Cloud Is Paying Off For Enterprises... To Get High Returns You Need To Know Key Success Drivers

Transcription

1 A Forrester Consulting Thought Leadership Paper Commissioned By Akamai June 2014 Cloud Is Paying Off For Enterprises... To Get High Returns You Need To Know Key Success Drivers

2 Table Of Contents Executive Summary... 1 The Public Cloud Is Approaching Enterprise s Main Street... 2 But Satisfaction Comes Best Through Proper Understanding... 3 Hybrid Comes With A Discrete Array Of Concerns And Challenges... 4 Key Recommendations... 8 Appendix A: Methodology... 9 Appendix B: Endnotes... 9 ABOUT FORRESTER CONSULTING Forrester Consulting provides independent and objective research-based consulting to help leaders succeed in their organizations. Ranging in scope from a short strategy session to custom projects, Forrester s Consulting services connect you directly with research analysts who apply expert insight to your specific business challenges. For more information, visit forrester.com/consulting. 2014, Forrester Research, Inc. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change. Forrester, Technographics, Forrester Wave, RoleView, TechRadar, and Total Economic Impact are trademarks of Forrester Research, Inc. All other trademarks are the property of their respective companies. For additional information, go to [1-MNIVO3]

3 1 Executive Summary Cloud adoption is accelerating, as corporate users report they are achieving the benefits from the cloud that they expected. Satisfaction with cloud services is widespread thanks to growing maturity, greater understanding of what makes them different, and their cost and elasticity benefits. However, these general satisfaction levels appear to be moderate, not high. What s missing? Those that are fully satisfied and maximizing the business impact of cloud initiatives understand in greater depth how various cloud services differ, how best to use them, and what changes clouds require of their applications and configurations. They are also using multiple cloud services in combination to achieve their business aims. Rare is the highly satisfied customer who is purely using just one cloud service. Organizations that leverage hybrid as well as a mix of cloud services that bring differentiated and complementary value are more likely to be highly satisfied. In March 2014, Akamai commissioned Forrester Consulting to evaluate cloud adoption and satisfaction. Forrester examined expected and realized benefits, along with the concerns and challenges of implementing public cloud across global enterprises. Organizations that leverage hybrid as well as a mix of cloud services that bring differentiated and complementary value are more likely to be highly satisfied. In conducting in-depth surveys with 261 IT and business decision-makers with software oversight at enterprises in the US, UK, Germany, India, and Japan, Forrester found that these companies achieved benefits such as economies of scale, risk mitigation, and autonomy for the IT organization. satisfaction. Why? We can attribute this partly to the maturity of the cloud services, but it s also because the higher the criticality, the more effort a company makes to ensure its success. Cloud success comes from mastering The Uneven Handshake. Cloud services offer highly standardized and automated capabilities, but often these capabilities fall short of the specific needs of your company. When this happens, it doesn t mean you can t use them, but that you have to close the gap between the service offering and your needs. This gap, what Forrester calls The Uneven Handshake, is filled through supplementation of additional cloud-based services that are critical to the overall cloud solutions stack. This means using multiple cloud services in coordination to deliver the service levels needed, and adjusting applications to fit the cloud platform and portfolio of necessary cloud services. It s a hybrid world. Modern applications are not a single executable running in one place, but a mix of applications and services some on-premises, some in the cloud that are increasingly not just on one cloud, but on a multitude of platforms and services. There are clear benefits from implementing a multicloud approach, such as economies of scope, risk mitigation, and autonomy for the IT organization. However, there are also several discrete challenges and concerns. Performance concerns include bandwidth challenges, inconsistent performance, and slow application response time. Top concerns about availability include connectivity challenges and lack of visibility into infrastructure availability. Finally, security is, of course, always present in cloud conversations and encompasses data, application, regulatory, and physical data center worries. KEY FINDINGS Forrester s study yielded three key findings: Public cloud use is increasing across a number of business-critical use cases. The idea that cloud services are only good for applications with low service level agreements (SLAs) applications and noncritical activities, like test and development, was disproven in this study of experienced cloud users. In fact, our study found that the more critical the application, the higher the

