Cloud Landscape: Benefits, Challenges and
Management Strategies
by
Harish Doddala
M. Tech in Information Technology
International Institute of Information Technology, India
B.E. in Electronics and Communication
Visvesvaraya Technological University, India
Submitted to the System Design and Management Program in partial
fulfillment of the requirements for the degree of
Master of Science In Engineering and Management
AOk
MASSACHUSETtS -4fl
OF TECHNOLOGY
at the
Massachusetts Institute of Technology
May 2013
IA
@2013 HarisK Doddala. All rights reserved.
JUN 2 6 2014
LIBRARIES
The author hereby grants to MIT permission to reproduce and to distribute publicly paper and
electronic copies of this thesis document in whole or in part in any medium now known or hereafter
created.
Signature redacted
Signature of Author:
Harish Doddala
System Design and Management Program
May, 2013
Signature redacted
Certified by:
Jeanne W. Ross
Director and Principal Research Scientist
MIT Center for In
Approved by:
VEW
mati
s Research
Signature redacted
Patrick Hale
Director
System Design and Management Program
EI.
This thesis is dedicated to my parents
My mother, late M. Padma (1957-2011), the greatestinfluence on my life! She not only
raised and nurturedme but also taxed herself dearly over the yearsfor my education
and personal development. She met her demise about a year before I left to MIT.
&
My father,D. Punyakoti, who has been a source of motivation, strength and continued
intellectual development
Acknowledgements
This thesis marks the completion of a remarkable journey that I undertook at the
MIT Center for Information Systems Research (CISR). The journey was enjoyable
and memorable.
Thank you to my advisor, Dr. Jeanne Ross, for taking time out of her busy schedule
to accommodate frequent meetings and updates. Her invaluable comments,
feedback and pointers helped shape the thesis into its current form. She was patient,
supportive and an excellent advisor to work with.
Thank you to Dr. John Mooney, Department Chair, Strategy and Information Systems
and Entrepreneurship at Pepperdine University and Research Affiliate at MIT CISR,
for his coaching and insight and all the intellectual discussions we had.
Thank you to Dr. Pat Hale for his amazing support and flexibility throughout the
program. Also, thanks to Kate Moloney, for all the scheduling and administrative
help.
Finally, thank you to my wife Deepali and my family for tolerating my late hours and
cheerleading my efforts all the way. I share your sense of relief now that it's over!
3
Executive Summary
The benefits of Cloud are quite well known and many companies are trying to
harness its potential. They are doing so to increase productivity, deploy newer
applications fast, reduce upfront costs and optimize resource utilization. However,
some companies are still trying to realize its full potential while dealing with
technical challenges such as legacy systems, complexities of integration and other
operational implications.
The goal of this thesis is to identify the top benefits that companies are gaining
through Cloud adoption and the main challenges they are facing in light of this
transition. Much has already been written and discussed about these issues in
literature. This thesis attempts to seek answers by directly reaching out to top
executives of companies to gain real insights and understand the management
strategies and best practices that are enabling this transition. By comparing
reviewed literature and information gathered through interview analyses, this
thesis brings clarity to areas of overlap and the major issues in Cloud computing
that were not emphasized or as clearly evident in the literature.
Based on the findings, key recommendations are made to help companies effectively
transition into the Cloud.
4
CONTENTS
1. INTRO DUCTIO N ....................................................................................
1.1
1.2
1.3
1.4
MOTIVATION ..........................................................................................................................
RESEARCH QUESTIONS & APPROACH ..............................................................................
THESIS STRUCTURE................................................................................................................7
KEY FINDINGS.........................................................................................................................8
2. LITERATURE REVIEW .......................................................................
2.1 THE BENEFITS/VALUE OF CLOUD COMPUTING.............................................................
2 .1.1 V IRTUA LIZATIO N ...............................................................................................................
2.1.2 TOTAL COST OF OWNERSHIP ......................................................................................
2.1.3 RESOURCE UTILIZATION.............................................................................................
2.1.4 RISK REDUCTION AS A RESULT OF CLOUD ADOPTION ...........................................
2.1.5 AGILITY AND TIME TO MARKET ................................................................................
2.2 THE ISSUES/HURDLES OF TRANSITIONING INTO THE CLOUD .......................................
2 .2 .1 IT C HA LLEN GES .................................................................................................................
2.2.2 COST ASSESSMENT ......................................................................................................
2.2.3 SECURITY AND IDENTITY CHALLENGES.....................................................................
2.3 PATH TO TRANSITIONING INTO THE CLOUD ...................................................................
2.3.1 CHANGING ROLE OF THE IT .......................................................................................
2.3.2 MOVING TO PRIVATE CLOUD ......................................................................................
2.3.3 MOVING TO PUBLIC CLOUD.........................................................................................
2 .3 .4 SU MMA RY :..........................................................................................................................2
3. ANALYSIS O F FINDINGS ...................................................................
3.1 RESEARCH METHODOLOGY ............................................................................................
3.2 MAJOR BENEFITS.................................................................................................................
3.2.1 FASTER TIME TO MARKET ..........................................................................................
3.2.2 ECONOMIC BENEFITS OF THE CLOUD.........................................................................
3.2.3 EASE OF GOVERNANCE .................................................................................................
3.2.4 IMPROVED PROVISIONING OF RESOURCES AND REDUCED COMPLEXITY ...........
3.3 CHALLENGES ........................................................................................................................
3.3.1 RE-ARCHITECTING PLATFORMS AND DEALING WITH LEGACY ............................
3.3.2 VENDOR MANAGEMENT .............................................................................................
3 .3 .3 S ECU RITY ............................................................................................................................
3.4 MANAGEMENT PRACTICES...............................................................................................
3.4.1 TRANSITIONING WITH PILOTS..................................................................................
3.4.2 VIRTUALIZATION...............................................................................................................
3.4.3 HYBRID CLOUD SOLUTIONS.........................................................................................
3.4.4 CHANGING ROLE OF IT ...............................................................................................
3.4.5 IT AND BUSINESS ENGAGEMENT STRATEGY............................................................
3 .4.6 SU M MA RY ...........................................................................................................................
4. CONCLUSIO N ..................................................................................
6
7
7
11
11
12
13
13
14
14
14
15
17
19
21
21
23
24
5
26
26
28
28
29
30
31
32
32
33
34
35
35
36
36
37
39
39
41
5
1. Introduction
Cloud can be defined 1 based on how the technology is currently utilized and
delivered. As Infrastructure as a Service (IaaS), the Cloud obviates the need for data
centers providing databases, networks, servers and other computing hardware.
Billing is typically pay as you go, depending on the amount of resources consumed.
As Platform as a Service (PaaS), it provides applications and services that can
essentially be built, tested and delivered without software downloads and
installations. The entire development environment is available to develop the
applications. As Software as a Service (SaaS), it eliminates the need to install and run
the application on one's own system. SaaS also enables upfront reduction of costs of
software purchasing, maintenance and upgrades. In summary, Cloud computing is a
model for enabling ubiquitous, convenient, on-demand network access to a shared
pool of configurable computing resources (e.g., networks, servers, storage,
applications, and services) that can be rapidly provisioned and released with
minimal management effort or service provider interaction.
More users are renting computing infrastructure from a utility provider instead of
maintaining their own hardware. 2 In the early days, users of electricity used to
generate their own power, much like how most software users also own the
hardware that runs the software. Some of the economies of scale and cost savings of
Cloud computing are akin to those in electricity generation. Nicholas Carr, an
independent blogger in his book, The Big Switch, claims that:
"At a purely economic level, the similaritiesbetween electricity and
information technology are even more striking. Both are what
economists callgeneral-purposetechnologies. (GPTs). GPTs are best
thought of not as discrete tools but as platforms on which many
different tools, or applications,can be constructed.Once it becomes
possible to provide the technology centrally,large-scale utility suppliers
arise to displace the private providers.It may take decadesfor
companies to abandon theirproprietarysupply operationsand all the
investment they represent.But in the end the savings offered by utilities
become too compelling to resist,evenfor the largestenterprises.The
grid wins."3
1 The NIST Definition of Cloud Computing, National Institute of Science and Technology. 24 July
2011.
