Cloud Store Product Definition
Web Server as a Service
March 2014
Contact Information
Your primary point of contact in relation to this document is:
Name Andy Dunn
Head of New Business
1
Product Overview
Having a presence on the web so that users, potential employees and business partners can efficiently and effectively access information and resources can be a great advantage to public sector
organisations of any size. Products and services can be conveniently purchased via a website too. The challenge is hosting a web server and ensuring that it is fully functional and accessible 24/7. A web hosting service enables customers to make their website readily available. Web hosts provide a server for the website, as well as providing Internet connectivity in a data centre.
The customer could ask, “Why can’t I just manage my web server in-house, or collocate the server and manage it myself, using an Internet Service Provider to manage my website?”
Well, there are several disadvantages of providing and managing a web server in-house:
> High-specification servers are required to host websites. These are expensive to build, run, house, power, cool and maintain. They also require a certain expertise and skill set to configure and manage which, if these are not available from existing personnel, staff must be trained or new staff acquired. Expensive maintenance contracts may even be required for the servers which add to the overall cost.
> The configuration of servers and all the other various setup and ongoing management and support that is involved is complex, time-consuming and requires human resources with special skills.
> The server operating system and any additional server software required (such as AV, etc.) must be obtained and licensed. This is by no means easy to install and configure. These headaches are handled by the web hosting service provider.
> Network bandwidth requirements (and storage if data is processed on the website) may increase exponentially as the number of visitors to the customer’s website increasingly grows, adding pressure on their existing IT environment.
> Protecting the web server (e.g. anti-virus (AV) software, firewall, Intrusion Detection System (IDS)/Intrusion Prevention system (IPS), etc.) creates additional support costs, increasing the burden on their IT department.
There are also some disadvantages of using a dedicated physical server to host a website.
A dedicated physical web server lets a customer effectively handle traffic – but it does come with a substantial price tag. A dedicated server enables a customer to manage their resources and system settings in accordance with corporate policies; they have complete control and a high capacity to handle traffic spikes.
However, a dedicated physical server may be too expensive to maintain for a customer’s needs. There is also a downside of a physical box in that to achieve scalability, disaster recovery (DR), etc. another physical box (es) is required.
A VPS is one of several virtual machines (VM’s) running on a single server. Although a VPS runs in software on the same physical server as other customers' VPS’s, it is in many respects functionally equivalent to a separate physical server:
> A VPS is dedicated to the individual customer's usage needs – the disk space and other resources are not shared with other VPS’s present on the physical server;
> A VPS has the privacy of a separate physical server as it is isolated from the other VPS’s - every VPS using the physical web server acts independently without affecting any other VPS’s present on the physical server;
> A VPS runs its own operating system (OS) and web server software.
VPS carries many of the benefits of a dedicated server: the customer is not subject to the issues of shared hosting, as a portion of the server is partitioned and offered just to them, so security is not an issue. Because the VPS hosting provider doesn’t dedicate an entire server for a customer’s business means that costs are reduced – it is more cost- effective for a customer to share bandwidth and physical servers with other customers.
All of these typical challenges could be the reasons why a customer may wish to outsource provision, control and management of their web server to a web hosting service provider, and Adapt has the resources, personnel and expertise to hand with our Web Server as a Service (WEBaaS) solution, which provisions dedicated virtual web servers for customers.
The customer gets all the benefits and functionality of an enterprise web server, without the financial burden or IT headaches that go with running their own web server.
2
Product Description
Adapt’s Web Server as a Service (WEBaaS) solution provides management and support of a virtual private server (VPS) to be used as a web server for hosting a customer’s website.
Adapt provides and manage the web server, up to the OS level, which is located in a UK-based Adapt data centre (DC). Adapt operates multiple data centres and are able to offer single, dual or multiple site configurations. Dual and multiple DC configurations provide high availability (HA) and, if required, disaster recovery (DR) of the hosted web service.
Note that it is important to inform the customer that it is their (or the third party’s) responsibility to upload the web content and install any applications on the web server in order to get their website up and running, and also their responsibility to make any changes to the website and updates/patches to the web applications. Adapt manages the web server and any underlying storage and network requirements, not the content of the website itself.
The managed web server solution is built upon the IaaS/Managed Server offerings (see the
IaaS/Managed Server Product Definition) for management of the underlying server infrastructure and storage. Adapt use a common approach and toolset to support our customers, ensuring that best practice is shared and always followed.
Operating system backup is obligatory, however Adapt recommends that this is extended to ensure backup of website content and data and to safeguard operational performance.
Note that, on a case by case basis and under agreement with the Commercial and Operational Teams, Adapt can migrate (import) existing customer web content to the web server for basic websites. This is provided as an optional transitional project work stream.
