
Post by Dr. Thorton Thomas Balley with UCLA California,
University Cloud Provider Group, LLC
In the world of information technology, it seems that
every few years a new concept comes along that emerges as being the next great leap in technology. One of the current concepts
that fits that description in the IT world is called cloud computing.
However, before a company
decides that it will embrace cloud computing, it needs to make sure that it understands all the implications of this new offering.
As with most technologies, there are many benefits that can be gained, but along with understanding the benefits,
the business risks must also be evaluated. When making this evaluation, it is important to keep in mind not only the short
term needs, but the long term objectives and goals of the organization.
In recent years, the Obama administration
has pushed for all federal agencies to investigate cloud computing to see if it will benefit each agency. “The Federal
CIO Council under the guidance of the Office of Management and Budget (OMB) and the Federal Chief Information Officer (CIO),
Vivek Kundra, established the Cloud Computing Initiative to fulfill the President’s objectives for cloud computing.”5
With the recent push from the current administration, cloud computing is expected to grow by leaps and bounds over the next
few years.
In some studies, there are predictions that “cloud services will reach $44.2 billion in 2013,
up from $17.4 billion of today, according to research firm IDC.”4 This paper will lay out the considerations that an
organization should consider at before making a decision to use or dismiss cloud computing at the present time.
Overview
of Cloud Computing:
“Cloud Computing is a model for enabling convenient, on-demand network-based access to a shared pool of configurable
computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released
with minimal management effort or service provider interactions.”2 This definition is one of many that have been introduced
within the IT industry, but what does this actually mean? The concept of a cloud can be looked at as a “leasing-versus-owning
concept – an operational expense versus a capital one.” 4
To understand the cloud computing concept more clearly, let us
compare it to a more common concept: paying for electric utility. Each month, a household or business utilizes a certain amount
of electricity which is monitored by a company and the consumer is billed based on their usage. If each household had their
own power source, that would be congruent with non-cloud computing; there is no central power source that households take
advantage of. If, as is the standard case, households buy their power from a consolidated power source (e.g. a power plant),
that would be like taking advantage of a cloud; many users sharing a resource to fulfill their independent needs. Using this
simple example, the cloud would be similar to the power plant, providing either infrastructure or software to customers on
pay-per-use basis.
Some experts may disagree, but in many regards, cloud computing is similar to the way that computers were used when
they first entered the market. At the advent of computers, computers (and associated facilities) were extraordinarily expensive
and only owned by a few select organizations such as universities or the government. Few had the expertise to support a separate
computing facility in house. Therefore, companies would lease time on computing resources provided by a small number of providers,
only purchasing what they needed for what they were working on. In a similar model, cloud computing introduces the concept
of buying resources as needed, and similar to the past, the resources can be accessed from a remote location.
Key
differences include quality of service, and variety of services offered by cloud computing vendors.
The National Institute of Standards and Technology (NIST) serves as a guide towards helping government
agencies achieve cloud. NIST’s cloud model “promotes availability and is composed of five essential characteristics,
three service models, and four deployment models.”2 As this paper continues, each of these components will be addressed.
Development
Models:
Prior to being able to evaluate if cloud computing is a good fit for a given organization, the general concepts of
cloud computing must be understood. There are a number of different deployment models as well as applications of clouds that
make up a cloud environment. The cloud deployment models include: public cloud, community cloud, private cloud and hybrid
cloud. There are strengths and weaknesses to each deployment model as it relates to the specific case that a cloud is being
considered for use with.
The following provides a summary understanding of each deployment model so that one can
be chosen to move forward with consideration of cloud implementation.
Public Cloud
“Made available to the general
public or a large industry group and is owned by an organization selling cloud services”2
A public cloud is owned by a third party
vendor that sells, or offers free of service, a cloud that can be used by the general public. A public cloud is the quickest
to setup within an organization, but it also has a limited amount of transparency and limits the amount of customization.
Community
Cloud
“Shared by several organization and supports specific community that has shared concerns” 2
A community cloud
is an architecture that is established when a group of organizations come together to share resources. A community cloud is
a mini public cloud, but only a select group of organizations will be authorized to use the cloud. In contrast to the public
cloud, it will generally be more expensive since it will only be used within a smaller group of organizations and all of the
infrastructure must be established.
A community cloud is a great choice for a group of organizations, such as
a group of federal agencies that desire to share resources but want to have more control over security and insight into the
cloud itself.
