Introduction
Small businesses, like the wild cheetahs of the African savannah, must be agile in order to survive. If another animal moves in to capture the cheetah’s prey, the slightest deficiency in speed, mobility, or endurance can mean the difference between going to sleep hungry or enjoying the fruits of a successful hunt. The case is very much the same for small and medium-sized businesses, where even the slightest edge in a highly-competitive environment can mean the difference between steering the the course of a new market and becoming an also-ran, licking your wounds and struggling to keep the business afloat.
According to the IEEE, “cloud computing refers to a recent trend in IT that moves computing and data away from desktop and portable PCs into large data centers” (IEEE 2008). Essentially, the technology acknowledges that in most cases, individuals have increased access to high-speed data connections and further takes advantage of this availability by offloading computing needs to the excess capacity found in large data centers today. Not only does this allow small businesses to buy their IT needs as a subscription-based service, but it can allow some large corporations to sell their excess computing power to recover some of the added cost of their IT overhead.
The paper that follows is our perspective on the technology, marketplace, and hosting suitability that comprises the issue of cloud computing. Through experimentation and research, we have formulated a framework, which assesses the feasibility of using subscription cloud computing services in place of costly infrastructure investments for small and medium businesses.
A Brief Technology Overview
Cloud Computing is a networking architecture in which users make use of computing facilities across the Internet. These facilities are used on an on-demand basis, providing users with a cost commensurate with their usage. The architecture features rapid deployment, scalable resources, and a low barrier to entry.
Cloud Computing bears a resemblance to other networking technologies such as Client/Server, grid computing, Web 2.0, and Software as a Service (SaaS). Although similar these network possess unique characteristics that are adopted in cloud computing.
The client/server model separates the input collection and output presentation on a client system from the business logic on a server system. It usually employs proprietary record formats and non-standard protocols. Because of these proprietary elements, client/server systems generally stand alone. They might be extensible with proprietary Application Programming Interfaces, but they cannot attract the large population of add-on programmers who have little interest in learning another API that they’ll only use once. From a user perspective, these systems are interactive between the user and the system, but the user usually has no awareness of other users on the system.
Grid computing however has little to do with user interfaces. Its main contribution is to make the server infrastructure highly scalable. Public grids permit a very large accumulation of computing power, but are challenging to manage. Private grids are less challenging to manage because the entire grid, a single administrative domain is under the control of the owner, but it would be wildly expensive to try to match the scale of a public grid.
Web 2.0 also separates presentation from business logic but it does so with standards. In particular, standards such as HTML, CSS, and AJAX are used to create an interface that looks more like client/server application user interfaces, and less like web sites. Web 2.0 applications are usually characterized not only by their interactivity, but also by a high degree of user participation. That is, there is a large same-side network effect of one user’s contributions to a site enhancing the experience of other users.
Software as a Service is more of a economic model than a technology. It frees companies from having to license, maintain, and upgrade software on their own servers by providing that software on public systems connected to the Internet. The SaaS provider takes the burden of licensing, patching, and upgrading the software. This affords the client company the freedom to focus on their core business, and not investing large sums of money up front for expensive software, such as Enterprise Resource Management software. This can lower the barrier to entry for small businesses to use expensive software like SAP.
Similar to client/server, cloud computing processing is separated into presentation services and computing/database services on two planes: the services that cloud customers use in the cloud, and the management plane of the cloud itself. Like grid computing, cloud computing allows large job to be distributed to many servers, but with the appearance of a single system. A cloud, unlike a grid, is not required to support heterogeneous physical server hardware and operating software. Like Web 2.0, cloud computing makes heavy use of World Wide Web technologies. Similar to SaaS, cloud computing relieves the user from responsibilities for managing infrastructure.
One of the tenets of cloud computing is that data is stored, long-term, in the cloud, so it is not simply utility computing providing CPU cycles. Clouds utilize virtualization for both processors and storage. A matrix of features is provided that further clarifies the comparison of these seemingly similar technologies.
