Table of ContentsExecutive Summary 2

Cloud Computing is poised for rapid growth 3

Security is the top challenge holding back Cloud adoption 5

Plan your Cloud Strategy to suit your business needs 6

Appendix A: Methodology 7

© 2011, Tech:Touchstone Ltd and Phil Sayer Associates. All rights reserved. Unauthorized reproduction is strictly prohibited. Information is based on best available resources. Opinions reflect judgment at the time and are subject to change.

About Tech:TouchstoneTech:Touchstone creates business-to-business events for the IT sector where face-to-face communication is paramount to fully understand complex issues, solutions and value propositions. The company’s portfolio of events focuses on areas of strategic industry debate and growth market sectors, with the aim of creating a collaborative learning environment for time-poor IT executives and to facilitate high value, quality interactions between all participants.For more information, visit http://www.techtouchstone.com/

About Phil Sayer AssociatesPhil Sayer Associates is an independent IT and telecoms consultant, specialising in advising both major enterprises as well as service providers. For more information, visit http://www.linkedin.com/company/1148015?trk=tyah

Cloud Computing 2012: Security is the key to unlocking business benefitsNovember, 2011

TECH:TOUCHSTONE | Cloud Computing 2012: Security is the key to unlocking business benefits

02

Executive Summary Across all UK industry sectors, the major IT initiatives of 2011 were aimed at reducing costs and improving operational efficiencies – server virtualisation and desktop virtualization were near the top of most enterprise CIOs’ priority lists, as budgets and head-count were frozen or reduced. Now, however, as we move into 2012 and firms plan for the future, CEOs look to IT to support business initiatives: they want to use IT to improve sales and customer service performance, for example by using web-based applications internally and e-commerce to boost external sales. The problem? All these initiatives rely on IT infrastructure and operations, which in many enterprises have been starved of investment. To solve this problem they will need to use cloud computing technology, which has the potential to lower IT costs and at the same time improve agility and flexibility. How can it do this? Cloud technology makes it possible for IT to deliver new servers in minutes rather than months, and to purchase computing and storage only when they are needed and to pay for only what is used. However, cloud services are not without risk: they must be planned and implemented with due care.

Cloud Computing: the one and only future of IT, or just another tool in the box?It is generally agreed that cloud computing technology is the future of IT: a research study carried out in July 2010 by Portio Research for Colt, entitled “European CIOs and Cloud Services”, reported that 86% of the 353 European CIOs surveyed believe that cloud services will be the operating method of the future. Some pundits think that cloud computing will entirely replace IT as know it. Nicholas Carr, in his book the “Big Switch”, uses the analogy of the public electricity grid to predict that:

“The entire computing industry is going to be turned on its ear. Instead of buying new computers, companies will just subscribe to various software services served up online for a low monthly fee”.

Cisco Systems quotes the CTO of one of the largest states in the US as saying that:“Five to ten years from now, I don’t foresee that our DCs will exist in their present form…We just don’t have the scale to be cost effective.”

However, most users disagree, and regard cloud as just another tool in the box. According to Portio, the majority of CIOs say cloud will have no impact of the number of internal servers. Forrester Research’s Q3 2010 Hardware survey found that over half of decision makers expected expenditure on both long term hosting and on-demand IaaS to stay about the same over the coming twelve months. Why is this? Two major issues dominate:

• Firms are not ready to adopt cloud technology. To benefit from cloud, IT departments need standardised operating procedures, fully automated deployment and management, self-service access for developers and deployers, and business units sharing the same infrastructure. In 2010 Forrester Research Inc reported that only 5% of enterprises were in that position.

• Immaturity of cloud services. Many of the cloud services marketed in 2010 and early 2011 were the same old hosting services rebranded as cloud – a phenomenon known as “cloud-washing”. The newer services that were genuinely cloud lacked maturity – they were offered without SLAs, and generally did not adequately address key performance and security issues such as reliability, availability, data protection, regulatory compliance, and data recovery on contract termination.

