Considerations for Organizations Wanting to Move Services to the Cloud

(1)

Considerations for Organizations Wanting to Move Services to the Cloud

Weathering the Storm

Who should read this paper

This whitepaper is for organizations who are considering moving

services to the cloud but are unclear on the options available. This

paper discusses the pros and cons of different cloud models and

the steps necessary to implement each type of cloud solution.

WHITE PAPER:

CLOUD SERVICES

(2)

(3)

WHITE PAPER: CLOUD SERVICES

W

eathering the Storm

Considerations for Organizations Wanting to Move Services to

the Cloud

Conclusion . . . 6

(4)

Introduction

While companies have been carefully evaluating whether or not to move to the cloud, the number of products and services encouraging CIOs to make the leap has continued to grow. There is also evidence of increased spending on the cloud; IDC recently announced that spending on

public cloud computing services will rise to $29.5 billion by 2014.1 The pressure on CIOs to move to the cloud is extensive, but many

questions remain.

Cloud services offer many advantages in terms of flexibility and on-demand resources that can give organizations a competitive advantage. However, CIOs have to balance keeping their companies competitive with maintaining the safety and security of the data and business processes they have been charged with. Cloud services like Salesforce.com can give numerous organizations a feature-rich CRM, but it can also introduce new risks.

In April 2011, Amazon’s cloud offering, EC2, suffered a severe outage illustrating the precarious nature of cloud based services.2 Many

companies that relied on that service lost a great deal of money and customer trust. Though clients of the EC2 service can be compensated for the downtime caused by the outage, the loss of customer trust is much harder to recoup.

This whitepaper is designed to give CIOs and IT Directors a guidebook for evaluating cloud services. It will describe the differences between private and public clouds, give suggestions to help organizations best determine how to move to the cloud securely and provide a checklist of attributes to consider when choosing a provider.

Private and Public clouds

The first thing organizations need to consider as they look towards the cloud is which approach to the cloud they want to take. It may surprise some to learn that despite all the press and discussions around the cloud, there are only two classes of clouds: private clouds and public clouds. There are significant differences between the two classes and each has its own unique set of advantages and disadvantages.

Public Clouds and Software as a Service (SaaS)

Public clouds are provided by a variety of well known vendors including Microsoft, Rackspace, Symantec, Amazon, and others. By providing stacks of servers all running virtual environments, public cloud environments are designed to provide the following benefits to organizations:

• Scalability - users have the ability to access additional compute resources on-demand in response to increased application loads. • Flexibility – public clouds provide flexible, automated management to distribute the computing resources among the cloud's

users.

• Reliability and fault-tolerance - cloud environments can take advantage of their large number of servers by enabling applications to utilize this built in redundancy for high availability.

• Utility-basedcomputing - users only pay for the services they use, either by subscription or transaction-based models.

• Sharedresources - by enabling IT resources to be consolidated, multiple users share a common infrastructure, allowing costs to be more effectively managed without sacrificing the security of each user's data.

1-http://www.idc.com/research/viewdocsynopsis.jsp?containerId=226222 2-http://aws.amazon.com/message/65648/

(5)

Data Access – any time data moves outside the walls of the organization, concerns over the privacy and security of the data will

come up. A recent (ISC)^2 survey showed data security is the number one concern of security professionals evaluating cloud

services.3 While many cloud providers have extensive security measures employed in their datacenters, it is important to research

potential cloud providers and fully vet their data security practices to ensure they are best of breed.

Data Control – many IT administrators fear that once an application leaves their environment, they will lose granular control over

that application. Historically, cloud applications were not as feature rich as premise based solutions because the service was running remotely, but cloud applications have come a long way in recent years and many cloud applications are just as feature-rich as their on-premise counterparts. Readers should investigate or even demo potential cloud-based solutions to ensure that critical features and controls are available in the offering.

Vendor lock in – once an organization moves their data and applications to the cloud, it can become very difficult to move away

from that provider, setting up the potential for extensive costs to move. To reduce this risk, find out the process for extracting your data from the cloud service provider and understand what the transition plan would be to an alternate service.

Difficulties maintaining regulatory compliance – Some compliance bodies have not updated their standards with provisions

around cloud based data. This does not necessarily prevent organizations from moving data and applications to the cloud. Companies must investigate whether a cloud provider’s infrastructure processes and stores data in a fashion that meets their compliance requirements. Another option is to ask a potential cloud provider for references with similar regulatory requirements to understand how those companies have maintained compliance.

Reliability – in theory public clouds offer higher availability than traditional premise based networks because the vendor is

providing Service Level Agreements (SLAs) around this availability and has a vested interest in honoring these agreements. Unfortunately, as seen in the EC2 outage earlier this year, even public clouds, if not designed properly, can fail, leaving customers without access to their own data and applications. Readers should seek to understand how potential cloud providers have built their infrastructure to ensure 100% availability.

• CAPEX savings - because the vendor is providing all the hardware, software, support, security, and high availability for the infrastructure, the organization is only paying to use the service and saves a significant amount of money on capital expenditure.