Some important differences between cloud computing and the other technologies are not really technical. Unlike public grids which are geographically dispersed to a great extent and utilize a variety of hardware and OS platforms, clouds are built with data centers of homogenous platforms, centralizing control and simplifying management (Buyya, Yeo and Venugo 2008). As a requirement of the utility computing aspect of clouds, provisioning of the virtual servers is necessarily dynamic. Perhaps the greatest difference between clouds and other solutions is the negotiated Service Level Agreement - which allows the customer to balance costs with the Quality of Service that is required of the cloud.
Market Overview
In its use, cloud computing has become a very generic term, which does not capture the wide range of services available, nor does it capture the various pricing models and markets for different cloud services. We suggest that cloud computing is actually a very diverse set of markets. Hence, the term “cloud computing” may refer to any number of markets for cloud storage, cloud application hosting, or some other platform in the cloud.
Amazon’s EC2, Google’s Application engine and Microsoft’s Azure, all offer cloud computing, though the output given to the user in terms of services and development opportunities, significantly differ (Baran 2008). This is where one could place strategy based clouds in place, each leveraging their own strengths, establishing a foothold in the market and eventually gaining market momentum to expand into other areas
Amazon’s EC2, allows a customer to use as much storage as desired at any given time. This is helpful in case of sudden spikes in traffic, which saves the customer extra unnecessary expenses. “Amazon EC2 charges the user for the time when the instance is alive, while Amazon S3 charges for any data transfer (both upload and download)” (Buyya, Yeo and Venugo 2008). This is especially helpful to new businesses, as it saves them a lot of money in infrastructure purchase and maintenance. Once these fledgling companies expand, they do bring in their own infrastructure, but may keep a foothold in the cloud to handle traffic spikes. Amazon is expanding its set of services into load balancing and automatic scaling in the future.
Microsoft’s Azure has brought about an interesting turn of events, since it was announced recently. The most important focus of this cloud is the .NET services offered. Also, the fact that companies may be able to effectively run tests on its own systems and the cloud, offers an unprecedented degree of interoperability. This would also allow for easier porting of .NET programs to the cloud.
Blogger Michael J Miller accurately synopsizes this. He says that as Amazon was early in the market it leveraged Internet standards and open source platforms to create a very flexible platform (Miller 2008). Comparably, Google leverages the work it has done with big databases and uses its internal development methods to create a powerful but more restrictive environment. And finally, Microsoft leverages its traditional strength with developers and the breadth of its tools to create a large array of services.
In the table below, we compare different services offered, the type of product, as well as the cost comparisons for the same:
We can see that the vendors providing clouds compete in services and products offered. Below, we have chalked out the differences between GoGrid and Amazon’s EC2 (ServePath LLC 2008).
GoGrid server costs are similar to Amazon’s, but they provide a different data transfer pricing model as compared to Amazon. A company which has more incoming hits but doesn’t have to provide the user dynamically with data may be better off going with GoGrid, but a company which has less incoming hits and provides more outgoing data may be better off with Amazon.
The market for cloud computing is immense, even at its infancy, the field spans various aspects of computing and spreads in many directions. This is exactly why Forester Research came out with a list of notable up-and-coming Cloud Computing vendors . Akamai, Amazon and Salesforce will be the most familiar to enterprise IT. According to Forester, Akamai offers application performance services that speed up apps for users of cloud services, while Amazon offers the Amazon Elastic Compute Service (EC2) and storage in the cloud (McLaughlin 2008). Salesforce is pushing hosted apps and what it calls Platform as a Service, to help developers create new software in the cloud. Newcomers in the market Terremark, Layered Technologies, XCalibre and startup Enki all operate behind the scenes in the hosting business that fuels and manages the cloud. A more detailed comparison has been given by John M Willis at his IT Management and Cloud Blog (Willis 2008).
Panda Security is interested in the cloud computing SaaS (software-as-a-service) model (Wilson 2008). They say that hundreds and thousands of malware are created every day. This is pushing up the size of antivirus signatures that a person has to download, as well as increasing the CPU usage of the particular antivirus software. Panda Security proposes to divide the data into sets, with the more important signatures being on the client side and the rest being on the cloud side. Also, with interrelated data being on one cloud server, it would be easier to form correlations as Clouds provide immense CPU power as well. In fact, Panda would like to switch to a 100% SaaS model.
