Cloud computing - we hear the term almost daily. But really, just
what is cloud computing all about? That seems to be a common question.
In June of this year, TELUS and IDC Canada released a study on cloud
computing which surveyed 200 Canadian business and IT executives and
directors at large Canadian companies (500+ employees) across a range of
industry sectors. The study found that 63% of Canadian companies
surveyed did not have enough or had only a base level of knowledge to
make decisions on whether to use a cloud service or their internal IT
department.
A
recent article from eweek.com also indicates that there is a great deal
of confusion about cloud computing. The article makes reference to a
recent study commissioned by Citrix Systems which included more than
1000 adults in the U.S. The study showed that most respondents thought
that the cloud is related to weather. 51% of respondents thought that
the weather could interfere with cloud computing. Despite the confusion,
the study also found that 97% of participants are using cloud services
today with examples including on-line banking, shopping, social networks
and file sharing. Further, 59% of respondents indicated that they
believe that the "workplace of the future" will be in the cloud which is
somewhat contradictory to the prevalence of cloud computing today.
This
insight above mirrors what we find amongst our own clients. Knowledge
of cloud computing is relatively limited and as a result, organizations
may be missing out on significant opportunities to make their business
stronger by reducing cost and risk. Our hope is that this article
provides insight into cloud computing to help you to assess its fit for
your business requirements.
What is cloud computing?
First
of all, it's useful to understand where the term cloud computing came
from. It most likely originated from the use of a cloud image to
represent a networked computing environment or the internet.
A
quick Google search will reveal a number of definitions for cloud
computing. I like a definition I picked up from Wikipedia which defines
cloud computing as the delivery of computing as a service whereby shared
resources, software and information are provided to computers and other
devices as a utility, similar to the electricity grid, over a network
which is most often the internet.
What are the various cloud computing models?
To
sort out some of the confusion around cloud computing, it is helpful to
understand the various cloud service models, of which there are three -
software as a service (SaaS), platform as a service (PaaS) and
infrastructure as a service (IaaS).
SaaS is the most widely known
flavour of cloud service. SaaS is sometimes referred to as on demand
software. With SaaS, software and its associated data are centrally
hosted and are typically accessed over the internet using a browser.
What are some examples of SaaS? MailChimp, the application we use to
distribute our newsletters, is an example. Google Apps is another
example as is Dropbox, and the list continues to expand.
PaaS
provides the delivery of a computing platform and required solutions to
facilitate the deployment of applications without having to invest in
the cost and complexity of hardware and software. Some examples of PaaS
include Microsoft Azure and Google's App Engine.
The IaaS service
model allows clients to avoid the procurement of servers, software, data
centre space and network equipment. Such resources are provided as a
fully outsourced service. Examples of IaaS include Amazon's Elastic
Compute Cloud and Rackspace.
In addition to the various cloud
service models, it's useful to understand the delivery models through
which cloud computing is distributed. The main delivery models include
public, private, community and hybrid.
A public cloud offers
infrastructure and solutions to the general public and is typically
owned by a large organization that sells cloud services.
A private
cloud is designed solely for one organization. A private cloud may be
managed by the organization which uses it, or by a third party, and the
infrastructure may be located on the site of the cloud user or
elsewhere.
A community cloud is shared by several organizations
and supports a community of users, usually with some common interest,
such as regulatory concerns.
A hybrid cloud model consists of two
or more clouds, for example a public and private cloud, bound together
by technology to facilitate data sharing and portability. Egnyte, a file
storing and sharing service, is an example of a hybrid cloud computing
solution.
What are some benefits of cloud computing?
Earlier
this year I participated in a webinar that featured a round table of
CFO's commenting on what they believed to be the major benefits of cloud
computing. The benefits cited included the following:
- Cost savings over on-site installations
- Anywhere anytime access through an Internet connection
- Reduced dependency on IT support
- Cloud solutions are most often faster to deploy than on-site solutions
- Cloud solutions typically enables organizations to buy into a bigger
product with much more functionality which would be cost prohibitive if
similar functionality was acquired through a non-cloud on-site solution
- IT can focus more on value-add activities as opposed to managing IT
infrastructure because infrastructure management shifts to the cloud
provider
- Cloud solutions typically contribute to the following:
- More timely financial information
- Optimizing business processes
- Connecting with employees and enabling staff to work remotely
What are some of the risks and concerns associated with cloud computing?
Not
withstanding the benefits, there are a number of common concerns
associated with cloud computing. It is very important to carefully
consider risks that could impact your sensitive information, no matter
whether you are evaluating cloud or on-site solutions. In doing so, it
is also important to evaluate risks associated with cloud solutions in
the context of similar risks you could face with your own on-site
alternatives.
The most common concern is security. For most small
and medium-sized organizations, security with cloud solutions is often
better than on-site solutions because reputable cloud solution providers
can invest in the skill sets and capabilities to address emerging and
evolving threats. Many small and mid-size organizations rely on
part-time IT support or have no dedicated IT support at all. This
combined with constantly evolving IT risks, would tend to suggest that
most small and medium organizations just can't keep up with threats to
their information assets. To address security concerns, a reputable
cloud provider should be able to provide assurance relevant to the
following:
- Access to data - There should be a rigid authentication process that all users should go through to access their data
- Transmission - Data should be encrypted as it travels from your local site to the cloud service provider
- Network - Strong security should be in place to protect the cloud provider's network
- Physical access - The cloud provider should be able to demonstrate
solid controls over physical access to its facilities where your data
will reside
- Data security -The cloud provider should be able to provide
assurance that your data is encrypted when it is "at rest" in the cloud
- Privacy and Compliance - Your cloud provider should be able to
provide assurance that it can protect the privacy of your information
and comply with relevant standards and legislation that may be relevant
to your organization.
Availability of cloud solutions is another concern. It is
relevant to assess the impact of a cloud solution becoming unavailable
due to circumstances such as an internet outage or a technical failure
by the cloud provider. Again such concerns should be analyzed in the
appropriate context. Internet outages, especially elongated outages,
tend to be uncommon. Reputable cloud providers can most often
demonstrate very high levels of uptime performance, and if problems
occur, skilled resources are available to address them. How does such a
scenario compare with similar risks associated with your on-site
alternative? What is your experience with downtime with on-site
solutions and can you get timely 24/7 support if you have a critical
problem? Availability risks can also be mitigated with the use of a
hybrid cloud model. Egnyte was referred to previously as an example of a
hybrid cloud model for file sharing and storage. With this option,
should the internet go down, you can still have a local copy of your
data available.
Access to data is raised as a concern in two
contexts. One is how can I get my data back if I leave my cloud
supplier. Another is what will happen if my cloud supplier goes out of
business. An answer to such questions should be readily available from
your cloud supplier and should be specified in your end user agreement.
It is most important to consider what format your data will be available
in if you seek to get it back from your cloud supplier. Consider for
example that if you use a cloud based accounting solution, your data
might not be provided back to you in the same format in which you
entered it.
One last consideration to think about is data backups.
In our experience with smaller organizations, it is not uncommon to
find no backup routines or problems with them, such as backups not being
stored off site or restoration from back-ups not being tested.
Reputable cloud solutions reduce this risk and in fact, many cloud
providers have multiple back-up locations in case there is a failure at a
particular site.