UTSpeaks: Clearing up the Cloud - How should we navigate the pitfalls of IT’s newest ‘big opportunity’?

  • 4,557 views
Uploaded on

For individuals and small business, Cloud computing via the internet offers unprecedented access to systems, software and technologies, previously restricted to the corporate world, at little or no …

For individuals and small business, Cloud computing via the internet offers unprecedented access to systems, software and technologies, previously restricted to the corporate world, at little or no cost.

But for mid-sized and large organisations the reality of adopting Cloud computing presents a whole new set of costs, risks and governance implications, quite different to those in traditional in-house IT systems.

This public lecture provides a concise, plain English overview of Cloud computing and what it means for businesses in Australia. It explores the privacy, security, commercial, regulatory, cost, risk and internal governance challenges that organisations, as well as the wider community, should be aware of.

Rob Livingstone is a fellow of the UTS Faculty of Engineering and Information Technology and consults widely to industry. His professional experience spans 33 years in the corporate sector as a manager and strategist, with the past 16 spent as CIO in multinationals based in Oceania - most recently Ricoh. Rob has held strategic advisory and executive roles both locally and internationally in defense-aerospace, manufacturing, public utility, packaging, construction and logistics. He possesses a clear understanding of the financial, operational, risk, commercial and human factors comprising modern corporations and offers insight to managers of small to medium-sized companies as well as multinationals on how IT can bring value to business and its customers. He is author of Navigating through the Cloud.

Introduced by Caroline Bucknell, General Manager, CIO Executive Council.

UTSpeaks: is a free public lecture series presented by UTS experts discussing a range of important issues confronting contemporary Australia.

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
No Downloads

Views

Total Views
4,557
On Slideshare
0
From Embeds
0
Number of Embeds
6

Actions

Shares
Downloads
70
Comments
1
Likes
1

Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
    No notes for slide
  • Welcome to our new improved basic media skills class! There are a number of things we want you to take away from today and these are:
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • (Read them out) So lets get started – by the way if you have questions at any time please feel free to raise your hand.
  • Welcome to our new improved basic media skills class! There are a number of things we want you to take away from today and these are:

Transcript

  • 1. UTSpeaks: Clearing up the Cloud 19 July, 2011 THINK.CHANGE.DO
  • 2. UTSpeaks: Clearing up the Cloud What I ’ ll be covering:
    • Cloud computing definition and attributes
    • Key differences between Public and Private Cloud
    • Migrating to the Cloud: A ‘ Ready-reckoner ’ .
    • The consumerisation or democratisation of IT
    • The intrinsic appeal of Cloud
    • The key considerations, such as :
      • Privacy
      • Risk and Security,
      • Statutory and Legislative,
      • Cost and commercial,
      • Regulatory
      • Internal governance
    • Cloud: The utility computing model
    • Cloud – The future is Now!
    • Open questions and discussion
  • 3. UTSpeaks: Clearing up the Cloud 1. Cloud computing definition and attributes:
      • Cloud is a very broad term for ‘ IT systems accessed via the Internet ’ .
      • The various components are all run by an external party, and you do not own anything, other than the data that you load into the system.
    • The primary attributes of Cloud systems are:
      • You subscribe to the service
      • The system is accessed via the Internet
      • You neither have control or title over the Cloud system
      • You have limited to full title over the data that you upload
  • 4. UTSpeaks: Clearing up the Cloud 2. Overview: Public and Private Cloud Public and Private Cloud – Key differences
  • 5.
    • The Public Cloud:
    • is hosted on ‘ somewhere in the universe ’
    • you own nothing, except your data that you upload.
    • is only accessible via the Internet.
    • Well known Public Cloud providers include Salesforce™, Google™ and Amazon™
    • There are a myriad of smaller Cloud providers coming onto the market
      • Some of which run on the major provider ’ s platforms, but branded separately
    UTSpeaks: Clearing up the Cloud 2. Overview: Public and Private Cloud
  • 6.
    • A Private Cloud:
    • Conceptually, uses same technology (ie: virtualisation)
    • What is meant by ‘ Virtualisation ’ ?
    • It is a technology that permits many ‘ virtual ’ servers to run off a single physical server, as if they were separate machines.
    UTSpeaks: Clearing up the Cloud 2. Overview: Public and Private Cloud
  • 7.
    • A Private Cloud:
    • Conceptually, uses same technology (ie: virtualisation)
    • Is owned by you, or your nominated service provider.
      • In the latter case, you generally have the contractual rights to access and manage the system, as if it were yours.
    • May reside on your own premises, or on a data centre of a provider of your choosing.
    • Grants you control over the underlying infrastructure
    • Gives you visibility over the design, operation and integrity of the overall system.
    UTSpeaks: Clearing up the Cloud 2. Overview: Public and Private Cloud
  • 8. UTSpeaks: Clearing up the Cloud Migrating to the Cloud Looking to move some of your systems from onsite to the Cloud? 3. Migrating to the Cloud: ‘ Ready reckoner ’ .
  • 9. UTSpeaks: Clearing up the Cloud 3. Migrating to the Cloud: Cornerstone questions .
    • If the answer to these questions are YES , then you should be able to progress relatively swiftly through your journey to Cloud computing:
    • Is the system standalone? (i.e. you do not need to build any system interfaces)
  • 10. UTSpeaks: Clearing up the Cloud 3. Migrating to the Cloud: ‘ Ready reckoner ’ .
    • If the answer to these questions are YES , then you should be able to progress relatively swiftly through your journey to Cloud computing :
    • Is the system standalone? (i.e. you do not need to build any system interfaces)
    • Are your business requirements likely to remain relatively static?
    • If the vendor goes out of business do you have a workaround in place?
    • Is the migration cost (Incl. write-off) for outgoing systems minimal?
    • Are the Cloud system boundaries clearly defined?
    • Are managerial accountabilities clearly defined and assigned?
    • Is there an immediate ‘ crisis ’ on your hands and Cloud is the only realistic alternative?
  • 11. UTSpeaks: Clearing up the Cloud 3 . Migrating to the Cloud: ‘ Ready reckoner ’ .
    • If the answer to these statements are YES , then you should be able to progress relatively swiftly through your journey to Cloud computing :
    • You will not need IT programmers to maintain the system
      • ie: Configure to suit your requirements through a control-panel
    • You will not need to do a major re-design of your business processes
    • Your data is not highly sensitive or subject to legislation (Eg Privacy Act, caveats on major client contracts)
    • Your most critical and important intellectual property is remaining in-house
    • Serving a short term need
    • Is your information largely in the form of pictures, files etc requiring no specific (granular) security and access controls?
  • 12. UTSpeaks: Clearing up the Cloud The ‘ consumerisation ’ of IT … also known as the ‘ democratisation ’ of IT I see it, I like it, I want it, I buy it (or it ’ s free!), I use it – Now!
  • 13. UTSpeaks: Clearing up the Cloud 4. The Consumerisation of IT
    • Individuals have unprecedented access to all type of IT systems, from email, file storage, banking, shipping, social networking (eg Facebook™ ).. The list is almost endless.
