Cloud landscape : benefits, challenges and management strategies

(1)

Cloud Landscape: Benefits, Challenges and

Management Strategies

by

Harish Doddala

M. Tech in Information Technology

International Institute of Information Technology, India B.E. in Electronics and Communication

Visvesvaraya Technological University, India

Submitted to the System Design and Management Program in partial

fulfillment of the requirements for the degree of

Master of Science In Engineering and Management

AOk

VEW

at the MASSACHUSETtS -4fl EI .

OF TECHNOLOGY

Massachusetts Institute of Technology

JUN

2 6 2014

May 2013

I A

_LIBRARIES

The author hereby grants to MIT permission to reproduce and to distribute publicly paper and electronic copies of this thesis document in whole or in part in any medium now known or hereafter

created.

Signature redacted

Signature of Author:

Harish Doddala

System Design and Management Program

May, 2013

Signature redacted

Certified by:

Jeanne W. Ross

Director and Principal Research Scientist

MIT Center for In mati s Research

Approved by:

Signature redacted

Patrick Hale

Director

(2)

This thesis is dedicated to my parents

My mother, late M. Padma (1957-2011), the greatest influence on my life! She not only

raised and nurtured me but also taxed herself dearly over the years for my education and personal development. She met her demise about a year before I left to MIT.

&

My father, D. Punyakoti, who has been a source of motivation, strength and continued intellectual development

(3)

Acknowledgements

This thesis marks the completion of a remarkable journey that I undertook at the MIT Center for Information Systems Research (CISR). The journey was enjoyable and memorable.

Thank you to my advisor, Dr. Jeanne Ross, for taking time out of her busy schedule to accommodate frequent meetings and updates. Her invaluable comments,

feedback and pointers helped shape the thesis into its current form. She was patient, supportive and an excellent advisor to work with.

Thank you to Dr. John Mooney, Department Chair, Strategy and Information Systems and Entrepreneurship at Pepperdine University and Research Affiliate at MIT CISR, for his coaching and insight and all the intellectual discussions we had.

Thank you to Dr. Pat Hale for his amazing support and flexibility throughout the program. Also, thanks to Kate Moloney, for all the scheduling and administrative help.

Finally, thank you to my wife Deepali and my family for tolerating my late hours and cheerleading my efforts all the way. I share your sense of relief now that it's over!

(4)

Executive Summary

The benefits of Cloud are quite well known and many companies are trying to harness its potential. They are doing so to increase productivity, deploy newer applications fast, reduce upfront costs and optimize resource utilization. However, some companies are still trying to realize its full potential while dealing with technical challenges such as legacy systems, complexities of integration and other operational implications.

The goal of this thesis is to identify the top benefits that companies are gaining through Cloud adoption and the main challenges they are facing in light of this transition. Much has already been written and discussed about these issues in literature. This thesis attempts to seek answers by directly reaching out to top executives of companies to gain real insights and understand the management strategies and best practices that are enabling this transition. By comparing reviewed literature and information gathered through interview analyses, this thesis brings clarity to areas of overlap and the major issues in Cloud computing that were not emphasized or as clearly evident in the literature.

Based on the findings, key recommendations are made to help companies effectively transition into the Cloud.

(5)

1. Introduction

Cloud can be defined1 based on how the technology is currently utilized and

delivered. As Infrastructure as a Service (IaaS), the Cloud obviates the need for data centers providing databases, networks, servers and other computing hardware.

Billing is typically pay as you go, depending on the amount of resources consumed. As Platform as a Service (PaaS), it provides applications and services that can essentially be built, tested and delivered without software downloads and installations. The entire development environment is available to develop the

applications. As Software as a Service (SaaS), it eliminates the need to install and run the application on one's own system. SaaS also enables upfront reduction of costs of software purchasing, maintenance and upgrades. In summary, Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage,

applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.

More users are renting computing infrastructure from a utility provider instead of maintaining their own hardware.2 In the early days, users of electricity used to generate their own power, much like how most software users also own the

hardware that runs the software. Some of the economies of scale and cost savings of Cloud computing are akin to those in electricity generation. Nicholas Carr, an

independent blogger in his book, The Big Switch, claims that:

"At a purely economic level, the similarities between electricity and information technology are even more striking. Both are what economists call general-purpose technologies. (GPTs). GPTs are best thought of not as discrete tools but as platforms on which many different tools, or applications, can be constructed. Once it becomes possible to provide the technology centrally, large-scale utility suppliers arise to displace the private providers. It may take decadesfor

companies to abandon their proprietary supply operations and all the investment they represent. But in the end the savings offered by utilities become too compelling to resist, evenfor the largest enterprises. The grid wins."3

1 The NIST Definition of Cloud Computing, National Institute of Science and Technology. 24 July 2011.

2 Cloud Computing and electricity: Beyond the Utility Model, Erik Brynjolfsson, Paul Hoffman and John Jordan

(7)

1.1 Motivation

The benefits of Cloud are well known and users have begun to harness the potential of Cloud across a wide range of industries. A number of companies are using Cloud services to reduce the time to deploy new applications and augment existing systems. MIT CISR research4 claims that a significant shift to Cloud computing is inevitable.

Although some companies are quite advanced in their adoption and utilization of Cloud computing, some of them are still learning the ropes on how to fully realize its potential. Technical challenges, economic factors, existence of legacy, user

provisioning, and platform complexities and concerns of security are some of the major drivers of this skepticism. Cloud adoption does not come without its challenges. Some organizations that may be aware of its benefits aren't fully

prepared for Cloud's operational implications. Businesses think they can buy Cloud services and meet all the IT requirements, resulting in governance and management challenges within the organization. Furthermore, it has become conventional

wisdom that Cloud computing can save money.

1.2 Research Questions & Approach

With the above motivation, this thesis attempts to answer two main questions: 1. What are the key benefits and challenges of moving to cloud?

2. What are key management strategies and best practices that would allow

enable these companies to transition to the cloud?