4 2 The Public Cloud Is Approaching Enterprise s Main Street Are the claims that cloud computing can save you money, make you more productive, and accelerate business value true? When you survey actual cloud users, as we did in this study of enterprise business and IT leaders, the answer is a clear yes. This study found that among those companies leveraging cloud computing services, they were meeting their business objectives and spreading cloud use across the company. Our study found: Use is increasing across a number of use cases. Use of cloud across a wide variety of categories is high and rising. Software-as-a-service (SaaS) offerings lead cloud adoption and are being found in nearly all application categories. But cloud platforms are also widely being used for a variety of applications, including some previously thought verboten. Business-critical workloads are moving to the cloud. The adage that cloud services are only for test and development and noncritical workloads proved to be untrue among our survey respondents. The majority said that their highest satisfaction with cloud services came with business-critical applications (see Figure 1). Satisfaction with the cloud for business-critical applications was nearly universal, reported by 85% of respondents (see Figure 2). Confidence is soaring. Over 50% of respondents reported extreme satisfaction. Even those with less than two years of experience using or managing cloud services were highly satisfied. Just over half of the business users with less than two years of experience were extremely satisfied, while 42% of IT leaders with more than two years of experience reported similarly high satisfaction. FIGURE 1 Satisfaction With Cloud-Based Services Is High Across Application Categories For the following types of cloud applications, please indicate your level of satisfaction. (Experienced [> 1 year]) 5 Extremely satisfied 4 Somewhat satisfied 3 Neutral 2 Somewhat dissatisfied 1 Extremely dissatisfied 1% services 51% 37% 9% 2% Websites or web applications 46% 41% 2% 7% 2% Business intelligence/big data 45% 41% 6% 4% 4% Customer relationship management (CRM) 43% 40% 12% 4% 3% Mobile or mobile web back-end apps 43% 40% 10% 2% Disaster recovery and backup services 40% 45% 9% 4% 2% Product life-cycle management 40% 42% 11% 4% 2% Rich Internet applications (RIAs) 39% 43% 11% 4% 1% Content/collaboration sites/portals 37% 50% 6% 6% 1% Enterprise resource planning (ERP) 35% 45% 13% 4% 2% elearning 33% 49% 8% 4% 3% Supply chain 32% 52% 10% 4% 1% Human resources 27% 50% 15% 5% 1% Base: 161 IT and business decision-makers with > 1 year experience in enterprise software oversight Source: A commissioned study conducted by Forrester Consulting on behalf of Akamai, March 2014

