Moving Enterprise Applications to the Cloud

Moving Enterprise Applications to the CloudClint HarderVP of Product Strategy

About Me• Responsible for product development and operational integration at TDS HMS• Recently developed strategy for ReliaCloud offering• Pragmatic business-oriented technician• Warning: I am NOT a PowerPoint ninja 2

What are Enterprise Applications?• Applications designed to solve enterprise-wide problems• Typically integrate with other applications in the organization• Have stringent security, availability, and performance requirements• Include: – ERP, financial systems, email and collaboration, data warehouses, line of business applications, CRM, eCommerce, portals, etc.

What is Cloud Computing?• Five characteristics according to NIST: – On-demand self-service – Broad network access – Resource pooling – Rapid elasticity – Measured service• My definition: – IT infrastructure and/or applications delivered as service and as an operating expense to the customer• IaaS vs. PaaS vs. SaaS – I prefer ITaaS (IT as a Service)• Public vs. Private vs. Hybrid? – Yes!

Key Study Takeaways“As a first step, we as an industry must still work to provide aclearer definition of what cloud is and how the many innovativeand secure services can help positively impact today’sbusinesses,” said J.R. Santos, global research director at CSA.“But, we need to start at the top and engage seniormanagement. Cloud needs can no longer be thought of as atechnical issue to address, but rather a business asset toembrace.”“For cloud to provide enterprise-changing capabilities and thebenefits that vendors have promised, it needs to transition froma technology solution to a business resource. This entailsunderstanding what cloud is and what it promises, incorporatingbusiness and technical requirements into contracts, monitoringperformance against requirements, and appreciating cloud-related risk within the wider context of the business andenterprise risk management.” 5

Key Study Findings• Satisfaction Levels of Various Cloud Components (Percent rating satisfaction as “4″ or “5″ on a scale of 1 to 5): – Software as a Service (applications) 63% – Infrastructure as a Service (compute power) 55% – Platform as a Service (middleware) 43%• Estimated Length of Time to Meet Maturity – Software as a Service 2.73 years – Infrastructure as a Service 3.02 years – Platform as a Service 3.34 years• Business enablers (score 4.08) rather than financial considerations (score 3.5) are the primary factors in making cloud decisions• The business enablement factors that most influence cloud computing decision making are related to the reliability and availability of services (mean score 4.59) and quality of service (score 4.29). 6

Motivations to OutsourceSource: Savvis 2012 Global IT Leadership ReportSurvey of 550 IT Execs 7

Cloud Supports the Agile Business Current State - IT Desired State - IT Increase 20% Value Innovating Profit Generator Creation 80%Cost Center Innovating 80% Sustaining and Running 20% Decrease Sustaining and Low Value Running Operations ‘Running in Place’ or ‘Innovating’? 8

Leading Constraints on Cloud Adoption• Information security (4.22)• Data ownership/custodian responsibilities (4.12)• Legal and contractual issues (4.04)• Regulatory compliance (4.01)• Information assurance (3.77)• Longevity of suppliers (3.44)• Contract lock-in (3.42)• Performance standards (3.30)• Disaster recovery/business continuity (3.25)• Performance monitoring (3.21)• Technology stability (3.10)* Average score, based on a scale of 1 to 5 9

Evaluating Cloud Services• Security Management• Availability and Performance Management• Contracting and Ongoing Management• Big Bang vs. Evolving Adoption 10

Security Management• Cloud computing requires a comprehensive control framework• Cannot focus solely on technology • Build “Defense in Depth” which moves beyond application of technical controls • Establish programmatic security approach drawing from key disciplines • Understand Cloud provider and consumer roles to manage risk

Physical securityWhere does the Cloud provider host your dataand services?• If an unauthorized party can gain physical access, nothing else matters – Access controls – Environmental controls – Surveillance controls• Facility management and ownership – Uptime Institute Tier 3 – Separation of Cloud services

Network securityDoes the Cloud provider’s network securitystrategy align with yours?• Look for providers who approach network security the same way you do – Firewall management – Intrusion detection and/or prevention – Remote connectivity from offices and mobile workforce – Denial of service protection – SSL acceleration

System securityWhat does the Cloud provider do to secure thevirtualization environment?• Cloud provider owns the servers, storage and virtualization layer• Know who owns the operating systems – Provider, customer or both – Document processes for • OS hardening, patching • Malware defense • Data and system backups • Data isolation and sanitization

Threat managementWhat visibility does the Cloud provider deliveron activity within the environment?• Capabilities will vary by Cloud provider• Know what options are available – Log collection and/or security event management – Configuration, vulnerability and/or penetration assessments – Practices to respond and contain security incidents; analysis for root cause

Risk managementHow do you know the Cloud provider ismaintaining their controls?• Insist on independent attestations from a third party – AICPA Service Organization Control Reports • SOC 1 • SOC 2, SOC 3 – Industry related attestations• Establish your own framework

ComplianceIs the Cloud provider enabling compliance withregulatory drivers?• Evaluate Cloud providers based on the compliance obligations of your industry – Health information – Financial records – Payment card data

Availability ManagementWhat is the SLA for availability and what arethe remedies if not met?• SLA for availablity• Credits and other remedies for non- performance• Does the architecture actually support high availability• Do not expect to transfer all the risk • Unlimited liability, lost profits, etc. 18

Performance ManagementCan the cloud platform meet your performancerequirements?• What is the cloud platform architecture? – How does it align to your existing investments and skill sets? – Does it support high capacity and performance? • High network throughput • High IOPS – Can it scale quickly with existing architecture and capacity?• Is there an SLA for performance metrics? 19

Support Options and Other ServicesHow is support offered for ongoing issues?• Voice• Electronic• PortalWhat other services are available?• Implementation and migration services• Can you colocate dedicated infrastructure? – Can you integrate into the cloud services?• Can you directly connect (private connectivity) into the cloud services?• Are other managed services available? 20

ContractingWhat are the important contractual terms to beaware of?• Term of contract – Month to month vs. longer committments• Costs and cost escalators• SLAs – What do they cover and how are they measured?• Data ownership 21

More contractingWhat guarantees the Cloud provider meets theirobligations?• Key controls to strive for: – Rights to audit and mitigate – Security incident notification – Retention and electronic discovery – Human resource practices – Business continuity and disaster recovery – Liability insurance• IMPORTANT: Does the cloud provider have the resources to back their contract?

How to get started?• Big Bang• Evolve• Public vs. Private vs. Hybrid• Data migration• Assign internal ownership for managing the relationship• Develop strong competencies in sourcing management 23

In Closing• Is the cloud ready for enterprise applications? – Yes, if providers are carefully evaluated and contracts are carefully structured.• Has cloud passed you by? – No. Just entering the maturation stage.• Will the cloud save me money? – It depends. – How much value do you put on flexibility and speed? – Apples vs. oranges 24

Moving Enterprise Applications to the Cloud

by VISI on Oct 19, 2012

Accessibility

Categories

Upload Details

Usage Rights

Statistics