MATCHING APPLICATIONS TO THE RIGHT CLOUD The CIO s New Role as Cloud Broker
CONTENTS Properly matching your applications to the right cloud delivery model is key to obtaining benefits from the cloud. This paper provides a guide to selecting the best cloud delivery model for each of your enterprise workloads. It provides insight and actionable criteria so you can make better decisions and improve relationships with the lines of business and cloud providers. Achieving Success with the Cloud... 3 Three Steps to the Right Cloud Solution: Step 1. Consult the Business and Assess User Requirements... 4 Step 2. Assess Technical Requirements and Establish a Risk Profile... 5 Step 3. Match Your Requirements to the Right Cloud Model... 7 Use Case: Healthcare Provider Selects the Right Cloud for its Applications... 8 Build a Team with the Right Expertise... 10 2
ACHIEVING SUCCESS WITH THE CLOUD The cloud is helping organizations across many industries operate with greater agility, leading to more efficient operations, better customer experiences, and improved business performance. Almost three-quarters (74 percent) of respondents to a 2014 study by Harvard Business Review Analytic Services confirmed that cloud computing has provided their organization with a competitive advantage. The cloud is benefitting organizations of all types in all sectors. Public sector organizations, for example, have turned to the cloud to enable new secure applications and services that allow citizens to pay taxes, register property, and renew licenses online. And shipping companies are now using cloud solutions to track and monitor their global fleets without the need to invest in expensive data-center infrastructure. While the need for greater agility is driving the adoption of cloud solutions, many organizations still find identifying the right cloud delivery model for enterprise workloads a significant obstacle. The decision they face is now far more complex than simply choosing between a public or private model. And with mission-critical applications at stake, the consequences are far more serious. 74 % OF ENTERPRISE RESPONDENTS SAID THE CLOUD HAS GIVEN THEIR COMPANY A COMPETITIVE ADVANTAGE. 1 Finding the right cloud delivery model for enterprise workloads is a significant obstacle for many organizations. The task of finding the right cloud solution is likely to fall on the IT function. And it s unlikely that you ll be given a well-defined technical specification to work with. Increasingly, you ll find yourself being approached by the lines of business with a broad business problem and asked to provide a solution. That means you ll need to develop a closer working relationship with your lines of business. And it s also likely to mean managing the relationship with thirdparty providers. While each organization will identify unique strategies, they are likely to feature some common elements. IT leaders will want to improve their agility and ability to respond to change, while maintaining tight control over cost. They will also need to work with multiple cloud providers and integrate those cloud services. 1 Business Agility in the Cloud, HBR Analytic Services, July 2014 verizonenterprise.com/resources/insights/hbr/ 3
THREE STEPS TO THE RIGHT CLOUD SOLUTION As an IT professional, you need a way to make smarter and faster assessments of how best to support applications securely in the cloud. One of the critical challenges is how to perform the necessary analysis to identify and select the right cloud approach for each application. The following three-step approach will help you find the most effective cloud delivery solution for your applications: Step 1. Consult the business and assess user requirements. Step 2. Assess technical requirements and establish a risk profile. Step 3. Match your requirements to the right cloud model. Of course, after you ve identified the best cloud solution, you ll also need a comprehensive workload-migration strategy, which will include design and execution. But before you can reap the benefits of the cloud, you ll need to carry out careful application analysis and our three-step approach will help you do this. Line-of-business managers are driving demand for the cloud, yet most aren t equipped to manage cloud providers. STEP 1 CONSULT THE BUSINESS AND ASSESS USER REQUIREMENTS. Within many organizations, line-of-business managers are driving demand for the cloud. Yet most aren t adequately equipped to manage cloud providers, so they turn to IT; in fact, the IT department manages over 80 percent of cloud spend. 2 Unfortunately, the line of business rarely gives IT sufficient information to select the best cloud model for an application. This means that, whether you have to seek out line-of-business managers or they come to you, you must drive this process. We ve set out some questions below to help you start the conversation with other departments. While some of these may seem obvious, it s important that you get answers to all of them. 4 What is the business goal for moving this application to the cloud? How important is availability of this application? How directly will loss of availability affect revenue? What is the per-hour or per-minute cost of downtime? What reporting information do you, the lines of business, the finance department, or other groups require? What is the expected useful life of the application? How often will we (IT) need to upgrade the application to stay ahead of the competition? How will any planned mergers or acquisitions affect this application? What is your desired timeline for the move? What regulations must this application and its data comply with? 2 Research Report for Verizon, 451 Research, May 2014.
