White Paper: An Evaluation Framework For Selecting an Enterprise Cloud Provider

(1)

White Paper:

An Evaluation Framework

For Selecting an

(2)

Introduction

Enterprise Cloud Evaluation Framework Overview

Enterprise-Grade and Industry-Standard Comprehensive and Controlled

Unified Management Enterprise Security

Cloud Operations and Resource Allocation Role-Based Management

Elasticity and Bursting

Cloud Consulting Services Cloud Automation

24x7 Customer Support Network Infrastructure Service Level Agreement Total Cost

Transparency and Visibility

(3)

Introduction

While the main benefits of cloud computing, decreased cost and ease of management, started the widespread interest in this technology, its limitations, including security concerns and losing control over applications, made savvy IT professionals wary. This is rapidly changing as access to Infrastructure as a Service (IaaS) offerings from providers who have an in-depth knowledge of how to best leverage infrastructure services for enterprise cloud applications becomes more widely available. From this experience four key themes have emerged for justifying moving to cloud services. They are:

• Enhanced Business Agility and Minimized Cost • Streamlined IT Operations

• Seamless Integration and Customization • Risk Management

Enhancing Business Agility means being able to respond faster and more efficiently to business changes.

Giving companies the ability to expand and contract compute, storage and network capacity at-will

dramatically reduces the time and cost required to develop new applications and deploy resources where they are needed, when they are needed. This also helps minimize the time and cost to scale existing applications in response to changing demand.

Streamlining IT Operations by moving resources into the cloud helps the business focus on their core

mission. This helps reduce the burden of maintaining compute, storage and network infrastructure in-house. Businesses need the ability to seamlessly integrate existing enterprise IT investments when moving to customized public and private clouds.

Finally, managing IT infrastructure is about managing risk. Loss of control of resources and maturity of the resources being used introduce risk to the enterprise. Cloud technology consolidates resources onto shared infrastructure with shared management. Cloud providers establish control over underlying enterprise compute, storage and networking infrastructure. As a result, security, availability and performance are consistently identified as top CIO concerns.

The pace of change in the cloud computing industry rivals the intensive change seen at the start of the Internet era. Cloud providers are innovating rapidly and new services and concepts are being announced daily. With so many complex moving parts, choosing the right enterprise cloud provider can be challenging.

This white paper provides an evaluation framework for selecting an enterprise cloud provider for your organization. Because the cloud is a fully integrated and highly dependent part of the company’s IT

(4)

Enterprise Cloud Evaluation Framework Overview

The enterprise cloud evaluation framework is designed to focus on key evaluation criteria that help a company evaluate cloud implementation strategies. Figure 1 highlights these key areas. This paper will provide

enterprises with objective advice as they evaluate an enterprise cloud provider’s ability to help meet business and technical objectives.

Figure 1 Enterprise Cloud Evaluation Framework

Enterprise-Grade and Industry-Standard

When a company acquires IT technology, it typically conducts a selection process including a review of the performance, reliability, compatibility and security attributes that will fulfill the requirements of its IT needs. Most large companies prefer using proven technology from proven innovative vendors that are trying to solve the issues that IT organizations experience. Using best of class vendors with industry standard technology makes integrating a cloud provider’s technology into an enterprises existing IT infrastructure much easier. The evaluation criteria for internal assets should apply to an enterprise cloud evaluation. A cloud provider should be transparent about which vendor technologies are implemented and how this can affect a provider’s service level agreements. This allows enterprises to make informed decisions on the reliability and viability of the technology with which they will be integrating.

Representative Evaluation Questions

• Does your cloud solution support industry-standard enterprise-grade cloud technologies to meet demanding security, performance and availability requirements?

Enterprise-Grade and Industry-Standard Comprehensive and Controlled Unified Management Enterprise Security

Role-Based Management Cloud Consulting Services 24x7 Customer Support

Service Level Agreement

Cloud Operations and Resource Allocation Elasticity and Bursting

Cloud Automation Cloud Automation Network Infrastructure

(5)

• Are they comparable in quality, security and reliability to what you implement today within your internal IT environments?

• Are the vendors and standards the enterprise cloud provider uses compatible with your own internal IT vendors and standards?

• If I were building this myself, what technology would I use? • How well does this integrate into my technology?

