POSITIONING PAPER FREEDOM IN THE CLOUD

FREEDOM IN THE CLOUDPOSITIONING PAPER

1 INTRODUCTION 3

2 WHAT IS CLOUD COMPUTING? 4

3 THE BENEFITS OF CLOUD COMPUTING 5

4 THE USE OF CLOUD COMPUTING IS LAGGING BEHIND 6

5 CLOUD COMPUTING: THE SCHUBERG PHILIS WAY 8

6 CLOUD TRANSITION IN PRACTICE 12

7 WHAT’S NEXT? 14

INTRODUCTION

2

An intelligent cloudThroughout this positioning paper you find images of “clouds” formed by birds, starlings to be more precise. These bird clouds are a metaphor for Schuberg Philis; we see ourselves as free self-thinking individuals who like to live in a group, because it makes us better and stronger. It is also represents the agility that is needed to respond to what is happening in rapidly changing world. The movement of such a flock of birds is not led by one individual. It is actually governed collectively by all of the flock members. But the remarkable thing about starling flocks is their fluidity of motion. As researchers put it, “the group respond(s) as one” and “cannot be divided into independent subparts.” When one starling changes direction or speed, each of the other birds in the flock responds to the change, and they do so nearly simultaneously regardless of the size of the flock. As if the group has a sense of direction in itself. We as a group of people at Schuberg Philis strive for the same kind of “synchronicity”.

Source: https://www.allaboutbirds.org/how-do-starling-flocks-create-those-mesmerizing-murmurations/

FREEDOM IN THE CLOUDPOSITIONING PAPER

INTRODUCTION

Nevertheless we observe that organizations find it difficult to incorporate cloud computing – whether it be in a private, community, public or hybrid form – in their IT environments. We see them wrestling with questions such as data security, privacy

is put in a cloud environment, making it possible to automate IT management processes to the maximum.

This position paper shows that it is possible, by taking the Schuberg Philis multi-cloud approach.

laws, costs, and the complexity of the integration. As a result, cloud computing is still used relatively little, and not at all for mission critical applications. That is a pity, because the advantages listed below can be realized best when the entire application landscape

ADVANTAGES OF THE MULTI CLOUD APPROACH BY SCHUBERG PHILIS:

• A holistic approach to the cloud transition: involving architecture and technology, culture and organization, DevOps and application development, security and compliance• Future-ready: the entire application landscape is placed in a cloud• Multi-cloud approach: freedom to switch cloud type (private, community, public, hybrid)• Cloud platform independent: flexibility and freedom• Manageable complexity: processes that are well organized from the outset and automated as much as possible• Schuberg Philis bears full responsibility and liability, not only for the technical infrastructure but also for the transition process• A production environment with the highest audit scores for quality, safety, stability, and speed• The existing IT environment can be entirely dismantled, so there are no unnecessary license costs, skills, and processes• In-depth technical knowledge of different cloud platforms• Self-managing customer teams, so you are in direct contact with the expert you need

3

1 Flexibility, rapid implementation of innovative business ideas, scalability, pay as you use, and the extensive automation of your IT management: cloud computing offers many benefits in commercial, financial, and technical terms.

FREEDOM IN THE CLOUDPOSITIONING PAPER

• Public cloud: open and accessible for everyone• Private cloud: developed for the use of one exclusive organization• Community cloud: between the public and private clouds, only accessible for a specific community of users, generally with shared interests• Hybrid cloud: combination of these models

2 What makes cloud computing unique is that its users call on infrastructure services independently as required (on-demand self-service) and receive them from the network. They share the infrastructure with others and can have access to seemingly limitless capacity, paying for it according to how much they use. Three types of services are offered from the cloud: software (SaaS), platforms (PaaS) and infrastructure (IaaS).

1 http://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf

4

WHAT IS CLOUD COMPUTING?

FOUR MODELS FOR PROVIDING CLOUD SERVICES:

There are many different definitions of ‘cloud computing’. Schuberg Philis uses the widespread definition of the American National Institute of Standards and Technology (NIST): This organization defines cloud computing as “a model for enabling ubiquitous, convenient, on-demand

(source NIST)

network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction.” 1

FREEDOM IN THE CLOUDPOSITIONING PAPER

Commercial advantagesBecause cloud services are available as ready-made systems, they contribute to speeding up the time-to-market for innovative business ideas. Using cloud technology encourages experimentation with new business models, functionalities, and technologies. It makes it possible to create a new IT environment more quickly, with a lower threshold and at a lower cost, and it is scalable.

