Interest in cloud computing is endemic, but the definition of the concept is still unclear. Is it a genuinely new business model for computing, industry commentators and aspiring users ask? If so, what are the features that distinguish it from other models reaching back for decades -- the computer bureau of the 1980s, for example, or the more recent vogue for the Applications Service Provider (ASP) and "utility computing"?
Speakers at the CIO Insights Luncheon in November made some attempt to agree on a working definition, while admitting, in the words of Unisys NZ managing director Brett Hodgson that, "We're not going to demystify that today."
He says the cloud Unisys talks about "is loosely defined as a multi-tenanted environment" -- as distinct from an ASP model, which usually means each customer using their own specialised applications relocated. "The cloud is a different business model, probably more aligned to pay-as-you-go."
Tim Sheedy, senior analyst at Forrester, agrees. "Paying for only what you use is one of the key tenets. If it's not pay-as-you-use, it's not true cloud."
Virtualisation is also a crucial part of the cloud model, according to the speakers.
Paying for only what you use works in favour of removing capital spikes from your budget, Hodgson says. Sharing a facility means sharing some of the costs and, at least in theory, reduces them. The global financial crisis has added to the normal "do more with less" pressure from business on CIOs and IT managers, and is an important impetus for mounting interest in the cloud.
But just offering customers a slice of remotely accessed computing capacity or storage does not qualify as a cloud service, says Fonterra chief technology officer Andrew Wilshire.
"In the local market, we see every two-bit ISP standing up their cloud infrastructure and offering to sell us a bit of CPU time and some memory. That's missing the point as far as we're concerned. The service orientation of this is key, we're not interested in buying tin."
Some local providers are moving in the service direction, "but I'm not sure some of these second and third-tier providers necessarily have the maturity from an ITIL perspective or just in terms of relationship management for dealing with corporate or government sectors," says Wilshire. "I think there's a lot of aspiration, but nothing material on the market. We'll wait and see."
Fonterra is using a cloud model internally -- though Wilshire admits he still cringes when he uses the word. The company currently has 60 percent of its servers virtualised. "Our aspiration is to be 100 percent virtualised in the next two to three years," he says. "It's working out well. We're able to consolidate workflow that was previously disparate and we get much better asset utilisation across our server farm."
Fonterra also runs a few software-as-a-service applications from outside providers, concentrating on tasks that can be cleanly separated from internally-run applications.
These include travel management and recruitment services "and also an AT&T service to provide web access and filtered access for our users in North and South America.
"That saves us from having to deploy a complex, internet-facing infrastructure around the globe, which would be very difficult to manage. We just get the ISP to provide that, it's a lot simpler.
"In terms of line-of-business apps, we've got two big ones," says Wilshire. "A trade-promotions management system that lets us optimise spend in marketing at the supermarket level, and a transport management system that allows us to optimise our rail, sea, and road movements of goods (see "Points of difference" in CIO August/September 2009). "Those are two fairly hefty applications, but they're quite autonomous," says Wilshire. "There's not a lot of integration there, not a lot of traffic going back and forth to other applications [in-house]. They've been sweet spots for us in terms of SaaS."
Recently, the company considered the pros and cons of SaaS for customer relationship management. It seemed straightforward and autonomous enough at first, Wilshire says. But there are relationships with every application from IVR, to production and marketing systems. [There are] so many touch points, he says, that at any time operations could be "hamstrung" by a faulty linkage between in-house and outsourced systems.
Weighing benefits and risks
The integration problem loomed large in two global customer surveys conducted by Unisys in June and September this year. Customers were asked what stops them from using cloud computing. By far the greatest concern is security, named as the top issue by 72 percent of respondents. In the later survey, on a different sample, that figure was 51 percent, but security and data-loss concerns still dominated.
The second-ranking concern in both surveys was integration. It is no trivial task, speakers agree, to integrate what you run in the cloud with the applications you still run in-house.
"What the survey results say overall is that the cloud is "not a silver bullet to major savings", says Hodgson. "It's hard work to get to there. There are definitely savings and opportunities within the cloud as it has been defined. They're not the same for every company, or for everyone.
"You can't be complacent with security issues. When you're putting things outside your control, then you've got to be asking some good questions [to potential providers]. Data protection and privacy is critical, particularly with government organisations but also for commercial enterprises."
In a country that has yet to mount a major cloud service onshore, going into the cloud raises the issue of sovereignty over data. "Where is my data going to reside? What are the operational rules around the datacentre? Is the provider ISO 20000 compliant?" These questions have to be answered so you know what level of trust to put in the provider and how to reflect that in your own operational environments, says Hodgson.
Critical questions
Tim Sheedy of Forrester introduced his presentation with three basic take-away points:
Firstly, he says, cloud computing will never be everything to everyone. "The cloud will be just another sourcing capability for your IT systems".
Secondly, cloud implementation should be looked at from a role perspective. People with different roles in the organisation will see different advantages and concerns, and there will be different factors that will change in the way each role operates.
"So you can see you need to bring in multidisciplinary teams to make these decisions. You will have to make changes across a lot of your organisation," Sheedy says.
Moreover, those changes will influence one another. "This is not something simple that you can do in one section and not have it impact the rest of the IT organisation."
His third point, however, is that the cloud will be a crucial element in the IT environment of the future. "By 2011 or earlier, for every IT decision you make, you should be asking 'should we be doing this in the cloud?' Or even 'why are we not running this in the cloud'?"
He says Forrester analyses the cloud into successive layers, where the technology and thinking shows different layers of maturity.
At the next level of complexity and maturity are application components as a service, linked to the in-house elements of the application by APIs. A map service is a basic example.
A complete development platform can be provided as a service, incorporating an applications server and cloud-based file, database and data object storage.
Forrester splits infrastructure as a service (IaaS) into two layers: virtual IaaS, comprising virtual servers, and disks and system management, typified by Amazon's Elastic Compute Cloud. Datacentre hosting provides another level of cloud; with physical infrastructure as a service.
Forrester has found cloud computing is an issue of growing importance for Australian and New Zealand organisations, with 22 percent ranking it a critical priority and a further 14 percent a high priority. "We expect these numbers to jump considerably when we do this survey again next year," says Sheedy.
The use of SaaS is showing particularly high growth. "About 55 percent of organisations are considering, implementing, piloting or increasing their use of SaaS in Australia and New Zealand. Last year that figure was 30 percent and the year before 15 percent," he says.
Asked for reasons for not using SaaS, respondents cited concerns that savings in total cost might not come about, the problem of network latency and concerns over application performance. About 27 percent cited lock-in to a current vendor.
Despite some evident total cost concerns, Sheedy argues cloud services have "a compelling value proposition over traditional sourcing".
What should you run in the cloud today? Sheedy lists such applications as employee portals, ERP, email, Web 2.0-style collaboration, testing, back-office transaction systems and disaster recovery.
The mention of ERP caused surprise in the audience. Clearly such a move deserves careful thought, says Sheedy, but the multi-year, in-house customisation that used to go on with ERP systems would no longer get past many boards.
There is little in ERP that makes your business any different from any other business, he says. "Sometimes this is about protecting us from ourselves and about cutting back the ridiculous amount of customisation we put these systems through."
Unisys kindly sponsored the CIO Insights Luncheon "Security in the Cloud" held in Auckland and Wellington.
Join the CIO New Zealand group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.