Comprehensive and Controlled

Because the enterprise cloud does not operate in isolation from the rest of the corporate IT infrastructure it needs to meet or exceed the same enterprise-grade requirements of the existing infrastructure. Security, visibility, transparency and overall governance capabilities must be core to the enterprise cloud. To meet enterprise needs, a total solution—a complete answer to the blended needs of the enterprise—is necessary. A comprehensive enterprise cloud strategy should be comprised of a full suite of services including managed services, consulting services, the ability to customize hybrid solutions, management, monitoring, security and more.

As the enterprise cloud represents an integration of many infrastructure components, it is

important to understand how much of the cloud is under the direct control of the cloud provider and how much flexibility the customer has in the cloud environment. The best way to assure consistent performance, availability and access is to work with enterprise cloud providers that own and control all aspects of their cloud solution. Cloud service providers who manage their own global networks, data centers, components and related services can assure consistent service levels, transparency and accountability for their users.

• What cloud services do I need to solve my IT challenges?

• Does your cloud provider allow you to implement a global hybrid public/private

enterprise-grade cloud solution including dedicated servers, managed services, colocation and customization?

• Which of these managed services do they provide: security, storage, backup, network, disaster recovery, server operating system and application?

• Are there other services that I would need in the future?

• How much of the total solution does your cloud provider own and control?

Unified Management

(6)

solution, dedicated servers, managed services or colocation as part of their cloud solution, a single management portal for all services is the most efficient way to manage the day-to-day aspects of a cloud implementation.

• Does your cloud provider offer a single integrated portal or single pane-of-glass visibility to all of your services including cloud, dedicated servers, network services, managed services,

integrated trouble ticketing, asset management and support? How easy is it to use this portal? • How do I access this portal?

• Who can access this portal? • What rights can I assign?

Enterprise Security

Cloud security is the top concern for CIOs today. An informal survey of the public cloud space shows a wide range of security maturity levels. For example, many enterprise cloud providers cannot implement a network-based intrusion detection system. Some providers settle for unknown software-network-based access control with no logging or visibility, bypassing industry-standard and certified firewall systems. Most companies would never take such risk with their enterprise security. The same attention should be applied to a cloud security implementation. A comprehensive security approach to the enterprise cloud includes security visibility (logging, network-level security); innovative enterprise-grade tested and certified security components; reputable and recognized vendors; and the option to have security managed as a service.

• Does your cloud provider offer enterprise-grade security appliances from vendors you rely on today — ones that are tested and certified, and that you trust?

• Can you leverage intrusion prevention systems (IPS) and enterprise-grade hardware-based firewalls?

• Do you have access to audit logs and asset-based usage reporting?

• Does your cloud provider offer managed security? Encryption for virtual machine instances? Machine level security hardening?

Cloud Operations and Resource Allocation

(7)

similar environment as they would in their own data center. The enterprise cloud provider should offer a way to clearly and cleanly allocate cloud compute, storage and network resources to specific applications. This is the most effective way to control and predict application

performance and cost.

• Does your cloud provider provide you tools to organize servers into unique manageable groups that align with your application architecture?

• Can you execute cloud operational commands across those groups?

• Can you flexibly allocate compute, storage and network capacity for groups of servers? • How quickly can you scale up those resources?

Role-Based Management

The enterprise cloud portal is a vital element of an enterprise cloud strategy. The management portal centralizes control over IT resources. Individuals within the IT organization with different responsibilities need to access the portal. A role-based management system allows permissions to align with the levels of responsibilities. Role-based management enables the systems to be tailored to allow or restrict access to cloud resources appropriately. For example, only certain users should have the ability to delete servers or access specific cloud resources.

• Does the cloud provider support cloud role-based administrative accounts so that you can assign individual permissions to users?

• Can you limit control of specific cloud resources (servers, storage and networks) to specific users?

Elasticity and Bursting

Meeting unpredictable capacity demands is fundamental to a successful cloud implementation. These demands have two key components: elasticity and bursting.

Elasticity is the ability to add or reduce capacity on an as needed basis

(8)

• Does your cloud provider allow you to burst beyond your purchased cloud capacity? • Do they guarantee that burst capacity will be available to you when you need it?

• Is it truly guaranteed capacity or are you relying on the cloud provider’s oversubscription model? • Can you reduce the resources without any penalty?