    • What is meant by ‘ consumerisation ’ of IT?
      • Individuals can use / buy systems as they see fit.
      • Personal choice and immediacy reigns supreme
      • Buy it / use it without necessarily a long term in mind
      • ‘ Apps ’ – for iPhone™, Android™, etc
    • For businesses, however, this presents a number of challenges
  • 14. UTSpeaks: Clearing up the Cloud The intrinsic appeal of Cloud to business
  • 15. UTSpeaks: Clearing up the Cloud 5. The intrinsic appeal of Cloud to business
    • Common influences include…….
    • It is available immediately
      • Potentially, the system can be operational with hours, days or weeks.
    • It allows you to ‘ Buy before you try ’ ……
      • buy a few user subscriptions and try the system. If it does not meet your needs, the walk-away costs are negligible
    • Avoids dealing with the IT Department !
      • avoids having to possibly deal with an internal IT department that may appear to be slow, inflexible or indifferent to Cloud.
    • Avoids the need for up-front capital / financing
      • ‘ pay as you go ’
    • Appears to be low cost
      • $100/user/month is a lot cheaper than $2Million upfront
          • … or is it?
  • 16. UTSpeaks: Clearing up the Cloud 5. The intrinsic appeal of Cloud to business
    • Users already have had a positive personal experience with Cloud…..
      • Personal experience in using Cloud applications (e.g. YouTube™ , Linkedin™, Gmail™, etc…) are invariably positive
    • Cloud eliminates the need for on-premises IT infrastructure
      • The provider does the maintenance, operation and support of the system.
    • Is a result of a compelling vendor offer……
      • It is not uncommon for Cloud vendors to bypass the IT department and go directly to the non-IT executive levels of organisations with an ostensibly compelling offer.
      • The difficult questions of cost, security, risk and governance may be relegated to a later date (provided you know what questions to ask, that is!) as the focus is on the usability of the application.
  • 17. UTSpeaks: Clearing up the Cloud The key considerations for business … could apply to businesses of all types
  • 18. UTSpeaks: Clearing up the Cloud 6. The key considerations for business
    • Privacy
    • Security
    • Risk
    • Statutory and legislative
    • Cost
    • Commercial, legal and contractual
    • Regulatory
    • Governance
  • 19. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Privacy
    • Privacy:
      • What National Privacy Principles apply [under The Privacy Act 1988] to your instance of the Cloud system?
      • If your vendor is an overseas entity, how can you assure that Australian Privacy legislation mandates are met, not only now, but should they change in the future.
    • International jurisdictions
      • On some foreign legal jurisdictions, Government agencies are able to demand access to your system. Examples of this are USA Patriot Act (2001).
      • Emerging Chinese Cloud providers
        • Concerned about sovereign ownership?
      • Data crossing multiple international regulatory and legislative jurisdictions
  • 20. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Security
    • Cloud concentrates the risk of security breach.
      • One provider can service thousands of customers
        • eg Distribute.IT lost 4,800 websites in a recent hack
    • Unauthorised or accidental access
    • Denial of service attack (ie: Saturation attack of the service)
    • What data transmission standards and protocols are guaranteed by the Cloud provider?
    • Which security standards apply, and to which components of the vendor ’ s infrastructure?
      • Review the statement of applicability (SOA) of the appropriate Certification
      • Is your Cloud solution in-scope of the SOA ?
  • 21. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Security http://trust.cased.de/AMID
  • 22. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Risk
    • Risk transfer
      • Can I buy insurance in the event of a problem with the Cloud?
    • Can you implement a Cloud escrow * arrangement in case the provider folds?
      • Some Cloud providers cannot offer escrow due to the technical design of their infrastructure
    • Does the provider have a disaster recovery plan?
      • What form does it take, and what scenarios does it cover?
    • Are you concerned about the unauthorised deployment of Cloud applications?
      • The risk of a ‘ viral ’ cloud is real, and may be hard to detect
      • Do you have a Cloud computing policy?
      • * Escrow: The system (or software source code) is released to the licensee by the escrow provider if the licensor files for bankruptcy or seriously breaches the terms of the agreement.
  • 23. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Cost
    • Do the TCO * over the expected life-span of the system
    • Do not exclude on-premises (Private Cloud, or traditional hosted) if these options exist
    • Understand the hidden costs (integration, 3 rd party, etc)
    • Understand the exit costs
    • Understand the implications of an ‘ enterprise ’ or ‘ unlimited ’ offer.
    • Compare on a like-for-like basis in terms of cost (buy vs. rent)