Cloud computing improves the capacity of the IT to respond quickly and flexibly to needs that arise within the organization. The process of moving from idea to implementation is considerably faster and cheaper. The use of SaaS, PaaS, and IaaS services means greater agility and speed in the provision of IT services, and it encourages innovation.

Financial advantagesIn financial terms, cloud computing means considerably lower operating

costs. Pay-as-you-use means that capital expenditure for hardware and part of the software is substantially lower. Only a small part of this saving is offset by higher operating expenditure, because cloud computing makes it possible to utilize hardware resources more fully, and it gives flexible support to upscaling and downscaling the number of users and/or the infrastructure.

However, the most important cost savings are these result of farreaching automation as a result of implementing a new infrastructure and the corresponding applications.

Technical advantagesIn addition, the automated process of change management is automated, runs significantly faster, with higher and more consistent quality. The burden of management is less, because manual management tasks are taken over by end-to-end automated management. The common

three-year or five-year cycle of hardware replacement is a thing of the past, and this simplification of infrastructure management – along with extensive automation of technical application management – reduces the pressure of operational work for IT managers, so that more time can be spent on projects, quality, change, and their role as integrators.

This acceleration on the operational side, as well as the wider possibilities of cloud computing, also contributes to the acceleration of software development. Developers can focus on their primary task, which ultimately contributes to a shorter time-to-market. The potential of cloud computing has initiated a real revolution.

5

3 THE BENEFITS OF CLOUD COMPUTINGCloud computing offers various commercial, financial, and technical advantages.

FREEDOM IN THE CLOUDPOSITIONING PAPER

THE USE OF CLOUD COMPUTING IS LAGGING BEHINDAlthough many organizations are aware of the benefits of cloud computing, its application in practice is lagging behind.

The National EuroCloud Monitor for the Netherlands, for 2015 2, based on research conducted among the IT decision-makers of 250 Dutch companies, shows that they are still

using the cloud in almost exactly the same way as they used it in 2012. They mainly use SaaS, and especially mail and messaging services, text processing and other

6

4Private 34%

Public 8%Not (yet) 36%

Hybrid 22%

STORAGE AND BACKUP CALCULATION

Private 33%

Public 7%Not (yet) 45%

Hybrid 15%

STORAGEAND

BACK-UP

PROCESSINGCAPACITY

USE OF IAAS SERVICESWhich of the following cloud solutions do you use?

Please indicate whether it is (mainly) a public, private, or hybrid cloud solution

office applications. The adoption of IaaS has been slow. The researchers remark that IaaS is still mainly provided in the form of a private cloud service.

Also: http://www.eurocloudnl.eu/de-nationale-eurocloud-monitor-2015-schiet-

het-al-een-beetje-op-met-die-cloud/

And: https://www.xtandit.nl/blog/werken-de-cloud-ontwikkelingen-en-voordelen

FREEDOM IN THE CLOUDPOSITIONING PAPER

Only a few companies have dared to put their whole IT environment on the cloud, and the use of the cloud for innovation has not really increased compared to the situation in 2012. Organizations are

7

still mainly concerned about data security (49%), privacy laws (30%), costs (18%) and complexity of the integration (14%).

Complexity of integration

Datasecurity Privacylegislation

Cost

Continuityrisk

The Patriot Act and the risk of American

spying

Unclear benefits

Doubts about continuous availability

Lack of standards

27%

30%

28%

18%

11%10%15%10%

21%14%

49%

36%

16%5%

7%14%15%9%

2015 2012

CLOUD OBSTACLES 2012-2015What do you consider the main obstacles to adopting cloud computing?