Cloud Consulting Services

Whether you require assistance in building a cloud business strategy, cloud security risk management plan or a methodology for on-boarding existing applications into the enterprise cloud, your enterprise cloud provider should offer a comprehensive and sophisticated suite of consulting services.

• Does your cloud provider offer you comprehensive cloud consulting services from strategy through implementation?

• Can they help you determine the best cloud “fit” and total solution for your business needs, looking at your total business objectives?

• Will they help you develop a cloud security risk management plan? • Will they calculate Return-on-Investment?

• Will they help you architect cloud-aware and cloud-enabled applications? • Will they help you on-board applications into the cloud?

Cloud Automation

One of the most interesting and powerful benefits of enterprise cloud computing is the ability to control the cloud directly from an application (a cloud-aware application) or through IT automation tools. This requires access to a cloud Application Programming Interface (API) that is standards-based with an emphasis on multiple security levels such as authentication, access control and other industry best-practices protection. Because the API is the entry point to cloud services, automating the security of the API saves time and mitigates risks for the enterprise cloud.

• Does your cloud provider allow you to programmatically, via an API, control your cloud? • Do they help you enable cloud-aware applications?

(9)

24x7 Customer Support

Services and support become an increasingly key function in the enterprise cloud. Users are relinquishing control of some of the physical aspects of their systems when they move them to the cloud. Enterprise users then depend on cloud services to meet or exceed the same demands as their internal IT services. A company may do business globally, but local accountability to resolve issues quickly is vital to any cloud initiative. When issues arise, trained technical experts should not stop at the implementation level. The ability to have access to senior-level engineers that can actually fix a problem means time and potentially dollars saved. Because of the importance of the enterprise cloud to operations, a cloud provider should offer 24x7 support staffed by senior-level engineers.

• Does the cloud provider give you 24x7 technical phone support staffed by human beings? • Who exactly handles support and where are they located?

• What is the support model?

• What level of engineers are you getting?

Network Infrastructure

A cloud provider’s network infrastructure assets are fundamental to high speed, efficient cloud application accessibility and management. An enterprise-grade global network that is continually upgraded to offer competitive performance levels, and incrementally expand cloud applications is needed. An enterprise may require cloud integration with sophisticated private networking capabilities, such as MPLS, or a high-speed connection between data centers. A cloud provider’s expertise should include the ability to optimize content delivery through the network or leverage enterprise-grade hardware-based load balancers.

• Does your cloud provider offer you world class enterprise networking capabilities including a Tier 1 global IP network, high speed data center interconnection, MPLS and VPN?

• Does your cloud provider offer hardware-based enterprise-grade load balancing? • Does your cloud provider offer content delivery network (CDN) services?

• What type of networking options does your cloud provider offer?

Service Level Agreement

(10)

network and server uptime but address latency and even support response times. Cloud providers with confidence in their solutions will provide monitoring software to ensure a company has visibility and control over both the promised performance and alignment with cost.

• What is covered in your cloud service provider’s SLA? Do they guarantee 100% uptime? • Does your cloud provider offer cloud performance monitoring and reporting, enabling you to

understand the quality of the service you are getting within the cloud platform itself?

Total Cost

Understanding what your true cost will be in the cloud can be difficult if a cloud provider uses a complicated billing model that is onerous to decipher and track. Services should be clearly defined and easily measured to ensure an accurate TCO calculation. The cost of a total enterprise cloud solution encompasses not only the cost of compute, network, and storage, but the trade off with capital expenditures that would provide access to an enterprise-grade infrastructure.

• Is the cloud provider’s pricing model predictable and easy to understand?

• Is it competitive when you consider all of your true costs in providing enterprise services? • Once you determine all of the gaps so that you have a fully maintainable and operational

enterprise cloud solution, what is your total cost?

Transparency and Visibility

An informed decision about a cloud strategy rests as much with the reputation of the provider as it does with the cost savings associated with implementing an enterprise cloud. For example, offering SLA monetary credits may not compensate the enterprise for the full range of losses from an IT outage. Your enterprise cloud provider should give you total transparency and visibility into how they achieve their features, functions, management, operational, security, performance and availability claims, and should be open about their vendor relationships.