5 3 FIGURE 2 Satisfied With Cloud Services for Critical Apps? Clearly Yes What is your level of satisfaction with your IaaS public cloud service today for critical applications? (most important, revenue generating, tight SLA applications) 5 - Extremely satisfied Business - Experienced (n=80) Business - Inexperienced (n=35) IT - Experienced (n=81) IT - Inexperienced (n=65) Extremely dissatisfied 4% 42% 51% 49% 65% 34% 9% Base: 261 IT and business decision-makers with enterprise software oversight Source: A commissioned study conducted by Forrester Consulting on behalf of Akamai, March 2014 Cloud benefits are real. Satisfaction was reported for cloud performance, agility benefits, security, and cost advantages as well. Respondents also reported high satisfaction with return on investment (ROI), achieving required service levels, and user experience satisfaction. The lowest reported satisfaction level was for time-tomarket, which was cited as satisfactory by only 80% of the respondents. But Satisfaction Comes Best Through Proper Understanding 28% 49% 7% 42% 8% 2% While the cloud story certainly looks rosy in these findings, this satisfaction doesn t come blindly. Note that about half the satisfaction being reported is only somewhat. To achieve high satisfaction, enterprises have to bring a strong understanding about what cloud services are best used for and how best to leverage them. Those companies reporting the highest satisfaction know that: It s a hybrid world. Cloud success doesn t come from moving everything to the cloud, nor does it come from moving just about anything. It comes from knowing which applications are most appropriate for the cloud and taking a hybrid portfolio approach. 3% 2% 3% 3% Cloud success isn t single-vendor. High satisfaction also comes from understanding that not all cloud services or vendors are equal and that certain clouds are better for certain applications and use cases. This means leveraging a mix of cloud services and vendors that are most appropriate and suited to your needs. Architecture matters. Success also comes from understanding how cloud services and platforms differ from traditional on-premises IT solutions. Clouds deliver standardized resources and capabilities that favor modern applications that scale out and are composed of multiple small instances and services, rather than single large executables that are tightly coupled to the underlying hardware. Thus, the most success comes from organizations that design for the cloud and optimize their configurations around these parameters. User experience matters most. A lot of cloud observers assume clouds are everywhere at once and that applications in the cloud inherently give you good performance no matter where the user lives. Those reporting the highest satisfaction with clouds know this isn t true and that cloud services all originate from physical data centers that suffer the same speed-of-light latency issues that traditional data centers face. They therefore supplement the clouds with solutions that address Internet bottlenecks and last mile problems. This helps them deliver performance consistently to their target geographies, load balance within and across cloud providers (and their existing data centers), and consistently defend against attacks targeting applications, data, and cloud infrastructure. A multicloud approach delivers the greatest benefits. No one cloud platform or service can meet all your business needs. And the enterprises showing the highest degrees of satisfaction reported using multiple cloud services. The value comes in understanding which are best for what purpose and how they can best be used in combination. Some cloud services are better suited to certain applications based on the services they provide that support that application type (such as providing a mobile back end as a service for smartphone apps). Also, the greatest success is achieved by customers who are able to successfully supplement core cloud-based compute and storage resources with additional cloudbased services that are critical to the overall cloud solutions stack, such as security, load balancing, and performance optimization.

6 4 Hybrid Comes With A Discrete Array Of Concerns And Challenges Given that your cloud portfolio won t be a single bet on one cloud service, it s important to understand the areas in which IT needs to focus its hybrid efforts. These areas support the concept of The Uneven Handshake of cloud computing (see Figure 3). 1 The Uneven Handshake is the recognition that cloud services, being highly standardized and automated capabilities, are designed to deliver a fixed service with a set service level to all customers in exactly the same way. So if you need to achieve higher SLAs, better performance, and/or a unique configuration or security, this is your responsibility. Combining and supplementing cloud services to achieve your business objectives is how you move from somewhat satisfied with cloud to extremely satisfied (see Figure 4). The key areas to focus on are: Ensuring cloud use meets your security and compliance requirements. Yes, it is possible to meet your company s unique security requirements when leveraging cloud services. But you need to understand where the given cloud provider s handshake stops and take the appropriate actions to fill the gaps from there. Key security areas to investigate include: 1. Extend your enterprise perimeter around your cloud. Cloud services are equally at risk from Internet security threats, including distributed denial of service (DDoS) attacks, SQL injection, and crosssite scripting all of which can bring a service to its knees or, worse still, compromise sensitive customer data. Content delivery network (CDN) providers typically offer services that are complementary to and easily integrated with a cloud provider s infrastructure in order to provide configurable first levels of defense against these threats, freeing up your valuable back-end resources to serve real customers. FIGURE 3 The Uneven Handshake Of Cloud Computing Source: AWS Cloud Security, Forrester Research, Inc., February 5, 2014

