Service level agreements and security in enterprise cloud computing

Cloud Computing

INFORMATION SECURITY in CLOUD COMPUTING PLATFORMS

Cloud computing manipulates and alters our way of understanding of how current computing systems are aligned. The economics of cloud computing are re-ordering the enterprise software industry globally, bringing greater value at a lower price to companies needing to stay in step with customers (Ambust, et al., 2009). The continued growth of cloud computing is also driving more digital content and information into data centers and the cloud than has ever been the case in the past, completely redefining the development methodologies of applications as well (Rajkumar, Yeo, Venugopal, 2008). Information and data are banished to a hypothetical land of bits and bytes that really exist nowhere but the cloud. All digital information in cloud computing relinquishes its presence on specific sets of computer, hard drives, and other storage components (Durkee, 2010). Cloud computing changes the locality of digital information which can be universally distributed to any geographic location. As a result, the command and control of this data is significantly diffused. This technological diffusement gives rise to new problems as well, including the need for managing security more effectively than has been the case in the past with enterprise applications (Kaufman, 2009). The most impactful concern dealing with cloud computing services is the customers' concerns dealing with the potential limitations that this trend leans towards including confidentiality of data and the need for greater fidelity of data platforms and their underlying technologies (Lin, Fu, Zhu, Dasmalchi, 2009).

In order to understand these limitations it is important to investigate the finer points and details that give cloud computing its definition. Many differing expectations and opinions must be explored to fully grasp the relative perspectives that arise from this idea. The thesis of this exploration deals with the legal, technical and economic viewpoints of cloud computing (RN Calheiros, et al., 2010). Specifically, this problem requires an identification process that potential customers should propose to cloud computing service providers before agreeing to their specific terms of contracts. This area specifically is focused on the area of Service Level Agreements (SLA) and their relative value for enterprise customers including their potential to re-order the economics of enterprise cloud computing in the enterprise (Balachandra, et al., 2010). The continual evolution of cloud computing from a technology standpoint continues to show significant potential for reduction of Total Cost of Ownership (TCO) while also reducing the incremental costs of aligning a specific application to the needs of a segment or larger audience of enterprise computing users (Ambust, et al., 2009). The lowered costs that cloud computing platforms are enabling and accelerating today are being further strengthened by how quickly applications on these platforms can be aligned to the specific, very precise needs of customers. Also what unified all of these strategies together is the continual reliance on Service Level Agreements (SLAs) and their role in stabilizing the nascent yet very fast moving aspects of cloud computing in the enterprise. The goal of this pursuit addresses the problems that might arise related to the capabilities and performance of software applications that are executed in cloud computing scenarios. The argument focuses upon previous research and personal experimentation in designated cloud computing scenarios. Ultimately, the goal is to distinguish the specific contributions affecting performance and, simultaneously provide some possible recommendations or solutions or to potential cloud users that might affect performance problems that are all initially defined through SLA benchmarks and continually monitored through real-time analytics of service performance including reliability and security metrics of performance (McQueen, M. (2008).

II. Project Proposal

i. Problem Description

As was defined in the problem description, the legal, technical and economic viewpoints of cloud computing form the foundation of this thesis, with specific focus on the issues that enterprise customers are facing in the context of extended service agreements including Service Level Agreements (SLAs). The cloud computing industry has however found that SLAs are often not enforceable with cloud computing services providers, as many of them do not allow for their contracts to be binding from a legal standpoint (Rajkumar, Yeo, Venugopal, 2008). This is because the performance of their back-end systems defy a purely scientific level of management; there is no clear cause-and-effect of how to manage a highly integrated and complex cloud computing architecture with the same level of precision as a desktop operating system for example (Balachandra, et al., 2010). Even the most well-known enterprise software companies who have cloud computing applications running on the Software as a Service (SaaS) platform are not offering legally binding SLA contracts, and this includes Salesforce.com (Stolfo, et al., 2012). For these very large, rapidly growing cloud computing and SaaS-based enterprise software companies, SLAs are more for marketing and less for actually managing the overall performance levels of the applications they deliver (Stolfo, et al., 2012). In many instances the SLA commitments made are not enforceable legally and are meant to be offered as miles per gallon (MPG) ratings for new cars; as in each buyer's and company's mileage may vary (Durkee, 2010).