• Does the cloud provider reveal the architecture, technologies and infrastructure used within the cloud to deliver your services? Do they provide real-time visibility into the underlying infrastructure?

(11)

NTT America Enterprise Cloud Evaluation

How does NTT America’s Enterprise Cloud offering conform to your evaluation framework? The section below provides proof points to help you in deciding your appropriate cloud strategy. The results are provided in summary tabular form.

Evaluation Area

_{NTT America Enterprise Cloud}

Enterprise-Grade and

Industry-Standard Does your cloud solution support industry-standard enterprise-grade cloud technologies to meet demanding enterprise requirements?

NTT America’s Enterprise Cloud is based on industry-standard technology providers including VMware, Cisco, EMC, Checkpoint and Juniper, among others. The enterprise cloud supports the VMware vCloud and vSphere standards and, as such, is compatible with existing customer VMware implementations.

Are they comparable in quality, security and reliability to what you implement today within your internal IT environments?

NTT America uses enterprise-grade vendors and products to assure high availability and performance. These products are matched by NTT America’s deep operational and engineering experience and processes to assure exceptional service levels and availability. Are the vendors and standards used by the enterprise cloud provider compatible with your own internal IT vendors and standards?

The vendors and standards supported by NTT America represent high quality enterprise-compatible solutions including VMware, Cisco, Juniper, Checkpoint and EMC.

Comprehensive and Controlled Does your cloud provider allow you to implement a global hybrid public/private enterprise-grade cloud solution including dedicated servers, managed services, colocation and customization?

NTT Communications is a global solution provider operating more than 30 data centers with more than 200,000 employees worldwide. As its US-based subsidiary, NTT America leverages all of NTT

(12)

Evaluation Area

NTT America Enterprise Cloud

Which of these managed services do they provide: security, storage, backup, network, disaster recovery, server operating system and application?

NTT America supports all of these managed services capabilities. NTT America can also manage complex business applications via an integrated service delivery made possible by the breadth of full ITO capabilities from NTT Group companies such as NTT Data, Dimension Data, and Integralis. As a full-service communications company, NTT America can offer a comprehensive portfolio of services that meet enterprise level requirements.

How much of the total solution does your cloud provider own and control?

NTT Communications owns and controls the network, data centers, and the entire compute, storage and network infrastructure. This results in a single point of accountability as well as the ability to provide transparency and visibility into all aspects of the cloud service.

Does your cloud provider offer a single integrated portal, or single pane-of-glass visibility, to all of your services, including cloud, dedicated servers, network services, managed services, integrated trouble ticketing, asset management and support?

NTT America provides a single integrated portal for all NTT America services to simplify the management of all enterprise cloud resources. The web-based interface allows real-time monitoring of services and several reporting options allow appropriate levels of detail for on-going management. Unified Management

Enterprise Security Does your cloud provider offer enterprise-grade security appliances from vendors you rely on today—ones that are tested and certified, and that you trust? Can you leverage intrusion prevention systems (IPS) and enterprise-grade hardware-based firewalls?

NTT America allows for enterprise-grade security devices, including, for example, Checkpoint Firewalls and Intrusion Detection and Prevention Systems (IDS/IPS), to be placed in front of or within enterprise cloud solutions. These enterprise-grade solutions are tested and certified by organizations including the International Computer Security Association (ICSA).

(13)

Evaluation Area

NTT America Enterprise Cloud

Does your cloud provider offer managed security?

NTT America provides a full range of managed security features including managed firewall services, managed IDS/IPS and

Distributed Denial of Service (DDoS) mitigation services. Regulatory and Compliance services can be layered on, per customer industry or governance policy requirements.

Does your cloud provider provide you tools to organize servers into unique manageable groups that align with your application architecture and to execute cloud operational commands across those groups?

NTT America’s Enterprise Cloud offers an innovative approach to organizing cloud resources. A flexible model allows functional permissions to be assigned by user responsibility within a Virtual Data Center. A customer’s enterprise cloud is organized into one or more of these Virtual Data Centers, which can be cascaded to Virtual Rooms and finally Virtual Applications. Cloud operational commands can be issued against Virtual Rooms and Virtual Applications by users with the appropriate permission level, saving time and increasing security.

Can you flexibly allocate compute, storage and network capacity for groups of servers?

