SA embraces the cloud

On a worldwide scale, Gartner predicts cloud services revenue will reach $68.3 illion in 2010, a 16.6% increase from last year, indicating a substantial growth in this market. South Africa, usually a late technology trend adopter, is looking into the market with growing interest, and will be even more interested as bandwidth restrictions become a thing of the past.

Locally, we are ready to embrace cloud computing from an infrastructure perspective," explains Edwin Thompson, GM: technology and infrastructure at MTN Business. "Bandwidth speeds are increasing all the time and they are busy working on another cable. We are currently getting eight to nine times better broadband than what we were one-and-a-half years ago. Infrastructure is catching up, even on a consumer level. The country can expect our current maximum of 4Mbps to soon increase to 10Mbps.

Thompson says according to industry watchers, around 20% of all infrastructure-related services will be cloud oriented by 2011. "As a result, IT service providers must be able to integrate IT services from in-house to cloud-based, building a solution that is best suited for each individual business, for effective cloud computing to occur."

He also notes that local uptake is relatively slow for the moment. "Full-blown cloud computing locally is relatively low, and there are still a lot of technology developments happening in the industry." Gary Lawrence, MD of CA Southern Africa, concurs: "It's early days still for the cloud. Most vendors are hyping it and creating lots of noise. The interest is there, but many are taking a more cautious view and moving slowly into it." According to Lawrence, many companies are first testing the waters risk-free in a private cloud. "Organisations are setting up private clouds so as to understand the technology better instead of rushing into a new technology. They are taking the time to explore which of their business processes would be best suited to the cloud."

What it comes down to, the experts agree, is asking the right questions and making sure adequate research is done. "There is a void in terms of basal experience in cloud computing, because the concept still needs to reach market maturity," says John Hope-Bailie, technical director at Demand Data.

According to David Ives, director at Microsoft Gold certified partner IS Partners, companies need to focus on their motivations to moving to the cloud. The motivations for going cloud have to be better understood. It is not purely a technology decision," he says.

Ives believes anything that is a non-core application, such as e-mail, can be virtualised. "But it is highly unlikely that a company would want to move processes that are tightly-coupled to the core business - those that differentiate the business - into the cloud."

It is because cloud computing is not adequately understood, believes TJ Hanekom, sales director for EOH company Global Testing Services (GTS), that many local concerns arise, especially in the area of data privacy and security.

"One of the real downsides to the lack of education about this concept is that many companies don't even know where the applications they are using are running, or where their data resides," says Thompson. "In many cases, they may not even realise that they are running cloud computing at all," says Thompson.

This, of course, creates many issues within the regulatory environment. Thompson believes the ideal way to deal with this would be the establishment of "virtual regulations" that are applicable across boundaries. In the meantime, however, South Africa's King III Report on Corporate Governance can be used as a framework to address some more critical security issues.

According to Alan Rehbock, sales and marketing director at Magix Integration, King III deals in great lengths with IT governance, and should be used as a guide when protecting data confidentiality, integrity, and confidentiality in the cloud. He reminds businesses that because cloud computing essentially has to do with the outsourcing of IT services, it is not a decision that should be taken lightly.

"The cloud computing model dictates that an organisation's IT is run on third party infrastructure. The overriding proviso that would need to be proven first is that 'cloud-based' IT should be exploited in a way that most effectively supports and enables the business strategy, delivers value and improves performance.

King III states IT should be directed and controlled effectively by the board through the establishment of an IT governance framework, control and responsibility therefore ultimately rests with the board," he explains. "Furthermore, it is against King III principles to spend funds for the acquisition of IT goods and services without ensuring that good governance principles are in place."

He believes it is critical that companies using cloud computing have visibility of their infrastructure, their data, and of the behaviours and the enforcement of access policies for people managing the data.

Not only does cloud complicate security through the reliance of third party infrastructure, but in most cases, several external service providers will be used by a single company, which greatly adds to the complexity of IT management.

"Control moves from single vendor to multiple ones depending on the applications and services required," says Lawrence.

Ives believes cloud computing will act as a springboard for the provision of a set of services that include an amalgamation of smart solutions and software in the cloud. "Outsourced solutions vendors have started creating clever ways of hosting and delivering their IT solutions, but systems integrators will also feel the impact in terms of the IP innovation needed to address myriad business issues." Cloud computing is not going to be the only model, he says. "There will be a mix of onsite 'competitive advantage' solutions and offsite commodity services that lead to some reduction of cost and complexity."