2 Cloud Computing and electricity: Beyond the Utility Model, Erik Brynjolfsson, Paul Hoffman and
John Jordan
3 Carr, n. The Big Switch: Rewiring the World, from Edison to Google. norton, new york, 2008.
6
1.1 Motivation
The benefits of Cloud are well known and users have begun to harness the potential
of Cloud across a wide range of industries. A number of companies are using Cloud
services to reduce the time to deploy new applications and augment existing
systems. MIT CISR research 4 claims that a significant shift to Cloud computing is
inevitable.
Although some companies are quite advanced in their adoption and utilization of
Cloud computing, some of them are still learning the ropes on how to fully realize its
potential. Technical challenges, economic factors, existence of legacy, user
provisioning, and platform complexities and concerns of security are some of the
major drivers of this skepticism. Cloud adoption does not come without its
challenges. Some organizations that may be aware of its benefits aren't fully
prepared for Cloud's operational implications. Businesses think they can buy Cloud
services and meet all the IT requirements, resulting in governance and management
challenges within the organization. Furthermore, it has become conventional
wisdom that Cloud computing can save money.
1.2 Research Questions & Approach
With the above motivation, this thesis attempts to answer two main questions:
1. What are the key benefits and challenges of moving to cloud?
2. What are key management strategies and best practices that would allow
enable these companies to transition to the cloud?
The thesis is primarily based on interviews with over 40 Fortune 500 company
executives, most of who were Chief Information Officers (CIOs) of the companies.
The questions posed to these executives were articulated by the MIT Center for
Information Systems Research 4 (CISR) staff and myself. Further details of the
analysis are discussed in Section 3, "Analysis of Findings."
1.3 Thesis Structure
While there are many benefits and challenges companies are facing in light of Cloud
adoption, this thesis will focus on what I believe are the most important ones, which
are enumerated in the following section. For these benefits/challenges, this thesis
discusses and introduces prevailing wisdom through literature review and results of
interviews/analysis to highlight key issues.
4 http://cisr.mit.edu/
7
The outline is as follows:
* The thesis begins by describing the motivation for this topic and the scope of
the research in the current section.
* Then it attempts to delve a little deeper into the details of the literature
review to highlight some of the prevailing knowledge in the area. Literature
from academic journals, market research reports, blogs and other sources
are consolidated and presented in Section 2.
* These findings are then analyzed and mapped to some of my own research in
the area. This analysis is correlated to earlier findings in the literature in
Section 3.
e
The thesis then concludes by presenting a summary of the research with
some recommendations and best practices.
Literature Review
Figure 1:Outline of the Thesis
1.4 Key Findings
From Literature Review Researching and reviewing existing literature, the following key benefits of Cloud
were identified * Agility and time to market
8
* Resource Utilization
* Virtualization
* Total Cost of Ownership
* Risk Reduction
The benefits are highlighted as Blue Ovals in Figure 2: Benefits, Challenges, and Path
to Cloud
Agility and
Time to Marks
Resource
Utilization
Total Cost of
IT ChaIlenges
Ownership
Cost Assessment
Security and Identity Management
'Utilization)
Risk Reduction
Figure Z: Benetits, Challenges, and Path to Cloud
Some of the challenges companies are facing, highlighted in the center in the above
figure, are as follows:
* IT Challenges
* Cost Assessment and
* Security and Identity Challenges
Companies are coping with these changes by having IT to support them and driving
adoption through more mature operational IT models (such as the Public/Private
Cloud).
These issues are explained in greater detail in the literature review.
9
From Analysis of Interviews with Company Executives * Faster time to market
- Economic Benefits of Cloud
- Ease of Governance and
" Improved Provisioning of Resources
"Re-architecting Platforms and dealing with Legacy
- Vendor Management and
"Security
K
Transitioning with Pilots
-Virtualization
+ Hybrid Cloud Solutions
* Changing Role of IT
- IT and Business engagement strategy
Figure 3: Results of Analysis: Benefits, Challenges, Management Practices
The key benefits and challenges that seemed to resonate among the companies that
were
analyzed are as shown in Figure 3: Results of Analysis: Benefits, Challenges, Management
The management practices adopted by companies to address these
challenges and arrive at the benefits they intended to receive are listed in Figure 3.
The key findings are explained in greater detail in Section 3.
Practices.
There seemed to be quite a bit of overlap in the benefits and challenges that
companies realized as a result of Cloud adoption between the literature that was
reviewed and my own analysis of the interviews with company executives. These
are explained at length in Section 3.
10
2. Literature Review
The following section addresses some of the benefits and issues of Cloud computing
perceived to have been received by companies. Given that the journey to Cloud is
inevitable for most companies, the major transitional issues and acquired benefits
are looked at more closely. This acquired wisdom is then correlated with some of
my own research, which was done by way of conducting interviews and also
analyzing available transcripts and interviews of companies at the Center for
Information Systems and Research (CISR) at MIT Sloan.
2.1 The Benefits/Value of Cloud Computing
Many companies are getting interested in Cloud computing. Some have already
begun to realize its benefits while others are starting to do so gradually. The Cloud
within an enterprise (internal Cloud) is beginning to provide increased
computational effectiveness at lower costs. It is not just the startups but large
companies, R&D and government systems that are also moving to this platform. 5
According to a McKinsey study 11 on Cloud adoption, more than 80 percent of IT
respondents say their companies are using or experimenting with Cloud technology.
Some 63 percent say their companies are using Cloud-based applications in some
aspect of day-to-day operations, and over the next 12 to 18 months, deployment and
piloting is expected to increase across all application types explored in the survey
(Figure 4: Adopting the Cloud).
Technology shifts, improved virtualization capabilities and rapid provisioning of
services have enabled companies to look closely at their business needs and IT
enablement strategies. Virtualization allows different operating systems to be
hosted on the same physical hardware. Companies can meet required needs with
existing hardware in their datacenter, thus reducing the cost of management of
these datacenters. Provisioning is essentially the way machines are made usable
through a single server or a pool of available servers. Using APIs (Application
Program Interface), the existing services are being able to interact with services
over the Internet across multiple devices.
5 Gartner Research - The Nexus Effect: How Cloud Computing Alters Established Architecture Models
11
% of respondents, n = 469
I Piloting
I
Deployed at some level
What is your company's current level of cloud deployment for each of the following
applications? What do you expect it to be in 18 months?
Collaboration
Customer relationship
management (CRM)
Finance or humanresources systems
ii
II
Current
In 18 months
Data access, analysis,
and delivery
II
Current
in 18 months
Current
Office productivityapplications
I
Current
Current
In 18 months
in 18 months
Supply chain
management or enterprise
resource planning
I
In 18 months
1i
Current
In 18 months
11' Respondents who selected "none"and "don'tknow" are not shown.
Figure 4: Adopting the Cloud
The following sub-sections summarize the value that is being extracted through
such a transition and the reason behind Cloud adoption.
The top five benefits of Cloud adoption are
e
Virtualization
* Total Cost of ownership
* Resource Utilization
* Risk Reduction as a result of Cloud Adoption
* Agility and Time to Market
2.1.1 Virtualization
Virtualization is the process of imitating a resource to support different operating
environments. The resource may be in the form of memory or software.
Virtualization has been the key to companies maximizing utilization of their data
centers. According to Gartner 6 utilization rates in a non-virtualized datacenter can
6 Gartner Research - Gartner Interviews Ian Pratt, Virtualization Visionary
12
be as low as 20% to 30% at times. This is because an application running on a given
hardware configuration may not utilize all of the resources of the hardware. Also,
the application may not need to be up and running all the time. The advantages are
summarized below
- Fewer or no physical servers in the data center lead to reduced power and
cooling costs, not to mention savings on server hardware and related
maintenance over time.
e
Application, backup, and disaster recovery testing is now completed in a
fraction of the time it takes with purely physical servers.
e
The ability to transfer the location of virtual machines between different
physical machines enables more users to use the same hardware.
2.1.2 Total Cost of Ownership
When comparing costs between on-premise options and Cloud Computing, it is
important to accurately assess the true costs of both options. With Cloud, most costs
are not upfront. The pricing is based on usage of servers, network, software, real
estate, time, etc. This is in contrast with direct costs companies incur due to onpremise technology such as server, floor-space, IT operations and management of
resources and indirect costs of running a server such as network, storage
infrastructure, etc.7 Cost of ownership is particularly of interest to small businesses
that may simply not be able to afford a security specialist or extra hardware that
could take care of securing their infrastructure. Large companies also use Cloud to
meet unpredictable demand spikes and achieve cost optimality.