      • * TCO = Total cost of Ownership. The total cumulative cost over a defined period, and includes all cost elements, not just the up-front, or most obvious costs.
    Illustrative example only
  • 24. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Commercial, legal and contractual
  • 25. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Commercial, legal and contractual
    • Total Cost of Ownership
      • Is the TCO known with certainty?
    • What are the key drivers behind the adoption of Cloud?
      • Are they to …
      • Drive innovation?
      • Lower cost?
      • Increase flexibility?
      • Global mandate (for a multinational business)?
    • Level of protection under the contract
      • Do the remedies for service failures make commercial sense?
    • What is the cost of seeking legal recourse?
      • If you provider ’ s contract is in an overseas legal jurisdiction, how practical will it be to seek damages?
  • 26. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Vendor contracts
    • What ’s your Cloud contract duration?
      • If this is truly utility Cloud, why commit to a contract for a long period of time? 
    • Can you scale up and down as you see fit at any time?
        • Easy to scale up – what if you want to scale down? 
    • If marketed on ‘per user per month’ pay on that basis.
      • Some request annual pre-payment. You are the vendor ’s banker.
    • Watch for automatic renewal and, in particular, sunset / termination clauses.
      • You should be in control of the process
    • Request a copy of the draft contract early
      • The procurement cycle can be time consuming for large projects.
      • All that effort could be wasted if there is a major sticking point in the contract.
    • Global Cloud providers are reluctant to change standard contracts
      • Standardisation is the cornerstone of Cloud
      • Some vendors will amend terms if you have large buying influence
  • 27. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Vendor contracts
    • Contract refers to website terms & conditions ?
      • May extinguish or override your written contract at any time? 
      • Seek perpetual, fully encapsulated contract that extinguishes any online terms and conditions including the ‘I Accept’ checkbox at logon
    • Purchasing additional subscriptions.
        • Subject to the existing contract or an online contract at the time of purchase ? 
    • Recourse for non-performance .
      • Is the compensation adequate in the event of non-performance ?
    • What warranty exclusions or limitations apply to all services offered .
      • Are these important to your organisation
    • Data transmission encryption standards and methods used
      • Specifically stated? If so, are these standards adequate for your purposes?
    • Right to Audit
      • Do you have the right to request an independent audit of the provider?
    • Jurisdictions
      • Which international legal and regulatory jurisdictions apply?
  • 28. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: 3 rd Party contracts
    • Proprietary 3 rd Party Cloud providers
    • Some vendors encourage an eco-system of third party developers who market their applications independently of the provider, but on their proprietary Cloud platform.
    • Has the potential to increase the ‘ pain of disconnect ’ when switching to another provider at a later date
        • Examples
        • Salesforce™ App Exchange
        • Google Android™ Market.
        • Apple™ App Store ( ‘ Apps ’ )
        • Software plug-ins
    • Perform due diligence of the risks, costs and benefits associated with these 3 rd party applications
  • 29. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: 3 rd Party contracts
    • Will the Cloud provider charge anything for access to these 3 rd party apps?
      • Some may charge an additional access fee for smart phones
    • Performance guarantees
      • What obligations exist for the Cloud provider to assure the quality, security, integrity and performance of the third party applications hosted on their infrastructure?
    • 3 rd Party contract
      • What are the terms and conditions of any 3 rd party contract?
      • Are there any conflicts between the 3 rd party and the vendor ’ s contract
      • Do they offer the same levels of security, governance, etc
      • as the primary vendor?
  • 30. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Regulatory
    • Planned 2012 changes in International Accounting standards will have a reporting impact for off-balance sheet financial commitments
    • All leases, regardless of their terms, should be accounted for in a manner similar to how finance leases are treated today.
    • May put Cloud costs back onto the balance sheet in businesses
    [ Standards published by the International Accounting Standards Board (IASB) ]
  • 31. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Regulatory
    • Planned 2012 changes in International Accounting standards will have a reporting impact for off-balance sheet financial commitments
    • All leases, regardless of their terms, should be accounted for in a manner similar to how finance leases are treated today.
    • May put Cloud costs back onto the balance sheet in businesses