STEP 2 ASSESS TECHNICAL REQUIREMENTS AND ESTABLISH A RISK PROFILE. Once you ve established the business requirements for moving to the cloud, the next step is to build a list of technical specifications and create a risk profile for your application. You ll also need to consider tenancy and compliance. It s vital that you assess the technical requirements of your applications carefully. We ve seen many migrations to the cloud go wrong when organizations have inadvertently missed important factors. Consider the following basic checklist. It can t encompass the complexity of your IT environment, but it can help you avoid the biggest pitfalls. 50 % THROUGH 2015, AT LEAST 50% OF CLOUD DEPLOYMENTS WILL SUFFER FROM NETWORK PERFORMANCE ISSUES. 3 Determine the load on the network. Maintaining strong network performance is vital to building an agile cloud solution. Migrating an application to the cloud involves solving known cloud-networking challenges, such as TCP Incast and dynamic network resource allocation, through careful design. Even interfacing with the public cloud presents issues, including the often-overlooked latency of the Internet. Factor in time to prepare the application. Line-of-business managers often assume that anything can live in the cloud. The truth is that some existing applications, even virtualized ones, require some adjustments to work in the cloud. Plan ahead in case you need to rewrite code or reconfigure applications, and be sure to inform affected departments. Carefully consider the costs of moving. It s easy to focus on the cost of running applications and lose sight of the cost of moving them. When a line of business wants to know how many applications it can move to the cloud and how quickly, it will fall to you to explain that migration costs can often outweigh the benefits. For example, many financial institutions currently run their transaction processing on mainframes. Some have found the cost of rewriting code for the legacy applications prohibitive, and have chosen to leave these applications in place. 3 Sorell Slaymaker, Andrew Lerner, Communications Hubs Improve WAN Performance, Gartner, May 12, 2014. 5
Assess your application s risk profile. Collecting information about business risk and technical specs is a good start in assessing an application s risk profile. But the best way to gain a full understanding is to look at the data running on the application. For example, the early phases of the Development Operations (Dev Ops) life cycle often carry low risk; running code with test data won t involve valuable intellectual property. But the risk profile increases when you begin testing with real data or when the code is in a preproduction environment. Line-of-business managers often assume that anything can live in the cloud. Use a data discovery tool. You ll need to verify the actual level of risk by determining exactly what data is being stored where. We recommend that you use a data discovery tool to look at actual data flows at a high level. This can also help detect data breaches sooner by revealing anomalous data flows, helping to minimize the impact. Manage risk by considering tenancy and compliance. Certain workloads will require strong assurances to run in a multitenant environment; others will require single tenancy or even on-premises location for proper assurance or compliance. In the case of an e-commerce solution, certain parts of the solution will deal with data that your organization must protect under the Payment Card Industry Data Security Standard (PCI DSS). In such cases, an organization s choice of cloud model may be limited to cloud providers that can help address PCI DSS requirements. 6
STEP 3 MATCH YOUR REQUIREMENTS TO THE RIGHT CLOUD MODEL. When choosing the best cloud model for a particular application, a distinction is often made between public and private where public is seen as cheap and less secure and private more expensive and less scalable. But while the terms public and private may be convenient shorthand, they are inadequate to describe the variety of cloud services available today. And that s why steps 1 and 2 are so important. To make the right choice of cloud model, you ll need a thorough understanding of business requirements, the technical specification, and the risk profile of your application. The terms public and private are inadequate to describe the variety of cloud services available today. Considering the following questions can help you further define business implications and determine the best cloud model: Does the application s risk profile allow it to run on shared infrastructure? What proportion of the application and its data are currently based on your premises, and how much with a provider? How much of the management of the cloud can you take on? You ll also be able to find other simple models that complement our three-step approach and will help you make the right choice of cloud solution. Intel, for example, has a three-stage classification model for matching different workloads to the best cloud model (see Figure 1). 1STANDARD Non-core workloads or applications used daily 23STRATEGIC Low utilization; unpredictable demand Standardized functionality Lower level of data sensitivity Public Cloud Figure 1. Intel, Cloud Services Starter Guide: IT Infrastructure Strategy, 2014. Core applications that add value High utilization; predictable demand Business critical Secure data for regulatory requirements Private or Hybrid Cloud PILOT Workloads that drive innovation Variable demand and scale Renting capacity while piloting initiatives Easier path to core applications requirements Private, Hybrid, or Public Cloud 7