2.1.3 Resource Utilization
Resources can be classified into storage, computing services and software
applications. Aggregate demand is smoother than individual demand since
aggregating demand from multiple customers tends to smooth out variation. This is
how Cloud gets higher utilization. Companies, in order to efficiently utilize the
resources, engage in IT and businesses for new initiatives. IT provides security,
compliance information and monitors traffic. Businesses focus on utilizing these
resources to meet their requirements and increase revenue.
Companies focus on price, reliability, availability of service and support when
considering their resource acquisition strategy. For instance, some may choose their
storage services from Amazon 8, computing services from Google and software
applications (such as CRM) from Salesforce.com. 9 Sourcing decisions are thus based
on dynamically changing workloads, priorities and costs. Furthermore, such
7 http://broadcast.rackspace.com/hosting-knowledge/whitepapers/Cloudonomics-
TheEconomicsofCloudComputing.pdf
8 http://aws.amazon.com/ec2-sla/
9 http://www.salesforce.com/services-training/customer-support/
13
companies are able to utilize its time on other important tasks and focus its energy
on growing its business as opposed to worrying too much about resource
management issues.
2.1.4 Risk Reduction as a Result of Cloud Adoption
Cloud users have the advantage of testing out projects and abandoning them if
necessary without having to spend millions of dollars for licenses, infrastructure
and consultants. Thus there is no idle hardware/software cost involved since
companies invest in resources depending on the outcome of these projects. This
helps reduce upfront costs and risk of depreciation of under-utilized assets.
Also, a professional Cloud services provider reduces the risks of less mature
companies-those that have issues with breakdowns or security breaches.
2.1.5 Agility and Time to Market
Reducing costs has been traditionally recognized as the major advantage to increase
business efficiency. However, the real reason more businesses are migrating
applications and data to the Cloud is for enhanced agility in the face of a fluctuating
market and changing demands. Cloud enhances decision-making and provides
greater control over data. Software upgrades are much more frequent on the Cloud
and companies don't have to waste too much time waiting for upgrades and newer
versions of the software. Traditional software vendors may release updated
versions of its CRM software once a year while newer Cloud providers deliver
updates every quarter. Many firms are using the Cloud to extend the data center
and add or remove capacity as needed. Thus, the real value lies in the ability to
adapt to constantly evolving business environment, market and client expectations.
By leveraging the Cloud for this capability, companies are able to reduce
unnecessary investments and better allocate spending to drive innovation. Thus
agility is becoming an important driver for businesses to opt for Cloud services..10 17
2.2 The Issues/Hurdles of transitioning into the Cloud
IT organizations are having to secure, manage and govern both what is in their
environments, as well as external Cloud services such as those that have been
acquired without IT's involvement. They need to deal with developing new
applications based on user needs and requirements, integrate and deliver them in
time for deployment. Some of these applications are internally managed while some
are outsourced. (Or being outsourced). Managing this internal/external, Cloud/nonCloud environment poses significant challenges. Users continue to clamor for the
speed, agility, flexibility, more choices and the perceived cost savings that Cloud
10 http://buildingsaas.typepad.com/blog/2006/08/what-businesses.html
14
.................
-.................
....
........
........
......
.....
.........
-- -...
.........
........
computing promises.
A McKinsey study" highlights some of the barriers to Cloud adoption in Figure 5:
Barriers to Cloud Computing. Security and business continuity risks and managing a
regulatory environment are the top issues on IT's agenda. This is consistent across
many Cloud adopters who feel that in such an outsourced environment, checks and
balances need to be enforced to mitigate risks. Non-IT executives on the other hand
are most concerned about a lack of organizational awareness, a barrier that ranks
higher than security concerns. These non-IT folks are primarily businesses that buy
Cloud systems to meet immediate needs and are not fully aware of the
accompanying risks.
% of respondents
Rank the toP 3 barriers, if any, your
company has overcome or stillfaces in
realizing value from the cloud.
IT executives,
Non-IT executives,
n = 462
n =264
Evaluating and managing security or business continuity risks
25
Managing regulatory risks or exposure
14
Developing a compelling business case for using cloud systems
12
Adapting existing business processes to cloud systems
11
Addressing issues with migration or interoperability with our
company's current systems or data architecture
M 10
Lack of awareness or interest in cloud systems in our company
10
Adjusting technology governance processes for cloud systems
(eg, policies for control, monitoring)
9
Developing the right set of skills to build, manage, and
support cloud systems
Figure 5: Barriersto Cloud Computing
14
,
7
11
14
12
08
21
*4
13
The main issues companies are facing in light of transitioning into the Cloud are
* IT Challenges
* Cost Assessment and
* Security and Identity management
These issues are discussed in detail in the following sections.
2.2.1 IT Challenges
This is not so much a hurdle as it is a challenge. A Cloud transition is made possible
as a result of combining internal and external services in support of the business
11 How IT is managing new demands: McKinsey Global Survey results
15
outcomes. Interest from large enterprises has been tempered by adoption risks,
leading to architectures that connect internal core services and critical data to
external, commoditized services. Because of this new IT delivery model, the role of
IT and its practitioners is undergoing significant change. Businesses buy Cloud
services assuming they meet all the IT requirements. Sometimes these services
don't meet the operational or security requirements. Regardless of whether they are
on-premise or on the Cloud, these requirements don't change.
Departments, work groups, and individuals often take advantage of low-cost, easyto-buy public-Cloud services-even when corporate policies say they should not. IT
organizations that do not match the request for IT as a service run the risk of
internal customers bypassing the IT organization and consuming IT services from
the external Cloud, thereby placing the company at greater risk. The IT
responsibilities are to keep the business users from going off and buying services to
meet immediate requirements. The complex relationship between the CIO and other
executives within an organization is shown in Figure 6: Cloud Attitudes stress the
CIO-Business Relationship.
CFOs are primarily interested in shifting the costs from capex to opex due to the
perceived low price point of Cloud. Business leaders, who are fueling Cloud
adoption, view Cloud as a means of engaging with the customers better and faster.
Cloud provides resources to the developers faster. Application development
managers try to balance leveraging Cloud with internal processes, integration and
architectural challenges. Sourcing vendors deal with the risks associated with Cloud
services in terms of meeting the company's requirements. Security professionals
(CISOs) worry about security breaches and sensitive data/process handling in such
an environment.
16
neiymy n A rr
something crucial
5%
cio
11%
like infrastructure
1UW WW#I, UW Uwi
outages and data
security are too
importantto
sounds nightmarish."
overlook.'
Cloudspresents
entirely new security
and compliance
issues as well as
simply less control
over our data.it's
too rsky.
OR n use
nterested
Source: Forrester Research, Inc.
60833
Figure 6:
&
"How are we suppose to
supportcloud services
when we can'tget the
some SL As?"
Cloud Attitudes stress the CIO-Business Relationship
2.2.2 Cost Assessment
When trying to assess whether to transition to Cloud, it is important to understand
the economics of Cloud and what really drives profits and savings. Cloud computing
can potentially save money and there is some rationale behind the cost advantage of
Cloud computing compared to in-house, always-on enterprise data centers. Joe
Weinman, an HP executive who has been independently analyzing the economics of
Cloud computing services for the past several years, believes that unit costs aren't
always what make public Clouds cheaper and what matters most is the resource
17
consumption pattern of the workload.12 Pay-per-user sort of models does not show
significant benefits all of the times. The key is in understanding how the applications
placed in the Cloud align with the economics of the various Cloud services out there
today.
Forrester enumerates some of these scenarios as follows
e
e
13
Low costs per employee add up as more people use it: Per employee pricing
looks attractive if for instance there are few sales employees in a CRM scenario.
However, the costs tend to mount if the number of employees using it increases
by the 100s per month.
Low per-hour costs often mask high ongoing consumption costs: 8 Cents per
virtual server may be an extremely cost effective value proposition. However,
additional costs for bandwidth, consumption, storage, load balancing, security,
monitoring or caching needs to be looked into in combination with just renting
out the server. These costs further escalate due to additional services such as
spam filtering, database and middleware services. Total costs are sensitive to
*
how much actual time the service is used for.