Private Cloud
“Operated solely for an organization” 2
A private cloud is one that is established
to support a small singular organization. There is much debate if a private cloud should be considered a cloud at all, as
the infrastructure and management of the cloud remains within the organization.
Hybrid Cloud
“Composition
of two or more clouds (private, community or public) that remain unique entities but are bound together by standardized or
proprietary technology that enable technology that enables data and application portability.” 2
A hybrid cloud allows for some of the
resources to be managed by a public cloud environment, while others are managed internally by a private cloud. This will normally
be used by an organization that wants to allow itself to have the scalability features that a public cloud offers, but will
want to keep mission critical or private data internal to the organization.
Service Models:
In addition to the platform on which
a cloud will be deployed, there are a variety of different applications of cloud. There are three major types of cloud services,
Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). Described below are the
concepts between the varying types of cloud models.
Software as a Service (SaaS):
“Delivers software over internet
without need to install and run applications on the customers own computers” 2
SaaS allows applications to be used
by customers over the internet to complete business processes. SaaS is not a new concept; for example, “Salesforce.com
has been providing on-demand software for customers since 1999.”6 The advantage of SaaS is the software is run from
one centralized location, which means that that the software can be accessed from any location over the internet. The other
benefit of having the software managed in one location is that the patches and updates only need to be done once, eliminating
the time consuming need to conduct software updates on every machine. Lastly, SaaS is generally “on-demand” which
means that an organization does not have to commit to enterprise licenses.
Platform as a Service (PaaS):
“Delivers
a computing platform and/or solution stack as a service, often consuming cloud infrastructure and sustaining cloud applications”
2
The PaaS is a platform that helps to deliver an environment where a user can use the clouds to develop new applications
without the need to have the software or infrastructure purchased in-house. The consumer will have control of the applications
that are running on the cloud, but will not have control of the infrastructure that it is running on. In essence, PaaS provides
“anything needed to support how a company builds and delivers Web applications and services in the cloud.”3
Infrastructure
as a Service (IaaS):
“Delivers computer infrastructure, typically platform virtualization environment as a service. It’s an
evolution of virtual private server offerings.” 2
IaaS is using the cloud to supply the infrastructure that would
normally have to be procured by a singular organization to run an organizations IT infrastructure. Included in the infrastructure
are such things as servers, memory and storage that allow a customer to scale up or down as necessary. The infrastructure
can than be used by customers to run their own software with only the amount of resources that are needed at a given moment
in time. In the past, companies would often have to purchase a huge infrastructure to support a periodic spike in the need
for resources, leaving the servers and networks idle for much of the remaining time. With IaaS, resources will not be wasted,
because only what is needed at a given moment is utilized. The customers to the cloud service have control over the operating
systems and applications, but don’t manage the cloud infrastructure.
Pros and Cons of Cloud Computing:
Now that the basic
concepts of cloud computing are understood, an organization needs to consider all of the impacts that cloud will influence.
As one might expect, there are a number of considerations that need to be weighed to decide if an implementation of cloud
computing is the best approach for a given organization.
Advantages:
There are many advantages that can be gained from the
use of cloud computing. Cloud computing is built upon the idea of economies of scale. The great thing about the concept of
cloud is the potential cost-savings benefits that can be gained for a small startup, large company, or even an entire federal
agency.
Cloud computing eliminates the usual high up-front cost that companies often cannot afford, allows for
“infinite” resources on-demand, and provides the ability to pay for resources as they are needed. It also removes
the need for special facilities and highly trained personnel dedicated to IT and the need to continually upgrade hardware
and software as technology moves on and company requirements change.
In general, the use of cloud computing should reduce costs by companies
paying for only the resources that are needed. Many companies do not know what the demand will be for their IT infrastructure,
which previously meant that companies either over-bought servers or were overwhelmed by demand that could not be handled;
leading to a loss of customers or degradation of service to their customers. In either scenario, there is a detrimental impact
because money was inefficiently expensed on unnecessary hardware and/or potential sales were lost.
Maintenance of software can be just
as big an expense for organizations as the initial purchase. With the use of cloud computing, software updates and backups
are made without the organization having to spend time and money on these activities. This helps to alleviate many of the
technical burdens that are often put on companies and allows them to concentrate on their core competencies while still gaining
the advantage of having the most up-to-date version software.
Cloud computing allows a company to operate in an elastic fashion.
Resources can be scaled up or down as needed by a project, consumer demand or operating need. The elasticity that is gained
by cloud computing allows projects to proceed in a manner that is appropriate, without the time consuming and costly delays
that the purchase of hardware and software has through the procurement process. Resources can be quickly provisioned/de-provisioned,
which should result in a lower investment cost.