While the above mentioned benefits are the key advantages of a public cloud, organizations still need to be cautious before moving to a public cloud. The primary concerns around public clouds today are:

Ultimately, cloud based services can help organizations better manage their computing resources. There are numerous examples of clients using public clouds to quickly stand up applications requiring varying amount of resources, all without having to plan and invest in their own internal infrastructure. This is exactly what the Red Cross did during the Japan Quake relief effort to handle payments and peak loads of their application. By relying on Amazon, the Red Cross could focus on putting donations to work.

3-Weathering the Storm

Considerations for Organizations Wanting to Move Services to the Cloud

(6)

Sof

Softtware as a Ser

ware as a Service (SaaS)

vice (SaaS)

SaaS is the best known example of public clouds. SaaS provides a ready-made application platform for users to start using once they sign up for the services. Because SaaS is still a public cloud infrastructure, all the same benefits and cautions apply. However, there are some additional advantages that organizations gain from using SaaS compared to traditional application development.

• Eliminates the need for patching – because the cloud provider is responsible for the patching of the system, this eliminates the need for a patch management system by the client.

• Automatic upgrades – SaaS applications are automatically upgraded by the cloud provider. This ensures that users are always using the latest builds of a given application solving many issues around security and help desk calls that plague traditional applications.

• Broader community for support and development – because the vendor is supporting one application for a large set of customers, that vendor will have a larger community to provide insight, support, and push for more features.

Private Clouds

As the name suggests, private clouds are designed to be visible only to the organization that creates them. They are essentially private datacenters that an organization creates with stacks of servers all running virtual environments, providing a consolidated, efficient platform to run applications and store data.

Private clouds provide a lot of the same benefits to the organization that a public cloud does, but still allows the organization to maintain ownership of the data and equipment. The benefits include scalability, metering and flexible resource allocation, without exposing any of the organization’s assets to the public Internet. Private clouds also address some of the top concerns that prevent organizations from moving to the cloud such as vendor lock-in and regulatory compliance in third party infrastructure.

However, where private clouds differ from public clouds is that private clouds can require a significant investment. The following are all costs that should be considered by organizations looking to create a private cloud:

• Hardware and software purchases – to create a private cloud, the organization much purchase all the servers, virtualization software, application licenses, and networking hardware to create the private cloud.

• Additional system administration costs – the organization must also bear the costs of upgrading and adding resources as the cloud grows. Additionally, all the traditional costs of managing servers must be considered.

• Specialized IT skills needed - the skill set required for the IT department to deploy, manage, and maintain a cloud environment will be different from the skill set they utilize for their on-premise systems. This could require hiring a consulting firm, training existing staff, or hiring new employees to manage the new infrastructure.

• High availability and disaster recovery – the organization will have to invest in additional resources to ensure that the private cloud maintains full-time availability and is fault tolerant.

(7)

• Reduced economies of scale – Although a large organization will reap the benefits of scalability and flexible resources using a private cloud, the efficiencies and cost savings will be limited by the company’s size. The more users that are on a cloud environment, the higher the efficiencies will be.

Despite these challenges, private clouds can provide significant advantages to organizations that need the flexibility and on-demand resources offered by the cloud, but cannot move the data outside of the organization.

Choosing Your Cloud

For an organization that is evaluating the different cloud options, the next step is to understand the process of moving to the cloud. Each class of cloud requires unique steps for migration.

Moving to a Public Cloud or SaaS

Since public clouds are set up to be open to the general public, acquiring the initial resources is straightforward. Public clouds are designed in a way that make it very easy for IT departments to start small and expand to more users, making public clouds ideal for testing. The steps required for an organization to move to a public cloud are:

1. Choose a provider

2. Create the infrastructure on the cloud platform

3. Create the applications on the cloud platform and migrate data

4. As the organization’s use of the cloud grows, simply pay incrementally for the increased usage

Moving to a Private Cloud

Moving to a private cloud is a more involved process than moving to a public cloud. The private cloud has to be created before any data or applications can be migrated to it. The steps required to create a private cloud are:

1. Acquire the hardware and virtualization software 2. Create the infrastructure

3. Add security, high availability, and disaster recovery 4. Migrate applications and data

5. Provide ongoing maintenance to the cloud, buy new hardware and software as needed 6. Expand the infrastructure as usage grows

Weathering the Storm

(8)

While private clouds are a necessity for some organizations, they require dedication and strong upper management support to ensure that the whole process is followed through from start to finish. As mentioned earlier, private clouds eliminate many concerns around security, but do require extensive CAPEX to be realized.

SaaS - The Easy Way to Move to the Cloud

There’s no doubt that a company contemplating the move to the cloud faces some difficult challenges. However, the cost benefits and advantages provided by a cloud infrastructure have been shown time and time again. As a result, companies wanting to stay competitive need to evaluate cloud services. The simplest and easiest way for a company to begin testing the cloud is with SaaS.