Using the Cloud also incurs operational costs: Managing, securing, monitoring,
and backing up and recovering Cloud deployments sum up to additional
operational expenses. These management functions/responsibilities between
vendors and businesses are summarized in Figure 7: Operational Costs are an
uneven handshake
- Physical support of infrastructure
(facilities, rack space, power,
cooling, cabling, etc.)
- Abstracted services (SaaS
application, hosted framework,
hypervisor, virtual firewall, etc.)
- Physical infrastructure security
and availability (servers, storage,
. Your application
- Architectural views (e.g., scalability, availability,
recovery, data quality, and security)
- Governance (who has authority/responsibility to
make changes and how)
- Life-cycle management (birth, growth, failure, and
recovery)
- Enterprise integration (identity management,
"Basic monitoring
- Element management
-Testing, monitoring, diagnosis, and verification
- Network of metadata (categories, capabilities,
configurations, and dependencies)
network bandwidth, etc.)
access control, etc.)
59165
Source: Forrester Research, Inc.
Figure 7: Operational costs are an uneven handshake
12 Joe Weinman, "Overview of Cloudonomics," Cloudonomics.com, April 25, 2011
(http://cloudonomics.com/)
13 Drive Savings And Profits With Cloud Economics, Forrester 2012
18
Furthermore, nearly a third of enterprises remain skeptical about IaaS Clouds
because they feel that their existing internal infrastructure costs are already
cheaper than what they can find in the Cloud. About 31% of the companies believe
that they could achieve some form of cost savings in a pay-per usage model. (See
Figure 8)
"What are your firm's concerns, If any, with pay-per-use hosting of virtual servers?"
Enterprise (1,000 or more employees)
Security concerns about security/privacy issues
in virtualization or cloud environments
Too immature
Specific compliance requirements that
the service providers can't meet
We believe our total costs are cheaper
Vendor lock in that makes it difficult
to leave the service provider
Service levels are insufficient or non-existent
67%
39%
38%
IllhiI31%
30%
28%
Software licensing issues
Our application vendor or custom apps aren't
compatible or won't support it
The offering capabilities don't match our needs
26%
23%
20%
The performance isn't good enough
Other reason
19%
5%
None
5%
Too difficult to understand
4%
Don't know
2%
Base: 1,047 IT hardware decision-makers at
companies with 1,000 or more employees
Source: Forrsights Hardware Survey, Q3 2011
61608
Source: Forrester Research, Inc.
Figure 8
2.2.3 Security and Identity Challenges
Organizations are cautious about exposing their sensitive data in the public Cloud.
Internal Clouds too have virtualization security issues similar to those of public
Clouds. Boundaries of trust change as applications move from internal networks and
data centers to untrusted zones in the public Cloud. Sensitive data may be encrypted
before it is stored in the public Cloud, or it may be masked to protect confidentiality.
Gartner claims that security of sensitive data in the Cloud is the No. 1 issue for Cloud
adoption.14 Although public Cloud service providers are improving security
practices and features, the market ecosystem remains immature. Furthermore,
14 Hybrid IT - the combination of internal and external cloud-based services is transforming IT
architectures and the role of IT, Gartner 2012
19
many enterprises would hesitate to move their data outside the firewall due to the
nature of the data or the nature of their business.
Identity management in such a diverse and heterogeneous environment is difficult.
New technologies, services and architectures are slowly emerging in response to
security challenges.
The security issues in Cloud adoption15 are summarized below:
e
Data protection: Services provided by Cloud providers such as email, messaging,
payroll, accounts and finance, CRM, sales management, etc include sensitive data
being processed. This data may belong to a number of persons (data subjects),
e.g., employees, clients, suppliers, patients and, more generally, business
partners and will need to be protected.
e
Confidentiality: Any leakage of information caused by voluntary communication
by the Cloud Provider or Clouds' security breach may jeopardise customer
business/services.
* Intellectual property: A breach of Intellectual Property rights from the Cloud
provider can potentially cause immediate damage to the customer, which may
never be fully restored in a legal proceeding.
* Professional negligence: Inability to access critical internal functions such as
email, messaging, desktops, project management, and payroll services, may lead
to customer liability to its employees. (Or its customers)
15 Cloud Computing - Benefits, risks and recommendation for information security. Daniele Cattedu
and Giles Hobben, European Network and Information Security Agency 2009.
20
2.3 Path to Transitioning into the Cloud
Moving into a more managed environment has many advantages as summarized in
Section 2.1. However, the adoption of Cloud poses many challenges too, as pointed
out in Section 2.2. How then can a company overcome these challenges? Does it
make strategic and business sense then for companies to transition into the Cloud?
Even after companies have embraced Cloud, how can they effectively utilize its
potential? The following section seeks to address some of these issues. The
information that follows, like the previous two sections, draws from existing
literature.
Once the IT organization has reached a high level of maturity in the Cloud, it has to
determine how it can integrate its overall IT strategy. Each application can be
looked at to determine its optimal deployment based on its technical, economic,
security and performance characteristics. Furthermore, new service requests and
application deployments could go through a common checklist to determine the
right deployment type. The paths of maturity leading to an optimal fifth stage are
shown below:1 7
t
Private cloud
0
rDt
Parallel,
autonomous
paths
Private cloud path
61605
Public cloud path
Source: Forrester Research, Inc.
2.3.1 Changing Role of the IT
So what role can IT play in this transition? How can it effectively ensure Cloud
enablement and service delivery? Gartner 1 6 feels that the IT organization needs to
Hybrid IT - the combination of internal and external cloud-based services is transforming IT
architectures and the role of IT, Gartner 2012
16
21
become more business-focused and broaden their knowledge and skills. Solving
system issues -
and creating new system opportunities -
requires a knowledge
set that spans technology domains (network, processor, storage, system software,
applications software and user interface design). The traditional role of the IT
professional in an enterprise is changing and becoming multifaceted.
Cloud adoption will also require internal and external IT professionals to support
the business capabilities of the enterprise. Infrastructure and operations may have
to learn new skills such as multi-sourcing and procurement. The workforce may
need to get a better understanding of the business so they can understand what it is
trying to accomplish. Perhaps partnering business units with IT more closely would
help IT understand and manage business expectations.
IT needs to have a good working knowledge of the Cloud services. If the team is
knowledgeable and relatively more experienced, they will have more credibility in
the discussions with businesses. IT can also share this knowledge with other team
members so everyone knows what's going on in this space. Over the long term, the
shifting nature of IT will result in management and organizational process changes
that catch up to the increasing power of individuals. Due to the growing needs of the
business, most enterprises find it necessary to include both private and public Cloud
services. These services jointly in essence are what really affect the transition and
adoption strategies of companies in moving into the Cloud. Each provides different
values and capabilities. Adoption of public and private Cloud depends on the
company's business objective. Smaller organizations that lack significant internal IT
investments or data centers may have a higher level of Cloud adoption and public
Cloud services relative to larger enterprises with mature operational IT models.
IT has to interact with the vendors and share the responsibilities in order to be able
to ensure the effective and timely delivery of services. Forrester summaries this
balanced nature of shared responsibilities in Figure 9.
22
61605
Source: Forrester Research, Inc.
Figure 9
There may be some overlap in the benefits of both the public and the private Cloud
but they may pose significant operational challenges in integrating the internal and
external services. So how can the organization's readiness really be determined to
adopt the private or the public Cloud? What are the underlying characteristics that
influence adoption of such strategies? The following section addresses these issues -
2.3.2 Moving to Private Cloud
Before delving into the strategic implications and the readiness for adoption, it is
important to first define what one means by the private Cloud.
Private Cloud is a virtualized environment that is dedicated to an IT organization
and deployed within the organization's data center.' In order to deliver core values
of any Cloud service, organizations should have high degrees of standardization,
automation of operational tasks, self service deployment etc. Furthermore, private
Clouds may help enterprises gain IT cost and agility benefits without losing control
of sensitive data. Securing the internal Cloud requires advanced virtual security
infrastructure and attention to securing the Cloud OS orchestrator function.
23
Forrester' 7 identifies four phases for maturity in an organization
1. Acclimation - Organizations first familiarize themselves with the tools
available to virtualize and assess the degree of consolidation that can be
achieved as a result of this migration.
2. Strategic consolidation - The tasks that can be virtualized or not are then
consolidated.
3. Process improvement - IT can standardize operational procedures at this
stage and automate them so they can then start managing the pool of
resources.
