IT Best Practices Series Cloud Computing Safe Harbor or Wild West? With IT expenditures coming under increasing scrutiny, the cloud is being sold as an oasis of practical solutions. It s true that many businesses love the cloud. But why do they love it? What does being in the cloud really mean? And what about the companies that are purposefully staying out of the cloud do they know something we don t? When talking about cloud adoption with CIOs, CTOs and other tech colleagues, it becomes clear that decisions aren t always made within the context of a long-term strategy. Many IT leaders feel under pressure by executive stakeholders to adopt the cloud for short-term financial gains, yet in the rush for results, some important due diligence steps are being skipped. The best way to benefit from cloud computing, in both the short and the long term, is to research what it can offer and evaluate the pros and cons based on your specific business needs. What Is the Cloud? Although cloud computing has been around for a while, the scope of what it offers is still new to some businesses. Here are a few definitions to help put the cloud into context. Virtualization allows you to move, clone, back up, delete and deploy your servers or systems across your available infrastructure, essentially independently from its physical components. This minimizes your purchasing and maintenance costs for hardware while maximizing server performance, security and availability. Virtualization and the cloud are sometimes confused. While virtualization is a powerful enabler for the cloud, it is not in itself the cloud. Cloud computing gives you on-demand network access to a shared pool of configurable computing resources, such as networks, servers, storage applications and services. The types of clouds include the following: Public (shared) clouds provided as an off-site service with little user control over their infrastructure Private (internal or enterprise) clouds controlled by an organization within their intranet Hybrid (integrated) clouds that combine public and private clouds to make the most effective use of both Cloud computing leverages virtualization technology by sharing hardware and other resources across multiple businesses for public clouds, or across multiple units within a business for private clouds. There are three levels of the cloud: Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS).
SaaS Cloud software services, referred to as Software as a Service, represent a distribution model in which software applications (e.g., customer relationship management, enterprise resource planning, and human resources management software) are hosted by a vendor and accessed by customers over a network, most frequently the Internet. SaaS eliminates the need to install, run and maintain the application on the customer s own computer. This is in contrast to the traditional software as a product distribution model, in which software is purchased, installed and maintained on individual computers. PaaS Cloud platform services, referred to as Platform as a Service, provide computing platforms (e.g., a computer s architecture and operating system, or programming languages) as a service. PaaS helps businesses handle deployment of applications without the fully loaded expense or procedural complexity of buying and supporting the underlying layers of hardware and software. IaaS Cloud infrastructure services, referred to as Infrastructure as a Service or Hardware as a Service (HaaS), provide computer infrastructure (e.g., a platform virtualization environment) as a service. Businesses use IaaS as an alternative to purchasing servers, datacenter space or network equipment. The service provider owns the equipment and handles its maintenance. Access to IaaS is generally billed somewhat as traditional electric utilities are your monthly expense depends on the amount of computing resources you consume. Rewards and Risks As with any business decision, there are pros and cons associated with moving into the cloud. It is important to consider each in relation to your business, particularly when evaluating the use of a public cloud. With references to the cloud in the rest of this article, the public cloud should be presumed. Pros: Lower start-up costs You don t have to purchase your own servers or worry about future hardware upgrade expenditures. Compatibility All of your users can use the same versions of operating systems and software programs. Reduced IT staffing needs There are fewer (or no) servers to maintain, and updates and patch management are automated. Fast implementation and scalability Your available capacity can be rapidly expanded (or contracted) with minimal effort, investment or maintenance on your part. Use-based cost models Rather than maintaining a full infrastructure, you pay only for the capacity your company uses. Global accessibility Connecting to cloud services or resources via the Internet means your team has access wherever they are located. Security Data stored in the cloud can offer much greater security than data held on laptops. The cloud provides a secure connection to the data, keeping it off users hard drives. Page 2
Cons: Security and privacy risks You don t control what happens at your cloud vendor s location, such as staffing decisions, building security or which other businesses are sharing the servers. If you re responsible for highly sensitive customer information, or if your application is your basis for your competitive advantage, putting it in the public cloud can be risky. Lack of specialized in-house IT capability The skills necessary to support a cloud strategy for your IT operations and manage new issues that can arise are not necessarily the same skills you have in-house. If you aren t managing your own data or infrastructure, you may lose critical expertise and institutional familiarity over time. Interruption of access to data or systems If the Internet or your cloud service provider is down, you will not have any access to your data and/or software, potentially grinding your business productivity to a halt. Switching costs Once all of your data is somewhere else, the logistics of switching cloud providers can be very complex. There are currently no standards for porting data between one cloud service provider and another, and you