HEALTHCARE PROVIDER SELECTS THE RIGHT CLOUD FOR ITS APPLICATIONS Use Case A large healthcare provider wanted to leverage the cloud to take advantage of changes in the U.S. healthcare market. The company s IT team took the lead in identifying the right cloud solution by following our three-step process. It worked in partnership with the lines of business and third-party providers to ensure it delivered a solution that met all the business goals and objectives. Assessing User Requirements of Four Applications The company began by identifying four solutions that could benefit from migration to the cloud clinical imaging, collaboration, patient management, and Big Data analytics and assessed user requirements for each. This process immediately highlighted that, despite a desire for Big Data analytics, the company had not budgeted for the large capital expenditures necessary to build a Hadoop cluster. Careful application analysis helped the company save money while protecting ephi. Reviewing Technical Requirements and Compliance Needs The IT team next assessed the applications themselves. It reviewed application interdependencies, network requirements, and the risk profile of each application. Some of the workloads had important compliance needs. For example, the clinical imaging solution and the patient management tool handle electronic protected health information (ephi), which is regulated by the Health Insurance Portability and Accountability Act (HIPAA). Matching Four Applications to Four Cloud Models The company used the information it had collected on business needs and risk to pair the four workloads with four cloud models: The company chose to run its clinical imaging application on its on-premises, internal private cloud to maintain the security of ephi. The collaboration solution involved a complex mix of applications and required extensive maintenance. The company chose to migrate it to an external public cloud. This meant that some of the burden of keeping the solution up to date could be passed on to software-as-a-service providers. 8
The company s patient management tool tests the limits of computer resources four times a year during enrollment periods. And as the tool handles ephi, it required a secure environment. The company selected an external, private cloud specifically one aligned with applicable HIPAA business associate requirements. This model allows the company to scale up rapidly during enrollment periods and reduce use to just a few servers during the rest of the year, delivering significant cost savings. The company was able to work with a cloud provider that specializes in Hadoop environments, and the large server clusters they require, to implement a cloud solution tailored for Big Data analytics. By selecting an external private cloud, the company can scale up rapidly during enrollment periods and use fewer servers during the rest of the year. The Right Choices Provide Cost Savings and Address Security Requirements. By following the three-step process and carrying out detailed application analysis, the healthcare provider was able to choose the right cloud model for each workload. The company made significant cost savings, while protecting ephi. It was also able to experiment with Hadoop and Big Data without large capital outlays. 9
BUILD A TEAM WITH THE RIGHT EXPERTISE Our three-step process will help you match your applications to the right cloud delivery models. But before you begin on this journey, you should ensure that you have the right team in place. This means partnering with with the lines of business to ensure you re meeting business goals. Surrounding yourself with the right knowledge is crucial to reaping the benefits of the cloud. The complexity of analyzing applications and selecting cloud models demands expertise in the cloud itself, in how networking affects the performance of the cloud, and in security. If you don t have the right expertise in house, look to third parties to fill any gaps. However you build your team, surrounding yourself with the right knowledge is crucial to reaping the benefits of the cloud. Partner with the Lines of Business. In the modern enterprise, all departments share the same goals: Drive growth, increase performance, and help make customers happier. Your job isn t just to put an application into the cloud; it s to help business users succeed. You can only do this by working in partnership with managers from across the organization on a cloud adoption strategy that addresses their goals. Don t Just Demand Security from Providers, Demand Transparency. Enterprises need to ask their cloud providers tough questions about the reliability and security of their cloud solutions. Your application analysis will arm you with a detailed list of demands, and you should expect a high degree of transparency from cloud providers on how they propose to meet these now and in the future. An enterprise-worthy cloud provider should be able to give you: Administration information Service management data The location where workloads are running Proof of logical and physical controls Governance and controls that create standardized and repeatable processes Achieving transparency with your providers can help you secure your workloads and offer your organization the reliable cloud services it desires. VERIZON PROFESSIONAL SERVICES OFFERS CLOUD PLANNING, MIGRATION TOOLS, AND EXPERIENCED STAFF TO HELP YOU SELECT AND MOVE TO THE RIGHT CLOUD MODEL FOR EACH OF YOUR MISSION- CRITICAL APPLICATIONS. Call us at 1-877-297-7816 or go online to learn more about our application performance analysis, cloud onboarding services, and best practices in architecture planning and design. verizonenterprise.com 2015 Verizon. All Rights Reserved. The Verizon name and logo and all other names, logos, and slogans identifying Verizon s products and services are trademarks and service marks or registered trademarks and service marks of Verizon Trademark Services LLC or its affiliates in the United States and/or other countries. All other trademarks and service marks are the property of their respective owners. WP16402 4/15