4. Private Cloud - After having achieved this level of maturity, IT can start
driving up speed and efficiency and have users request and deploy resources
on their own.
The public Cloud is discussed in a little of detail in the following section.
2.3.3 Moving to Public Cloud
Public Cloud entails different challenges compared to private Cloud. In private
Cloud, the readiness of the IT organization depends on its own infrastructure. Public
Cloud strategy focuses more on procurement, management and supplementation.
The four stages of maturity for the public Cloud are summarized below17
1. Getting started - The IT organization can start by developing an
understanding of how Cloud services fit into the organization and what
protection the services provide.
2. Engaging more actively - Having determined the high level needs, the
organization can then engage business for Cloud service consumption. The
key here is to establish necessary security and management needs for
applications and services that require it.
3. Operationalizing the Cloud - At this stage, IT is required to manage Cloud
services as well as they do internal services.
4. Efficiency - The IT organization can then drive up efficiency once it has a
good handle on the operational aspects.
In the public Cloud, security is an important concern to leverage Cloud services. The
sourcing and vendor management teams are also required to develop a multisourcing strategy and competence. Security, performance and availability concerns
will need to be addressed while also managing new Cloud services as they are added
to the existing portfolio. Most companies will have to deal with a hybrid
environment in the future. Internal legacy systems will have to be combined with
external capabilities.
17
Assess Your Cloud Maturity, Forrester 2012
24
2.3.4 Summary:
The literature review offered a lot of interesting thoughts on the current state of
Cloud Computing and the issues companies are facing. Cost was not really seen as a
single most important reason for Cloud adoption. Security and Identity management
still posed many risks for organizations that were hesitating to move their data
outside their firewalls. The lack of proper SLAs and mutual understanding between
IT and businesses also posed significant governance challenges. But, the incentives
to transition to Cloud were overwhelming. The ease and optimal use of resources
resulted in significant cost and management advantages. Some organizations have
already started to reap the benefits by carefully architecting their technical
platforms to respond to business challenges while others are still in a state of
transition.
In conclusion, the company's vision and key capabilities define the choices around
how the Cloud services can be delivered. Refusing to use Cloud capabilities is not a
viable option for most institutions. The combination of improved agility and a lower
IT cost base is spurring large enterprises to launch concerted programs to use Cloud
environments. The following chapter supplements the existing literature with some
of my own research findings. The prevailing wisdom is compared with the specific
issues company CIOs are facing to highlight what constitute the important benefits
and issues companies have to deal with when transitioning into the Cloud.
25
3. Analysis of Findings
3.1 Research Methodology
Before proceeding to explain the research findings, a note on the research
methodology followed in this study The study was carried out at the MIT Sloan Center for Information Systems and
Research (CISR).
The process can be broken down into 3 stages.
1. During the initial stage of the research, about 40 fortune 500 companies were
interviewed at CISR. The initial interviews, conducted by CISR faculty and staff,
were transcribed and made available to me for further analysis. A senior
research affiliate at CISR and myself conducted 7 follow up interviews during
November 2012 to January 2013. The follow-up interviews were conducted
roughly a year after the initial interviews.
2. In the next stage of the research, the conversations were analyzed by myself
under the guidance of the CISR staff through the lenses of the following criteria * Business Case for Cloud adoption - What are the business benefits
companies have been seeing in moving to the Cloud? Do the benefits
translate to cost? Or are they driven by a time to market and ability to
respond to business needs?
e
Re-architecting Digitized platforms - How have companies been dealing with
some of the internal digital platforms and integration issues? What kind of
re-architecting challenges do companies have to deal with in transitioning to
the Cloud?
* IT Governance - How are companies dealing with the business-IT
relationship challenges in light of the new responsibilities Cloud adoption
brings to the table?
e
Reallocate IT budgets - What has been the economic value of transitioning to
the Cloud? What has been the magnitude of this shift?
- Rethink end-user requirements - How have companies handled the
proliferation of tablets and mobile in meeting user requirements and
business needs?
The above questions were articulated by CISR faculty and staff to pose to the
company executives. My research, in discussions with the supervising staff,
added the following questions to the list.
* Interesting Notes/Metrics - What have been some of the quantifiable
benefits (if any) achieved as a result of Cloud adoption?
* Challenges - What have been some of the key challenges companies have
been facing? How are they addressing them?
26
Business Aspirations / Vision - What do companies aspire to do with Cloud
moving forward? What is their vision for the future?
I divided these questions into cells and extracted the appropriate information
from the transcripts inserting them into its respective column. A snapshot of the
document is as shown:
*
WotW
O" ffdWIVW,
3. In the final stage, which culminates to this section, I attempt to highlight the key
benefits that seemed to resonate across most companies I analyzed. Then I list
some of the key challenges and the methods that were adopted to address these
challenges. Finally, I highlight some of the key management practices based on
my learning.
Unless explicitly mentioned in quotes andfindings in the sections thatfollow, the
references were primarily based on interviews that were already conducted by CISR
staff
As mentioned in the introduction section, there was quite a bit of overlap between
the literature reviewed and my own findings in talking to company executives. The
key drivers of Cloud adoption such as agility and time to market, resource utilization
and cost savings from the literature review were reinforced in the transcripts
analyzed and the interviews conducted. However, there was relatively greater
emphasis on aspects surrounding IT governance and business and IT relationship
management strategies in my analysis. Although the literature touched on these
aspects, the specific challenges companies were facing in light of the changing
governance structure were not prominent. Anecdotal evidence and real stories from
the interviews laid credence to some of the issues both businesses and IT were
facing. The most important takeaways were the key management practices
companies were adopting during transitioning into the Cloud.
27
3.2 Major Benefits
The major benefits of Cloud adoption are as follows:
* Faster time to market
" Economic Benefits of Cloud
e
Ease of Governance and
e
Improved Provisioning of Resources
3.2.1 Faster Time to Market
Based on my research and as reinforced in the literature review, time to market
emerged as one of the top reasons for Cloud adoption. The convergence of
computing and connectivity has enabled businesses to evolve and move at an
unprecedented rate to react to changing market. Organizations are building
capabilities to adapt to a rapidly evolving landscape.
One CIO points out that moving to an on-demand (Cloud-based) financial
management and human capital management software vendor enabled them to
implement services in under a month and a half for their entire IT organization. "Our
finance organizationsget a sharedservice center,our information securitygroup,our
Telecom group have all sincegone on boardwith it,all operating out of a single
instanceof it. So speed of implementation has also been really good", he comments.
Companies either choose to buy or build software based on the business
opportunities they are faced with and whatever makes sense from an economic,
platform and governance standpoint.
A global pharma company with over $5 Billion in revenues believes in employing
services to meet the growing demands of the company. An executive from the
company explains that it may not always be useful to rely on internal folks for quick
delivery of services. He says, "we sign upfor services to plug and play into our
processes and the deliverable is in place in six weeks. There's nothing we do
internally." In moving to such a plug and play environment, the company doesn't
have to worry about identity management, Data Loss Protection (DLP) etc. Cloud
providers help shrink time for delivery avoiding IT handle most of these tasks.
He emphasizes that the primary goal of adopting a Cloud-based strategy has been
business agility as opposed to just finding a cost-efficient provider to reduce costs.
"In redefining the value propositionfor IT, switchingfrom an efficiency perspective,
driven by low cost into thinking about business enablement, specifically enablement of
business agility has been a core value proposition",he claims.
Businesses achieve speed of implementation through buying off the shelf Cloud
solutions that meet their needs. Things like time sheets, expenses and so on for
example are just business needs that don't require any IT support. As one IT
28
executive from a large media corporation puts it, "It'sreally the convenience. It's
being able to meet more of our demands with less effort."
The strategy at an operational level that's kind of guiding companies towards Cloud
have been around time to develop. A CIO of an American insurance company says
"The typical conversationsthese days are more about responding to a need and
getting up our innovationplatform and notfrom the standpointof, look at how much
money it saved us, it was, look at howfast we launched our innovation program.It's
kind of like innovation within an innovation," he claims. Faster time to market
resonated among a lot of companies I researched as a top benefit driving them to
adopt Cloud.
3.2.2 Economic Benefits of the Cloud
An important benefit of transitioning into Cloud is the economic value it generates.