Hope-Bailie views the increasing management complexity of cloud computing as a positive feature for consultants. "There is a definite gap in the market for consultants that can not only demystify cloud computing as a whole to local organisations, but provide them a means to reduce the complexity that comes with managing several service providers."

Other challenges, says Hanekom, include bandwidth restrictions and possible downtime in electricity supply. "If we are supplying to the international market, these concerns will influence our global competitiveness."

According to Hope-Bailie, however, this creates opportunities for local versions of international cloud service providers that consider latency as a factor. "No matter how good our links get, we are still going to experience latency," he says.

Latency issues can in part be overcome by choosing to virtualise only those systems that do not require low latency, such as e-mail or Web site hosting. According to Yaron Assabi, CEO of Digital Solution Group, using services through the Internet is a great advantage for many African countries that cannot invest a lot of capital in broadband infrastructure or end-user devices. It also presents tremendous opportunity for application developers to cater to the large number of mobile users throughout Africa if they play their cards right.

"Instead of laying out infrastructure, provide them with applications," he says. "To be truly successful in this market, it is imperative that the applications are able to support not only 2G, but work across platforms."

He says the benefits to mobile workers will be many. "People prefer to travel with smaller devices and with cloud computing it is possible to still have a lot of functionality, but use less processing power and require less storage. Furthermore, the security risk that comes with data loss as a result of stolen devices will be lessened, because everything will be stored in the cloud.

Cloud computing, sometimes described as "Internet computing", is a fast-growing trend towards the sharing of applications, software and other IT resources by companies on an on-demand basis.

Cloud computing can be defined by three characteristics: services are sold on demand, typically on a monthly or annual basis, where payments are made either as a utility (similar to an electricity bill) or as a subscription. Services are flexible, whereby a user can have varying amounts of the service - at any given time. Services are fully managed by the provider, with the user requiring little more than a PC and Internet access to get started.

The offerings available in the cloud environment have been categorised as software as a service (SaaS), infrastructure as a service (IaaS), and platform as a service (PaaS). SaaS is the broadest market, where companies can access applications and large amounts of virtual computing power without buying it. IaaS is an evolution of Web hosting and virtual private server offerings. PaaS is a set of software and development tools hosted on the service provider's servers.

* 51% of organisations are now using some form of cloud computing service

Of those:

* 74% experience alleviated internal resource pressures
* 72% report improved end-user experience
* 73% reduced their infrastructure costs
* 57% experience improved security
* 58% have better control of their data
* 62% use a cloud-based e-mail application
* 52% use a cloud-based security application
* 50% use a cloud-based storage application
* 62% believe storing data externally is a significant security risk
* 58% think replacing legacy IT solutions will almost always cost more than the benefits of new IT
* 54% say potential benefits of cloud delivery models are overstated
Source: Mimecast Cloud Adoption Survey

Cloud computing represents another stage in the continuum of the use of information technology. Cataloguing and managing data is a major challenge for companies and will become even more complicated as the elements of cloud computing are implemented.

Technologies that identify and store data are becoming more sophisticated and will continue to evolve to assist companies to improve information asset understanding.

A key element of managing the complexities of the "cloud" is the capability to gather event data and correlate what is going on in the environment.

Data backup and storage in the cloud does not remove a company's responsibility for legal, regulatory and audit obligations attached to the information.

Cloud computing is becoming a part of the fabric of a company's business, making it imperative for executives to tangibly demonstrate how the company is establishing governance, risk and compliance processes across the organisation.

Data classification considerations

* Do you know what legislation is applicable to your business?
* Have you separated your applications according to legislative and business requirements, and determined what is necessary for each application with respect to data availability, data criticality, data protection, and data retention?

Application classification considerations

* Which are your core applications and non-core applications, and which can move, or do you want to buy from the cloud?
* Identification of applications that interact and how, and what the impacts of the change will be on them (eg, transaction response time).
* Comparative costing for your current and potential cloud environments (including development costs so as to be able to set expectations, measurements, and deliver on a clear business case).

Security policy considerations

* Disaster recovery requirements.
* Availability requirements - including security requirements for data in transit and data at rest.
* Access requirements.
* Access controls - authorisation, authentication, alerting and tracking

Enabled applications considerations

* Will legacy environments be updated, or built according to SOA principles and models?
* Transactional environments - tight coupling between applications, or loose?
* Identified application groupings, and are similar available from your target cloud environment?
* Optimised for network requirements of the cloud?

Reporting requirements considerations

* What do you need?
* What do you want, and why?
* Detailed billing for sub-distribution to departments