TECH:TOUCHSTONE | Cloud Computing 2012: Security is the key to unlocking business benefits

Cloud Computing is poised for rapid growth2012 looks to be the year cloud computing will take off in UK enterprises. In November 2011 Tech:Touchstone surveyed the delegates attending its UK Virtualisation/Cloud Computing Executive Summit. The survey revealed that cloud computing already has a significant share of UK large organization IT budgets: the firms surveyed are now spending 10% of their IT budgets on cloud computing services, and plan to increase that number to 28% in the next 2 years. However, behind this average 10% figure there are two types or organizations: those that have embraced cloud as an important part of their future strategy and those that are still on the starting blocks. 43% of delegates surveyed were spending less than 1% of their IT budgets on cloud; the remaining 57% were spending on average 18%. The survey also confirmed that making the business case for cloud is becoming easier: earlier this year 60% of delegates at the June 2011 Tech:Touchstone Virtualisation/Cloud Computing Executive Summit with a zero spend on cloud were unsure of the financial benefits of cloud computing; now that figure is down to 27%.

Figure 1Top Reasons for zero budgets on cloud computing

Security issues dominate firms’ thinking on CloudMany organizations are finding that security is the initial obstacle they must overcome to unlock the benefits of cloud computing. To find out what was holding back the reluctant 43% who had no firm plans for using cloud computing services, we asked them what they were worried about; 67% responded that they had technical or security concerns (See Figure 1).We conclude that security concerns are a major barrier that hinders and delays firms from entering the cloud world; the survey also confirmed that cloud security is an issue for those already spending IT budget no cloud services. In fact security is the top topic about which both existing adopters and firms new to cloud computing firms seek information and help (See Figure 2).

Base: Sample taken from Tech:Touchstone delegates – UK CIOs/senior IT Managers Source: Survey of delegates attending the Tech:Touchstone 2011 Virtualisation/Cloud Computing Executive Summit, November 2011

03

“If none of your IT budget is spent on cloud computing services today and no firm plans for next 2 years, why not?”

TECH:TOUCHSTONE | Cloud Computing 2012: Security is the key to unlocking business benefits

The survey confirmed that security concerns underlie all firms’ strategies for adopting cloud services. Of the organizations surveyed:

• 69% reported that they had a specific interest in cloud security products and services. Firms are looking to outside expert vendors to help them find the right security solutions to meet their needs.

• 67% of delegates were interested in private cloud services. Private cloud is a solution which has the benefits of cloud technology without the security risks inherent in public cloud, so this confirms the degree to which security is a top concern.

• 46% were interested in hybrid cloud/public cloud services. Private cloud is not seen as the only way forward; almost half of firms would like to use hybrid or public cloud, once they can be convinced that these clouds can be made secure enough for each appropriate application.

• 39% are interested in cloud based communications services. Public cloud-based email, instant messaging, and unified communications (such as Microsoft lync on-line) are all growing in popularity; adequate security is the key to the future take-off of these services.

Figure 2Top Virtualisation/Cloud Product/Service Interests

Base: 40 UK CIOs/senior IT Managers

Source: Survey of delegates attending the Tech:Touchstone 2011 Virtualisation/Cloud Computing Executive Summit, November 2011

04

“Please indicate which of the following type(s) of Virtualisation/Cloud products/services you currently have a specific interest in.”

TECH:TOUCHSTONE | Cloud Computing 2012: Security is the key to unlocking business benefits

Security is the top challenge holding back Cloud adoptionWhat is holding back cloud adoption? IDC carried out a survey which asked end user firms to rate cloud computing implementation challenges described as “significant”. Of the end users surveyed:

• 89% listed Security. According to IDC, “Security is top of mind for the vast majority of IT organizations looking into public cloud delivery models”.