7 5 FIGURE 4 Meeting Expectations How well did your chosen cloud service actually meet these key metrics? 5 Meet/met very well 4 Somewhat well 3 Neutral 2 Somewhat meet/met 1 Not well Business improvement 57% 36% 3% 2% 2% Business agility 53% 39% 7% 1% Application regulatory compliance 49% 37% 12% 1% 1% Global access requirements 46% 44% 8% 1% End user performance SLA 45% 44% 10% 1% Cloud application availability SLA 45% 45% 5% 5% Content delivery/distribution 43% 46% 8% 3% Data security 43% 45% 9% 3% ROI 42% 47% 7% 4% Ease of scalability 40% 44% 10% 6% Cloud application performance SLA 39% 48% 9% 2% 1% Revenue generation from this application or deployed service 38% 48% 10% 3% Cost savings 38% 48% 9% 4% 2% User experience/end customer satisfaction/adoption 37% 52% 6% 5% Time-to-market 36% 44% 17% 3% Base: 261 IT and business decision-makers with enterprise software oversight Source: A commissioned study conducted by Forrester Consulting on behalf of Akamai, March Verify application security. The most common breaches that have occurred in the cloud have not been the fault of the cloud vendors but errors made by the customer. Designing an application and leaving share all or port 80 open to the public Internet might not be a big deal when the application is in your data center behind the firewall, but on the public cloud, this can spell disaster. Get familiar with the tools and cloud-based security services that let you monitor and enforce application security and can help guide you to application architectures and lifecycle practices to ensure this security. 3. Pass regulatory compliance in the cloud. This can be possible, but the cloud vendor itself won t get you there. It is becoming increasingly common to find cloud services that carry compliance certifications from the payment card industry, healthcare associations, and other industries that define compliance rules and laws. These certifications, however, only cover the compliance of the service the cloud provider gives to you not how you use the service. This part of The Uneven Handshake remains your responsibility. The value in using a compliant cloud comes in knowing that for the service, its operations, and how its data centers are operated, you have assurances and can focus your efforts on your application and data. 4. Know that physical security is usually covered by the cloud provider. But not always. Cloud providers that have certifications or self-audits (look for an SSAE-16 Type II audit) are required to document their physical data center security practices. It s your responsibility to read this information and ensure it meets the needs of your company. Some customers with highly sensitive data may only want to use cloud services that employ data center operators who are citizens of your country. If that isn t the case with a given cloud provider, you need to ensure your data stays within

8 6 country boundaries, and that usually means supplementation. 5. Fear the agile unknown. If you have been tracking the security news feeds of late, you have a good sense of how quickly and creatively hackers are moving. The evolution of cyberthreats is accelerating, making it increasingly difficult for corporate security departments to keep up. This is where supplemental cloud services can really help, as their security teams serve as supplements to your own team, and their security solutions continuously evolve to stay ahead of the changing threat landscape. But all services are vulnerable, so it behooves you to layer security services that focus on different vulnerabilities and give you greater visibility across services. Avoiding outages. The days are gone in which your application was a single executable that you could point to in the data center and easily ensure its availability. Today s modern applications are a mix of several components that together build a process that the customer experiences as a service. This means availability comes through collective assurance. To do this in the cloud means understanding the following points: 1. Fact: All infrastructure fails. There s no getting around it. This is why we deploy redundant instances of our applications to get greater availability. And in the cloud, the best practice is to deploy redundant instances across fault zones and geographies so we avoid outages at these levels as well. And in the largest cloud services, failure of individual infrastructure components (servers, storage arrays, drives, etc.) are typically higher because they deploy low-cost, commodity components. Rather than expect the server to deliver high availability, we rely on the application and virtual infrastructure to assure this. That means it s important to build applications that handle this model and monitor these applications, along with augmenting applications with real-time load balancing and failover between application environments. 2. But we often lack visibility into availability. If you are like most IT operations teams, you monitor the infrastructure but rarely the application, and even more rarely the third-party services on which the modern apps rely. Our survey found that lack of visibility is one of the top concerns when it comes to availability in a public IaaS cloud environment (see Figure 5). This is where SaaS-based monitoring solutions and app-level and end user monitoring can make all the difference. As we move applications onto services that manage the infrastructure, our incumbent practices lose value and the need to manage the actual service and customer experiences rises, as availability isn t judged by the server that went down, but by the user experience getting slow. 3. We must monitor connectivity between machines. Cloud apps don t live on an island, but they are usually spread throughout the cloud data center, across multiple data centers, and then linked back to your facility. Monitoring these connections is key to ensuring availability. FIGURE 5 Availability Worries Mirror Those Of Performance Specifically, what are your concerns around availability in a public IaaS cloud environment? Vulnerability to cyberattacks Lack of visibility into cyberattacks Connectivity between machines Infrastructure availability Lack of visibility into availability High failure rates of existing VMs already provisioned None we don t have any concerns 16% 30% 29% 27% 33% Base: 261 IT and business decision-makers with enterprise software oversight Source: A commissioned study conducted by Forrester Consulting on behalf of Akamai, March % 36% Understanding that performance is in the eye of the beholder (see Figure 6). Today s user (e.g., consumer, buyer, employee, partner, etc.) is highly impatient. If your service or mobile application makes users wait as data loads from a distant server or is undergoing a restart due to an infrastructure failure, users may take action that negatively affects your business, such as moving to your competitor or reverting to costly manual business processes, before you can address the issue. 2 This puts

