Head in the clouds
by Carol Hildebrand // illustration by Ian Whadcock
The long-range forecast: Cloud computing is here to stay.
Buoyed by the promise of cost flexibility and lower IT maintenance, the worldwide revenue outlook for cloud services last year was US$17.4 billion, according to research firm IDC. And that number is expected to jump to US$44.2 billion by 2013.
Not wanting to miss out, nearly every IT company is angling for a piece of the action. In January, tech titans HP and Microsoft announced a $US250 million pact aimed at advancing cloud computing.
“I've been amazed by the rate of uptake on this,” says Larry Beck, senior director of cloud strategy at Avanade, a business technology services provider in Seattle, Washington, USA.
Loosely defined, cloud computing allows companies to scale up their IT resources via virtual servers, without having to make a permanent investment.
“We are moving very strongly in that direction and so far it has worked very well,” says Evangelos Kotsovinos, PhD, vice president of hosting at global financial giant Morgan Stanley, London, England. “It reduces infrastructure costs through standardization and consolidation, provides engineering efficiencies—as developers do not have to do the ‘heavy lifting’ of installing and configuring software on servers—and it allows faster time to market.”
Temporary by their very nature, projects are prime candidates for the technology. Rather than investing in IT for a limited scope of work, companies can run projects in the cloud.
“For example, we talked to several customers in the real estate industry who wanted to create a line of business that focuses on properties available through banks,” says Mr. Beck. “They know this is a one-to-three-year business opportunity, so they don't want to invest in the systems and networks that support this segment of the industry. Cloud services built specifically for this are a good solution for them.”
In many ways, running a project in the cloud shouldn't feel that different from running a project with dedicated inhouse resources. But getting to that point requires serious upfront planning.
Project managers must realize the cloud isn't magic, says James Staten, principal analyst, IT infrastructure and operations, Forrester Research, Cambridge, Massachusetts, USA.
“The big lesson clients need to learn is that clouds aren't automatic. They don't automatically scale. They don't automatically correct for bad application design,” he explains. “You have to understand what it takes to make your application behave well in a cloud environment and how you want it to scale.”
Before heading into the clouds, project managers have to figure out whether the project at hand is actually suited to the technology. Some projects are tailor-made for the cloud, such as creating a new app.
“Most enterprises have a limited testing and development environment, and it rarely is large enough to accommodate all the development efforts that a company wants to move forward,” says Mr. Staten. “So rather than investing to grow this, companies can push non-critical test work up to a cloud environment.”
The worldwide revenue outlook for cloud That number is expected to jump to US
Clouds are also a good option for collaborative projects, such as quickly created project sites, wikis and other applications needed for short-term usage.
Once the decision has been made to use a cloud, it's time to choose a provider. There are nearly as many different types as there are projects—from huge, comprehensive offerings from companies such as Google and Amazon to niche operations specifically geared to vertical industries and applications.
To find the right level of service, “identify within the company what kind of benefits you're seeking or what business problems you're trying to solve,” says Mr. Beck.
If the project's objectives can be met by existing pre-built SaaS (software as a service) offerings, then choosing a cloud is a relatively simple matter.
When custom applications are needed, it gets more complicated. Project managers will have to answer a few questions, including: What level of development and infrastructure is appropriate? How long will it be needed? And what level of security will be required?
Then there's the private cloud option, increasingly popular with larger companies with substantial IT staff, and when flexibility and reliability are paramount.
Not all clouds are created equal:
- Infrastructure as a service:
Allows companies to migrate or extend their existing data centers
- Platform as a service:
Concentrates more on offering the tools necessary to build, run and manage applications, with some development work
- Software as a service:
Provides applications for users and transactions—though only the data and processes belong to the client
- Private clouds come in a couple of types:
There are the highly virtualized use-based models built within an internal data center that has internal provisioning and self-management mechanisms. Then there are those from well-known vendors that give firewall anonymity from the rest of the vendor's data center
- Hybrid clouds are just what they sound like:
Part public cloud service, part internal cloud
One more factor to consider when selecting a vendor is how closely it can replicate the existing corporate environment. This decision can make or break a project because teams can get rolling more quickly using familiar technology, Mr. Beck advises.
There's another wrinkle involved in choosing cloud providers: “Should this even be the project manager's responsibility?” he asks.
No matter who's in charge, moving a project into the cloud does not obviate the need for the IT department. There may be integration and migration issues that require technical assistance. At the very least, a project manager should plan to collaborate with IT staff members, as they may already have done a lot of legwork on cloud providers.
services last year was US$17.4 billion. $44.2 billion by 2013. SOURCE: IDC
“The key benefit is being able to provision resources and service only when needed and only pay for the amount that is needed at exactly that time.”
