Some Cloud services providers are finding that firms aren’t running to them at full-speed to migrate their infrastructure to the ‘new cloud world’ and for some reason, they are delaying decisions. Why might that be?

There are many articles written that suggest security and supplier stability is the biggest barrier, but I think there is another factor  to consider.

Many firms have already invested in their in-house technical infrastructure, often running a virtualised server and storage (SAN)  environment (referred to as a ‘private cloud’). These firms will need a ‘step change’ to help ‘push’ them to a cloud service.  What could a step change be?

• Current data centre runs out of space or requires significant investment. For example, air conditioning replacement, new UPS or a new fire suppression system.
• Current technical infrastructure requires a significant upgrade or replacement due to age, capacity or performance.  For example, if a firm is still operating separate physical servers with no virtualization, migrating to a cloud service would be a good opportunity to reap the benefits of virtualization.
• Premises relocation, which would require an in-house hosted data centre to be rebuilt in a new location.
• Additional premises capacity required by the business, forcing the data centre to move out of the firm’s premises to a hosted service.
• Segregated infrastructure. For example, suppose a firm only hosts and operates systems that are used in-house with no external client access. If a new requirement was to offer Internet facing services, there would be a strong argument to physically separate the different infrastructure.
• Introduction of disaster recovery services.

So that is some of the step changes that would make it the right time to consider cloud services. However, there are situations when a cloud service might be unattractive.

• When the computing capability can be sourced by simply upgrading the current infrastructure.  For example, if additional storage and processing capacity is required, it could be achieved by a relatively low incremental investment in additional disk for a current SAN and an additional virtual server host.
• When the infrastructure that would be replaced by the cloud service was purchased and not fully depreciated. For example: Let’s assume that the firm’s depreciation policy is five years, that the infrastructure cost £100,000 when purchased and has been used for two years. A financial ‘write-down’ of £60,000 would be incurred (the remaining depreciation amount). In many  companies this would be added to the project cost – making it an unattractive proposition financially.
• When the infrastructure that would be replaced by the cloud service is leased and not at the end of the lease period. As with  the previous point regarding depreciation, the remaining lease costs and sometimes an early termination penalty could be added to the project cost – making it an unattractive proposition financially.

I’m not arguing against cloud services – far from it – I am a cloud advocate.  I am suggesting some reasons why firms haven’t rushed to migrate everything to the cloud.

For some Cloud providers, the best marketing strategy could be to ensure prospective clients understand your service capability, then wait until the time is right.

With Cloud based services becoming commoditised, will the smaller players will be able to compete against the likes of Salesforce.com, ProofPoint, Microsoft’s Azure, Office365 and Amazon’s EC2 ?

Last week, we saw the launch of a new and powerful IaaS service (vCloud) from Foreshore (Jersey).  Why would you choose to host your Cloud based services with a supplier who will undoubtedly charge more than a big player such as Microsoft?  It may seem a bizarre question, so here are my thoughts on things to consider before shipping your data to a different location in order to reduce (immediate) costs.

What’s a jurisdiction?

• A jurisdiction is more than just a location. For example, knowing that your Internet transaction processing system is hosted in the USA isn’t enough – you need to know which state(s) it is in and understand the legal and tax implications of those states.
• You need to look at the legal and tax implications of all the relevant jurisdictions, including where you and your business are located, where the hosted servers physically are (including any disaster recovery facility) and also where your hosting provider’s headquarters are.

Client perception

• Where do your clients think their data physically is?
• Do your clients actually care where their data is ? For example, a Trust client may take a keen interest in data jurisdiction, whereas a client of an online shop probably takes no interest as long as their data is secure and their goods are delivered.
• How would your clients react if their data was hosted in a different location to where they thought it was?

Client agreements

• Do any of your client agreements specify the physical location or jurisdiction of their data?
• If you haven’t repapered clients recently and sought their agreement to the changes (if required), you may be bound by legacy client agreements.
• If you have ‘click-wrap’ agreements, this may be easy for you. In other words, if you have the ability to change your agreements and simply republish online for them to become effective.

Legal and regulatory

• Have you ensured that the jurisdiction you are considering for hosting has data protection, regulatory and legal standards at least as high as your current location? For example, would you want to be associated with a non-white listed OECD country by hosting your data there?
• For example, Singapore does not have one unified data protection law. Instead, it is subject to over 140 disparate and  sector epecific statutes that regulate the use and disclosure of personal data.
• Some jurisdictions could have more stringent laws than your current jurisdiction. For example, Germany currently has some of the most onerous data protection laws in Europe. This may place more demands on your organisation.
• How will you maintain compliance across multiple jurisdictions? For example, the storage and processing of payment card data.
• If the relationship between you and the hosting provider turns sour, are you comfortable with the legal process in their jurisdiction? You may need to use it.
• Does your regulatory regime require you to physically inspect the data centre used?
• Microsoft, being a USA company, have confirmed that their European data centres are subject to the USA Patriot act. Are you comfortable with this?

Tax

• Have you taken taxation advice about the jurisdictions, to determine if you will need to pay tax there? You need to think about where you are, where your company’s operations are, where your clicnts are and where you are hosting.
• If you host a transactional website in the USA, it can create a taxable presence for USA federal income tax purposes. Just storing data would not usually be deemed to be conducting business for USA tax purposes, however the activity can be treated as the conduct of business if the non-USA person stores data for the account of others or allows clients or other third parties access to the data. Click here to read an interesting document regarding the USA tax implications - it’s written for Australians but the principle is the same.
• If you are considering hosting in the USA, don’t forget that the USA has fifty states (hence it’s name!), each with it’s own laws and taxation regime. Make sure you know which state(s) your data will be in and how that state’s laws and taxation will impact you. Click here to read about the Amazon challenge on a new California tax as an example.
• If you host a transactional website in Singapore, you could be liable for Singapore tax if it is deemed that your Singapore presence is deemed a permanent establishment – ie you have a fixed place of business in Singapore and you carry-out your business activities wholly or partly through that place. You can start to see that a hosted Internet transaction website could be deemed as taxable in a jurisdiction other than where you may be located. Click here to read an interesting document regarding Singapore tax implications – it’s written for Australians but the principle is the same.
• Is there a double taxation agreement in place between your business jurisdiction and the hosting jurisdiction? You don’t want to pay tax twice !