9 7 even greater focus on defining performance at the end user/customer and looking backward from there. 3 To do this, focus on these problem areas: 1. Bandwidth challenges. The skinniest pipe is the one you have the least control over. If a user s 4G connection falls back to 2G, they may blame the network, but they will more likely blame your application. This is where caching content and pushing the end user interactivity to as close to the user as possible pays the biggest dividends. And while you may think the cloud is everywhere, it isn t. Every cloud service comes out of a small set of data centers that have clear geographic locations. If your users are distant from your cloud provider, they will feel latency you have to address. 2. Consistency equals quality. Users will define the quality of their experience not by how fast your logo loads, but by how consistently you conduct the entire user experience. This means they will have low tolerance for performance variation due to high usage, geography, time of day variances, or how busy and crowded your public cloud provider happens to be at the time. Supplement your application deployment (and monitor this architecture) with application delivery services to ensure consistent experiences. monitoring is crucial, and having as many points in the system where the issue can be isolated and addressed will shorten the fix cycle. It also prevents packet losses from cascading through the system and making root-cause identification difficult. FIGURE 6 Performance Concerns Specifically, what are your concerns around cloud performance in a public IaaS cloud environment? Lack of visibility into cyberattacks 28% Bandwidth challenges 27% Vulnerability to cyberattacks Consistency 22% Application response time is slow Lack of visibility into performance 21% Packet loss 21% 21% 26% Base: 261 IT and business decision-makers with enterprise software oversight Source: A commissioned study conducted by Forrester Consulting on behalf of Akamai, March Slow application response time. Remember that the configuration, supplementation, and caching approaches still can t overcome a poorly designed application. This is where a partnership with development is critical to operations and performance assurance. An application designed to assume the fast pipes inside your data center may not run so well when moved up to the public cloud without some recoding and reconfiguration. 4. Lost in transit. You might have a well-designed application, fast pipes, good caching, application delivery services, solid monitoring, and the proper geographic reach and still have performance challenges. The likely culprit in this case is packet movement and retry. In a complex transactionoriented application, packets (and even bits) may get lost or fail to transfer fully through the system. In these cases, retries are inevitable and slow down the customer experience. These errors can be caused by multiple sources such as geographic events, sunspots, cyberattacks, or a multitude of other issues. This is why end-to-end application-level