—James Staten, Forrester Research, Cambridge, Massachusetts, USA
Project managers must also think through the ramifications beyond the scope of the project itself. For example, what will happen to the data and application after the project concludes? Will they be brought back into the internal data center, and if so, in what format?
THE TRUE COST OF CLOUDS
In today's cash-crunched project landscape, one of biggest selling points of cloud computing has been the lure of bottom-line IT savings.
“The key benefit is being able to provision resources and service only when needed and only pay for the amount that is needed at exactly that time,” Mr. Staten says. “Today, especially given the economic climate, companies want the ability to dial up—and dial back—expenditures based on business patterns. That's the big value cloud computing provides.”
Be warned, though: Clouds aren't always the best deal.
“If cost is the only reason you want to move to the cloud, you really need to validate your assumptions before moving forward,” Mr. Beck says.
Projects that may have spikes in computer use could be a good fit. But large long-term ones might not work as well because vendors charge more per hour for a cloud's on-demand ability.
“Time is the most important issue,” Mr. Staten says. “You really want to optimize the use of a cloud to minimize the bill.”
When organizations start to get too dependent on cloud computing, all those promised cost savings can evaporate.
“Cloud platforms are a very expensive place to be permanently. They are designed as on-demand infrastructures and thus cost more per hour than traditional hosting or in-house operations,” Mr. Staten says. “Their true value comes from the fact that when you aren't using them, they cost you nothing. You really need to understand how to take advantage of this.”
Don't forget about the hidden costs of cloud computing, either. The company may have to contend with a steep learning curve for internal IT staff or be forced to hire an outside contractor.
“You should make sure that your existing IT staff have training which allows them to cope with a migration to the cloud,” says Giles Hogben, information security expert at European Network and Information Security Agency, Heraklion, Crete, Greece. “The environment changes considerably, and they will have to deal with new challenges. For example, they should understand very clearly which parts of security you as a customer of cloud service are responsible for, such as file encryption.”
A SAFE INVESTMENT?
It's those kinds of security risks that are often raised as a red flag for proposed cloud projects, but they're not necessarily any more dangerous.
“A move to the cloud has both benefits and risks from a security point of view,” says Mr. Hogben, co-author of a November 2009 report on information security in cloud computing.
“The relative risk depends on how you would address the risks if you were not using the cloud and what the cloud provider is doing from a security point of view.”
Project managers should first map out possible security risks with the provider, says Dr. Kotsovinos.
“Weigh carefully the costs and benefits of internal and external clouds,” he advises. “Internally, you have full control of your security policies and practices. Externally, you may need the vendor to provide a similar level of transparency.”
With that map in hand, project managers can then clearly define internal security responsibilities.
“One of the main points to bear in mind is that you should be aware of how the responsibility for various security tasks is divided according to your agreement with the provider,” Mr. Hogben says. “For example, are you responsible for the security of the login details used to authenticate your customers?”
To stay on the safe side, project managers should ensure that all necessary project work stays in the cloud rather than creeping onto corporate systems, suggests Marcus Vinícius Villalobos Mendes, project management office consultant at IT provider CPM Braxis in São Paulo, Brazil. And make sure everybody on the project saves documents to the cloud server rather than the network, he says.
Even with these precautions, the prospect of moving corporate technology and data outside of a firewall still does raise security concerns.
For example, once a provider is chosen, it may be difficult to switch vendors “due to the limited amount of tools, procedures or standard data formats or services interfaces that could guarantee data and service portability,” says Mr. Hogben.
“This makes it extremely difficult for a customer to migrate from one provider to another, or migrate data and services to or from an in-house IT environment,” he says.
In fact, cloud providers may have an incentive to actually prevent the portability of their customers’ data and services.
Organizations must cede control to cloud providers on a number of governance issues, too. They face the possibility that the isolation of their data and applications could be breached due to technical failure, or that data protection will not comply with legal standards.
“A move to the cloud has both benefits and risks from a security point of view.”
—Giles Hogben, European Network and Information Security Agency, Heraklion, Crete, Greece
Then there's the unanticipated downtime when the dreaded crash occurs. “One of the major risks to consider in a cloud-based project is problems with the connection,” Mr. Villalobos Mendes says.
Despite the obstacles, project managers should know the ins and outs of clouds.
“We are reaching the point of seldom talking to a client where cloud isn't what they want to talk about,” Mr. Beck says. “More and more, they are looking for help understanding how to actually do it: Does it make sense for this project? What are my risks?”
After all the talk, it's time to get down to seeding the cloud. PM
PM NETWORK APRIL 2010 WWW.PMI.ORG
APRIL 2010 PM NETWORK