Cloud-based solutions free businesses from the need to invest in expensive
hardware and software or commit to costly service and maintenance packages. The
resulting cost savings can be significant. Businesses can then invest the money
saved in other crucial areas such as producing improved products and services,
expanding to new markets and diversifying its operations.
Assessing the economic value of transitioning to the Cloud is thus an important
issue. Companies do not necessarily find it cheaper to adopt Cloud than to make
some of those investments as capital expenditures. In my analysis, most
interviewees noted that the costs per usage in moving to a more OPEX based Cloud
type environment was OK as long as they could be justified against tangible business
benefit they were producing.
A senior executive of an Electronics manufacturing company claims that his
organization was able to avoid enormous capital expenditure of building or
implementing and configuring software packages, by moving to an out-of-the-box
configuration of SaaS models. He was able to bring the upfront capital costs from
$11M to $13M annually down to $1.1M on HR and Payroll modules alone.
Companies are finding it easier and more beneficial to just deal with costs per usage
as opposed to upfront capital expenditures.
As the Director of Enterprise Architecture of on organization with over 80,000
employees explains that price can actually be a very tricky thing. Cloud may appear
to be cheaper than internal hosting but when you drill into it and estimate the
overall cost of storage, database licenses, backup functionality, the cost of data going
across the network to the data center etc, the costs actually shoot up. For a large
organization operating big data centers of the order of 5 to 10 thousands, the costs
is comparable to hosting them in house. This message on the direct relationship
between Opex/Capex and costs needs to be communicated across the organization.
As for running servers 24 x 7, he claims that they can be turned off or on as the need
29
arises by writing scripts and thus optimize using existing resources thus achieving a
substantial impact on the cost.
A scenario where Cloud achieves huge cost savings, or when Opex makes sense, is
when there are spurts of demand to be met in a deterministic setting. As pointed out
in the literature review, companies can determine those applications and services,
which are elastic or transient, web pages for promotion or applications supporting
seasonal activities for example. A major sponsor of the 2012 Olympics foreseeing
massive number of hits to the websites in the run-up and during the games itself
used Cloud to meet this demand. Instead of investing heavily on hundreds and
potentially thousands of servers for a short period of time, the company managed to
just rent them out.
Every IT investment was a long-term investment traditionally. If it wasn't a capital
expense that had to be amortized over three to five years, it was an operating
expense negotiated into a three- to five-year term to get the best discount. Cloud
may thus seem attractive because of its price point. However, companies are also
looking for where they can grow in an increasingly flat market. Cloud needs to not
only be looked at as a cost saver but also as a profit maker by identifying new
revenue streams. Companies are looking to either reach new markets, in new
services, in developed regions, which are already saturated or reach the next billion
consumers, out in Brazil, Russia, India and China. In both cases, trying to find
additional services in developed markets or reach the consumer in developing
markets, companies need the price points of the Cloud.
However, a senior executive of a pharma company points out that cost savings alone
has not been the guiding principle in wanting to transition to Cloud. The decision
was largely motivated by the agility the solutions provided to the company. There
may not be any guarantee of an ROI benefit to Cloud-based solutions. In the end they
may be as expensive.
3.2.3 Ease of Governance
Governance is different in a Cloud-based model. A lot of processes are outsourced
and the IT department oversees its management by specifying service levels and
requirements. The responsibilities are shifting from tactical to strategic and the
scope is getting broader with IT dealing with commodity type services. A CIO of a
120,000 strong workforce explains, "You're looking at meta processes and making
sure the governance is on that level. Running an enterprise,how we're managing the
shared services and what framework and tools we can provide clients that want to do
their own, governance is at the center of that management."
By adopting such a model, IT is able to ease governance, meet business
requirements and make good decisions regarding performance. In order to achieve
the agility the company needs, IT is becoming fairly resilient and adaptive to the
changes. Furthermore, these benefits are further reinforced under good leadership.
30
The CIO of a large personal care products company was managing a team that was
tasked with managing facilities, workloads, data and software, and network
infrastructure. He was able to deliver more business with significant savings in costs
by instituting simplicity and standardization into systems and technology. These
savings were in turn invested on new product development and improving products
and services. His team was able to effectively establish organizational relationships,
understand business issues and monitor these processes better leading to effective
governance.
3.2.4 Improved Provisioning of Resources and Reduced Complexity
The benefits of Cloud adoption from an end user perspective was somewhat
addressed in the literature review. The end users here refer to the employees of the
companies who benefit from rapid provisioning of data and resources that they can
access through their own systems or devices. Although the benefits can be
translated to savings in cost, there are many intangible benefits, which improve the
operational procedures and organizational processes. The efficacy of these
processes translates to improved and informed decision making across the board.
This theme seemed to resonate among many companies I spoke to and researched.
One CIO notes that IT organizations need to accommodate employees' and
consumers' desired pace of change. "iPads,iPhones,Androids,you can't stop them
from coming into the corporateenvironment and they're demanding email access and
it's interesting that in some cases they didn't exist two years ago. So, being able to
remove the complexity, standardize,operationalizeit, and then push it out to people
that are better at it than we are,so that we can lean more into our business processes
and analytics,that's where the real value is", he says.
The advantage of a Cloud-based solution for his company is availability across
multiple devices instantly. This makes it easy to deploy, use and upgrade. The
flexibility of being able to work from anywhere affects workers' work-life balance
and productivity. Data can be stored and managed from one central location, and
everyone works off of one central copy. Employees can even chat to each other
whilst making changes together. This whole process makes collaboration stronger,
which increases efficiency and improves the company's bottom line.
Furthermore, the CIO of a major auto manufacturer explains that a big concern for
companies is complexity handling and its associated costs. Distributed e-mail clients
such as Lotus Notes offered the best corporate level security at that time which
prompted many firms to adopt it. But overtime, getting developers and people to be
able to support Lotus Notes became more challenging, with the cost for upgrades
continuing to rise. He claims that the costs for upgrading were over $5M, which was
prohibitive. By moving its corporate email onto the Cloud by overcoming initial
security concerns and shrinking IT budgets, the company was able to enable
31
efficient user provisioning. "Having to deal with mail upgrades and now the demands
of the customers and how they want to use mail and how they want to access it,
getting me out of that business and having somebody else say I'm going to keepyou
currentandyou won't have to worry about it is of tremendous value to me", he
explains.
3.3 Challenges
Based on my analysis, the major challenges companies are faced with in Cloud
adoption are
* Re-architecting Platforms and dealing with Legacy
- Vendor Management and
- Security
3.3.1 Re-architecting Platforms and dealing with Legacy
Internal legacy systems are hard to write off either due to
e
High capital costs or
Complexity in moving data, processes or solutions out or
e
e
Integrating them as new pluggable systems into the existing architecture.
This is an important challenge for companies looking to transition into the Cloud.
A senior executive of a drug company says that his company is dealing with the
transition to Cloud by adopting a loosely coupled architecture. Such an architecture,
when equipped with integration points helps one integrate multiple third party
platforms. Several Cloud based modules such as Data Loss Prevention (DLP), Cloudbased identity management solution, and Cloud-based application solutions are
built into such a loosely coupled architecture to make the overall system more
flexible.
Increasing economic pressures result in outsourcing and other options that
externalize IT. Organizations are optimizing business value and delivery of solutions
by brokering (or integrating) a mix of internally and externally provided services.
Such integrations introduce significant cross-functional and cross-supplier
challenges. These changes also lead to long-term impact of decoupling core and noncore functions and having to distribute them effectively.
Some functions maybe core to the business systems and some may be peripheral.
Critical IT services may remain on premise (or in the "internal Cloud") while the
non-critical IT services may be outsourced. (Or moved to the "external Cloud") The
Cloud software can potentially interact with the internal and external resources to
operationalize these business processes. On quizzed about these opportunities,
many interviewees agreed that they may be willing to start with services such as
mail and work their way up to business systems and ERP gradually. But the core of
32
the business systems, which is the most important to the company, would probably
be the last one to go. An enterprise architect of a multinational consumer goods
company says that his IT unit separates core and non-core business to evaluate
what can be moved to the Cloud and what cannot. He explains that instead of using
expensive legacy hardware to run business intelligence and dashboards, moving the
non-core stuff out to the Cloud registers huge benefits.