need to be certain that you actually own the data you want to move. Approaching the Cloud Some proponents say everything should be in the cloud, while others say don t go in at all. In general, we re an advocate of a hybrid approach a mixture of cloud and traditional hardware as a solution. To determine what makes sense for you, you need to look at your company s specific business processes and requirements, both near- and long-term. Keep in mind that an ill-planned solution can be more troubling and harder to reverse than the original problem. A Few Scenarios to Consider Addressing rapid infrastructure growth Moving to the cloud is a good solution for fast growth, especially if that growth could be temporary. Recently, a CTO shared with us her company s use of PaaS. Her team was managing their customer care system using 25 servers to handle all customer transactions. They were fortunate to land another huge account, but serving the influx of new customers would require doubling the number of servers they had to maintain. And they were unsure whether the client would stay with them in the long run. Their capacity planning and financial analysis showed that the cost (in terms of money, time and team effort) of buying the servers, setting them up, and maintaining them would have been significant. She decided they were better off moving the new capacity into the cloud. Their setup and server allocation happened within hours. If needed, additional capacity could be provisioned within minutes, and easily reduced if they lost the new account. But they didn t move their old environment into the cloud only the new capacity. This hybrid model has served them well thus far. Page 3
Handling swings in activity with elastic capacity The need for elastic capacity is another good driver for adopting the cloud. The IT manager for a television production team shared with us his motivation for entrance into the cloud. They were experiencing tremendous peaks and valleys in traffic on their weekly show s website. Normal daily traffic was roughly 10K unique visitors. But on the night of the TV show, it would spike to 100K unique visitors for the four hours following the broadcast. Invariably, the in-house servers would get overwhelmed and crash. Rather than buy and maintain on-site capacity for their peak usage, they decided to use an elastic PaaS model in which they purchased modest capacity levels six days a week, and bought 10X additional capacity to support their weekly four-hour peaks. If they had to build and maintain that level of infrastructure in-house, the cost would have been unwieldy and inefficient. Maintaining or moving legacy systems A CIO shared with us his decision about one of their legacy systems for supply chain management. They had already spent millions of dollars to get it up and running. At this point, they were in maintenance mode, annually spending approximately 20% of their initial investment to maintain it. If they moved it into the cloud, the transition would have cost another 50% of their initial investment, and maintaining it would have cost another 20% per year. While moving had many upsides, they decided to wait for stronger economic conditions before making the investment. Cost and Resources Evaluation It s important to run the numbers to determine whether the cloud is cost-effective for your business. You should evaluate metrics such as capacity required, performance requirements, anticipated scheduled usage, number of seats required, cost to buy and maintain vs. outsource, cost to sign up, cost to transfer systems or data to the cloud, and so on. Try to compare everything in an apples-to-apples fashion. This will require annualizing monthly costs for comparison. We recommend taking a three-year view for cost analysis. It s also important to dive into the details of service-level agreements (SLAs). You need to understand how much you d be paying for the level and quality of service you d gain in the cloud. Vendor Evaluation The old adage holds true you get what you pay for. Taking the lowest bid isn t always the best decision. You need to research the cloud provider s reputation and track record. Helpful metrics to evaluate include length of time in business, uptime reliability, security breaches, and timeliness to respond to breaches or downtime. At the end of the day, it boils down to whom you can trust. You should have full visibility into who you re working with and how your data will be protected. If you run a company that accepts credit cards or gathers other sensitive information, you need to trust that your cloud provider will protect that data. Page 4
Disaster Recovery Plans What happens if your cloud provider goes down for a day or a week, or out of business entirely? You need to be familiar with your vendor s data backup and disaster recovery plans, but you are ultimately responsible for your own disaster recovery plan and for minimizing your company s exposure to failure at a cloud provider. Vendor Switching and/or Cloud Exit On a similar topic, you need to decide ahead of time what will happen if you re not happy with your cloud vendor. Read your service agreement very carefully before signing it, and pay special attention to whether you actually own your data. The complexity of dissolving a relationship isn t limited to contractual terms. Data migration can be painful. For example, if you ve downsized your IT team, you d need to determine whether you have sufficient in-house expertise to manage a transition to another cloud vendor or take operations back in-house. Future Development One of the biggest changes in development methodologies will likely be that companies will build interfaces into their applications so they can easily switch between vendors, or back to in-house, as a natural course of business. In theory, any cloud-based service should work fine with the infrastructure you develop. Your method of programmatically accessing that service should be flexible enough to go either way. About SmarTek21 SmarTek21 is a global IT services company that helps enterprises solve development, implementation and business problems. SmarTek21 provides full enterprise architecture consulting, software development, managed services and product realization support. More information is available at www.smartek21.com. Page 5