And finally ….

The message here is that all that glitters is not necessarily the most appropriate for you and your business. An apparently low cost solution may not be the best solution for your business. If all you need is e-mail and Microsoft Office type functionality, then Office 365 could be good for you and your organisation. If you need transaction processing capability, look before you leap to an apparently lower cost supplier and different jurisdiction.

Also read this

• Clouds and data jurisdiction
• Cloud service provider due-diligence
• Real-life advice for adopting private Cloud technology

There’s no denying that Cloud Computing is the latest buzzword, but is it just another way of selling outsourced services?

Firstly, some definitions….

• Outsourcing – this is the contracting out of a business function, normally one previously performed inhouse, to an external provider.
• Cloud Computing service – for this article. I am not referring to a ‘Private cloud’ hosted in a firm’s building. I am referring to a Cloud type service that is hosted outside a firm’s premises – whether that be a Public Cloud or an externally hosted Private Cloud.

There’s no getting away from the fact that if you are using a service provided by a supplier, it is either an outsourced service or very close to being so. However, a Cloud service is so much more than that.

Why would you outsource?

Outsourcing occurs for a number of reasons, typically:

• Supplier can provide a better quality of service
• Supplier can provide service for lower cost.
• The function isn’t the outsourcing company’s core focus. I.e., don’t try and be the best at everything.

Why would you use a Cloud service?

Firstly, it depends on what type of Cloud service you use. Let’s look at two examples.

IaaS (Infrastructure-as-a-Service) services include Microsoft’s Azure platform. and Jersey Telecom’s OneSource. Typical benefits include:

• Avoid upfront investing capital into hardware and software.
• Avoid building Data Centre(s) in your firm’s premises.
• Access to computing resources when your need it – e.g., you may have very spikey/seasonal traffic, such as ticket sales.
• Ability to reduce total computing power, as the multi-tenanted servers will be better utilised than the traditional model of one server=one role.

AaaS (Application-as-a-Service) services include Google Docs, Gmail, Google Calendar, Xero Accounting, Microsoft’s Cloud-based Office365 and Dynamics CRM. Typical benefits include:

• Avoid an upfront investment of capital into hardware and application software.
• Avoid installing bespoke technology for just one system and avoid training technical staff.
• Geographic coverage due to the providers coverage.

You can see from just these two short examples that there are far more benefits to be had from Cloud computing services, than the traditional outsourcing of IT services.

So, getting back to the question….

…. is Cloud Computing just another selling opportunity dreamt-up by the marketing team in a bid to repackage and sell outsourcing services?  The answer is ‘no’ – Cloud computing is far more than that.

There is no doubt that utilising Cloud services is a form of outsourcing, however Cloud computing is a paradigm shift from the traditional hosting model. Don’t dismiss Cloud computing as ‘the latest fad’ or just a ‘passing trend’. Whichever Cloud model is used, there can be many benefits derived when compared with the more traditional outsourcing of IT services.

Application-as-a-service (AaaS)

This is typically a specific and often specialised business system that is delivered over the Internet to a user, typically accessing the application through a browser. While many people associate Application-as-a-service with ‘vertical’ enterprise applications such as Salesforce, office automation applications are also Applications-as-a-service, such as Google Docs, Gmail, Google Calendar and Microsoft’s Cloud-based Office365 or Dynamics CRM.

Also read this article.

Data as a service

It could be argued that this service has been with us for some time now – for example Interactive Data’s pricing services.  Data/Information-as-a-service provides data on-demand using well defined interfaces such as an API.

Data-as-a-service is typically provided to a company by an external service provider. However, large corporations can benefit from scales of economy by aggregating data and disseminating it within it’s ‘child’ companies.

There are two types of Data-as-a-Service; private data and public data.

• Private data is typically paid-for access to valuable data that isn’t readily available in the public domain. Examples include live stock price information, address and post code/zip code validation, and credit reporting. This type of service is not new and has been provided for years by companies such as Interactive Data.
• Public data is a newer service and is typically formatted data in the public domain. For example, the Google Public Data Explorer allows you to incorporate demographic data with your company’s sales figures to perform powerful statistical analysis.

Data Centre-as-a-service

Refer to Infrastructure-as-a-service.

Database-as-a-service

This provides the ability to use the services of a remotely hosted database, sharing it with other users, and having it logically function as if the database were local. Different providers have different models, but the advantage of this service is to be able to use database technology that would typically be a significant cost in hardware and software licenses if hosted in-house.

Desktop-as-a-service (DaaS)

Also referred to as ‘virtualized desktops’. A large cost for firms is the purchase, deployment and subsequent management of desktop PC devices – especially in remote offices. Desktop-as-a-service can help alleviate these costs and headaches, by offering a virtualized desktop that runs ‘in the Cloud’.

There are operational considerations, such as the fact that the users need physical devices to access the Cloud-delivered desktop. However, these can be low-cost, low-maintenance locked-down thin clients.

Also read this article.

Governance-as-a-service

Refer to Management-as-a-service.

Hardware-as-a-Service

This term seems to have faded out of use now. It referred to the ability for companies to avoid purchasing hardware when they could ‘rent’ services from cloud platforms such as Amazon’s EC2.