Companies find it difficult to achieve 100% virtualization or move all their systems
to Cloud. One executive of a large Internet corporation calls the art of encasing the
legacy systems as "Chernobylize". The legacy systems are integrated with APIs in
front of it since it didn't make business sense to build software and re-write
significant elements of code and get them onto the Cloud.
Another CIO I interviewed echoes this sentiment. He says, "Internaland external
services need to blend in together to make the experience of the user seamless thereby
containing any risk IT can be externalized to some degree by moving the IT resources
from its own control to that of an externalservice provider.One reason to do so is to
reduce expenses through improved value delivery and transition to variablecosts.
Another motive is to refocus efforts on core capabilitieswhile examining alternatives
for noncore capabilities.Core capabilitiesmay be defined as those that provide
competitive differentiation to the business. Noncore capabilities,or context
capabilitieson the other hand typically have an indirect contribution(or no
contribution) to differentiation:They are essentially commodities."
This was an important learning point since most companies transitioning into the
Cloud have to deal with their existing systems. Little has been said about this issue
or how to address it in the literature I researched.
3.3.2 Vendor management
As noted in the literature review, it is difficult to express and implement the terms
of agreement for Cloud usage at a technical level. Outsourcing services and changes
in control influence a customer to choose a particular Cloud provider because of the
conditions it offers, its reputation or professionalism, or its technical skills. A senior
executive from a large electronics multinational conglomerate explains that
although the pricing of its vendor, a highly reputed software provider, at first
seemed attractive, the price grew considerably when it was augmented with storage
and upon feeding new requirements. This was exacerbated further by architectural
challenges due to insufficient connectivity, expensive offerings and lack of service
guarantees. Contractual obligations around service levels, storage of data,
movement of data, change and control had to be negotiated for the company.
As was evident in the literature review as well, the IT delivery model and the role of
IT and its practitioners is undergoing significant changes. Businesses are buying
Cloud services assuming they meet all the IT requirements while these services
don't necessarily meet the operational or security requirements. Regardless of
33
whether they are on-premise or on the Cloud the IT unit is responsible for brokering
solutions from these vendors.
3.3.3 Security
One of the biggest concerns for companies is evaluating and managing security or
business continuity risks. (See Figure 5: Barriers to Cloud Computing)
An OEM firm with a 250 strong IT organization team and over 38 data centers
around the world still considers moving its internal data out to the Cloud risky. This
apprehension mostly stems from lack of confidence in vendors and fear of litigation
as a consequence of data leakage. But the IT unit is currently spending a lot of time
studying security enhancement and would like to eventually move most of their
services such as email, HR, payroll and performance management to the Cloud.
New technologies, services and architectures are slowly emerging in response to
security challenges. Some companies are starting to take that leap of faith as one CIO
notes, "if there's been hacking attempts or denial of services, they (the Cloud vendors)
are going to take appropriateactions to protectyourdata."
Another marketing executive explains that much of a company's data is already
external today. Customer information in many cases is already in a colocation
center. So the issue is mainly access to that data itself, and the way the encryption
intended to secure it. As long as the shared infrastructure can be trusted and there
are adequate security measures and data encryption, there is no additional risk. The
big security breaches according to him are simple: leaving laptops at airports, and
so on.
34
3.4 Management Practices
Companies have introduced management practices intended to help them generate
expected benefits without being derailed by the challenges and costs. Interviewees
listed 5 practices that they have found valuable. These practices are listed as
follows.
e
Transitioning with Pilots
e
Virtualization
e
Hybrid Cloud Solutions
* Changing Role of IT
e
IT and Business engagement strategy
3.4.1 Transitioning with Pilots
IT organizations can learn from smaller and newer pilots to understand how best to
transition into the Cloud. IT can begin with back-office or departmental services
where they can learn and implement best practices initially before moving to
building tougher and bigger applications. Companies can start by determining those
applications and services, which are elastic or transient. An application that is
required only for a short period of time is an ideal candidate.
As noted in the literature review more than 80 percent of IT respondents say their
companies are using or experimenting with Cloud technology. While 63 percent say
their companies are using Cloud-based applications in some aspect of day-to-day
operations, and over the next 12 to 18 months, deployment and piloting is expected
to increase across all application types explored in the literature review. (Figure 4:
Adopting the Cloud)
A CIO of a marketing company who has over hundred people reporting to him in the
IT unit believes that an IT organization rarely gets to replace their entire
infrastructure at the same time. "We see a big advantagein easier(and incremental)
transitions,because we're planning on upgradingsmaller versions of the software as
wego along. We are also moving a significantportion into a virtualized environment,
so we envision that whatever step we take after this one, we'rejust moving VM images
around." he claims.
A senior enterprise architect I interviewed also echoes the benefits of such a
transition. He says that in having to deal with hundreds of servers racked and
mounted in its data centers to meet various levels of utilization, his IT unit tried to
pilot a Cloud strategy which he refers to as sort of its Cloud 1.0. By virtualizing the
hardware the company managed to create tiered storage for production,
development and testing environments. The idea behind the pilot is to be able to
test automatic provisioning based on policy and rules to provide compute to its
production environments. He hopes that his data center, which currently operates
24 x 7, will have the ability to commit compute resources based on user demand and
peak workload requirements.
35
3.4.2 Virtualization
Some companies currently deal with legacy systems and are trying to maximize
their utilization by improving their internal capabilities through virtualization. Ian
Pratt, the visionary behind virtualization in his interviews with Gartner 6, believes
that the utilization rates in a non-virtualized datacenter can be as low as 20% to
30% because an application running on a given hardware configuration may not
utilize all of the resources of the hardware. Virtualization, and the Internet are
enables companies' deliver IT services, while reducing the constraints of traditional
software and hardware licensing models.
The director of enterprise architecture of one of the largest Oil and Gas companies
notes that by using Cloud technology, the company wishes to get to a place where it
has much higher utilization rates for its existing servers using virtualization. He
notes, "We want to run our existing infrastructuremuch more efficiently. And for new
applications,we wanted to put them on infrastructurethat is much more highly
automated and virtualized.And we think, at the moment, about 30% of our server
state is used. We think the right number should be 65-70%."
Virtualization detaches workloads and data from the functional side of physical
infrastructure, enabling unprecedented flexibility and agility for storage, servers
and desktops.
3.4.3 Hybrid Cloud solutions
National Institute of Standards and Technology (NIST) defines 1 Hybrid Cloud as a
composition of two or more Clouds (private, community or public) that remain
unique entities but are bound together, offering the benefits of multiple deployment
models. Such a composition expands deployment options for Cloud services,
allowing IT organizations to use public Cloud computing resources to meet
temporary needs.
Most companies are already consuming Cloud services and applications in a hybrid
world. Perhaps, even in the long term, all applications may not move to the Cloud, so
there will always be a mix of on-premise, traditional hosting, SaaS, and Clouddeployed workloads. Adjusting the right workloads to the right deployment types is
the challenge.
Many IT executives echo that integrating internal IT systems with external services
poses many challenges on the infrastructure. Re-architecting Platforms and dealing
with Legacy is an important challenge for companies looking to transition into the
Cloud. It is therefore important for IT to be able to provision services swiftly and
inexpensively. The hybrid-Cloud is potentially a solution that presents a list of Cloud
services to the end user where the user can select a Cloud service and subsequently
36
be redirected to an internal or external resource. This helps in furthering innovation
within the organization by letting people do new stuff.
Another enterprise architect I spoke to is using a hybrid environment to connect
private and the public Cloud to the back-end infrastructure. Legacy systems are
giving way to more agile IT that sources functions from a variety of suppliers. He
says that his organization is approaching this transition by building an enterprise
service bus that legacy applications can talk to and then essentially translate that
into web services so these services can then interact with external applications or
external services. This, he argues, leads to increased preparedness and enable some
of the legacy apps to talk directly to the web services without needing a middle layer
in between.
On the applications side, companies are also seeking flexibility for users to be able to
access them anywhere, anytime. They are trying to enable users of applications to
be able to go to an online portal, which looks like an app store, and then choose from
applications within that app store. Newer applications and users may result in
deluge of data. IT organizations need to handle this effectively through their
architectures and data governance principles.
On strategies for deployment of Cloud, a CIO of a large bank comments that he has
managed to move quite a bit of services in HR, talent management, performance
management, emails and other non-banking applications to the Cloud. That's ideally
a level most banks would like to buy software from, where it's non-strategic. But in
addition, they also do quite a lot of computing that are banking specific and which
are mostly on premise.