The thesis is primarily based on interviews with over 40 Fortune 500 company executives, most of who were Chief Information Officers (CIOs) of the companies. The questions posed to these executives were articulated by the MIT Center for

Information Systems Research4 (CISR) staff and myself. Further details of the analysis are discussed in Section 3, "Analysis of Findings."

1.3 Thesis Structure

While there are many benefits and challenges companies are facing in light of Cloud adoption, this thesis will focus on what I believe are the most important ones, which are enumerated in the following section. For these benefits/challenges, this thesis discusses and introduces prevailing wisdom through literature review and results of interviews/analysis to highlight key issues.

(8)

The outline is as follows:

* The thesis begins by describing the motivation for this topic and the scope of the research in the current section.

* Then it attempts to delve a little deeper into the details of the literature review to highlight some of the prevailing knowledge in the area. Literature from academic journals, market research reports, blogs and other sources are consolidated and presented in Section 2.

* These findings are then analyzed and mapped to some of my own research in the area. This analysis is correlated to earlier findings in the literature in Section 3.

e The thesis then concludes by presenting a summary of the research with

some recommendations and best practices.

Literature Review

Figure 1:Outline of the Thesis

1.4 Key Findings

From Literature Review

-Researching and reviewing existing literature, the following key benefits of Cloud were identified

(9)

* Resource Utilization * Virtualization

* Total Cost of Ownership * Risk Reduction

The benefits are highlighted as Blue Ovals in Figure 2: Benefits, Challenges, and Path to Cloud Agility and Time to Marks Resource Utilization IT ChaIlenges Total Cost of Ownership Cost Assessment

Security and Identity Management

'Utilization) Risk Reduction

Figure Z: Benetits, Challenges, and Path to Cloud

Some of the challenges companies are facing, highlighted in the center in the above figure, are as follows:

* IT Challenges

* Cost Assessment and

* Security and Identity Challenges

Companies are coping with these changes by having IT to support them and driving adoption through more mature operational IT models (such as the Public/Private Cloud).

(10)

From Analysis of Interviews with Company Executives

-* Faster time to market - Economic Benefits of Cloud - Ease of Governance and

" Improved Provisioning of Resources

"Re-architecting Platforms and dealing with Legacy - Vendor Management and

"Security

K

Transitioning with Pilots -Virtualization

+ Hybrid Cloud Solutions

* Changing Role of IT

- IT and Business engagement strategy

Figure 3: Results of Analysis: Benefits, Challenges, Management Practices

The key benefits and challenges that seemed to resonate among the companies that

were analyzed are as shown in Figure 3: Results of Analysis: Benefits, Challenges, Management Practices. The management practices adopted by companies to address these

challenges and arrive at the benefits they intended to receive are listed in Figure 3. The key findings are explained in greater detail in Section 3.

There seemed to be quite a bit of overlap in the benefits and challenges that companies realized as a result of Cloud adoption between the literature that was reviewed and my own analysis of the interviews with company executives. These are explained at length in Section 3.

(11)

2. Literature Review

The following section addresses some of the benefits and issues of Cloud computing perceived to have been received by companies. Given that the journey to Cloud is inevitable for most companies, the major transitional issues and acquired benefits are looked at more closely. This acquired wisdom is then correlated with some of my own research, which was done by way of conducting interviews and also analyzing available transcripts and interviews of companies at the Center for Information Systems and Research (CISR) at MIT Sloan.

2.1 The Benefits/Value of Cloud Computing

Many companies are getting interested in Cloud computing. Some have already begun to realize its benefits while others are starting to do so gradually. The Cloud within an enterprise (internal Cloud) is beginning to provide increased

computational effectiveness at lower costs. It is not just the startups but large companies, R&D and government systems that are also moving to this platform.5

According to a McKinsey study 11 _{on Cloud adoption, more than 80 percent of IT}

respondents say their companies are using or experimenting with Cloud technology. Some 63 percent say their companies are using Cloud-based applications in some aspect of day-to-day operations, and over the next 12 to 18 months, deployment and piloting is expected to increase across all application types explored in the survey (Figure 4: Adopting the Cloud).

Technology shifts, improved virtualization capabilities and rapid provisioning of services have enabled companies to look closely at their business needs and IT enablement strategies. Virtualization allows different operating systems to be hosted on the same physical hardware. Companies can meet required needs with existing hardware in their datacenter, thus reducing the cost of management of these datacenters. Provisioning is essentially the way machines are made usable through a single server or a pool of available servers. Using APIs (Application Program Interface), the existing services are being able to interact with services over the Internet across multiple devices.

(12)

% of respondents, n = 469 I Piloting

I Deployed at some level

What is your company's current level of cloud deployment for each of the following applications? What do you expect it to be in 18 months?

Collaboration

II

Current In 18 months

Data access, analysis, and delivery II Current in 18 months Customer relationship management (CRM) Current In 18 months Office productivity-applications I Current I In 18 months Finance or human-resources systems

ii

Current in 18 months Supply chain management or enterprise resource planning 1i Current In 18 months

11' Respondents who selected "none" and "don't know" are not shown. Figure 4: Adopting the Cloud

The following sub-sections summarize the value that is being extracted through such a transition and the reason behind Cloud adoption.

The top five benefits of Cloud adoption are

e Virtualization

* Total Cost of ownership * Resource Utilization

* Risk Reduction as a result of Cloud Adoption * Agility and Time to Market

2.1.1 Virtualization

Virtualization is the process of imitating a resource to support different operating environments. The resource may be in the form of memory or software.

Virtualization has been the key to companies maximizing utilization of their data centers. According to Gartner6 _{utilization rates in a non-virtualized datacenter can} 6 Gartner Research -_{Gartner Interviews Ian Pratt, Virtualization Visionary}

(13)

be as low as 20% to 30% at times. This is because an application running on a given hardware configuration may not utilize all of the resources of the hardware. Also, the application may not need to be up and running all the time. The advantages are summarized below

- Fewer or no physical servers in the data center lead to reduced power and cooling costs, not to mention savings on server hardware and related maintenance over time.

e Application, backup, and disaster recovery testing is now completed in a

fraction of the time it takes with purely physical servers.

e The ability to transfer the location of virtual machines between different

physical machines enables more users to use the same hardware.