• 88% cited Performance. According to Easynet, almost 60% of Europe’s CIOs believe that can migrate to cloud services without any updates to their corporate networks.

• 85% mentioned Availability. The furore over the April 2011 Amazon EC2 outage suggests that some major firms are buying cloud services without adequate consideration of availability.

All the delegates attending the Tech:Touchstone November 2011 Virtualisation/Cloud Computing Executive Summit emphasized the need for a solid business case – cloud projects will be compared for financial return with every other potential investment that a firm could make – but most considered that this was no longer a top challenge for them.

Security issues dominate firms’ thinking on CloudIDC research carried out for VMware in 2011 found that EMEA end-users are subject to stricter compliance and governance regulation than their U.S. counterparts, with additional complications due to the fragmented territory and strict data protection directives. Even when solutions are identified to security issues, IDC concluded that there is still a clear psychological barrier in knowing that data and applications reside physically somewhere else. Gartner summarises the issues as follows:

• Risk of data loss. Sensitive data processed outside the enterprise brings with it an inherent level of risk.

• Regulatory compliance issues. Customers are ultimately responsible for the security and integrity of their own data.

• Data location. When you use the cloud, you probably won’t know exactly where your data is hosted.• Data segregation. Data in the cloud is typically in a shared environment alongside data from other

customers. • Recovery. Ask your provider if it has “the ability to do a complete restoration, and how long it will take”.• Investigative support. Investigating inappropriate or illegal activity may be impossible in cloud

computing.• Long-term viability. Ideally, your cloud computing provider will never go broke...

Performance is overlooked in planning Cloud strategiesIn a report on telecomseurope.net in May 2011, Easynet CTO Justin Fielder was quoted as saying that:

“CIOs must realize that the ability to deliver to end-users is a vital element of any cloud strategy.”The performance of an application running on a server in the cloud depends on several factors:

• The server capacity allocated to the application. Cloud solutions are often used where the number of end-users is either highly variable or unknown; adequate server capacity is key to providing acceptable response time.

05

TECH:TOUCHSTONE | Cloud Computing 2012: Security is the key to unlocking business benefits

• Server location and application design. The speed of light may seen impossibly fast, but ‘chatty’ applications written with no regard for server location can involved hundreds of messages for every response, and will perform badly if the server is hundreds or thousands of miles away from the end-user.

• Network bandwidth. Inadequate network bandwidth acts as a throttle, requiring packets to queue for delivery. In the case of private clouds, this issue can be solved by providing sufficient network capacity; in public clouds it is more difficult. Public internet performance is highly variable and rarely covered by SLA; however the biggest bottlenecks are at international gateways and users can generally minimise performance issues by using a cloud service provider with a data center in their own country.

Availability requires diligent purchasing of Cloud servicesIn April 2011 Amazon had a significant service outage of its Elastic Cloud Compute service (EC2), which affected more than 70 firms’ public-facing web services including parts of the New York Times. However, the outage only impacted one of Amazon’s data centres; Amazon offers a service called “Availability Zones” where users can specify that their service is provided by a back-up data centre if the primary fails, so the fault lies with the end user not with Amazon, for failing to think about back-up services in their enthusiasm to use to cheaper external provider of web services. End-users generally have back-up plans for critical applications provided in their own data centres; when moving these applications into the Cloud they need to purchase resilient services with the same diligence that they would apply to outsourcing their own internal IT.

Plan your Cloud Strategy to suit your business needsThe time to act is now: all firms should put in place a cloud strategy. According to the Verdantix/Carbon Disclosure Project published in July 2011 report entitled “Cloud Computing, the IT solution for the 21st Century”, by 2020 69% of US $1billion-plus enterprises’ IT budgets for infrastructure, platform and software will be spent on cloud services, compared with 10% today. The top benefits cited by Tech:Touchstone summit delegates in our survey were cost-efficiency, agility and flexibility; however there are many others; you should start by asking what your business needs from IT. We suggest using the following three imperatives to help you plan your cloud strategy:

Imperative 1: Adopt a strategy based on business needFirst you need to assess your business priorities: these will vary from firm to firm. For example, Citigroup’s Paul Stemmler says:

“Carbon reduction is one driver, but not the primary driver. Our primary driver is time to market. Developers used to take 45 days to get new servers, but in our virtualized private cloud environment, it takes just a couple of minutes.”