Complexiteitvan integratie

Databeveiliging Privacy wetgeving

Kosten

Coninuiteits-risico’s

Patriot / Prismspinage

Onduidelijkebaten

Twijfels overbeschikbaarheid

Gebrek aanstandaarden

27%

30%

28%

18%

11%10%15%10%

21%14%

49%

36%

16%5%

7%14%15%9%

2015 2012

Complexiteitvan integratie

Databeveiliging Privacy wetgeving

Kosten

Coninuiteits-risico’s

Patriot / Prismspinage

Onduidelijkebaten

Twijfels overbeschikbaarheid

Gebrek aanstandaarden

27%

30%

28%

18%

11%10%15%10%

21%14%

49%

36%

16%5%

7%14%15%9%

2015 2012

FREEDOM IN THE CLOUDPOSITIONING PAPER

Our view at Schuberg Philis is that those who want to enjoy all aspects of the advantages of cloud computing should place their entire application landscape on the cloud, while automating their IT management processes to the maximum. The provision of stable, reliable mission critical platforms is a core competence for us, and we also specialize in the transition of mission critical systems to the cloud. Long-term customer satisfaction is our highest priority.

Companies are not faced with a trade-off between the advantages of the cloud and reliability and safety. At Schuberg Philis they get both, because we approach cloud computing in the ways described below.

The Multi-Cloud approachCloud computing involves making smart choices: which application belongs in each type of cloud? We evaluate each application or business process to see whether it can best be placed entirely on a public, community, private, or hybrid cloud.

This is not the same as distributing

a single application over two types of clouds, as often happens with the hybrid cloud approach. In that approach, the data (the ‘systems of record’ in Gartner’s Pace Layered Application model 3) are placed in a private cloud to comply with laws and regulations, while the processing (the ‘systems of engagement’) takes place in the public cloud. This is an attractive solution, but it is technically challenging, and does not entirely solve the compliance issues. What is worse, this distribution method also introduces risks, because the data (whether it is temporary or not) can be used and processed in the public cloud.

8

5 CLOUD COMPUTING:THE SCHUBERG PHILIS WAY

Because we place applications in their entirety in the most suitable type of cloud, we are able to comply with all security and privacy requirements.

Mission Critical Cloud Our Mission Critical Cloud has been specifically designed for hosting the application landscapes that are operationally critical. Our customers can choose to have a private cloud or a community cloud which they share, for example with their partners in a chain of production.

The Mission Critical Cloud has been designed to minimize the risk of cascading failures. The cloud

FREEDOM IN THE CLOUDPOSITIONING PAPER

infrastructure is held physically in three data centers in the Amsterdam region. If one data center goes down or malfunctions, the other two data centers are still available. Server and network functions are implemented in software, using server virtualization and network virtualization (Software Defined Networking, SDN).

This means that applications in the Mission Critical Cloud are guaranteed to be 100% available, optimally secure, flexible, and maximally reliable, and no data leaves the country. Naturally the Mission Critical Cloud works in accordance with all the principles of cloud computing, such as elastic growth in line with usage and pay-as-you-use.

Where technical and/or license considerations form an impediment to using the public cloud, as in the case of legacy applications or if applications depend on specific hardware or software, these can be integrated in the Mission Critical Cloud. Thanks to our Mission Critical Cloud, even the applications that are most critical to business operations can run in the cloud, without any continuity risks.

Orchestration platformFor the management of applications in the cloud, we have developed an orchestration platform for our

customers. Using this platform, an application landscape can be designed and rolled out easily. This user-friendly method, which is known as Desired State Infrastructure (DSI), has been developed on top of the open source tooling of Apache Cloudstack, Cosmic, Chef, and HashiCorp Terraform. The technical design comprises graphically presented re-usable building blocks for functions that are needed in any cloud environment, such as the firewall, connection, and server configurations. New building blocks are developed as required

for customers’ specific business applications.

All the building blocks are designed to be independent of specific cloud platforms. When the blueprint for an application landscape is complete, automation allows it to be completely rolled out on the desired cloud platform with one click. The platforms available at present are those of the public cloud providers Amazon (AWS), Microsoft (Azure), and of course our own Mission Critical Cloud.

Because all our customer teams use the same building blocks and these are continually being optimized

– for example when something changes in the underlying cloud technology – the building blocks are of very high quality.