As pointed out in the literature review, IT can combine the benefits of both the
public and the private cloud depending on the business needs and strategic
implications. The economics of public and private Clouds differ and the need for
both the public and the private cloud (or the Hybrid Cloud) are high because there is
so much investment in legacy environments within the datacenter, which is not
going to go away. This was also pointed out earlier in challenges companies are
facing in having to deal with legacy systems. There are reasons (security,
compliance, operational control, etc.) why companies are continuing to maintain
their datacenters. Those characteristics need to be maintained while bringing the
benefits of Cloud computing to the datacenter.
3.4.4 Changing Role of IT
What role does IT play in the transition to Cloud? Governance was an aspect looked
at very closely in this research to understand how companies are coping with the
inevitable journey to Cloud. During my interviews, it was evident that the
relationship between the CIO and business is very important. This is also articulated
in Figure 6: Cloud Attitudes stress the CIO-Business Relationship.
37
A CIO of a very large marketing company I spoke to believes that IT has an
important role at the contractual level to essentially take all the provisions of the
past and make sure that those are in the contract, a checklist of sorts. It is clear in
his senior executive team that at the end of the day, the custody of data and the
stewardship of data and the custody of any process that is supported by technology
rest with him. He believes that IT has a significant role as a custodian, and none of
those responsibilities ever go away. IT will assume a more managerial and a less
technical role. IT needs to be careful about the barriers erected for accessing Cloud
services that might potentially let individuals bypass IT. If IT finds excuses to
constantly strike down business ideas due to security or sustainability risks, it may
not be easy to engage and contribute effectively to the projects. However, if there
are no checks and balances in place, it might lead people in the organization to go off
and do crazy things.
The complex relationship between IT and the other units in an organization as
articulated in Figure 6: Cloud Attitudes stress the CIO-Business Relationship was
reiterated in an interview with the Director of Enterprise Architecture of a large Oil
company. He believes that one of the big dangers for IT from Cloud computing is
that businesses can disintermediate the internal IT group. This is also partly
because of lack of IT's confidence in the vendors in the market. He believes that this
lack of confidence in assuring the quality of vendors leads businesses to make their
own decisions. Sometimes contracts are signed and thrown over the fence to IT to
sort of do what it needs to do to make sure that it doesn't fall over. He believes that
IT needs a more structured way of incorporating software as a service vendors into
the overall application landscape, so that the service that end users get is much
more seamless. The IT group has the skills required to do all the assessments of a
vendor to ensure that corporate data will be held securely or that the business risk
of that particular company will not compromise business processes. While business
buyers may provision certain Cloud applications themselves, it still takes developers
and IT administrators to activate infrastructure and platform Cloud service.
Some companies I spoke to use financial levers to manage governance challenges.
One CIO explained, "All of our IT budgets are managed centrally.IT is a centrally run
organization here around the world. We've controlled the funding so none of our lines
of business have theirown data centers and really don't have anywhere to put it". He
believes that using Cloud effectively has positioned his company well to rapidly give
lines of businesses the compute power they need to tackle whatever business issues
they need to. By being more responsive, IT can check businesses to ensure they go
through traditional channels of purchasing equipment and help rack it in the data
center and configure it.
This also brings about an interesting re-alignment in careers for those in IT. The socalled server huggers may switch to working for Cloud providers as opposed to
working for banks and insurance companies. The managerial types may continue
working and negotiating with Cloud vendors.
38
3.4.5 IT and Business Engagement Strategy
A senior executive from a hundred thousand strong organization, offers an
interesting vignette. When the executive met with the Cloud provider who offered to
provide a range of services using Cloud he realized that his company was already
doing business with the provider without his knowledge. The Cloud provider said
that he could not disclose who (or which businesses) were using it because of client
confidentiality. When the executive persisted, the Cloud provider responded with an
email authorization request to cease and desist. At that point he decided that his IT
unit was going to put together this Cloud-enabled framework to offer integrated
services because clearly there was demand for it. This was implemented by going
through internal process checks to make sure the system was compliant and in line
with the needs of the business. Any attempt to buy services separately by businesses
was then considered a code of conduct violation.
The move to Cloud is inevitable. IT needs to engage with the businesses to ease this
transition by implementing appropriate measures. In order for IT to be able to
effectively optimize the Cloud investments and Cloud delivery, it needs to be able to
use a framework or a checklist to identify the legal, compliance and data sharing
issues. It could then use this checklist to work with the business units by responding
to requests to evaluate particular Cloud services, and by helping them identify
opportunities to safely leverage the potential of Cloud. Projects/requests may be
analyzed considering its potential for near-term or long-term impacts. Initiatives
whose benefits are high with the risks being relatively low or manageable are worth
focusing on.
3.4.6 Summary
IT as a department is shrinking while its importance in technological know-how is
increasing. Also, the relationship between the IT department and the business is still
evolving and expanding in light of transitioning into the Cloud. IT is starting to
partner with businesses and respond to the changing business conditions more
quickly and efficiently. It is building a strategic, value-based partnership with the
business by engaging with the business and selecting services that meet compliance
and governance requirements. This is an effective management strategy to meet the
growing business needs of the organization and a key learning point of my research.
To address the rapidly changing organizational needs, companies are using
virtualization, learning from smaller pilots to optimize resource utilization and rearchitecting their existing digital platforms to be able to plug in newer services.
Vendors are getting more mature to address the security challenges while the IT
units are implementing checks and balances to ensure that the acquired services
meet the standards of the company. Companies are increasingly being able to
39
achieve the economic benefits, optimally provision resources and adapt to a rapidly
evolving IT landscape.
40
4. Conclusion
Cloud technology has evolved into an important force in the industry. Some
companies are racing ahead in adopting Cloud for a number of reasons such as
faster time to market, better utilization of resources, economic benefits etc. Others
are still trying to deal with how best Cloud can be integrated into their platforms,
the vendors they can trust and the potential security threats they think it poses.
Existing literature had a lot to offer in how Cloud is really disrupting industries and
the accompanying challenges companies are dealing with. The main motivation of
this research was to understand the big benefits that are driving companies towards
adopting Cloud technology and the real challenges that they are facing in light of this
trend. Talking to company executives across a vast range of industries helped me
supplement, validate and demystify the prevailing wisdom on Cloud.
In summary of my research, the benefits/challenges of Cloud adoption are as
follows:
1. Among the major drivers of Cloud adoption, agility, cost and better utilization
of resources seemed to be at the top of the stack.
2. As for challenges, security and the complexity of integrating systems with
Cloud services were the big concerns.
The benefits, for most companies, outweighed the challenges justifying the reasons
for Cloud adoption.
Based on my analysis, I recommend that companies
-
Invest in key governance capabilities - For IT to be able to build credibility
with businesses, provision resources effectively to users and manage the Cloud
environment, it is necessary for companies to invest in individuals with the right
skillsets. The most successful companies that were interviewed had the best
leaders who understood precisely what the existing capabilities were and the
desired strategy for change. The leaders' skills were further augmented by an
effective team who were adaptable and enthusiastic to change and understood
the challenges that came with it.
-
Effectively broker services with vendors and businesses - IT units need to
manage internal Cloud services, and external vendors to be able to provide
advice and guidance for the businesses. This also goes back to the earlier point
about educating the team with the right skills.
" Learn from smaller projects and pilots - Several companies that I analyzed
already had businesses using Cloud services. IT was able to assess which of these
services could be leveraged and how best to move forward, based on the
experiences of the businesses. Legacy applications, often times were a painful
impediment due to their complexity and interconnections. Companies were able
41
to learn from smaller pilots and best practices to make this transition smoother
and more secure.
*
Explore hybrid models - Companies have to operate in a hybrid environment,
which is to manage, secure and govern what is in their systems as well as
external Cloud services. Hybrid models enable ease of aggregation, integration
and customization that help the companies meet their need for speed, agility,
flexibility and cost savings. Hybrid models and a path to maturity in phases were
explained in management practices both in the literature review and analysis
sections.
As future research, it would be interesting to follow up on the companies that were
initially interviewed to further refine the architecture and models of successful
Cloud deployments.
Also, it may be worth exploring the specific benefits, challenges and successful
management practices of Cloud adoption across specific industries such as banking,
retail, consumer goods, etc.
42