Cloud computing appears to us as a strong, upcoming marketplace for services. The cloud service and solution set to be used, seems to be more dependent on the services a client needs, with regards to the business segment in which this client is involved. However, in the current scenario, the cloud vendors seem to be offering a little bit of everything, instead of focusing on specific customer needs. This is what needs to be resolved, as the vendors need to focus on their niche strengths and offerings, instead of offering a wide range of services.
Issues and Concerns
It is critical for organizations to understand the risks and tradeoffs with cloud-based services. Potential issues and concerns include disruptions in data flow and accessibility, security and access controls, and leveraged privacy of intellectual property housed on servers not solely owned by or dedicated to the company. Furthermore, all services provided through cloud computing require remote access, which suggests the need for secure communications between the client and the cloud service, in addition to internally on the cloud infrastructure, in order to protect sensitive data. Organizations should also consider legal measures to ensure its hosting company is adhering to their policies and standards of data protection and privacy. However, legal deterrents can only take a company’s ability to enforce such policies so far. When the administrative control of the infrastructure does not belong to an organization, how can that organization effect change ? What policies and procedures exist that can ensure a service model that meets the needs of the organization investing in the usage of cloud computing?
Liability Issues
Privacy and security are topics that govern the level of access and transparency necessary for a company to control unauthorized modification of data, deter distribution of sensitive data, and the handling of that data by third parties if necessary. Cloud computing implies some sort of trusted third party, the service provider, to subsidize infrastructure costs. Therefore, privacy and security are of interest for the sake of an organization’s responsibility to protect client information. Furthermore, if a breach or data leak occurs, who is liable? In the cloud computing landscape, the answer does not yet seem clear, and traditional models are difficult to fit to this new model of service.
Reliability Issues
The reliability of the cloud is a fundamental factor in deciding whether or not to use cloud services. Availability is a chief concern for many organizations; however, in this type of computing platform, perfection seems difficult to achieve. Small and Medium Businesses (SMBs) must consider the tradeoffs involved in not being able to fully control the data of their consumers or the uptime of the cloud. To what extent cloud computing providers are liable for their services is a question that will need to be addressed through Service Level Agreements or other metrics.
Liability and potential litigation is a growing concern of cloud computing providers, who function in a currently gray area. Unnecessary litigation would stifle innovation, as no technical system is infallible, and 100% uptimes and services simply cannot be guaranteed (Jaeger, Lin and Grimes 2008). Service disruptions are inevitable, but must be mitigated quickly to ensure mission critical data is accessible. This could be detrimental and could be a breach of the contractual agreement between the SMB and the cloud provider. The methodology to handle these situations is vague and could cause an SMB to make an uninformed decision about the usage of cloud computing. If the downtime interferes with the business continuity of the SMB then alternative means of infrastructure may need to be considered because service outages can drive customers to competitors (Jaeger, Lin and Grimes 2008).
Interestingly enough, applications hosted in the cloud interact with other applications in other cloud computing environments offered through different service providers. These services are connected and the medium of communication between these applications is transparent to the end user. SMBs must take this into account, as the operations happening in the backend cannot be audited through their internal security policy. This is orchestrated in such a fashion in which, “Clouds within clouds connecting service providers together on their back-ends. Meanwhile, on the front end, organizations are moving sensitive and regulated data into multiple cloud applications with little or no accounting of how security of and access to that data is carried out” (Radcliff 2008). This transfer of information requires cloud interoperability with other service providers and an integrity mechanism to ensure the data transferred is not modified. As stated by Treb Ryan of OpSource, “The one thing that’s most controllable for user organizations is in developing and enforcing policies. If some of that in-cloud data is risky then ensure that security controls are guaranteed by the primary service provider” (Radcliff 2008).