Cloud platform independenceCloud providers come and go, organizations change rapidly, and technology does not stand still. To avoid vendor lock-in and dependence on proprietary technology, the blueprint for an application landscape is entirely separated from its technical implementation. This has the great advantage that an application landscape can at any time be moved from the public to a private cloud, or vice versa, or to another

9

SELECTING THE RIGHT CLOUDConsiderations for the transition: which business processes in which type of cloud?

NO• Internal security policies• Privacy legislation• Requirements of supervisory bodies

SCHUBERG PHILISMISSION CRITICAL

CLOUD NO• Suppliers’ license conditions• Financial constraints• Technical constraints• Hardware dependence

PUBLIC IAAS,PAAS, SAAS

CLOUD

May this process or application be put on the

public cloud?

Can this process or application be put on the public cloud?

WHAT type of cloud(and from which

provider)?

Factors to consider:• Price• Quality• Functionality

YES

YES

FREEDOM IN THE CLOUDPOSITIONING PAPER

cloud platform, without any problems. Customers are always in control, so they will never be forced to retrace their steps. We are not tied to particular suppliers, not even to our own Mission Critical Cloud, and we do all we can to comply with the customer’s specific requirements.

If a customer decides, for strategic or other reasons, to move their application landscape out of our Mission Critical Cloud and to manage it themselves in a private cloud (in-sourcing), we ensure that the retransition goes smoothly. We provide all the documentation, configuration files, and deployment scripts that we have used. Our focus on customer satisfaction is not limited to the time when a customer is using our Mission Critical Cloud; it

also includes the retransition phase, if that is decided.

So choosing our Mission Critical Cloud and the associated orchestration platform is a sustainable solution that prevents vendor lock-in and disinvestments.

Open standards and open sourceOur Mission Critical Cloud and orchestration platform are based on open standards and open source technologies. The Mission Critical Cloud is built on Apache Cloudstack, an open source cloud platform. We have developed our own fork of CloudStack 4 in order to better support mission critical application landscapes. Because we are one of the leading developers of Apache Cloudstack in the world, we have a deep and detailed knowledge of the code and do not rely on support from third parties.

The open source ecosystem is now mature and offers so many functionalities that in practice we can develop solutions much better and faster than with the available commercial technologies, without any loss of freedom. At Schuberg Philis we are active in many open source communities, in the fields of security, orchestration, application delivery, IDM, and CloudStack. We share the knowledge we gain in these communities with our customers and partners.

By using open standards and open source technology, we ensure that an entire application landscape, including mission critical applications, stably in our Mission Critical Cloud.

Legislation and regulation, security and complanceNaturally cloud environments that we create satisfy the very highest standards for availability, integrity, and confidentiality. The same can be said of our Mission Critical Cloud, which is built and managed with a maximum focus on stability, security, and data residency.

At Schuberg Philis we guarantee customers that their data is processed in Dutch data centers. These are all ISO27001 certified and regularly audited. We have written a white paper, together with Allen & Overy, about the many misunderstandings about PRISM, the USA Patriot Act, and the Dutch Protection of Personal Information Act. 5 In relation to our IaaS services, we give our customers an ISAE3000 assurance declaration. This declaration, which provides a detailed picture of the quality of all the relevant operational processes involved in managing our own and our customers’ infrastructure, is evaluated twice a year by external auditors. The

10

SECURE AND COMPLIANT ON EACH LEVELWarranties by Schuberg Philis for cloud computing

APPLICATIONLANDSCAPE

IAAS SERVICES

SCHUBERG PHILISDATA CENTERS

Measures to implement in line with the security survival pyramid

ISAE3000 (SOC2)

ISO27001:2013

FREEDOM IN THE CLOUDPOSITIONING PAPER

underlying ‘Control Framework’ is based on the Cloud Security Alliance (CSA) – Cloud Control Matrix – and on the Trust Services principles of privacy, security, integrity, and confidentiality (SOC2). Schuberg Philis was one of the first outsourcing providers in the Netherlands to obtain this form of certification 6 and we receive the highest audit scores.