Identity-Management-as-a-service (IMaaS)

This is an area that has the potential to grow significantly. It covers the identification of users and ensuring they receive only the access levels that they should have. That sounds easy, but how do you know that a remote user is really who they say they are?

This service  provides access control and audit capability for multiple SaaS, Public Clouds and Private Clouds, whilst at the same time giving users the benefit of single-sign-on (SSO).

An example of a service in this area is Symplified.

Information-as-a-service

Refer to Data-as-a-service.

Infrastructure-as-a-service (IaaS)

This is also referred to as Data Centre-as-a-service, this is the ability to remotely access computing resources. In essence, you lease a physical server that’s yours to do with as you will, and for all practical purposes it is your data centre, or at least part of a data centre. The difference with this approach versus more mainstream cloud computing is that instead of using an interface and a metered service, you’re getting access to the entire machine and the software on that machine.

In short, it’s less a packaged solution and more akin to ‘traditional’  hosting.

Also read this article.

Management-as-a-service and Governance-as-a-service

This is an on-demand service from a Cloud service provider that allows the management of one or more Cloud services.  Typically, these are simple things such as systems topology, resource utilisation, virtualization management and up-time management.

management/governance systems are now becoming available, such as the ability to enforce defined policies on data and services and report on SLA and service metric compliance.

Platform-as-a-service (PaaS)

This is a complete platform that is delivered through a remotely hosted (Cloud) platform to subscribers. It can include application development, interface development, database development, storage and testing.  It is based on the traditional timesharing model and modern Cloud Platform-as-service providers provide the ability to create enterprise-class applications for use locally or on-demand for a subscription price or free that is typically less than hosting it in-house yourself. An example of this is Microsoft’s Azure platform.

Also read this article.

Process-as-a-service

This refers to a remote resource that can aggregate many resources together, such as services and data, whether hosted within the same cloud computing resource or from separate providers, to create business processes.

You can think of a business process as a Meta application that spans different systems, leveraging key services and information that are combined into the correct business sequence to form a process. These processes are usually easier to change than applications, and thus provide agility to those who use these process engines that are delivered on-demand.

Security-as-a-service

As the incidence of viruses, malware, attacks and email phishing increases day-by-day, the job for the IT team to protect a firm gets more and more complex. Security-as-a-service is starting to become an attractive proposition, as it’s a method of outsourcing a headache for management by experts.

For this to work, all Internet connectivity for the firm needs to be routed through the service provider. Failure to do this could result in an unmanaged ‘unlocked back door’ into your firm.

Examples of Security-as-a-Service providers are McAfee, Zscaler and Symantec’s MessageLabs who have been providing this service for some years.  Click here for a high-level review of service offerings.

Software-as-a-service (SaaS)

Refer to Application-as-a-service.

Also read this article.

Storage-as-a-service

Also known as ‘storage on demand’ or ‘disk space on demand’.

This is the ability to use storage that physically exists at the remote Cloud service provider but logically appears as local storage resource to any application that requires storage. Apple’s MobileMe iDisk service is an example of Storage-as-a-service..

Testing-as-a-service

This is a service that allows the testing of local or Cloud-delivered systems using testing software and services that are remotely hosted by the Cloud services provider. Note that while a Cloud service requires testing itself, Testing-as-a-service services can test other Cloud applications, Web sites and even internal enterprise systems.  They do not require a capital investment  in hardware or software within the enterprise, for something that may only be used for a limited period of time.

Before signing-up to use a Cloud hosting or backup services provider, it is really important to determine who is the best supplier for your needs. Here are some suggested questions to ask to help you decide if they are the best supplier for your needs.

Please note that this is not an exhaustive list – it is to help get you started – make sure you tailor it to your organisation’s requirements.

.

Data location

1. Where will my data be located?
2. Do you distribute your systems or load balance in such a way that my data could reside in a different jurisdiction? If so, where are these jurisdictions?
3. If you perform backups, where is the location of the backup storage site?

For more information about data jurisdiction and why it matters, click here.

.

Security of your data

You must ensure that the service provider will protect your data. The security of your backups needs to at least match the security you place around your client data. Imagine you want to steal a company’s data – targeting the backup media would be so much easier that trying to hack into individual systems and copy data from them.

As a real-life reminder of this, In August 2010, the UK’s Financial Services Authority (FSA) hit the UK arm of Zurich Insurance with a record £2.275 million fine for the loss of a backup data tape containing the details of 46,000 clients.

1. Describe the physical security of your data centres.
2. Is my data encrypted on your systems?
3. What level of encryption is used?
4. Who can decrypt it and who has access to the decryption keys?
5. Who has access to my data?
6. Are your backups encrypted when stored on media?
7. What level of encryption is used for the backup media?
8. For the backup media, who can decrypt it and who has access to the decryption keys?
9. Is the backup media securely stored in a site other than the live hosting site?
10. Where is the location of the backup media storage?
11. Does the site used for backup media storage have the same physical and logical security as the live hosting sites?
12. If the backups are transported from one site to another (such as a courier), what physical security is used?
13. If my backups are transmitted to another site, are they encrypted during transmission?
14. What level of transport encryption is used?

.

Service continuity

1. What is your business continuity and disaster recobery strategies?
2. How many different power sources supply your hosting site?
3. Do you have UPS protection with automatic cut-in in the event of a power failure?
4. Do you have generator protection with automatic cut-in in the event of a power failure?
5. How often do you test the UPS and generator?
6. When was the last time your hosting site suffered a complete loss of power?
7. When was the last time that one of your clients suffered an outage due to the loss of power?
8. Do you have an alternative hosting site that you can automatically switch to in the event of an issue?
9. How many different and diversely routed Internet connections do you have?
10. In the event of an Internet service providers connection failing, can all your services be provided on the other Internet connection(s)?
11. When was the last time your hosting site suffered a complete loss of Internet connectivity?
12. When was the last time that one of your clients suffered an outage due to the loss of Internet connectivity?
13. Is your Internet connectivity protected from DOS or DDOS type attacks?
14. Have you experienced a DOS or DDOS type attack and how were your clients impacted?
15. If your service (including your hosted clients and applications) is attacked/hacked in any way, how quickly do you inform me and how is it reported?