There are many SaaS services that can be moved to the cloud. CRM and email are some of the best known examples but there are a number of other services such as messaging and Web security, archiving, and backup that can also be moved to the cloud. Starting the cloud journey with security services is ideal because organizations can get a feel for how cloud services operate while offloading time intensive tasks. Consider the management of endpoint security for your organization and the challenges involved in that process. It requires dedicated servers, patching, managing version control, computing resources and system administrator time in order to make endpoint security run reliably. Using cloud services to offset the challenges of endpoint security is a great option. Symantec Endpoint Protection. cloud allows you the deployment simplicity of out-of-the-box AV while still giving you management over the agents thanks to the hosting of the management

infrastructure.4

Criteria for Choosing a Cloud Provider

Now that you have made the decision to move to the cloud, how does one choose a provider? Given the number of vendors offering cloud solutions, organizations have more than enough options to choose from. There are some key attributes one should consider when evaluating cloud service providers:

• Reputation. How long have they been offering cloud services?

• Security is key. Really understand how secure your data needs to be, and ask the vendor how they would solve your security problems.

• Backing up and Moving Your Data. Investigate how the cloud provider makes back-up copies of your data, how you can move the data to another provider.

• Service Level Agreements. Work hard to get a good service level agreement with clear financial penalties to ensure a good service.

• Be Careful of Certifications. Certifications capture just a moment in time. Do your own research on how the vendor is performing. Ask questions of other customers.

• Try Before You Buy. The beauty of cloud computing is that it's easy to switch on and off. Obviously don't start your cloud adventure with confidential data or mission-critical systems, but if the service works for you, you can expand.

(9)

Conclusion

Moving to the cloud can seem overwhelming, and there are numerous options to consider. However, by taking incremental steps into the cloud with a trusted provider, organizations will realize significant benefits in terms of cost savings and efficiencies gained by moving to the cloud. Organizations need to realize that they control their own destiny in moving to the cloud. Ultimately the choice to start with a public cloud, private cloud, or SaaS comes down to the specific requirements of the organization.

(10)

AMERICAS UNITED STATES 512 Seventh Avenue 6th Floor New York, NY 10018 USA Toll-free +1 866 460 0000 CANADA 170 University Avenue Toronto, ON M5H 3B3 Canada Toll-free :1 866 460 0000 EUROPE HEADQUARTERS 1270 Lansdowne Court Gloucester Business Park Gloucester, GL3 4AB United Kingdom Tel +44 (0) 1452 627 627 Fax +44 (0) 1452 627 628 Freephone 0800 917 7733 LONDON 3rd Floor 40 Whitfield Street London, W1T 2RH United Kingdom Tel +44 (0) 203 009 6500 Fax +44 (0) 203 009 6552 Support +44 (0) 1452 627 766 NETHERLANDS WTC Amsterdam Zuidplein 36/H-Tower NL-1077 XV Amsterdam Netherlands Tel +31 (0) 20 799 7929 Fax +31 (0) 20 799 7801 BELGIUM/LUXEMBOURG Symantec Belgium Astrid Business Center Is. Meyskensstraat 224 1780 Wemmel, Belgium Tel: +32 2 531 11 40 Fax: +32 531 11 41 DACH Humboldtstrasse 6 Gewerbegebiet Dornach 85609 Aschheim Deutschland Tel +49 (0) 89 94320 120 Support :+44 (0)870 850 3014 NORDICS St. Kongensgade 128 1264 Copenhagen K Danmark Tel +45 33 32 37 18 Fax +45 33 32 37 06 Support +44 (0)870 850 3014 ASIA PACIFIC HONG KONG

Room 3006, Central Plaza 18 Harbour Road Tower II Wanchai Hong Kong Main: +852 2528 6206 Fax: +852 2526 2646 Support: + 852 6902 1130 AUSTRALIA Level 13 207 Kent Street, Sydney NSW 2000 Main: +61 2 8220 7000 Fax: +61 2 8220 7075 Support: 1 800 088 099 SINGAPORE 6 Temasek Boulevard #11-01 Suntec Tower 4 Singapore 038986 Main: +65 6333 6366 Fax: +65 6235 8885 Support: 800 120 4415 JAPAN Akasaka Intercity 1-11-44 Akasaka Minato-ku, Tokyo 107-0052 Main: + 81 3 5114 4540 Fax: + 81 3 5114 4020 Support: + 852 6902 1130

More Information

(11)

(12)

About Symantec.cloud

Symantec.cloud, a division of Symantec

Corporation, offers customers the ability to work

more productively in a connected world. More than

31,000 organisations ranging from small

businesses to the Fortune 500 across 100 countries

use Symantec.cloud to administer, monitor, and

protect their information resources more

effectively. Organizations can choose from 14

pre-integrated applications to help secure and manage

their business even as new technologies and

devices are introduced and traditional boundaries

of the workplace disappear. Services are delivered

on a highly scalable, reliable and energy-efficient

global infrastructure built on fourteen datacenters

around the globe.

Symantec.cloud North America

512 7th Ave.

6th Floor

New York, NY 10018 USA

1 (646) 519 8100

1 (866) 460 0000

www.SymantecCloud.com

Symantec helps organizations secure and manage their information-driven world with managed services, exchange spam filter, managed security services, and email antivirus.

Copyright © 2011 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.

managed services

exchange spam filter,

managed security services, and

email antivirus.

Considerations for Organizations Wanting to Move Services to the Cloud