In addition to the lack of enforceability of SLAs often cloud computing and SaaS-based enterprise software companies rely extensively on maintenance fees and annual maintenance contracts to generate the case they need to operate on a daily basis. The reliance on maintenance fees within enterprise software is commonplace and often doesn't lead to greater innovation in new product development, instead making the enterprise software companies even more complacent over time due to the lack of urgency of generating revenue (Leavitt, 2009). For the typical enterprise software customer, this is often the case. They pay often up to 22% of the purchase price of their applications on a yearly basis, only to be given periodic, small updates that only incrementally deliver value (Rajkumar, Yeo, Venugopal, 2008). Cloud computing vendors including Salesforce.com, and others have created a strong business model by concentrating their efforts on selling against the maintenance fee model of on-premise software vendors, promising to deliver a continual stream of new product updates in exchange for the maintenance fees they charge, which ironically are in the same range as their on-premise counterparts (Balachandra, et al., 2010). The cloud computing enterprise software vendors also claim that their maintenance fees are also delivering more value because they refresh their entire application suite online every 30 days or less; which is significantly faster than any on-premise application can (Kaufman, 2009). Even with all these commitments to deliver a continual stream of new product and feature updates seamlessly over the Web via their cloud platforms, many cloud computing software companies still are not keeping the majority of commitments to their customers. Also, the SLAs they promise are not legally binding given the complexity of wording and lack of accountability and traceability of results (Pronto, JP (2008).

These factors taken together leave the enterprise software buyer with little protection from cloud computing-based software vendors from delivering on their commitments to increased levels of application performance and greater availability of enterprise-grade applications over the Internet. Today the economics of cloud computing are compensating for the lack of accountability of long-term performance (Stoddard, M. (2005). Yet from a legal, technical, and economic standpoint, the broader implications of cloud computing growth are at stake with how these enterprise software vendors choose to manage the distance and dichotomy of their promises and what they deliver. The SLA as a legal instrument needs to continually improve and gain a strong legal precedent to ensure it will be able to protect customers over time and ensure they get the value they are promised. This extends to their reliance on security, scalability of the cloud computing platforms as well, in addition to the development of more effective accounting and performance monitoring systems as well. Salesforce.com has been a leader in this area, as the value proposition of moving CRM systems off of on-premise; highly expensive to maintain systems to cloud computing has been a very profitable selling strategy. The creation of trust of salesforce.com is an example of how cloud computing vendors are working to create a more effective approach to quantifying and verifying their performance over time.

ii. Solution or Approach to Solving the Problem

What is needed to alleviate the obfuscation and confusion that enterprise software vendors are propagating on this issue is an independent entity such as a standards organization to benchmark the SLAs of enterprise cloud computing vendors and report the results publically. This index needs to also take into account customer satisfaction levels and show how cloud computing, when properly implemented, can lead to significant gains in enterprise performance from a profitability and workflow perspective as well (O'Bryan, 2006). The indexing of corporate performance also needs to include a TCO (total cost of ownership) component to evaluate the real value of cloud computing in the enterprise.

iii. Expected Results of the Project

By creating an index of cloud computing performance and defining its attributes from a TCO standpoint, the industry will have a truer measure of the real value of cloud-based applications. This approach to defining a performance-based taxonomy will also allow for a more effective comparison within industries as well. All of these factors taken together will provide enterprise computing buyers with more effective foundations of arguing for more thorough measures of application performance. The net result will be much greater visibility into how cloud computing is actually changing the global economics of the enterprise computing industry.

III. Final Report:

Introduction

The foundational aspects of cloud computing's economic advantage are predicated on how efficiently this approach to propagating enterprise-wide applications across entire organizations at a very reasonable cost. The technological factors of this technology platform, along with its accompanying infrastructure stability, fault redundancy, multitenancy, security and user experience advancements, have made it an area of continued research & development focus by many leading corporations and universities. As a result there is a wealth of both empirical and theoretical knowledge with regard to cloud computing as a technology platform alone. The myriad of those developments form the foundation of a disruptive shift in the economics of enterprise software, including a complete redefinition of how Total Cost of Ownership (TCO) is used today for evaluating and choosing SaaS-based applications over traditional, and more expensive on-premise applications (Bhutta, Huq, 2002). While the TCO advantages of cloud-based applications and platforms are very compelling, there is a lingering doubt in the minds of many Chief Information Officers (CIOs) with regard to their long-term viability and value. CIOs are given the responsibility of stabilizing the enterprise it infrastructure for the companies they work for; their ideal situation is having no risk and no strategic challenges to deal with during their tenure (Carr, 2011). They are in essence the keepers of the it infrastructure dial-tone.