NTT America’s solution allows you to allocate cloud resources (compute, storage and network) to one or more Virtual Data Centers depending on current needs. Within a Virtual Data Center, cloud resources can be allocated to one or more Virtual Rooms. Within a Virtual Room, Virtual Applications can be allocated a portion of the Virtual Room’s resources. Within a Virtual Application, servers can be individually assigned compute, storage and network resources. This allows you to quickly adapt your cloud resources to short and long term requirements.

Cloud Operations and Resource Allocation

Role-Based Management Does the cloud provider support cloud role-based administrative accounts so that you can assign individual permissions to users? The NTT America Enterprise Cloud portal supports specific roles that can be assigned to individual users. These users and their roles can be assigned to specific Virtual Data Centers.

(14)

Evaluation Area

NTT America Enterprise Cloud

The NTT America Enterprise Cloud portal allows users and roles to be assigned to a Virtual Data Center. Users can only access those cloud resources (servers, storage and networks) within their assigned Virtual Data Center.

Does your cloud provider allow you to burst beyond your purchased cloud capacity?

NTT America guarantees that 100% of the cloud resources you have purchased (CPU, memory, network and storage) will be available to you. NTT America does not oversubscribe the resources you have purchased – you are guaranteed to receive them. This provides exceptional performance and availability service levels and assures you receive the services that you have paid for.

Do they guarantee that burst capacity will be available to you when you need it?

NTT America guarantees that you will have an additional 25% of burst capacity available to you beyond that which you have committed to at a given point in time. This burst capacity is automatically made available to you to assure you achieve your service level objectives. In addition to burst capacity, at any given time an NTT America customer can request increased committed cloud resources.

Is it truly guaranteed capacity or are you relying on the cloud provider’s oversubscription model?

NTT America does not oversubscribe your cloud resources. You are guaranteed to receive the cloud resources you have purchased. Elasticity and Bursting

(15)

Evaluation Area

NTT America Enterprise Cloud

Can they help you determine the best cloud “fit” and total solution for your business needs, looking at your total business objectives? NTT America offers a sophisticated suite of consulting services including a cloud-fit application profile process enabling you to quickly identify new and existing applications that best fit the cloud. Through repeatable application profile templates, NTT America can help streamline how you plan and implement your use of the cloud. NTT America can help your organization articulate application fit to the cloud in business and technical terms.

Will they help you develop a cloud security risk management plan? NTT America consultants can provide a streamlined cloud security risk management plan and process. NTT America can integrate a plan with a cloud application profile and cloud application on-boarding processes. Our cloud security risk management methodologies represent thought leadership in the area of cloud computing and consider the unique security risks and benefits cloud computing brings at the platform and application-levels.

Calculate your Return-on-Investment?

All of NTT America’s cloud consulting services include the ability to articulate both the hard and soft Return-on-Investment (ROI) associated with your cloud computing plan. In addition, NTT America provides a valuable reprioritization methodology allowing you to balance your approach to the cloud based on speed of deployment; relative levels of capital and operational expenditure; and business-specific soft ROI benefits.

Help you architect cloud-aware and cloud-enabled applications? NTT America understands that the cloud is much more than servers, storage and a network. It represents a new way of thinking and programming applications to leverage the programmable and highly elastic capabilities of the cloud. NTT America consultants provide expert guidance on architecting cloud applications for better economy and performance by leveraging on-demand elastic capabilities and cloud application programming interface (API) integration including use of the vCloud API.

Help you on-board applications into the cloud?

(16)

Evaluation Area

NTT America Enterprise Cloud

Does your cloud provider allow you to programmatically, via an Application Programming Interface (API), control your cloud enabling cloud-aware applications?

NTT America supports the industry-standard vCloud API, allowing customers to directly control their cloud resources to automate IT operations and develop cloud-aware applications.

What steps do they take to secure API access to your cloud — are they adequate?

As a mature provider of enterprise services, NTT America believes and understands that securing the cloud API is of significant importance and has taken unique steps to secure it. Rather than exposing the cloud API to the open Internet as many public cloud providers do today, NTT America restricts access to the cloud API at a network-level and requires user authentication. NTT America secures the cloud API interface servers with traditional enterprise-grade security solutions, including web application firewalls and proxy servers.

Cloud Automation

24x7 Customer Support Does the cloud provider give you 24x7 phone technical support staffed by human beings?

