also backed by SLAs guaranteeing % uptime, and includes 24/7/365 on-site technical support. In addition, Peak 10 offers hybrid cloud capabilities, with reliable connectivity between the Peak 10 Enterprise Cloud and local private clouds, remote private clouds or other public clouds, as well as colocation services.

9 Migrate to a Peak 10 cloud solution today! Learn More