3 x Services
Small: 1 x CPU, 2GB RAM, 50GB OS +50GB App Disk
Medium: 2 x CPU, 4GB RAM, 50GB OS + 100GB App Disk
Large: 4 x CPU, 8GB RAM, 50GB OS + 150GB App Disk
There are various options, depending on the customer requirements:
CONFIGURATION
REQUIREMENTS
1 VPS, single site
High availability and resilience are not required. Suited to websites with limited data processing, lightweight applications, and generally regarded as not mission-critical (i.e. periods of downtime will not adversely affect the business)
*2 VPS’s, dual site (1 web server per site)
High performance, high availability and site resilience (in the form of backup and restoration of web content between different geographically-located sites) are required
*Multiple VPS’s load balanced, single site
Highest performance and high availability are required; site resilience is not required (resilience is needed in the form of backup and restoration of web content between VPS’s, but not between sites)
*Multiple VPS’s load balanced, multiple sites
Highest performance, high availability and site resilience are required
Table 1: WEBaaS Configuration Options
*Note that, if required, synchronous storage replication for failover between VPS’s (for single site configurations) and sites (for dual/multiple site configurations) can be provided as an optional extra to configurations with multiple VPS’s.
Network communications between VPS’s and clients can be made via either Hypertext Transport Protocol (HTTP) or Hypertext Transport Protocol Secure (HTTPS). (HTTPS is used for websites which require a secure connection to protect sensitive information, such as passwords, credit card numbers, or payment information).
Note that Adapt can supply certificate signing request (CSR) from the secure web server (which is using HTTPS), but it is the customer’s responsibility to provide the public key (digital identity) certificate (also known as a Secure Sockets Layer (SSL) certificate). The customer owns the website so therefore it is advisable that they own the security certificate for the web server. If required, Adapt can aid the customer in generating a CSR code and installing it.
Adapt uses PRTG Network Monitor software to monitor availability and usage of the website content, and Solarwinds Server & Application Monitor (SAM) software to monitor the server infrastructure. The service is offered on Microsoft Window Server 2008 (both R1 and R2) and Red Hat Enterprise Linux (RHEL) operating systems.
Adapt will install the following web server software on the managed web server:
> Internet Information Services (IIS) on Windows Server OS
The customer is responsible for the configuration of the web server software and ongoing management (including patching and updates).
Adapt offers the following resources as part of the product:
> Compute (physical server and VPS)
> Server Operating System (OS)
> Storage Area Network (SAN)
> Network (inc. IP address of website Uniform Resource Locator (URL))
> Load balancing (dependent on configuration)
> Backup and restore
> Dedicated firewall for each VPS
> Disaster recovery (DR) (optional and depending on configuration – see above)
> Anti-virus (AV) software. Note that AV software is not deployed as standard on RHEL and is not recommended unless there is a specific requirement, due to the performance overhead and limited applicability in most scenarios
This solution includes all aspects of the build, management, maintenance and monitoring of the server up to the operating system (OS) level, including:
> Server build and test, including installation and configuration of the chosen operating system. Note that application management and installation is excluded from the standard service, as these are usually performed by the customer. For MS Exchange, BlackBerry BES, SQL and Oracle databases, the customer may wish to investigate the use of Adapt’s XaaS and DBaaS managed application offerings (see the relevant Product Definitions)
> Monitoring, reporting and resolution of errors and events
> Permission management (management of users and privileges)
> Patching and fulfilment of customer-requested OS related change requests
> Capacity management of server compute, memory and storage
> Server performance analysis and management
> Availability management
> ITIL-compliant service management
> 24/7 Operations Bridge and Network Operations Centre (NOC)
> Dedicated service via the Adapt Management Portal (aMP) with online monitoring
2.1
Risks and Mitigations
The table below provides some potential high-level risks which the customer could face by migrating to the WEBaaS solution. It also outlines the resolutions which Adapt will/may undertake in order to mitigate against these risks.
RISK
MITIGATION
Migration of website content to an Adapt web server will obviously result in downtime of this website
Advance planning, bringing up the new web server in isolation, testing, etc. and then agreeing a cut-over point which minimises any business impact.
The actual cut-over should have almost no down time, as it is just a case of re-pointing Domain Name Server (DNS) records.
Security
The following security measures will be undertaken by Adapt:
Physical segregation of VPS’s, through the use of dedicated firewalls
Deployment of AV software on server OS (if applicable)
Patching to apply security and critical fixes to the server OS
3
Product Benefits
Enables the customer to focus on business, not on the web server – optimising operational efficiency and performance:
> Frees up in-house IT staff to focus on core business;
> Alleviates the need to employ additional IT support staff, enabling customers to streamline their business;
> Avoids the high costs of maintaining and supporting their own infrastructure in-house, reducing OPEX;
> 24/7 management and monitoring of infrastructure, therefore if a problem occurs out-of-hours Adapt will endeavour to fix it so that there are no interruptions to customers’ business in core operating hours;
> Provides access to our 24/7 Operations Bridge and Network Operations Centre (NOC) so that issues can be reported any time;
> Allocated Service Manager looking after their account personally;
> Ensures a stable and controlled system through incident, change and capacity management.