Yet cloud computing, with its disruptive economic forces and as this study shows, significantly lower Total Cost of Ownership (TCO) indexed to SLA performance, can deliver significantly greater business gains over time. As has been often cited in Dr. Clayton Christensen's book the Innovator's Dilemma, the role of new market entrants is to often change the economics of a given industry by making more streamlined, cost-effective technologies more strategic over time. This is the identical paradigm that is reshaping the cloud computing industry today globally, and is especially evident in the area of Customer Relationship Management, which is experiencing the most rapid adoption rates of any category. For purposes of this study, a comparison of TCO performance between on-premise CRM applications and cloud-computing CRM applications has been made. These results are indexed by services revenue of each company, which is an indicator of how profitable Service Level Agreements (SLA) is for each vendor. From the cloud computing vendor's perspective, SLAs are often used as a means to gain trial and eventual adoption of enterprise-wide cloud computing applications. For the o-premise vendor, their maintenance revenue stream, as has been mentioned before, form the majority of their recurring revenue stream over time. To ensure complete coverage of the market, the top three market share leaders will be covered in this analysis. The following chart provides an analysis of the worldwide CRM market share leaders in 2012, which is the latest available data from it research advisory firm Gartner Inc. In their report Market Share Analysis: Customer Relationship Management Software, Worldwide, 2012 published April 18, 2013 this firm showed that Salesforce.com has the majority of worldwide CRM market share with 14%, followed by SAP at 12.9%, Oracle at 11.1% and Microsoft at 6.3%. Only Salesforce.com generates all of its revenues using a cloud-based architecture. Figure 1, Worldwide CRM Software Spending by Vendor, 2012 illustrates the distribution of worldwide CRM software sales by vendor.

Figure 1: Worldwide CRM Software Spending by Vendor, 2012

Source: (Gartner, 2013)

SAP, Oracle and Microsoft each rely on the traditional enterprise software model of having a series of relative high up-front costs, followed by a recurring maintenance fee over time. This is in contrast to the business model cloud-based application providers use including Salesforce.com, who relies on a subscription-based business model. Large-scale enterprise deployments that are on-premise often take several months to gain funding approval of, and in the case of 400 seat implementations or more, must also go through a rigorous budgeting process (Stanic, 2003). This is because the initial costs of enterprise-wide application support and platforms can be well over $1 million or more. For cloud-based applications however, enterprises pay subscription fees and consulting fees for business process reviews. An emerging best practice today by early adopters of cloud computing in the enterprise is to use the implementation of a cloud-based application to also completely redefine several business processes that the new cloud-based system will automate (Read, 2011). Of the many areas where early adopters of cloud-based applications are making process, the one with the most use cases and evidence of business process management (BPM), business process re-engineering (BPR) and significant gains in corporate performance is CRM as a result. Given the wealth of CRM use cases, this area of enterprise software is the basis of this TCO and SLA analysis. on-premise enterprise software companies have long relied on BPM and BPR-based projects to increase the size and profitability of sales for on-premise applications (Shackleton, Saffre, Tateson, et.al. 2004). This has especially been true in CRM, where process latency from isolated, often customer-centric workflows can be quickly determined, and the isolated effects of a new CRM system quickly quantified as a result. This is lucrative for traditional enterprise software vendors including SAP, Oracle, Microsoft, IBM, Infor and many others that it is common to see the costs of these BPM and BPR projects are at least ten times those of the actual costs of the software itself. This 10X multiple for services, the majority of the time driven by BPM and BPR-based work, is often managed b y the CIO and their staff. In contrast, BPM and BPR-based work on cloud computing application are typically at a much lower multiple, nearly 5X at most, given the highly iterative nature of cloud-based applications and the ease of modifying them in real-time (Denne, 2007).

The discussion of BPM and BPR strategies for on-premise enterprise applications vs. those that are cloud-based is especially relevant from the funding perspective of the enterprise adopting them. For on-premise applications with heavy requirements for BPM and BPR custom programming professional services, funding is treated as a capital expense (CAPEX). CAPEX-based spending on a project requires approval not just of the CEO but of the board of directors of a corporation as well (Katzan, 2010). If the corporation is public, the expenditure will also need to be mentioned in the financial reports, filed with the Securities and E. change Commission (SEC) as a material event if the company is publically-held in the U.S. To ensure compliance with the Sarbanes-Oxley Act of 2002. While lengthy, complex and very time-consuming, corporations often tolerated this purchasing process to gain the potential value of an enterprise software application in their company. CRM, with its strong focus on driving top-line revenue, have historically been the most efficient at navigating the CAPEX process as the Return on Investment (ROI).