.

Backup related questions

1. Are yours systems backed-up?
2. Is my data backed-up? (This may seem like a bizarre question, but if your provider suffers a major systems failure, you could lose your backups that you need for legal of regulatory purposes).
3. How often is my data backed-up?
4. What is the backup retention policy?
5. Can I determine the backup retention policy of my data?
6. What media is it backed-up to? (Remember this could be disk-to-disk).
7. If backup is to disk, is this storage on completely separate infrastructure and in a different location to the hosting service? (This question is if you are looking at using a backup service from the same hosting provider).
8. How often is testing performed of recovering your systems from backup media?
9. How often is testing performed of restoring data from backup media?
10. Can I copy my backups to an external source?
11. Can I perform an ad-hoc backup when I need to? (For example, before a significant system change).
12. Can I restore an individual object (such as a file) from a backup?
13. Are ‘open file’ backups supported?
14. Are my e-mail system(s) supported?
15. Are the database(s) that I use supported?
16. Do you support incremental backups?
17. Can I select whether I perform a full or incremental backup?
18. If a send/receive of data to/from yourselves should fail, is there a ‘transmit from failure point’ option or will it start at the beginning again?
19. Who has access to my backed-up data?

.

Accessing data

1. How do I send you my data in order to get started?
2. What level of transport encryption is used?
3. How do I access my backed-up data?
4. How quickly can I get access to my backed-up data?
5. Do you object to my company or an independent technical auditor from validating the backups on a regular basis?
6. If necessary, is it possible to transport large backups on physical media to aid a fast recovery?
7. Is it possible to perform data mining on my backup data (for example in legal data discovery), or do I need to restore it to my systems first?

.

Cost of service?

1. How do you charge for the hosting service?
2. How do you charge for the backup service? (Make sure you calculate the likely tariffed cost for the service, taking into account your data volumes, backup frequency and retention period).
3. Is there a charge for each system I backup from (such as backup agent software).
4. Is there a charge for accessing or restoring backed-up data?

.

General questions?

1. Are your services and those of your sub-contractors/partners, SAS70 compliant?
2. Do I retain exclusive ownership of my data at all times, including after the end of a contract?
3. Do you own and run your own data centres? If not, please give details of the underlying service provider.
4. What accreditations does your organisation have?
5. Has your organisation won any awards relevant to the service to be provided?
6. What type of employee/contractor/services provider screening do you perform before you hire or contract with them?

.

Also read this….

• Clouds and data jurisdiction
• Cloud-based backup services

.

And finally….

A key indicator of a providers service will be how they respond to your questions. If you have an open dialogue with them, it’s a good sign.

Remember that a supplier’s pre-sales service is nearly always better than after-sales …. so if you’re not happy before you sign-up – don’t do it !

.

.

Performing backups, checking them, testing restores, securely transporting and storing the backup media all take operational time and expense. Cloud-based backup services aim to alleviate some of the operational challenges, although not all of them.

.

What is a ‘Cloud backup service’?

Simple Cloud-based backup solution

Some people regard Cloud backup services as a ‘Software as a Service’ (SaaS). However, it can also be configured as ‘Infrastructure as a Service’ IaaS and can be implemented in a hybrid cloud model.

Cloud-based backup services have been around for some time now, albeit without the ‘Cloud’ prefix. Many of these managed services are now mature and worth considering. However, before taking the jump, here are some notes about the use of online backup services.

.

Advantages over traditional ‘in-house’ backups

• Storage capacity is highly scalable. Subject to the service provider’s capability, the upper storage limit can be very high and is unlikely to be a restrictive ‘glass-ceiling’ for most companies. This is of course, subject to your willingness to pay the increased storage charge.
• Removes the need to invest and maintain in-house backup hardware and software infrastructure. This is of particular interest to those who object to paying for the backup software agents at a cost close to the underlying operating systems itself.
• Billing of service use is normally on a ‘pay-as-you-use’ model. This means you don’t need to purchase expensive infrastructure just-in-case you need it. The ‘pay-as-you-use’ model also has its drawbacks (see disadvantages).


Cloud-based backup solution for distributed sites

• If you have the challenge of many small sites, each with their own servers and data, this can be a method of centrally controlling the backups and making sure they are performed properly from sites with no IT presence. This is a good way of reducing one of the risks of a distributed data computing model.
• Backed-up data is accessible from anywhere with an Internet connection. For example, if your primary site had a disaster that meant you couldn’t access it, you would be able to access the backed-up data from an alternate location to recover your systems.
• Avoids the need to securely transport your backup media to an alternate location for safe storage.

.

Disadvantages of Cloud-based backup services

• If you are backing-up from systems hosted at your premises, large Internet bandwidth is needed to accommodate the high volume of data being transferred. See below for more on this subject. If you use a Cloud backup service to backup a different Cloud hosted service, the data will flow between the two providers, meaning you don’t need to worry about bandwidth at your premises.
• Your company will have a view about the perceived and actual risk of your data residing on third-party infrastructure. Don’t take the decision to use Cloud-based backups yourself – involve your company’s Compliance, Risk and Legal teams with the due diligence to ensure they are comfortable with such a change.
• If the available window of time to perform backups isn’t currently enough, it’s unlikely that a Cloud-based backup service will solve this on its own.
• Most of the Cloud-based backup providers base their charging structure on a ‘pay-as-you-use’ basis. In other words, the more data you have backed-up on their systems, the more you pay. On first looks, this seems good. However, beware because a seemingly low charge can quickly mount-up.

As an example; when using tape backup media, if you needed to take a backup, it would cost you the cost of a tape – you could then keep it for as long as you required. Using a Cloud-based backup service, you will have a recurring charge for as long as you keep the backup.

.

What Cloud-based backup services won’t do for you

Before you run-out and sign-up for a Cloud backup service, remember that it won’t solve all your problems. Here are some backup related activities that you will still need to do:

• Daily checks to ensure backup processes completed normally.
• Regular restore testing to ensure backups are complete.
• Regular house-keeping of your servers and backup schedule to ensure you aren’t backing-up redundant data.
• Install and upgrade backup agent software on your servers.

.

What to look-out for

Internet bandwidth

If you are backing-up from systems hosted at your premises, large Internet bandwidth will be needed to accommodate the high volume of data being transferred.

Many providers offer software agents that perform incremental backups; this will reduce the size of your backup and the transfer time needed. You should always bear in mind however that there will be times when you need to perform a full backup, so make sure your Internet bandwidth gives you enough transfer time.

If you use a Cloud backup service to backup a different Cloud hosted service, the data will flow between the two providers, meaning you don’t need to worry about bandwidth at your premises.

.

Data storage charges

On first sight, Cloud based backup services look like a good financial option. However, here are two examples of the charges that may be incurred.

Example one – backup your own personal important data. Let’s make some assumptions:

• Your treasured important data and photos take-up 2Tb. For calculation simplicity, this size doesn’t increase.
• You want to keep two full backups online, in case you need to go back in time to retrieve something.
• You use the ‘Mozy Home’ service, which charges USD$54.45 per annum for ‘unlimited’ storage space (the first 1Gb is free).

Your annual charge would therefore be USD$54.45 or USD$272.25 over 5 years.

Example two – backup your corporate data. Let’s make some assumptions:

• Your corporate data takes 2Tb (a modest amount). For calculation simplicity, this size doesn’t increase.
• You take a backup on each day of the month (1 full backup plus 30 incremental backups).
• For regulatory and legal reasons, you need to keep a full backup from the last working day of every month – these cannot be incremental backups. These need to be kept for a minimum period of 10 years.
• You have 10 servers to backup from
• You use the ‘Mozy Pro’ service, which charges USD$6.95 per server and USD$0.50 per Gb.

Your charge would be USD$1.6M over 5 years. If we make an assumption that the supplier can process incremental data changes, the cost would reduce to USD$174,420 (assuming 5% data change per month).

As you can see, what appears to be a reasonable cost quickly mounts-up when backing-up and retaining corporate data backups. I know that at this point, some providers will say that their incremental backup features are able to reduce space and ‘rebuild’ the required end of month positions. Some products have very sophisticated features (here is an example from Jersey-based Foreshore). If you are going to use an incremental feature, test it first (as you would with in-house backup software), to ensure it meets your needs.

Make sure you calculate the realistic charges for using the service and compare it to the cost of a traditional in-house backup solution.

.

Understand your backup requirements

This may sound obvious, but do you really understand what data you should be backing-up?

• Your business sector is likely to have specific legal and regulatory requirements. If you have a Compliance or Legal team in your company, ask them for their understanding of the requirements.
• You probably have test databases that could be recreated, so they don’t need to be backed-up.
• Different types of data may have different retention periods. For example, voice recording may not need to be retained as long as transactional data. Keep the data with different retention periods separate from each other, as this will ease the exercise of removing backups at the end of their retention period.
• Don’t retain backups for longer than you need to. Not only is there the cost, but if you need to perform a legal discovery, you may need to search all the backup copies you have. Keeping the minimum needed will shorten this process.

.

Make sure your data is securely stored

Don’t be lulled into thinking that the choice of Cloud backup service provider needs less attention than choosing a Cloud hosting provider. Both are storing your data and providing a service. You must apply the same level of detailed due diligence to ensure the provider will treat your data securely and can provide you with the service and features you need.

Remember that your backup needs to be as secure as your primary data.

.

Data jurisdiction

You must take as much care with the location of your backup data as you do if selecting a service provider for Cloud hosting. Read this article for more information on data jurisdiction.

Make sure the supplier commits to where your data and systems will be located, including any copies or online/offline backups.

Jurisdictional issues can often be circumvented by encrypting the data and encrypting the network transport. However, ensure you get legal opinion on this before committing to a service.

.

Also read this….

• Jurisdictions and Cloud data
• Cloud service provider due-diligence

Sample of Cloud backup service providers ….

• Foreshore Online Backup – aimed at companies, hosted in Jersey
• Mozy – aimed at individuals and companies. Part of EMC
• Carbonite – aimed at individuals
• Zmanda – aimed at companies. Stores your data on Amazon Z3
• IBM’s (snappily named) Information protection Services – aimed at companies

.

And finally

When choosing a Cloud backup service provider, don’t base your decision on cost alone. There are other important factors such as security, features and service. It’s generally true that the more you pay, the more tailored service and more personal service you will get.

Don’t be tempted to try-out a free or low-cost solution with your corporate data. You must ensure that any security and jurisdictional matters are understood first.

Cloud-based backup services have been around for some time now, albeit without the ‘Cloud’ prefix. Many of these managed services are mature and worth considering. Before taking the leap, make sure you fully understand the charging structure and what your bills are likely to be over a period of time given the backup retention period required.

It’s interesting to watch Cloud Computing as it moves through the cycle. There has been a period of resistance from many companies in adopting it, particularly the banking sector. A press release this week could see an early adopter of the services encourage other financial institutions to seriously consider migrating to cloud-based services.

This week, the Japanese Bank Sugamo Shinkin has announced that it has selected IBM to develop a virtual client environment, utilising IBM’s ‘Smart Business Desktop Cloud’ service.

The bank plans to migrate 900 desktop PCs from its 45 sites to the new cloud environment, with the first 200 set to start using it this month and the rest shifted by the end of the year.

The bank will initially start the desktop cloud operation with 200 client terminals in five sites from August 2010. The migration of all 900 PCs at 45 sites will be completed by the end of the year.

Previously, the bank needed to configure the PCs at 45 sites separately. The cloud based virtual desktop environment will need just one update on the server. Security will also be improved, by centralising  and securing the data.

IBM say that by using their ‘Smart Business Desktop Cloud’, Sugamo Shinkin Bank will improve their security and significantly increase operational efficiency.

Also read ….

• Desktop as a service (Daas)
• Cloud Computing – why is everyone so excited?
• Clouds and data jurisdiction

That shiny new cloud is just so tempting. At just the click of a button, you can move your corporate data to it and enjoy the financial and operational benefits. But wait – before moving any data to the cloud, make sure you fully understand the legal and regulatory implications of doing it, especially the jurisdiction where your data is to be located.

The issue of data jurisdiction has always been with us – it’s not a new ‘cloud’ thing. However, with cloud services excitement reaching fever-pitch, it’s a good opportunity to discuss it again.

If, up-to now, your data has all been hosted by your company in the same jurisdiction and all your users are in that jurisdiction, then you probably haven’t had to think about this before. Read on ….

.

What’s the difference between a jurisdiction and a country ?

I know it sounds like the start of a nerdy joke, however …. a jurisdiction refers to a bounded space that is subject to its own laws and regulation. In some instances a jurisdiction is a country. For example:

• The USA is a country, but its different states have their own laws, which means the USA has multiple jurisdictions (albeit also with USA-wide laws and regulation).
• England is a country and a jurisdiction. Its laws and regulations covers its entirety.
• Jersey in the Channel Islands is not a country but has its own laws and regulations, so is a jurisdiction. Before you ask, Jersey is neither a country, or part of England !

.

Why should I care where my data is ?

If you have a responsibility for IT or hold a senior position in your organisation, you have a responsibility to ensure that your data is stored in a jurisdiction that has data protection laws at least as strong as your current jurisdiction. I used the term ‘data protection’ in lower-case deliberately, as I refer to the wider laws and regulation that govern the protection and access to data in a jurisdiction. This includes the jurisdictions actual Data Protection law.

Here are a few examples of why you need to care where your data is hosted:

• For non-Americans who host their data in the USA, they must be aware of the USA Patriot Act. This law presents two issues regarding data stored in the USA.
  • Firstly, USA law enforcement agencies can access your hosted data in the USA if they consider it ‘relevant’ to their investigations. This is much easier to meet than the usual ‘probable cause’ test.
  • Secondly, if your hosted data in the USA is accessed by the USA law enforcement agencies, the data holder (the cloud service provider based in the USA) is not permitted to tell the non-USA data owner (that’s you) that their data has been accessed, even if the cloud service supplier is contractually bound to advise them.
• Law protection authorities in many locations (as mentioned above for the USA) can seize your data with the relevant orders. For example, suppose your cloud service provider hosted a business that wasn’t as law abiding as your company. If the local law protection authorities raid the cloud service provider and take all the equipment – they are unlikely to be interested in the fact that other clients are using that equipment – they want to ‘catch their man’.
• If, during an investigation, a law enforcement agency seized a server in their jurisdiction, but it contained data about your clients in a different jurisdiction, would this infringe your clients data protection rights and would you be breaking the Data Protection law for locating the cloud service there ?
• Some regulatory authorities take the view that they either regulate or have a responsibility for businesses whose data is stored in their jurisdiction.
• Some jurisdictions consider the tax on a transaction to be borne in the jurisdiction that the transaction was made. For some automated transactions, such as online gaming, this is often where the processing is performed. Therefore, beware of the location where your processing and data is based. This is why some companies are attracted to particular jurisdictions for transaction-based tax reasons.

.

How do I know where my cloud data is ?

There is only one sure way – ask the cloud service provider.

With commodity cloud service providers, you will have a non-negotiable clickwrap contract. All you can do with this is read it and accept or reject it – there is no negotiation.

Some commodity cloud service providers are not so forthcoming about their locations, but many are open with you about their jurisdictions. For example, Amazon’s ECC is available in USA East (Northern Virginia), USA West (Northern California), European Union (Ireland), and Asia Pacific (Singapore). Mimecast, as another example offers its clients a choice of jurisdictions.

If you can’t determine which jurisdiction(s) your data will be hosted in, you have to work on the assumption that your data is hosted ‘somewhere’. That makes the decision to use the cloud computing service more difficult, as you don’t know where you data will be located and which laws and regulations will apply.

Here are a few things not to do, in order to try and find the cloud providers jurisdiction(s):

• Don’t try to use traceroute to pin the website to an IP address and location. Most large cloud service providers have data centres in different locations and countries and dynamically move processing and content between them to optimise performance and network utilisation.
• Don’t assume that your data is at the cloud service providers office address or even in that jurisdiction.
• Don’t assume the data is stored in the location denoted by the URL address. E.g., a website suffix of .com doesn’t mean the cloud service is located in the USA.
• Unless specified, don’t assume the cloud service provider only uses their infrastructure. Some host their infrastructure on an underlying provider.

.

Can I host my data outside my jurisdiction ?

As you will have gathered by now, it’s not a straight forward ‘yes’ or ‘no’ answer. It depends on your location, the cloud service providers data location(s), the laws and regulations in those locations and any client contracts/agreements you may have.

• Make sure the new jurisdiction has data protection laws at least as strong as your current jurisdiction. This refers to the wider laws and regulation that govern the protection and access to data in the jurisdiction, including the jurisdictions actual Data Protection law.
• If transaction processing will happen in another jurisdiction, make sure that your taxation position isn’t impacted.
• If you are a licensed or regulated services provider, make sure that your current jurisdiction’s regulator is happy with your chosen data location.
• If you are a licensed or regulated services provider, make sure that you won’t be subject to the regulator in the new jurisdiction and that you won’t be required to have additional license(s) to operate from that location.
• Make sure there is nothing in your terms and conditions or client agreement/contract that would prohibit you moving data to a different jurisdiction. For example, banks that acquire clients from another bank can find that the client agreements are old and commit to the client’s data being in a particular jurisdiction.
• Don’t forget to find out where the cloud suppliers contingency site is and if they use backup media and where that is stored. If these are in different jurisdictions, you need to be aware.

.

Possible solutions

The obvious solution

The obvious solution is to use either a ‘private cloud’ or a ‘public cloud’ in which the supplier guarantees the location of your data.

Jurisdictional cloud computing services tend to be more expensive but are gaining popularity, for example, the OneSource service from Jersey Telecom and Virtustream.

More complex solutions

Clients of cloud computing infrastructure services tend to encrypt the data held at the hosting provider. This means that the cloud services provider is a custodian of the data and has no part in its use. Whilst encryption is easy to implement for infrastructure level services such as IaaS, PaaS and DaaS, it is more difficult at the software provision level (SaaS).

Another solution is to use ‘hybrid cloud’. This extends the cloud into the infrastructure in your premises. The cloud service provider would install a server in your premises which keeps sensitive data in your jurisdiction and under your control. The sensitive data is still stored in the cloud service, but in a tokenised form.

An example of this is PerspecSys who have implemented such a solution with Salesforce.

.

Also read ….

• Cloud Computing – what is everyone so excited ?
• Cloud-based backup services

.

And finally ….

If you have read this far and are still looking for the answer as to whether you can move your data to a cloud, you will have gathered that it’s not straight-forward to answer. It depends on your location, the cloud service providers data location(s), the laws and regulations in those locations and any client contracts/agreements you may have.

Please note, I am not qualified in legal or tax. These are guidelines based on my personal experience. If in doubt, get professional legal advice. Data jurisdiction, taxation, law and governance is a complex matter. A relatively small amount spent on good legal advice will be much less than a lawsuit later-on.

.

.

DaaS is an outsourced service offering in which a service provider hosts the infrastructure and storage to deliver manage your company’s desktop devices. For many people, DaaS is more difficult to understand than IaaS, PaaS or SaaS. This is probably because IaaS, PaaS or SaaS are all server focused and it is easy to envisage a remote third-party hosted servers service, however it is not so easy to envisage how the ‘PC on my desk’ can be virtualised and run remotely.

DaaS uses desktop virtualisation or VDI (virtual desktop infrastructure) to deliver a standard desktop to the users in your company. The desktop (or laptop) device used to access the service can be a ‘thin client’ which means there is very little infrastructure required at the company premises. 

DaaS services are usually accessed by the Internet or in some cases, by a private network.

.

What is the relationship between Cloud Computing and DaaS ?

Cloud Computing is a generic term that describes shared computing resources that can be dynamically scaled according to business requirements, faster than traditional computing environments.

DaaS is one delivery model of Cloud Computing. Refer to these articles for information about other delivery models: IaaS (Infrastructure as a Service), PaaS (Platform as a Service) and SaaS (Software as a Service).

Service delivery options

SaaS is offered through a number of different delivery options, such as Public cloud service, Private cloud, Hybrid cloud and managed cloud.

Refer to this article about Cloud Computing for further information.

.

What are the benefits of using DaaS ?

• The up-front cost of introducing desktop infrastructure is reduced, as the usual capital investment in hardware is replaced by a monthly ‘usage’ charge. The economic benefit of this should be verified to account for the services used and data volumes.
• The cost of using the system (should be) less than the cost of hosting it yourself, when taking into account all the infrastructure costs such as hardware, software, backups, contingency provision and ongoing upgrades and maintenance.
• Provides a standard desktop that is secure and locked-down for the users in your company.
• Cost of deploying and upgrading an application can be lower than installing on separate desktops.
• Desktop devices last longer. This is because they are almost a ‘dumb screen’ and don’t need significant processing power, therefore they won’t need upgrading to cope with new applications.

.

What should I be aware of before using DaaS ?

• The desktop is usually ‘locked-down’ to some extent, meaning that changes to its configuration will be restricted. If your company has ‘power users’ who have the ability to change their desktop and install software, this solution is unsuitable.
• Deploying a non-standard application may not be possible or may incur charges from the supplier.
• Multi-media applications that demand high processing power or fast graphics capability don’t tend to work well.
• Attaching non-standard peripherals may be difficult, such as USB devices, dongles and bank security card readers.
• Perform due-diligence on the supplier to ensure they are financially stable and have security and operational policies and procedures in place that are at least as comprehensive as those of your company.
• Ensure you know where your data is. Many companies have a legal and regulatory obligation to know exactly where their data is.
• Ensure you know who has access to your data at the service provider. You don’t want a disgruntled employee of the service provider taking a copy of your client database.
• Ensure the data is encrypted on the service provider’s servers and on their backups.
• Ensure the backed-up data is available for you to recover from as a result of an issue caused by your company. For example, many Cloud service providers perform regular backups, but will only restore if they suffer a problem. This won’t help you if you accidentally delete some of your data.
• Ensure you understand the legal and regulatory requirements that you must comply with. For example the retention of month-end backups.
• Ensure the infrastructure is configurable to meet your needs ‘out of the box’. For example, make sure you have the ability to restart servers and install software as you need to.
• Understand how upgrades to the operating system software are applied and whether you have the opportunity to test your business systems on the new version before it is implemented for live use.
• Understand how the system and its security will be integrated into your company’s existing infrastructure.
• Delivery of the service is totally dependent on the performance and stability of the network. Make sure that both the company premises and the hosting provider have sufficient capacity and diverse routing to cope in the event of a failure.