> Ensures web services are available through high availability and optional disaster recovery (dependent on configuration);
> Server OS patching and network connectivity included in the service;
> Adapt 'Pod' managed service support structure provides the highest level of customer support quality available in the UK market.
Reduces business costs when compared to implementing a dedicated physical server:
> Cost-effective VPS model - a VPS costs less than a traditional server due to its longer life, absence of a local hard disk, and reduced power consumption;
> WEBaaS can reduce the total cost of ownership (TCO), including capital expenditure (CAPEX) and operational expenditure (OPEX).
Protects any sensitive content and information stored on the website:
> Backup and restore of the web content is included in the service;
> DR of the web server is an option;
> Delivers secure and compliant systems which meet or exceed the majority of business requirements. Adapt is ISO27001 and ISO9001 certified and offers Government Impact Level Assessment Level 4 (IL4) and PCI DSS Data Security Tier 1 compliance assurance, if required;
Highly skilled resources without employment overhead:
> Access to highly skilled web server experts without the costs associated with employing them on a full-time basis;
Allows the business to retain control and flexibility:
> Abstraction of infrastructure (when combined with Adapt’s IaaS service offering) and web server management, allowing for faster set-up and expansion than traditional methods;
> An IT system that can grow and adapt with the business;
> Scales precisely with a customer’s evolving compute and storage requirements;
> Delivers a service management layer that keeps the business informed and in control of their requirements;
> Multiple data centres with existing interconnected networks allowing DR to be enabled where required;
> UK-based DC’s and staff, ensuring UK security and compliance standards can be adhered to where required;
> Can be architected for a higher Service Level Agreement (SLA) than customers would typically be able to achieve with their own resources;
> Adapt can offer a diverse range of Internet carriers directly from our DC’s, providing flexibility over Internet connectivity to suit customer’s needs;
> Customers can leverage Content Distribution Networks (CDN’s) from our network partners.
Simplifies budget management:
> Offers a highly flexible 'pay as you grow' model giving businesses access to the benefits of on-demand infrastructure services without upfront capital investment;
3.1
References
SciSys (working with the Environment Agency)
Co-operative Financial Services (CFS)
3.2
Awards
The following Adapt awards have been considered as relevant to this solution:
SVC Awards – 2012 Runner-up
Managed Services Provider of the Year
Datacentre Solutions Awards – 2012 Finalist
3.3
Partners and Certifications
3.3.1
Partners
Adapt has strong technology partnerships with the following vendors in order to provide its XaaS solution:
Microsoft Gold Partner
Red Hat Ready Hosting Partner
3.3.2
Certifications
Adapt focuses on the provision of effective, efficient and economic service delivery. To help us achieve this goal, we've attained the following formal certifications:
BSI ISO 9001:2008
Quality Management Systems
BSI ISO 27001:2005
Information Security
ISO/IEC 20000-1:2011
4
Commercial Model(s)
4.1
Set-up
A set-up fee applies, reflecting Adapt’s time to configure the web server. This is an additional charge over Adapt’s charge to build and configure the server operating system. Where an up-front fee presents a barrier to customer adoption of the service, the fee can be amortised over the term (subject to approval from the Commercial Team).
4.2
Term
Web servers should typically be offered on a 36 month term as part of a new contract with a
customer. Longer terms can be offered at a discount, and shorter terms at a penalty (to be agreed by the Commercial Team on a case-by-case basis).
For additional servers ordered for an existing customer, a shorter term is typically appropriate, for example arranging the term of the additional servers to be coterminous with the existing contract.
4.3
Service Levels
Adapt offers a Service Level on Web Server availability, dependent on the underlying platform.
4.4
Optional Extras
Appendix A – Frequently Asked Questions
Q1
Why do I need to employ a web hosting service provider?
To take away the costs and burden of implementing an in-house web server, alleviating the costs and time taken to build the system and install the software. Also, to eliminate the costs and time taken to train employees on using the new system, and/or employ new staff for the purposes of web server administration.
Q2
How secure and reliable is your service? Can I trust that my data is in safe hands?
Adapt delivers secure and compliant systems which meet or exceed the majority of business requirements. Adapt is ISO27001 and ISO9001 certified and offers Government Impact Level Assessment Level 4 (IL4) and PCI DSS Data Security Tier 1 compliance assurance, if required.
Q3
What implications will implementing this have on my business? Will there be
downtime/loss of service and, if so, for how long?
This will all depend on if Adapt is migrating an existing website. If this is the case, then this will all depend on how quickly the internet DNS name can be updated to the new public IP address of the website.
Q4
What service levels are you offering?
Adapt offers availability service levels depending on the configuration of the underlying platform. The highest service level is offered for a replicated, load-balanced, highly available multiple-site solution, with lower service levels offered for less resilient solutions such as a single-site, single server solution.