Risks in the Cloud Computing Solution
In Gartner’s report, “Assessing the Security Risks of Cloud Computing” they categorized major areas of concern for organizations interested in transitioning to a cloud computing environment. At the onset of making such a decision a SMB should differentiate security implications before choosing a cloud provider (Radcliff 2008). Recommended criteria include:
- Privileged user access
- Regulatory compliance
- Data location
- Data segregation
- Recovery
- Investigative support
- Long-term viability
All issues contribute to finding the right solution for the SMB. In doing so, they must understand how sensitive data is protected, and what access controls are enforced if necessary for the organization. They must determine what regulatory auditing will need to be done and how the service provider supports this action. Next, the organization must understand where their data will be housed and what leverage they have in determining the location. Being that the cloud computing environments house data in various locations, this can be vital in information recovery as distance is a factor in how quickly the organization can service their clientele. Another issue that has been overlooked is the fusion of information stored on shared servers. SMBs should be concerned with how their data will be sandboxed from other information on multi-purpose servers. This becomes an access and integrity issue if compromised. The service provider should ensure precautionary steps are taken to manage the information on the servers properly and in compliance with the notion that data must stay separated. Recovery of data should be within the contingency plan that states how often the file replication system will run and where this data will be stored. This is to the benefit of the SMB to understand how the disaster recovery plan will be constructed and implemented in the case that the primary cloud infrastructure has been destroyed. It is important that the data storage medium is accessible to the SMB in the case that a tragic event occurs.
Law Enforcement and Investigative Concerns
Furthermore, the cloud computing environment presents a grey area in relation to investigative support. Questions arise as to who is responsible for the disclosure of information in the event a subpoena is served? SMBs are obliged to relinquish information to law enforcement, but an issue arises when the data is not housed on the infrastructure of the organization. This could result in a more intricate subpoena that details what data is needed and in which data stores it resides. Alternatively, the cloud service provider may have to disclose the information stated in the subpoena without forewarning the information owner.
Lifetime Concerns
Lastly, a SMB should inquire about the longevity of the cloud provider and what happens to data in the event of a merger or acquisition. This is unlikely being that most cloud providers are well established organizations; however, as the market evolves and new entrants emerge this issue will become increasingly pertinent.
Summary of Risks, Issues, and Concerns
When the impacts of cloud computing are broken down into different components and addressed separately, under the regulatory implications, they may suggest it is easy to analyze the items of interest for different business areas. Cloud computing issues are contingent on the sensitivity of the data being stored and the availability needs of the organization seeking to use the cloud computing environment. With this in mind a SMB will able to store data sets that are conducive to the cloud computing services offered or opt to invest in the necessary infrastructure. With the latter being less of an option, service providers have customizable services that better suit the organizations looking to adopt the new cloud computing environment. Security issues exist as they do with any other technological feat; however, the onus is on the SMB to adequately assess their computing needs and leverage that against the challenges that cloud computing potentially poses. This analysis should be a subset of the risk management assessment in order to gauge cost benefit of such a transition.
Conclusion
In lieu of the information we have presented in this paper, a business decision maker must still decide if the cloud is suitable for meeting their company needs. Since we recognize that a wide range of issues have been presented here, we have attempted to simplify the decision-making process with the matrices attached in Appendix A and B. Appendix A shows a matrix that compares the various features of network application technologies with one another. This provides a reference point where we can visually compare, in a simple form, the features of cloud computing to the features of peer technologies. As you can see, cloud computing does provide a diverse feature set to support business needs, but this is not enough to say for certain that any given application can live in the cloud. This is where Appendix B comes in. This matrix is designed to take the suitability of individual applications and their features, and describe their suitability in the cloud computing environment.
To close, we have found that despite clear concerns in the areas of privacy and security, cloud computing does seem to provide a sufficiently flexible architecture to support a wide range of applications and services that seem well suited to organizations that are unwilling or unable to invest in proprietary infrastructure. The costs associated with cloud computing scale in a relative stable fashion, making business expansion possible over time without having to make major adjustments in billing, application interface, or any other critical components. We conclude that cloud computing is indeed more than just a trend in the industry, and something that warrants a serious look from interested parties.
[ PDF Version ]