NTT America provides 24x7 technical phone support staffed by experienced engineers and technical support representatives. Who exactly handles support and where are they located?

NTT America’s 24x7 operations centers are staffed by NTT America employees or employees of NTT subsidiaries. NTT America’s operations centers are located in the United States. NTT-managed services offered by NTT subsidiaries may offer global follow-the-sun technical support staffing with multilingual support. What is the support model?

(17)

Evaluation Area

NTT America Enterprise Cloud

Does your cloud provider offer you world class enterprise

networking capabilities including a Tier 1 global IP network, high speed data center interconnection, MPLS and VPN?

NTT America owns and operates a world-class Global Tier1 IP backbone with multiple physical and logical networks, a 100% uptime service level agreement, packet loss that will not exceed 0.1%, and latency that will not exceed 5 milliseconds within the data center, 50 milliseconds in North America, 90 milliseconds trans-Atlantic and 130 milliseconds for the transpacific network. The network also includes Distributed Denial of Service (DDoS) countermeasure services. NTT America provides a comprehensive MPLS private network offering full mesh network communication, high security and low latency. The NTT America Arcstar private network service offers a full range of VPN services.

Does you cloud provider offer hardware-based enterprise-grade load balancing?

NTT America’s Enterprise Cloud solution offers high performance hardware-based load balancing, assuring that individual cloud servers are not burdened with the cost and performance impact of performing load balancing functions.

Does your cloud provider offer content delivery network (CDN) services?

To optimize the performance and cost of applications delivering large amounts of content over the network, NTT America offers a CDN service leveraging local load balancing, global load balancing and reverse-proxy caching.

Network Infrastructure

Service Level Agreement What is covered in your cloud service provider’s SLA? Do they guarantee 100% uptime?

NTT America provides a service level agreement of 100% cloud resource uptime (compute and storage) and 100% customer portal availability.

Does your cloud provider offer cloud performance monitoring and reporting, enabling you to understand the quality of the service you are getting within the cloud platform itself — to confirm that you are getting what you paid for?

(18)

Evaluation Area

NTT America Enterprise Cloud

Is the cloud provider’s pricing model predictable and easy to understand?

NTT America’s Enterprise Cloud offers predictable and

straightforward pricing, offering regularly monthly capacity charges as well as burst and hourly charges.

Is it competitive when you consider all of your true costs in providing enterprise services – once you have filled-in all the gaps so that you have a fully maintainable and operational enterprise cloud solution, what is your total cost?

NTT America’s approach to enterprise cloud computing is to provide the customer a total solution, not one containing gaps that must be filled by the customer. A total solution includes enterprise-grade security, predictable high-performance, high-availability, adjunct services (managed servers, colocation and more), dependable high quality customer support, and a single point of ownership, accountability, transparency and visibility. NTT America’s total cost is competitive while acting as a trusted advisor and business partner with the customer.

Total Cost

Transparency and

Visibility Does the cloud provider reveal the architecture, technologies and infrastructure used within the cloud to deliver your services? Do they provide real-time visibility into the underlying infrastructure? NTT America provides transparency and visibility to customers in how it architects its cloud service and the underlying technologies, vendors and approaches used. The company also provides

transparency and visibility into how it operates its cloud platform including operational processes and procedures to support the customer. NTT America invites enterprise customers to tour its data centers and learn more about its approach to enterprise cloud computing and overall solutions.

When you pay for cloud computing capacity, are you sure you are getting what you paid for?

NTT America provides reporting and visibility into how the

(19)

Conclusions

The evaluation and selection of an enterprise cloud provider should include a comprehensive look at all aspects of a total enterprise solution. The enterprise cloud provider should be transparent in how they meet your security, performance and availability objectives. A

customized solution should allow you to streamline IT operations and seamlessly integrate in order to meet the unique needs of your business.

NTT America offers a comprehensive enterprise cloud solution and as a trusted advisor and business partner, has provided this cloud evaluation framework to help you carefully select your enterprise cloud provider. NTT America is committed to meeting the true needs of your business and welcomes the opportunity to talk more about how the NTT America Enterprise Cloud can be part of your total enterprise solution.

Learn more about NTT America Cloud services at http://www.dedicatedserver.com/cloud-hosting/ Twitter: @ntt_america