Our customers’ security and compliance requirements determine which applications can go on the public cloud and which cannot. The security of all of our environments is guaranteed by measures based on the ‘security survival pyramid’ designed by Joshua Corman of Carnegie Mellon University 7, and it is internally audited every year. These measures ensure that we satisfy the highest criteria of availability, integrity, and confidentiality. We can implement an even higher security level or additional measures on request. This means that stronger security for one customer does not hinder other customers, and the relatively weaker security of one customer does not become a security risk.

Maximum automation of IT processesIn the orchestration platform, the implementation and release of application landscapes in the cloud is automated to the highest possible

degree. This means that changes can be implemented significantly faster and with high and constant quality. That in turn reduces the pressure of operational work for IT managers, so that more time can be devoted to supporting business activities.

Application management in the cloud is making it increasingly easy to automatically test and analyze how a complete application landscape functions. For example, customers and their partners can see data traffic, log-ins, and error messages in real time via the customer portal Connect. We continually monitor the performance of the platform and can detect and solve problems quickly, together with our customers.

The Desired State Infrastructure (DSI) orchestration platform offers automated configuration management, which guarantees consistency across the separate environments for development, test, acceptance, and production. We use the same building blocks for all of our customers in every environment and a new version of a building block is always activated at the same time in all customers’ environments.

In our view, the complete automation of IT processes is the

most revolutionary aspect of cloud computing. It is the basis for all the other advantages that cloud computing brings.

Every customer at their own paceCloud computing is not just a matter of technology; its implementation also requires a change of culture and organizational adjustments. Historic patterns of IT organization, structured according to fields of expertise and the processes of infrastructure management and application management, are not suited to the principles of cloud computing. For cloud computing, IT competencies and IT processes are bundled in teams supporting each application landscape.

A transition to the cloud must always be tailored to the customer. The pace, risk-avoidance, and maturity of an organization determine the speed of a transition process. We not only supply the technology but also support companies during the required changes in culture and organizational structure, to ensure that the organization, like the technology, is ready and able to work in the new situation.

11

FREEDOM IN THE CLOUDPOSITIONING PAPER

This process of digital transformation impacts not only the technology, but also culture and organizational structure, DevOps and application development, as well as security and compliance. In our approach, these four dimensions are inextricably linked to one another in all phases. At the end of each phase we check to see what we have learned, so that we can further refine the plan for the following phase (according to the procedure Plan, Do, Check, Act).

Determining principles and goalsIn the first phase, as much knowledge as possible is gathered about the four dimensions so that the common goals and principles of the transition to the cloud can be determined. What does the customer want? What goals must be achieved, and why? What does their application landscape look

12

6 CLOUD TRANSITION IN PRACTICE A transition to the cloud is a journey that we make to-gether with our customer. In the first phase, the common principles and goals are determined. Then we design the future situation, which is rolled out iteratively in the third phase. In the final phase the new environment is operating and previous IT environments can be dismantled.

THE FOUR PHASES AND DIMENSIONS OF A TRANSITION

PHASE 1:Determining

principles and goals

PHASE 2:Design

PHASE 3:Iterative roll-out

PHASE 4:In production

Technology and architecture

Culture and organizational

structure

Applicationdevelopment and DevOps

Security andcompliance

Detailedknowledge and understanding

Common principles and goals (’DNA’)

Guidelines and principles, Continuous Integration &

Continuous Delivery- concepts

Risk analysis, security survival pyramid

Develop the blueprint and plan

Rough sketch of the culture

and organizationalstructure

Co-creation, short feedback cycles,

‘show, don’t tell’

Security procedures

Monitoring and improvement

Change as the only constant

More direct manage-ment by the business

Automated IT-management

Continuous optimization and audits

Develop building blocks for ‘pockets of

innovation’, roll out the blueprint

Implement newmodels: ‘learning

by doing’

Implementation of Continuous Integration & Continuous Delivery-

concepts

Design and implementsecurity processes,

procedures and checks

FREEDOM IN THE CLOUDPOSITIONING PAPER

like? Where is the organization now? And what does it wish to achieve in the future situation? Which guidelines play a role in the choices it faces?

We conduct documentary research (policies, security guidelines, incidents, requirements of supervisory bodies), analyze the information obtained, and validate and deepen it in the workshops that we organize for each dimension. The participants in these workshops are the most important stakeholders on the customer’s side and the Schuberg Philis engineers who will constitute the customer team.This phase, which varies in length from a few days to several weeks, is the most important of the four. In it we lay the foundations for all that follows.