For Dhritiman Dasgupta at Juniper Networks, the drivers for cloud computing can be summarized as cost, resiliency and efficiency. Other end users have different priorities; for example Matthew Dines, Head of Group IT Strategy & Architecture for Aviva, says:

“We see the cloud as reducing the administration and headache side of IT, allowing our leadership to focus on things that are critical to the business”

(Quotes from the Verdantix/Carbon Disclosure Project July 2011 report entitled “Cloud Computing, the IT solution for the 21st Century”.)

06

TECH:TOUCHSTONE | Cloud Computing 2012: Security is the key to unlocking business benefits

In summary, start with a business case assessment of applications where you want to use cloud, then:• Plan to replace obsolete systems so you can virtualise all your servers• Complete standardisation, virtualisation and automation projects to take full advantage of cloud

services.• Add automated systems management to start to build an internal cloud

Imperative 2: Start simple and build from thereAccording to 451 Group, the most popular places to start are web applications, test and development, and collaboration:

• Use public cloud services for your public web apps. Delivery is via the Internet anyway, so security is already addressed. You can scale up to meet demand, deal with peaks cost-effectively, and only pay for what you need.

• Test & Development is often a good place to start using public cloud services. You are not dealing with live data, and need speed of deployment and flexibility. You can use role-based access control (RBAC) deployment tools, and build to practices that automate promotion to QA, then production.

• Collaboration uses the cloud for delivery. Email is where most firms start in moving collaboration to the cloud, when they wonder whether they really want to operate their own Exchange server, or to use a vendor with greater scale and expertise. Instant Messaging often follows, and then SharePoint and many firms are looking at Communications-as-a-Service tools such as Lync on line.

Imperative 3: Work with a partner that you trustFind a provider that can add value to IT’s approach by using professional and managed services to plug your organization’s skill gaps. According to Forrester Research, the top attributes that firms look for in selecting a cloud service provider are that they:

• Offer competitive pricing• Offer performance level assurances/ SLAs• Understand my business and industry• Can move cloud offerings back on-premise

Tech:Touchstone summit delegates in our survey indicated that their top choice for a provider of cloud services was a global Systems Integrator such as IBM or HP; second choice was a global telco such as Orange or Verizon. Both these types of vendor certainly have the in-depth skills and services, including security services, to meet end-user needs; however they may not always be the most cost-effective or most flexible. In summary firms should purchase cloud services with exactly the same diligence and skills that they would apply to negotiating an IT outsource contract.

Appendix A: MethodologyFor this study, Tech:Touchstone conducted an online survey of a sample of 40 participants at its November 2011 Virtualisation/Cloud Computing Executive Summit, held at the Richmond Hill Hotel. Delegates included UK-based CIOs and other IT decision-makers directly involved in their organization’s architecture, management, and/or operations strategy decisions, in UK and global organizations in both the private and public sectors. The online survey provided to participants included questions about their strategy, priorities, adoption, budgets, and preferred suppliers for virtualization and cloud computing products and services.

07

TECH:TOUCHSTONE | Cloud Computing 2012: Security is the key to unlocking business benefits

08

RICHMOND HILL HOTEL. SURREY. 28-29 FEBRUARY 2012

If you are involved in Information Security initiatives for your organisation why not have a look at our Information Security Executive Summit

being held in Richmond, Surrey on 28th-29th February 2012.

Join the Techtouchstone Group to keep updated on the latest industry news, white papers and events.

Follow us on

Or our other Executive summits: