Case Study Cloud Computing

Transcription

1 Case Study Cloud Computing Rotterdam Juli 2013 Robeco Ton Ligtvoet, Manager IT Contracts and Infra Projects For institutional investors 1

2 Facts and figures Robeco IT Servicing Asset Management, Pension Solutions, Retail and Corporate Departments; Servicing around 1000 people in the Netherlands; Servicing around people 200 internationally (mainly in 6 sales offices) with a Wide Area Network and a limited number global applications (such as Trading, CRM and Office365); IT Strategy around standardization and reduction of complexity; IT Strategy around reducing costs. 2

3 Robeco IT Outsourcing and Cloud perspective Robeco is an early adopter in the financial services industry regarding IT Sourcing and Cloud; Robeco has a culture of challenging, opportunistic, entrepreneurial and pragmatic towards IT Sourcing providers; We have limited own IT : We have completely outsourced our infrastructure (Datacenter, WAN, Desktop, Service Desk); We have minimal custom developed software (mainly in Integration and End User Computing); We have no mainframes left at the end of 2013; We have multiple Cloud based (SaaS) solutions deployed. Our cloud decisions are based on an extensive risk analysis based on ENISA standards, such as: Policy and Organizational risks such as loss over governance, cloud service termination and lock-in; Technical risks such as data leakage, DDoS, Deletion of Data, Intercepting data in transit, Encryption; Legal risks such as licensing and data protection; Others risks such a network breaches and traffic, back-ups, lost of log files. 3

4 Decision for Office365 The decision for Office365 was based on 3 key strategic drivers: Strategic business program called You! (Bricks, Bytes and Behavior) to implement Knowledge Sharing & Collaboration and Working anywhere, anytime and anyplace ; IT & Ops Strategy to reduce complexity, increase standardization and reduce costs; Life Cycle Management necessity. The solution we have implemented includes: From Lotus Notes to Outlook Online for mail and calendar; From Lotus Notes to Sharepoint Online for docslibs and applications; From Webex to Lync Online; From Blackberry to iphone; From a customized intranet to Sharepoint Online ; And new features such as Webmail, BYOD (ipad, iphone and Android Phone). As part of the decision to implement a thorough risk analysis was executed. Key conclusions: Right to Audit. Mitigating measures included continued discussions with DNB and Microsoft, Extensive reviews of Microsoft s Audits & certifications and a fast exit process from the cloud to an on premise solution; Deviations in Security Policy. Mitigating measures included 2 factor authentication based on RSA, ADRMS for encryption, Legal Hold features; Information and notifications regarding data center location. Mitigating measures included usage of Microsoft Trust Center for notifications, continuation of discussions with Microsoft and a fast exit process from the cloud to an on premise solution. Robeco 4

5 Implementation of Office365 The timeline of implementation: Implementation & Migration Outlook Online Phase out Lotus Notes Workspace Architecture Decision O365 & Contracting Workspace renewal & Infrastructure prerequisites (AD) Implementation & Migration Sharepoint Online Implementation & Migration Lync Online 1/1/ /3/ /06/ /09/ /12/ /03/ /06/ /09/ /12/ /03/2013 DNB Involvement: During the project in December 2012 DNB published their vision and guidelines towards Cloud Computing; As of that moment we have intensified contacts with Microsoft for contractual enhancements; At the end of Q we have started discussions with DNB and we have been sharing information; In Q DNB and Microsoft agreed on a Right to Examine; In Q Rabobank and Microsoft have signed several contractual enhancements. Implementation Approach: Strong focus on standardization and reducing complexity. Number of group mailboxes have been reduced with 75%. Number of Lotus Notes Applications have been reduced with 75%; Agile approach. Work with short iterations as much as possible in an infrastructure environment; Use of Pilot groups implementing new functionality first; Robeco 5

6 Results of Office365 Support of the Business Strategy; From an IT perspective: Lower costs for infrastructure, storage, licenses and operational management; Executed major LCM components; Higher availability of the mail infrastructure (including mail on smartphones); Better performance of the mail infrastructure (including mail on smartphones); Staying in control based on certifications provided by Microsoft; New alternatives for Business Continuity Management given the possibilities of Webmail and Smartphones. From an User perspective: Improved user satisfaction because of up to date and better known versions. Easy to adopt for new joiners; Improved user satisfaction because of new and more open corporate Smartphone support; Improved user satisfaction because of new features such as Webmail and Bring Your Own Device (ipad, iphone and Android Phone). Robeco 6

7 Lessons Learned Execute a thorough risk analyses including Microsoft s Decision Framework; Ensure involvement and commitment from Compliance, Risk Management, Legal and Audit during the risk analysis and continue during implementation; Ensure commitment from Senior Management. In our case we have involved the In Control Board and the Management Board in our decision making process; Involve DNB early in the process; Work with an external partner with extensive knowledge regarding Office365. In our case we have worked with Avanade; Continue to evaluate Microsoft based on publications in its Trust Center such as ISO and ISAE audits and certificates; Alignment with Rabobank for definition of Workspace architecture, contracting with Microsoft and with discussions with DNB. Robeco 7