DesignIn the second phase we make a design for the future situation, which is co-created with the customer. The design includes the shapes of the four dimensions and how they will relate to one another. Among the important decisions are determining which applications and business processes will be placed in each type of cloud. That results in an architecture for the infrastructure and the application landscape. We also determine which service level agreements, security procedures, and quality guarantees are desired. The success of a transformation is determined by how people learn

and how quickly they learn. We accompany them in this change, using ‘learning by doing’ and ‘show, don’t tell’ principles. We select the applications or business processes that we will roll out first. In the following phase, using these ‘pockets of innovation,’ we and the customer can achieve the fastest success and demonstrate the advantages of the new situation.

Iterative roll-outThe roll-out of the blueprint is planned around small, rapid iterations (agile approach). After each iteration the results that have been achieved are demonstrated. In this way, the assumptions behind all the dimensions of the design are validated, step-by-step together with the customer.

Frequent reiterative decision-making creates space for developing insights and enables the organization to learn. The company can adjust course continuously and in a controlled fashion. Where necessary, we develop extra building blocks and improve the business functionality. We also design and implement the necessary security processes, procedures, and checks.Sometimes, in this phase, it becomes apparent that things work somewhat differently in practice than we had thought. By rolling out the blueprint in iterations we can immediately improve anything

that is not yet working. Together with the customer, we develop all the required knowledge for the following phase.

In productionThe goal of the journey has been reached: monolithic and rigid systems have been replaced by flexibly-linked building blocks. A well-functioning application landscape has been created in the cloud, with all the benefits that brings: flexibility, rapid implementation of innovative business ideas, scalability, and extensive automation of IT management.

The route of our journey has followed the principles that were determined in the design phase. Nevertheless, small optimizations will still be required, on both the organizational and technical levels, in the development field, and in relation to security and compliance. Monitoring and improvement always require continuous attention. Our engineers manage the applications in the cloud, under the customer’s direction, with the right people in the right place. Software development takes place on the basis of Continuous Integration & Continuous Delivery concepts. The dynamic of transformation does not end here, as it has led teams and individuals to embrace change as the only constant.

13

FREEDOM IN THE CLOUDPOSITIONING PAPER

The latest version of our orchestration platform draws on technological developments relating to Docker and Kubernetes. Kubernetes is the container orchestration platform, which is supported from Google and is the basis for Google’s Container Engine.

Continuous cloudThese technologies give applications an even more central role and are well suited for use with Continuous Integration and Delivery (CI&CD) methods, which can be implemented with a lower burden of management. This means that software development processes can be accelerated and business issues can be provided with working solutions more quickly.

Cloud native computingThis development also stimulates innovation within the software domain. For example, it is a good starting point for the development of software based on “micro services” and “server-less” computing. This shift is also known as “Cloud Native Computing.” The goal is to develop applications in such a way that they are optimally suited to the cloud, making them future-ready at lower operational cost.

This paper is merely a snapshot of the developments that are playing a role at the time of writing. Important as they are, it is good to know that the Schuberg Philis development team is structured to enable continuous utilization of the latest possibilities in cloud computing.

7 WHAT’S NEXT?Cloud computing is evolving rapidly and the cloud team at Schuberg Philis is continuously exploring, testing and developing new possibilities. The focus is on the far-reaching decoupling of infrastructure from applications. This makes it possible to orchestrate applications in different clouds even faster, better, and more cheaply.

14

FREEDOM IN THE CLOUDPOSITIONING PAPER

About Schuberg PhilisSchuberg Philis is an IT partner that focuses exclusively on the development and orchestration of the application infrastructures that are vitally important for organizations and society. Self-steering teams of experts with a broad authorization work with customers and partners to find solutions for the most complex IT challenges. Their work enables customers to innovate continuously and to seize new opportunities in a rapidly changing environment. For more information about this positioning paper:

Arjan Eriks, Cloud DirectorT +31 (0)6 41 67 46 77E aeriks@schubergphilis.com Author: Daphne RiksenEdition: December 2016

15