2.1.2 Total Cost of Ownership

When comparing costs between on-premise options and Cloud Computing, it is important to accurately assess the true costs of both options. With Cloud, most costs are not upfront. The pricing is based on usage of servers, network, software, real estate, time, etc. This is in contrast with direct costs companies incur due to on-premise technology such as server, floor-space, IT operations and management of resources and indirect costs of running a server such as network, storage

infrastructure, etc.7 Cost of ownership is particularly of interest to small businesses that may simply not be able to afford a security specialist or extra hardware that could take care of securing their infrastructure. Large companies also use Cloud to meet unpredictable demand spikes and achieve cost optimality.

2.1.3 Resource Utilization

Resources can be classified into storage, computing services and software applications. Aggregate demand is smoother than individual demand since

aggregating demand from multiple customers tends to smooth out variation. This is how Cloud gets higher utilization. Companies, in order to efficiently utilize the resources, engage in IT and businesses for new initiatives. IT provides security, compliance information and monitors traffic. Businesses focus on utilizing these resources to meet their requirements and increase revenue.

Companies focus on price, reliability, availability of service and support when

considering their resource acquisition strategy. For instance, some may choose their storage services from Amazon8, computing services from Google and software applications (such as CRM) from Salesforce.com.9 Sourcing decisions are thus based on dynamically changing workloads, priorities and costs. Furthermore, such

7 http://broadcast.rackspace.com/hosting-knowledge/whitepapers/Cloudonomics-TheEconomicsofCloudComputing.pdf

8 http://aws.amazon.com/ec2-sla/

(14)

companies are able to utilize its time on other important tasks and focus its energy on growing its business as opposed to worrying too much about resource

management issues.

2.1.4 Risk Reduction as a Result of Cloud Adoption

Cloud users have the advantage of testing out projects and abandoning them if necessary without having to spend millions of dollars for licenses, infrastructure and consultants. Thus there is no idle hardware/software cost involved since companies invest in resources depending on the outcome of these projects. This helps reduce upfront costs and risk of depreciation of under-utilized assets. Also, a professional Cloud services provider reduces the risks of less mature companies-those that have issues with breakdowns or security breaches.

2.1.5 Agility and Time to Market

Reducing costs has been traditionally recognized as the major advantage to increase business efficiency. However, the real reason more businesses are migrating

applications and data to the Cloud is for enhanced agility in the face of a fluctuating market and changing demands. Cloud enhances decision-making and provides greater control over data. Software upgrades are much more frequent on the Cloud and companies don't have to waste too much time waiting for upgrades and newer versions of the software. Traditional software vendors may release updated

versions of its CRM software once a year while newer Cloud providers deliver updates every quarter. Many firms are using the Cloud to extend the data center and add or remove capacity as needed. Thus, the real value lies in the ability to adapt to constantly evolving business environment, market and client expectations. By leveraging the Cloud for this capability, companies are able to reduce

unnecessary investments and better allocate spending to drive innovation. Thus agility is becoming an important driver for businesses to opt for Cloud services..10 17

2.2 The Issues/Hurdles of transitioning into the Cloud

IT organizations are having to secure, manage and govern both what is in their environments, as well as external Cloud services such as those that have been acquired without IT's involvement. They need to deal with developing new

applications based on user needs and requirements, integrate and deliver them in time for deployment. Some of these applications are internally managed while some are outsourced. (Or being outsourced). Managing this internal/external, Cloud/non-Cloud environment poses significant challenges. Users continue to clamor for the speed, agility, flexibility, more choices and the perceived cost savings that Cloud

(15)

computing promises.

A McKinsey study" highlights some of the barriers to Cloud adoption in Figure 5: Barriers to Cloud Computing. Security and business continuity risks and managing a regulatory environment are the top issues on IT's agenda. This is consistent across many Cloud adopters who feel that in such an outsourced environment, checks and balances need to be enforced to mitigate risks. Non-IT executives on the other hand are most concerned about a lack of organizational awareness, a barrier that ranks higher than security concerns. These non-IT folks are primarily businesses that buy Cloud systems to meet immediate needs and are not fully aware of the

accompanying risks.

% of respondents Rank the toP 3 barriers, if any, your company has overcome or stillfaces in

realizing value from the cloud.

IT executives, Non-IT executives,

n = 462 n =264

Evaluating and managing security or business continuity risks 25 14

Managing regulatory risks or exposure 14 11

Developing a compelling business case for using cloud systems 12 14

Adapting existing business processes to cloud systems 11 12

Addressing issues with migration or interoperability with our _M 10 08 company's current systems or data architecture

Lack of awareness or interest in cloud systems in our company 10 21

Adjusting technology governance processes for cloud systems 9

*4

(eg, policies for control, monitoring)

Developing the right set of skills to build, manage, and _, ₇ ₁₃

support cloud systems

Figure 5: Barriers to Cloud Computing

The main issues companies are facing in light of transitioning into the Cloud are * IT Challenges

* Cost Assessment and

* Security and Identity management

These issues are discussed in detail in the following sections.

2.2.1 IT Challenges

This is not so much a hurdle as it is a challenge. A Cloud transition is made possible as a result of combining internal and external services in support of the business

11 How IT is managing new demands: McKinsey Global Survey results

(16)

outcomes. Interest from large enterprises has been tempered by adoption risks, leading to architectures that connect internal core services and critical data to external, commoditized services. Because of this new IT delivery model, the role of IT and its practitioners is undergoing significant change. Businesses buy Cloud services assuming they meet all the IT requirements. Sometimes these services don't meet the operational or security requirements. Regardless of whether they are on-premise or on the Cloud, these requirements don't change.

Departments, work groups, and individuals often take advantage of low-cost, easy-to-buy public-Cloud services-even when corporate policies say they should not. IT organizations that do not match the request for IT as a service run the risk of internal customers bypassing the IT organization and consuming IT services from the external Cloud, thereby placing the company at greater risk. The IT

responsibilities are to keep the business users from going off and buying services to meet immediate requirements. The complex relationship between the CIO and other executives within an organization is shown in Figure 6: Cloud Attitudes stress the CIO-Business Relationship.

CFOs are primarily interested in shifting the costs from capex to opex due to the perceived low price point of Cloud. Business leaders, who are fueling Cloud

adoption, view Cloud as a means of engaging with the customers better and faster. Cloud provides resources to the developers faster. Application development

managers try to balance leveraging Cloud with internal processes, integration and architectural challenges. Sourcing vendors deal with the risks associated with Cloud services in terms of meeting the company's requirements. Security professionals

(CISOs) worry about security breaches and sensitive data/process handling in such an environment.

(17)

neiymy n A rr 5% cio 11% 1UW WW#I, UW Uwi

something crucial outages and data

like infrastructure security are too

sounds nightmarish." important to

overlook.'

Cloudspresents

entirely new security

and compliance issues as well as

simply less control

over our data. it's

too rsky.

OR n use _&

nterested _{"How are we suppose to}

support cloud services when we can't get the

some SL As?"

60833 Source: Forrester Research, Inc.

Figure 6: Cloud Attitudes stress the CIO-Business Relationship

2.2.2 Cost Assessment

When trying to assess whether to transition to Cloud, it is important to understand

the economics of Cloud and what really drives profits and savings. Cloud computing can potentially save money and there is some rationale behind the cost advantage of

Cloud computing compared to in-house, always-on enterprise data centers. Joe Weinman, an HP executive who has been independently analyzing the economics of

Cloud computing services for the past several years, believes that unit costs aren't always what make public Clouds cheaper and what matters most is the resource

(18)

consumption pattern of the workload.12 Pay-per-user sort of models does not show significant benefits all of the times. The key is in understanding how the applications placed in the Cloud align with the economics of the various Cloud services out there today.

Forrester enumerates some of these scenarios as follows 13

e Low costs per employee add up as more people use it: Per employee pricing

looks attractive if for instance there are few sales employees in a CRM scenario. However, the costs tend to mount if the number of employees using it increases by the 100s per month.

e Low per-hour costs often mask high ongoing consumption costs: 8 Cents per

virtual server may be an extremely cost effective value proposition. However, additional costs for bandwidth, consumption, storage, load balancing, security,

monitoring or caching needs to be looked into in combination with just renting out the server. These costs further escalate due to additional services such as

spam filtering, database and middleware services. Total costs are sensitive to

how much actual time the service is used for.

* Using the Cloud also incurs operational costs: Managing, securing, monitoring,

and backing up and recovering Cloud deployments sum up to additional operational expenses. These management functions/responsibilities between

vendors and businesses are summarized in Figure 7: Operational Costs are an uneven handshake

-Physical support of infrastructure .Your application

(facilities, rack space, power, -Architectural views (e.g., scalability, availability, cooling, cabling, etc.) recovery, data quality, and security)

-Abstracted services (SaaS -Governance (who has authority/responsibility to application, hosted framework, make changes and how)

hypervisor, virtual firewall, etc.) -Life-cycle management (birth, growth, failure, and

-Physical infrastructure security recovery)

and availability (servers, storage, -Enterprise integration (identity management,

network bandwidth, etc.) access control, etc.)

" Basic monitoring -Testing, monitoring, diagnosis, and verification

-Element management -Network of metadata (categories, capabilities, configurations, and dependencies)

Figure 7: Operational costs are an uneven handshake

12 Joe Weinman, "Overview of Cloudonomics," Cloudonomics.com, April 25, 2011 (http://cloudonomics.com/)

(19)

Furthermore, nearly a third of enterprises remain skeptical about IaaS Clouds because they feel that their existing internal infrastructure costs are already cheaper than what they can find in the Cloud. About 31% of the companies believe that they could achieve some form of cost savings in a pay-per usage model. (See Figure 8)

"What are your firm's concerns, If any, with pay-per-use hosting of virtual servers?"

Enterprise (1,000 or more employees) Security concerns about security/privacy issues

in virtualization or cloud environments Too immature Specific compliance requirements that the service providers can't meet We believe our total costs are cheaper Vendor lock in that makes it difficult to leave the service provider Service levels are insufficient or non-existent Software licensing issues Our application vendor or custom apps aren't compatible or won't support it The offering capabilities don't match our needs The performance isn't good enough

Other reason 5%

None 5%

Too difficult to understand

39% 38%

IllhiI31%

30% 28% 26% 23% 20% 19% 4% Don't know 2%

Base: 1,047 IT hardware decision-makers at companies with 1,000 or more employees Source: Forrsights Hardware Survey, Q3 2011

61608

Figure 8

Source: Forrester Research, Inc.

2.2.3 Security and Identity Challenges

Organizations are cautious about exposing their sensitive data in the public Cloud. Internal Clouds too have virtualization security issues similar to those of public Clouds. Boundaries of trust change as applications move from internal networks and data centers to untrusted zones in the public Cloud. Sensitive data may be encrypted before it is stored in the public Cloud, or it may be masked to protect confidentiality. Gartner claims that security of sensitive data in the Cloud is the No. 1 issue for Cloud adoption.14 _{Although public Cloud service providers are improving security}

practices and features, the market ecosystem remains immature. Furthermore,

14 Hybrid IT - _{the combination of internal and external cloud-based services is transforming IT} architectures and the role of IT, Gartner 2012

(20)

many enterprises would hesitate to move their data outside the firewall due to the nature of the data or the nature of their business.

Identity management in such a diverse and heterogeneous environment is difficult. New technologies, services and architectures are slowly emerging in response to security challenges.

The security issues in Cloud adoption15 are summarized below:

e Data protection: Services provided by Cloud providers such as email, messaging,

payroll, accounts and finance, CRM, sales management, etc include sensitive data being processed. This data may belong to a number of persons (data subjects), e.g., employees, clients, suppliers, patients and, more generally, business partners and will need to be protected.

e Confidentiality: Any leakage of information caused by voluntary communication

by the Cloud Provider or Clouds' security breach may jeopardise customer business/services.

* Intellectual property: A breach of Intellectual Property rights from the Cloud provider can potentially cause immediate damage to the customer, which may never be fully restored in a legal proceeding.

* Professional negligence: Inability to access critical internal functions such as email, messaging, desktops, project management, and payroll services, may lead to customer liability to its employees. (Or its customers)

15 Cloud Computing -Benefits, risks and recommendation for information security. Daniele Cattedu and Giles Hobben, European Network and Information Security Agency 2009.

(21)

2.3 Path to Transitioning into the Cloud

Moving into a more managed environment has many advantages as summarized in Section 2.1. However, the adoption of Cloud poses many challenges too, as pointed out in Section 2.2. How then can a company overcome these challenges? Does it make strategic and business sense then for companies to transition into the Cloud?

Even after companies have embraced Cloud, how can they effectively utilize its potential? The following section seeks to address some of these issues. The

information that follows, like the previous two sections, draws from existing literature.

Once the IT organization has reached a high level of maturity in the Cloud, it has to determine how it can integrate its overall IT strategy. Each application can be looked at to determine its optimal deployment based on its technical, economic, security and performance characteristics. Furthermore, new service requests and application deployments could go through a common checklist to determine the right deployment type. The paths of maturity leading to an optimal fifth stage are shown below:1 7

t

Private cloud Parallel, autonomous paths 0 rDt

Private cloud path Public cloud path

2.3.1 Changing Role of the IT

So what role can IT play in this transition? How can it effectively ensure Cloud enablement and service delivery? Gartner1 6 _{feels that the IT organization needs to}

16 Hybrid IT - _{the combination of internal and external cloud-based services is transforming IT} architectures and the role of IT, Gartner 2012

(22)

become more business-focused and broaden their knowledge and skills. Solving

system issues - and creating new system opportunities - requires a knowledge

set that spans technology domains (network, processor, storage, system software, applications software and user interface design). The traditional role of the IT professional in an enterprise is changing and becoming multifaceted.

Cloud adoption will also require internal and external IT professionals to support the business capabilities of the enterprise. Infrastructure and operations may have to learn new skills such as multi-sourcing and procurement. The workforce may need to get a better understanding of the business so they can understand what it is trying to accomplish. Perhaps partnering business units with IT more closely would help IT understand and manage business expectations.

IT needs to have a good working knowledge of the Cloud services. If the team is knowledgeable and relatively more experienced, they will have more credibility in the discussions with businesses. IT can also share this knowledge with other team members so everyone knows what's going on in this space. Over the long term, the shifting nature of IT will result in management and organizational process changes that catch up to the increasing power of individuals. Due to the growing needs of the business, most enterprises find it necessary to include both private and public Cloud services. These services jointly in essence are what really affect the transition and adoption strategies of companies in moving into the Cloud. Each provides different values and capabilities. Adoption of public and private Cloud depends on the

company's business objective. Smaller organizations that lack significant internal IT investments or data centers may have a higher level of Cloud adoption and public Cloud services relative to larger enterprises with mature operational IT models. IT has to interact with the vendors and share the responsibilities in order to be able to ensure the effective and timely delivery of services. Forrester summaries this balanced nature of shared responsibilities in Figure 9.

(23)

Figure 9

There may be some overlap in the benefits of both the public and the private Cloud but they may pose significant operational challenges in integrating the internal and external services. So how can the organization's readiness really be determined to adopt the private or the public Cloud? What are the underlying characteristics that influence adoption of such strategies? The following section addresses these issues

-2.3.2 Moving to Private Cloud

Before delving into the strategic implications and the readiness for adoption, it is important to first define what one means by the private Cloud.

Private Cloud is a virtualized environment that is dedicated to an IT organization and deployed within the organization's data center.' In order to deliver core values of any Cloud service, organizations should have high degrees of standardization, automation of operational tasks, self service deployment etc. Furthermore, private Clouds may help enterprises gain IT cost and agility benefits without losing control of sensitive data. Securing the internal Cloud requires advanced virtual security infrastructure and attention to securing the Cloud OS orchestrator function.

(24)

Forrester'7 _{identifies four phases for maturity in an organization}

1. Acclimation - Organizations first familiarize themselves with the tools available to virtualize and assess the degree of consolidation that can be achieved as a result of this migration.

2. Strategic consolidation - The tasks that can be virtualized or not are then consolidated.

3. Process improvement - IT can standardize operational procedures at this stage and automate them so they can then start managing the pool of resources.

4. Private Cloud - After having achieved this level of maturity, IT can start driving up speed and efficiency and have users request and deploy resources on their own.

The public Cloud is discussed in a little of detail in the following section.

2.3.3 Moving to Public Cloud

Public Cloud entails different challenges compared to private Cloud. In private Cloud, the readiness of the IT organization depends on its own infrastructure. Public Cloud strategy focuses more on procurement, management and supplementation. The four stages of maturity for the public Cloud are summarized below17

1. Getting started - The IT organization can start by developing an

understanding of how Cloud services fit into the organization and what protection the services provide.

2. Engaging more actively - Having determined the high level needs, the organization can then engage business for Cloud service consumption. The key here is to establish necessary security and management needs for applications and services that require it.

3. Operationalizing the Cloud - At this stage, IT is required to manage Cloud services as well as they do internal services.

4. Efficiency - The IT organization can then drive up efficiency once it has a good handle on the operational aspects.

In the public Cloud, security is an important concern to leverage Cloud services. The sourcing and vendor management teams are also required to develop a multi-sourcing strategy and competence. Security, performance and availability concerns will need to be addressed while also managing new Cloud services as they are added to the existing portfolio. Most companies will have to deal with a hybrid

environment in the future. Internal legacy systems will have to be combined with external capabilities.

(25)

2.3.4 Summary:

The literature review offered a lot of interesting thoughts on the current state of Cloud Computing and the issues companies are facing. Cost was not really seen as a single most important reason for Cloud adoption. Security and Identity management still posed many risks for organizations that were hesitating to move their data outside their firewalls. The lack of proper SLAs and mutual understanding between IT and businesses also posed significant governance challenges. But, the incentives to transition to Cloud were overwhelming. The ease and optimal use of resources resulted in significant cost and management advantages. Some organizations have already started to reap the benefits by carefully architecting their technical

platforms to respond to business challenges while others are still in a state of transition.

In conclusion, the company's vision and key capabilities define the choices around how the Cloud services can be delivered. Refusing to use Cloud capabilities is not a viable option for most institutions. The combination of improved agility and a lower IT cost base is spurring large enterprises to launch concerted programs to use Cloud environments. The following chapter supplements the existing literature with some of my own research findings. The prevailing wisdom is compared with the specific issues company CIOs are facing to highlight what constitute the important benefits and issues companies have to deal with when transitioning into the Cloud.

(26)

3. Analysis of Findings

3.1 Research Methodology

Before proceeding to explain the research findings, a note on the research methodology followed in this study

-The study was carried out at the MIT Sloan Center for Information Systems and Research (CISR).

The process can be broken down into 3 stages.

1. During the initial stage of the research, about 40 fortune 500 companies were interviewed at CISR. The initial interviews, conducted by CISR faculty and staff, were transcribed and made available to me for further analysis. A senior

research affiliate at CISR and myself conducted 7 follow up interviews during November 2012 to January 2013. The follow-up interviews were conducted roughly a year after the initial interviews.

2. In the next stage of the research, the conversations were analyzed by myself under the guidance of the CISR staff through the lenses of the following criteria -* Business Case for Cloud adoption - What are the business benefits

companies have been seeing in moving to the Cloud? Do the benefits translate to cost? Or are they driven by a time to market and ability to respond to business needs?

e Re-architecting Digitized platforms - How have companies been dealing with

some of the internal digital platforms and integration issues? What kind of re-architecting challenges do companies have to deal with in transitioning to the Cloud?

* IT Governance - How are companies dealing with the business-IT

relationship challenges in light of the new responsibilities Cloud adoption brings to the table?

e Reallocate IT budgets - What has been the economic value of transitioning to

the Cloud? What has been the magnitude of this shift?

- Rethink end-user requirements - How have companies handled the proliferation of tablets and mobile in meeting user requirements and business needs?

The above questions were articulated by CISR faculty and staff to pose to the company executives. My research, in discussions with the supervising staff, added the following questions to the list.

* Interesting Notes/Metrics - What have been some of the quantifiable benefits (if any) achieved as a result of Cloud adoption?

* Challenges - What have been some of the key challenges companies have been facing? How are they addressing them?

(27)

* Business Aspirations / Vision - What do companies aspire to do with Cloud moving forward? What is their vision for the future?

I divided these questions into cells and extracted the appropriate information from the transcripts inserting them into its respective column. A snapshot of the document is as shown:

WotW O" ffdWIVW,

3. In the final stage, which culminates to this section, I attempt to highlight the key benefits that seemed to resonate across most companies I analyzed. Then I list some of the key challenges and the methods that were adopted to address these

challenges. Finally, I highlight some of the key management practices based on

my learning.

Unless explicitly mentioned in quotes andfindings in the sections thatfollow, the references were primarily based on interviews that were already conducted by CISR

staff

As mentioned in the introduction section, there was quite a bit of overlap between the literature reviewed and my own findings in talking to company executives. The

key drivers of Cloud adoption such as agility and time to market, resource utilization

and cost savings from the literature review were reinforced in the transcripts

analyzed and the interviews conducted. However, there was relatively greater

emphasis on aspects surrounding IT governance and business and IT relationship management strategies in my analysis. Although the literature touched on these

aspects, the specific challenges companies were facing in light of the changing

governance structure were not prominent. Anecdotal evidence and real stories from

the interviews laid credence to some of the issues both businesses and IT were facing. The most important takeaways were the key management practices companies were adopting during transitioning into the Cloud.

(28)

3.2 Major Benefits

The major benefits of Cloud adoption are as follows: * Faster time to market

" Economic Benefits of Cloud

e Ease of Governance and

e Improved Provisioning of Resources

3.2.1 Faster Time to Market

Based on my research and as reinforced in the literature review, time to market emerged as one of the top reasons for Cloud adoption. The convergence of computing and connectivity has enabled businesses to evolve and move at an unprecedented rate to react to changing market. Organizations are building capabilities to adapt to a rapidly evolving landscape.

One CIO points out that moving to an on-demand (Cloud-based) financial

management and human capital management software vendor enabled them to implement services in under a month and a half for their entire IT organization. "Our

finance organizations get a shared service center, our information security group, our Telecom group have all since gone on board with it, all operating out of a single instance of it. So speed of implementation has also been really good", he comments.

Companies either choose to buy or build software based on the business

opportunities they are faced with and whatever makes sense from an economic, platform and governance standpoint.

A global pharma company with over $5 Billion in revenues believes in employing services to meet the growing demands of the company. An executive from the company explains that it may not always be useful to rely on internal folks for quick delivery of services. He says, "we sign upfor services to plug and play into our

processes and the deliverable is in place in six weeks. There's nothing we do internally." In moving to such a plug and play environment, the company doesn't

have to worry about identity management, Data Loss Protection (DLP) etc. Cloud providers help shrink time for delivery avoiding IT handle most of these tasks. He emphasizes that the primary goal of adopting a Cloud-based strategy has been business agility as opposed to just finding a cost-efficient provider to reduce costs.

"In redefining the value proposition for IT, switching from an efficiency perspective, driven by low cost into thinking about business enablement, specifically enablement of business agility has been a core value proposition", he claims.

Businesses achieve speed of implementation through buying off the shelf Cloud solutions that meet their needs. Things like time sheets, expenses and so on for example are just business needs that don't require any IT support. As one IT

(29)

executive from a large media corporation puts it, "It's really the convenience. It's

being able to meet more of our demands with less effort."

The strategy at an operational level that's kind of guiding companies towards Cloud have been around time to develop. A CIO of an American insurance company says

"The typical conversations these days are more about responding to a need and getting up our innovation platform and notfrom the standpoint of, look at how much money it saved us, it was, look at howfast we launched our innovation program. It's kind of like innovation within an innovation," he claims. Faster time to market

resonated among a lot of companies I researched as a top benefit driving them to adopt Cloud.

3.2.2 Economic Benefits of the Cloud

An important benefit of transitioning into Cloud is the economic value it generates. Cloud-based solutions free businesses from the need to invest in expensive

hardware and software or commit to costly service and maintenance packages. The resulting cost savings can be significant. Businesses can then invest the money saved in other crucial areas such as producing improved products and services, expanding to new markets and diversifying its operations.

Assessing the economic value of transitioning to the Cloud is thus an important issue. Companies do not necessarily find it cheaper to adopt Cloud than to make some of those investments as capital expenditures. In my analysis, most

interviewees noted that the costs per usage in moving to a more OPEX based Cloud type environment was OK as long as they could be justified against tangible business benefit they were producing.

A senior executive of an Electronics manufacturing company claims that his organization was able to avoid enormous capital expenditure of building or implementing and configuring software packages, by moving to an out-of-the-box configuration of SaaS models. He was able to bring the upfront capital costs from $11M to $13M annually down to $1.1M on HR and Payroll modules alone.

Companies are finding it easier and more beneficial to just deal with costs per usage as opposed to upfront capital expenditures.

As the Director of Enterprise Architecture of on organization with over 80,000 employees explains that price can actually be a very tricky thing. Cloud may appear to be cheaper than internal hosting but when you drill into it and estimate the

overall cost of storage, database licenses, backup functionality, the cost of data going across the network to the data center etc, the costs actually shoot up. For a large organization operating big data centers of the order of 5 to 10 thousands, the costs is comparable to hosting them in house. This message on the direct relationship between Opex/Capex and costs needs to be communicated across the organization. As for running servers 24 x 7, he claims that they can be turned off or on as the need

(30)

arises by writing scripts and thus optimize using existing resources thus achieving a substantial impact on the cost.

A scenario where Cloud achieves huge cost savings, or when Opex makes sense, is when there are spurts of demand to be met in a deterministic setting. As pointed out in the literature review, companies can determine those applications and services, which are elastic or transient, web pages for promotion or applications supporting seasonal activities for example. A major sponsor of the 2012 Olympics foreseeing massive number of hits to the websites in the run-up and during the games itself used Cloud to meet this demand. Instead of investing heavily on hundreds and potentially thousands of servers for a short period of time, the company managed to just rent them out.

Every IT investment was a long-term investment traditionally. If it wasn't a capital expense that had to be amortized over three to five years, it was an operating expense negotiated into a three- to five-year term to get the best discount. Cloud may thus seem attractive because of its price point. However, companies are also looking for where they can grow in an increasingly flat market. Cloud needs to not only be looked at as a cost saver but also as a profit maker by identifying new

revenue streams. Companies are looking to either reach new markets, in new

services, in developed regions, which are already saturated or reach the next billion consumers, out in Brazil, Russia, India and China. In both cases, trying to find

additional services in developed markets or reach the consumer in developing markets, companies need the price points of the Cloud.

However, a senior executive of a pharma company points out that cost savings alone has not been the guiding principle in wanting to transition to Cloud. The decision was largely motivated by the agility the solutions provided to the company. There may not be any guarantee of an ROI benefit to Cloud-based solutions. In the end they may be as expensive.

3.2.3 Ease of Governance

Governance is different in a Cloud-based model. A lot of processes are outsourced and the IT department oversees its management by specifying service levels and requirements. The responsibilities are shifting from tactical to strategic and the scope is getting broader with IT dealing with commodity type services. A CIO of a

120,000 strong workforce explains, "You're looking at meta processes and making

sure the governance is on that level. Running an enterprise, how we're managing the shared services and what framework and tools we can provide clients that want to do their own, governance is at the center of that management."

By adopting such a model, IT is able to ease governance, meet business

requirements and make good decisions regarding performance. In order to achieve the agility the company needs, IT is becoming fairly resilient and adaptive to the changes. Furthermore, these benefits are further reinforced under good leadership.

(31)

The CIO of a large personal care products company was managing a team that was tasked with managing facilities, workloads, data and software, and network

infrastructure. He was able to deliver more business with significant savings in costs by instituting simplicity and standardization into systems and technology. These savings were in turn invested on new product development and improving products and services. His team was able to effectively establish organizational relationships, understand business issues and monitor these processes better leading to effective governance.

3.2.4 Improved Provisioning of Resources and Reduced Complexity The benefits of Cloud adoption from an end user perspective was somewhat

addressed in the literature review. The end users here refer to the employees of the companies who benefit from rapid provisioning of data and resources that they can access through their own systems or devices. Although the benefits can be

translated to savings in cost, there are many intangible benefits, which improve the operational procedures and organizational processes. The efficacy of these

processes translates to improved and informed decision making across the board. This theme seemed to resonate among many companies I spoke to and researched. One CIO notes that IT organizations need to accommodate employees' and

consumers' desired pace of change. "iPads, iPhones, Androids, you can't stop them

from coming into the corporate environment and they're demanding email access and it's interesting that in some cases they didn't exist two years ago. So, being able to remove the complexity, standardize, operationalize it, and then push it out to people that are better at it than we are, so that we can lean more into our business processes and analytics, that's where the real value is", he says.

The advantage of a Cloud-based solution for his company is availability across multiple devices instantly. This makes it easy to deploy, use and upgrade. The flexibility of being able to work from anywhere affects workers' work-life balance and productivity. Data can be stored and managed from one central location, and everyone works off of one central copy. Employees can even chat to each other whilst making changes together. This whole process makes collaboration stronger, which increases efficiency and improves the company's bottom line.

Furthermore, the CIO of a major auto manufacturer explains that a big concern for companies is complexity handling and its associated costs. Distributed e-mail clients such as Lotus Notes offered the best corporate level security at that time which prompted many firms to adopt it. But overtime, getting developers and people to be able to support Lotus Notes became more challenging, with the cost for upgrades continuing to rise. He claims that the costs for upgrading were over $5M, which was prohibitive. By moving its corporate email onto the Cloud by overcoming initial security concerns and shrinking IT budgets, the company was able to enable

(32)

efficient user provisioning. "Having to deal with mail upgrades and now the demands

of the customers and how they want to use mail and how they want to access it, getting me out of that business and having somebody else say I'm going to keepyou current andyou won't have to worry about it is of tremendous value to me", he

explains.

3.3 Challenges

Based on my analysis, the major challenges companies are faced with in Cloud adoption are

* Re-architecting Platforms and dealing with Legacy - Vendor Management and

- Security

3.3.1 Re-architecting Platforms and dealing with Legacy Internal legacy systems are hard to write off either due to

e High capital costs or

e Complexity in moving data, processes or solutions out or

e Integrating them as new pluggable systems into the existing architecture.

This is an important challenge for companies looking to transition into the Cloud. A senior executive of a drug company says that his company is dealing with the transition to Cloud by adopting a loosely coupled architecture. Such an architecture, when equipped with integration points helps one integrate multiple third party

platforms. Several Cloud based modules such as Data Loss Prevention (DLP), Cloud-based identity management solution, and Cloud-Cloud-based application solutions are built into such a loosely coupled architecture to make the overall system more

flexible.

Increasing economic pressures result in outsourcing and other options that

externalize IT. Organizations are optimizing business value and delivery of solutions by brokering (or integrating) a mix of internally and externally provided services. Such integrations introduce significant cross-functional and cross-supplier

challenges. These changes also lead to long-term impact of decoupling core and non-core functions and having to distribute them effectively.

Some functions maybe core to the business systems and some may be peripheral. Critical IT services may remain on premise (or in the "internal Cloud") while the non-critical IT services may be outsourced. (Or moved to the "external Cloud") The Cloud software can potentially interact with the internal and external resources to operationalize these business processes. On quizzed about these opportunities, many interviewees agreed that they may be willing to start with services such as mail and work their way up to business systems and ERP gradually. But the core of

(33)

the business systems, which is the most important to the company, would probably be the last one to go. An enterprise architect of a multinational consumer goods company says that his IT unit separates core and non-core business to evaluate what can be moved to the Cloud and what cannot. He explains that instead of using expensive legacy hardware to run business intelligence and dashboards, moving the non-core stuff out to the Cloud registers huge benefits.

Companies find it difficult to achieve 100% virtualization or move all their systems to Cloud. One executive of a large Internet corporation calls the art of encasing the legacy systems as "Chernobylize". The legacy systems are integrated with APIs in front of it since it didn't make business sense to build software and re-write significant elements of code and get them onto the Cloud.

Another CIO I interviewed echoes this sentiment. He says, "Internal and external

services need to blend in together to make the experience of the user seamless thereby containing any risk IT can be externalized to some degree by moving the IT resources from its own control to that of an external service provider. One reason to do so is to

reduce expenses through improved value delivery and transition to variable costs. Another motive is to refocus efforts on core capabilities while examining alternatives for noncore capabilities. Core capabilities may be defined as those that provide

competitive differentiation to the business. Noncore capabilities, or context capabilities on the other hand typically have an indirect contribution (or no contribution) to differentiation: They are essentially commodities."

This was an important learning point since most companies transitioning into the Cloud have to deal with their existing systems. Little has been said about this issue or how to address it in the literature I researched.

3.3.2 Vendor management

As noted in the literature review, it is difficult to express and implement the terms of agreement for Cloud usage at a technical level. Outsourcing services and changes in control influence a customer to choose a particular Cloud provider because of the conditions it offers, its reputation or professionalism, or its technical skills. A senior executive from a large electronics multinational conglomerate explains that

although the pricing of its vendor, a highly reputed software provider, at first

seemed attractive, the price grew considerably when it was augmented with storage and upon feeding new requirements. This was exacerbated further by architectural challenges due to insufficient connectivity, expensive offerings and lack of service guarantees. Contractual obligations around service levels, storage of data,

movement of data, change and control had to be negotiated for the company.

As was evident in the literature review as well, the IT delivery model and the role of IT and its practitioners is undergoing significant changes. Businesses are buying Cloud services assuming they meet all the IT requirements while these services don't necessarily meet the operational or security requirements. Regardless of

(34)

whether they are on-premise or on the Cloud the IT unit is responsible for brokering solutions from these vendors.

3.3.3 Security

One of the biggest concerns for companies is evaluating and managing security or business continuity risks. (See Figure 5: Barriers to Cloud Computing)

An OEM firm with a 250 strong IT organization team and over 38 data centers around the world still considers moving its internal data out to the Cloud risky. This apprehension mostly stems from lack of confidence in vendors and fear of litigation as a consequence of data leakage. But the IT unit is currently spending a lot of time studying security enhancement and would like to eventually move most of their services such as email, HR, payroll and performance management to the Cloud. New technologies, services and architectures are slowly emerging in response to security challenges. Some companies are starting to take that leap of faith as one CIO notes, "if there's been hacking attempts or denial of services, they (the Cloud vendors)

are going to take appropriate actions to protectyour data."

Another marketing executive explains that much of a company's data is already external today. Customer information in many cases is already in a colocation center. So the issue is mainly access to that data itself, and the way the encryption intended to secure it. As long as the shared infrastructure can be trusted and there are adequate security measures and data encryption, there is no additional risk. The big security breaches according to him are simple: leaving laptops at airports, and so on.

Cloud landscape : benefits, challenges and management strategies