.

What is the financial impact of using DaaS ?

Financially, the significant difference of Cloud Computing to the traditional model of owning your own servers, is that Cloud Computing is typically charged on a pay-as-you-use operating expense instead of a capital investment. This may suit many companies, as they can very quickly get access to significant computing power and capacity for no capital outlay. However, tight control needs to be kept on the use of the services, as it is easy to expand and hence increase ongoing charges.

Charges are typically based on the number of virtualised desktops, the amount of network traffic and the data storage space used.

Watch-out for the network traffic charge. Often this is capped at an amount per month. If your Cloud Computing has public access, the network usage could be out of your control and you could end-up paying an excess network usage cost.

.

Examples of DaaS

An example of DaaS is the OnePoint Office managed desktop service from Jersey Telecom.

.

Do I still need an IT capability in-house ?

It depends on whether the server-side infrastructure is hosted externally. It would be unusual to outsource DaaS and not the server-side. If both sides are hosted externally, the in-house IT capability changes to one of ‘box swapping’ when a desktop unit fails because activities such as hardware maintenance and backups transfer to the service provider. The role of IT changes to be less engineering focused and being closer to the business.

Also read ….

• Cloud Computing – what is everyone so excited ?
• Infrastructure as a Service (IaaS)
• Platform as a Service (PaaS)
• Software as a Service (SaaS)

.

IaaS is an outsourced service offering in which a service provider hosts the base infrastructure and storage. Using these base infrastructure services, you can install the servers and services you need to run for your business although many providers will also provide this as a service.

Typically, the infrastructure will be delivered using virtual infrastructure which allows the service provider to better utilise hardware and hence offer the service at a lower cost than the traditional ‘host your own servers’ method.

IaaS services are usually accessed by the Internet or in some cases, by a private network.

.

What is the relationship between Cloud Computing and IaaS ?

Cloud Computing is a generic term that describes shared computing resources that can be dynamically scaled according to business requirements, faster than traditional computing environments.

IaaS is one delivery model of Cloud Computing. Refer to these articles for information about other delivery models: DaaS (Desktop as a Service), PaaS (Platform as a Service) and SaaS (Software as a Service).

Service delivery options

SaaS is offered through a number of different delivery options, such as Public cloud service, Private cloud, Hybrid cloud and managed cloud.

Refer to this article about Cloud Computing for further information.

.

What are the benefits of using IaaS ?

• The up-front cost of introducing infrastructure is reduced, as the usual capital investment in hardware is replaced by a monthly ‘usage’ charge. The economic benefit of this should be verified to account for the services used and data volumes.
• The cost of using the system (should be) less than the cost of hosting it yourself, when taking into account all the infrastructure costs such as hardware, software, backups, contingency provision and ongoing upgrades and maintenance.
• Improves the agility of IT services, by being able to quickly obtain additional computing processing power and storage capacity. Many companies use IaaS as a testing environment where they need additional computing facilities for a short period of time.

.

What should I be aware of before using IaaS ?

• Perform due-diligence on the supplier to ensure they are financially stable and have security and operational policies and procedures in place that are at least as comprehensive as those of your company.
• Ensure you know where your data is. Many companies have a legal and regulatory obligation to know exactly where their data is.
• Ensure you know who has access to your data at the service provider. You don’t want a disgruntled employee of the service provider taking a copy of your client database.
• Ensure the data is encrypted on the service provider’s servers and on their backups.
• Ensure the backed-up data is available for you to recover from as a result of an issue caused by your company. For example, many Cloud service providers perform regular backups, but will only restore if they suffer a problem. This won’t help you if you accidentally delete some of your data.
• Ensure you understand the legal and regulatory requirements that you must comply with. For example the retention of month-end backups.
• Ensure the infrastructure is configurable to meet your needs ‘out of the box’. For example, make sure you have the ability to restart servers and install software as you need to.
• Understand how upgrades to the operating system software are applied and whether you have the opportunity to test your business systems on the new version before it is implemented for live use.
• Understand how the system and its security will be integrated into your company’s existing infrastructure.
• Delivery of the service is totally dependent on the performance and stability of the network. Make sure that both the company premises and the hosting provider have sufficient capacity and diverse routing to cope in the event of a failure.

.

What is the financial impact of using IaaS ?

Financially, the significant difference of Cloud Computing to the traditional model of owning your own servers, is that Cloud Computing is typically charged on a pay-as-you-use operating expense instead of a capital investment. This may suit many companies, as they can very quickly get access to significant computing power and capacity for no capital outlay. However, tight control needs to be kept on the use of the services, as it is easy to expand and hence increase ongoing charges.

Charges are typically based on the number of virtualised servers, the amount of network traffic and the data storage space used.

Watch-out for the network traffic charge. Often this is capped at an amount per month. If your Cloud Computing has public access, the network usage could be out of your control and you could end-up paying an excess network usage cost.

.

Examples of IaaS

An example of IaaS is the OneSource service from Jersey Telecom and Virtustream.

.

Do I still need an IT capability in-house ?

The quick answer is ‘yes’. With an IaaS service, there is still the need to support all the IT infrastructure, the main change is that the server-side hardware is hosted elsewhere, so activities such as hardware maintenance and backups transfer to the service provider.

Also read ….

• Cloud Computing – what is everyone so excited ?
• Platform as a Service (PaaS)
• Software as a Service (SaaS)
• Desktop as a Service (DaaS)

.