    • What National Privacy Principles (NPPs) apply under the Privacy Act ( The Privacy Act 1988) ?
    • What document and information retention requirements apply under the applicable Federal or State laws? (eg: Corporations Act 2001).
    • Are there any industry specific regulations that apply to your organisation? For example, APRA (Australian Prudential Regulation Authority)
    [ Standards published by the International Accounting Standards Board (IASB) ]
  • 32. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Governance The ‘ Viral ’ Cloud
    • A viral Cloud is characterised by a localised initial installation of a Cloud system (approved or otherwise!) which expands in an uncontrolled manner.
      • Additional subscriptions are gradually purchased for others outside of the initial user pool to approve workflows, access documents, process information etc.
    • The low barrier to entry could mask the potential for additional cost, unmitigated risk and breach of minimum governance standards.
      • A leading Australian University experienced an unauthorised deployment of a Cloud system that was funded from one Faculty ’ s discretionary budget, as it fell within their prevailing local discretionary expenditure approval limits. This was only noticed when data integrity issues within their core student enrolments databases started occurring.
  • 33. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Governance Change and version Control You may have no control over the timing and types of changes Is this important in your organisation?
  • 34. UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Governance Change and version control Scenario: Upgrading your Cloud 1 ’ other system ’ interfaces
  • 35.
    • Change and version control
    • Scenario: Upgrading your Cloud 1 ’ other system ’ interfaces
    • Usual practice to take a ‘ point in time ’ backup as a restore point before implementing the upgrade.
      • This is in the event of needing to fallback to the pre-upgrade point should the upgrade fail for whatever reason.
    • If your Cloud provider cannot restore designated elements of, or your entire system, in an acceptable timeframe * , what can you do?
      • Core to effective governance of IT is change control and recovery processes
        • (eg SOX Section 404 – General controls, to name but one).
    • * - eg: Restore may be needed immediately. Some providers can take a few days
    UTSpeaks: Clearing up the Cloud 6. The key considerations for business: Governance
  • 36. UTSpeaks: Clearing up the Cloud 7. Cloud: The ‘ utility ’ computing model Or is it? Cloud computing …… The ‘ utility ’ computing model
  • 37. UTSpeaks: Clearing up the Cloud 7. Cloud: The ‘ utility ’ computing model
    • A utility service is characterised by:
      • Pay for what you use
      • Switching providers is effort free and painless
    • What ’ s this got to do with Cloud Computing?
    • Understanding these concepts are important when matching the various vendor ’ s marketing messages to the reality of what you are buying.
    • This applies particularly to ‘ Software as a Service ’ (SaaS)
    • Let ’ s consider these two points …..
  • 38. UTSpeaks: Clearing up the Cloud 7. Cloud: The ‘ utility ’ computing model
    • Pay for what you use
    • SaaS is generally on a Named user subscription basis
    • How does it work?
    • One subscription is assigned to a unique logon (user name), irrespective of how many times the users access the system.
      • ie: You pay the same whether you log on once in a month, or 1,000 times in the same time period
    • The analogy:
    • This model licenses you for the number of light bulbs in your house, whether you switch them all on, or some, some of the time.
  • 39. UTSpeaks: Clearing up the Cloud 7. Cloud: The ‘ utility ’ computing model Pay for what you use Consider for a moment the information on a leading SaaS provider ’ s website …
  • 40.
    • Painless barrier to changing providers
    • The ‘ Pain of change ’ :
    • Switching is neither painless or trivial as there are no common interchange standards
    • Can extract your data, but not the business logic and application software
    • Your software is left behind on the outgoing Cloud
    • You will need to re-configure or re-build any system-to-system interfaces
    UTSpeaks: Clearing up the Cloud 7. Cloud: The ‘ utility ’ computing model
  • 41. UTSpeaks: Clearing up the Cloud 8. Cloud – The future is now
    • Cloud technology, as with any other innovation, has the potential to do things cheaper, faster and better.
    • Cloud has the potential to be a real game changer for the astute
    • Define your strategy now:
      • Be an early adopter, or
      • A fast follower, and leap-frog the early adopters be capitalising on their experiences
    • To achieve these benefits understand:
      • the true cost
      • the value
      • the risk
      • when to buy
      • what to buy, and
      • when to exit the technology and/or switch horses.
  • 42. UTSpeaks: Clearing up the Cloud 9. Open questions and discussion Thank you I trust that you have found this presentation informative, and of value Rob Livingstone [email_address]
  • 43. Thank you THINK.CHANGE.DO