The use of cloud is looked at as an environmentally friendly approach. Currently, there
are a huge number of server farms that operate to serve individual organizational needs. With cloud computing, a single server
farm can support a large number of different entities, potentially reducing power requirements, emissions, and disposal of
old electronics.
Disadvantages:
A company may think that cloud computing is unquestionably the way to go, but there are a number of concerns that
need to be taken into consideration before a company elects to implement cloud computing. The main concerns inherent in cloud
computing include security, privacy, reliability and cost.
Security is by far the most common reason that an organization states for
not moving forward with cloud. Many organizations ask: “who would trust their essential data out there somewhere?”1
The amount of security control that an organization will have depends on the type of cloud structure that is adopted; private,
public or community. The amount of security control is highest in a private cloud and lowest in a public one. While a cloud
environment might be just as secure as a non-cloud, there is limited transparency into the cloud which escalates the worry
of security. Along the same lines, there is also a concern by many organizations about the amount of privacy that a cloud
environment could potentially lack.
The third party vendor that is supplying the cloud could potentially access
a company’s sensitive information, which increases the risk of a privacy breach.
Reliability is a huge concern for many organizations;
having a service down for even a few minutes a year could be very costly or even cause a safety concern. Cloud takes the control
of reliability out of the hands of the organization and puts it into the hands of the cloud vendor. It is important that service
level agreements are established with the cloud vendor to make sure the reliability requirements are agreed upon by both parties
upfront.
In
some organizations, especially within the government, there are reporting laws that make it so a cloud option might “not
be an acceptable solution due to government regulations such as Sarbanes-Oxley and Health and Human Services Health Insurance
Portability and Accountability Act (HIPPA)”.1 In addition, there are many regulations that prevent sensitive data from
being transmitted beyond the borders of a nation. Cloud computing farms are general built in locations that offer the lowest
possible cost, many times outside the borders of the customer’s nation. Currently, clouds are being established that
alleviate this concern, but as a result, the cost of using the cloud vendor increases.
While the “advantage” section mentioned
how cloud computing was a way to lower costs, this is not always the case. The initial cost of utilizing a cloud will be lower,
but the lifetime costs could be much higher due to the continual expense of paying for service. Lastly, there is always the
concern the business that is selling the cloud services goes out of business. Cloud applications from one provider will generally
not be compatible with other providers’ clouds; thus limiting an organization’s options if they needed to change
providers for some reason.
Cloud Implementation:
The first step that needs to be taken before deciding to implement
a cloud within an organization is deciding if cloud is the right fit. The proper analysis needs to be conducted to include:
cost, time, risk, benefits and interoperability. The cloud environment could be a great revolution for a given organization,
but it is not a one-size-fits-all solution. If flexibility and scalability are an organization’s paramount needs, cloud
is likely an optimal solution. In organizations that have high concerns for security and privacy, cloud might be a viable
IT solution, but an in-depth analysis of the tradeoffs needs to be conducted. The length of time that an application or infrastructure
will be commissioned should be a factor in deciding if cloud is an appropriate model. For a short duration project, cloud
is likely an excellent candidate due to the fact that the infrastructure does not need to be procured. In the case of a long
term implementation, cloud might still be a very viable option due to the fact that demand often fluctuates. This being the
case, if demand is steady, a procurement of the hardware might a better option, considering cloud normally has a higher cost
per transaction.
After it has been decided that a cloud environment is the correct fit, the layer of cloud that will be implemented
needs to be selected: SaaS, PaaS or IaaS. Each of the differing layers brings with it entirely different questions. Following
the selection of the layer, the type of platform that the cloud will be deployed on needs to be chosen: public, community,
private or hybrid.
It is important to take into consideration the entire life cycle cost of implementing cloud. Without much question,
the initial cost of implementing a cloud will be lower, but since costs are paid for on a per-use basis, the cost over the
entire lifetime of could potentially be higher with cloud.
When developing the cost estimate to establish an IT
infrastructure without cloud, it is essential that cost beyond the initial purchase of the hardware and software are taken
into account. With cloud, especially in the public cloud, there is a large reduction in the costs for updates/patches, maintenance
and reductions in staff, all factors that need to be taken into consideration when doing a fair comparison. Simply put, opportunity
cost must be determined for moving to a cloud and a decision should be made based on the needs of the organization.