10 8 Key Recommendations While the straight-up consumption of cloud services may meet your business and IT objectives somewhat, addressing cloud platform shortcomings (AKA The Uneven Handshake ) will not only ensure success, but also increase the overall impact on the business. Organizations that are achieving the highest efficiency, biggest gains, and competitive advantage bring multiple cloud services together to orchestrate solutions that deliver outsized gains. The ways to get started down this winning path are: Drive more aggressively to the cloud. The latest Forrester Forrsights surveys show that nearly 50% of business-unitaligned developers are already building or will build applications in the cloud by the end of And 31% of corporate IT ops teams plan to add public cloud infrastructure-as-a-service (IaaS) to their official portfolio in the coming year. 4 The cloud is not only a viable option for a broad range of workloads but has quickly become the preferred option for reaching new markets and buyers faster and staying ahead of the competition. It s time for IT leaders to ask themselves who will deliver the cloud the business wants and rise to the challenge. Think beyond cloud platforms. While much of the hype around cloud computing centers on IaaS platforms, they are just a core building block to a successful cloud implementation. Organizations must know and address blind spots across multiple clouds and data centers. This means understanding The Uneven Handshake and identifying the gaps in SLAs, security, performance, availability, and end user experience that cloud platforms alone cannot meet, then filling these gaps with complementary services. Know that one size does not fit all when it comes to building cloud architecture. While it s clear that applications that scale out fit well on cloud platforms, there are a wide variety of additional parameters and approaches that can win in the cloud. The winning approach we see from enterprises comes through an understanding that not all cloud services are the same but that many can be used in complement with each other to achieve certain aims. Clients will undoubtedly have multiple SaaS applications; security, backup, monitoring, application delivery services, management, and content delivery networks in their cloud portfolio. Mixing and matching the platforms, tools, and services to give you the greatest productivity, competitive advantage, and user experience is the winning formula. Use heterogeneous deployment and management tools to help you manage the mix. While cloud-specific tools may give you clear access to capabilities and functions that are unique to that platform, your foundational approach should be through tools that drive consistency in how you configure, deploy, and manage applications across platforms. While these tools may not cover 100 percent of the features and services of every platform, they can help ensure good repetitive practices that are common across cloud services. And consistency is necessary for standardization and automation, which will drive up the quality and availability of the services you build. Eliminating human error from out-of-process actions is key to how the clouds themselves drive greater reliability. 5 Value-add cloud services that give multicloud advantage. Just as heterogeneous management tools can drive consistency of process, using platform-independent cloud services that complement and enhance these platforms deliver the same type of benefit. Services that offer independent security, caching, web performance acceleration, CDNs, identity federation, and other common services give you greater control and ultimately choice. While it may be easier in some cases to use the cloud platform- or SaaS-specific services for these common functions, if they re available, doing so can lock you into these offerings or make migration more challenging. At the end of the day, cloud services should be viewed as yet another set of tools in your IT toolbox. Along with your data center, traditional hosting, and outsourcing portfolios, cloud brings additional capabilities and offerings your company can use to build better user experiences and more efficient processes. The broader your toolkit, the more options you have to leverage. Don t be the builder who only has a hammer and treats every business problem like a nail when a full tool belt of services is available today to help you work more productively and efficiently.

11 9 Appendix A: Methodology In this study, Forrester conducted an online survey of 261 IT and business decision-makers at enterprises in the US, UK, Germany, India, and Japan to evaluate cloud services. Survey participants included managers and above with software oversight. Questions provided to the participants asked about adoption, benefits, challenges, and trends. The study was completed in March Appendix B: Endnotes 1 Source: Cloud Management In A Hybrid Cloud World, Forrester Research, Inc., July 30, Source: The Business Impact Of Customer Experience, 2014, Forrester Research, Inc., March 27, Source: Best Practices: Attaining And Maintaining Blazing Fast Web Site Performance, Forrester Research, Inc., February 4, Source: Forrsights Developer Survey, Q1 2013, Forrester Research, Inc. and Forrsights Hardware Survey, Q3 2013, Forrester Research, Inc. 5 Source: Five Data Center And IT Infrastructure Lessons From The Cloud Giants, Forrester Research, Inc., August 15, 2013.