SaaS-based applications including CRM are sold on a subscription basis, where payment is made only on the functionality and in some cases, measured value delivered. This has over time lead to Salesforce.com and a myriad of other software companies creating pricing that aligns with operations budgets of enterprises. This budgeting approach is called OPEX (operating expense) and is under control of the line-of-business manager or leader of a given department. Selling software using the OPEX model leads to sales cycles that average less than two months, have in-build value accelerators to provide customers with incentives for using the software across more of their companies while also streamlining the BPM and BPR-based process improvements that enterprises typically put in place as they also introduce a new enterprise software application.

This shift in enterprise software economics, from CAPEX to OPEX, has its foundational elements in the compelling financial advantages TCO shows cloud-based applications have. SLAs are the accelerators of TCO-based change throughout the enterprise. Quantifying just how much of an impact SLAs have in decision-making is outside the scope of this research, which centers on indexing TCO performance of cloud-based applications. These fundamental shifts in the economics of cloud computing are a threat to the status quo CIOs so religiously attempt to protect. Yet the economics of cloud computing, in this era of economic uncertainty, are so pervasive that the role of the CIO is also being changed.

Change management is often the most critical success factor of any enterprise software deployment. The economics of cloud computing in general and the continual influence of TCO-based decision making in enterprises, is accelerating the pace of change in enterprises. CIOs can no longer rely on the status quo and a risk mitigation strategy to resist change, even when cloud computing platforms offer such compelling financial benefits to their organizations. CEOs, board of directors and shareholders all realize the pace of change itself is changing in the enterprise, and all calling on the CIO to become a strategist first, technologist second. In those empirical studies of cloud adoption in the enterprise, it was found that cloud-based architectures provided CIOs with less resistance in adopting their role as business strategist first (Read, 2011). The ease of configuring cloud-based applications is one of the key determinants of their ability to gain greater adoption in the enterprise. This agility and permeability of cloud-based applications also allow the CIO to more precisely align these specific systems and their features to the process needs in their business (Ledford, 2004). While cloud-based applications require CIOs to relinquish a proportion of their control over all it assets, it does free them up to be strategists. Throughout the background research completed the recurring theme of the CIO emerging as business strategies resonates through much of the research completed.

The paradox of the CIO and their need to retain control over it assets yet at the same time being an increasingly active participant in the strategies ot the enterprise is further amplified by the wide variation in TCO analysis of on-premise relative to Cloud or SaaS-based applications. This paradox is made more complex when the SLAs of enterprise vendors offering on-premise vs. cloud-based applications are taken into account. The intent of this study is to index TCO values, comparing on-premise to cloud-based implementations, while also factoring in SLA impact from a purely financial standpoint. To measure the impact of SLA influence on the software, vendor and functionality evaluations would require a comprehensive attitudinal analysis of completed purchasing cycles of enterprise cloud applications. Given the breadth and depth of this analysis and its longitudinal nature to ascertain the effects of SLA on long-term funding decisions, it is considered outside the scope of this research.

The Method

Indexing TCO levels of cloud-based vs. on-premise CRM applications needs to take into account six different key areas of cost. These six areas include the baseline costs for the software, services, and in the case of indexing cloud application to on-premise applications, the hardware costs for the latter. The second set of costs includes alternative consumption-based pricing options. This is the most critical area of the TCO Index created as it includes subscription-based, per user per month and transaction-based pricing (Garfamy, 2006)

. The third category of costs used in the construction of the TCO Index is the pre-deal costs. These include everything from long-term costs of evaluation to the costs associated with completing a thorough TCO analysis of key processes beforehand. The fourth category is the transitioning into the new solution and the integration costs associated with having the cloud-based CRM system is fully operational across the enterprise evaluating them. This is the area mentioned earlier in this analysis that can often reach ten times the costs of enterprise software, as the level of integration required can be extensive. The fifth categories of costs included in the TCO Index are those costs designed to normalize Costs (Heilala, Montonen, Helin, 2007). These include costs specifically designed to ensure commonality of measurement across cloud-based and on-premise applications. The sixth section of the TCO Index is the risk mitigation and associated costs with minimizing the risks inherent in any new system implementation. By incorporating these six cost components into a single index, the full extent of differences between cloud and on-premise applications can be quantified.

In creating the TCO Index, a series of assumptions also needed to be created. Using the it Key Metrics Data from Gartner Inc., a table of cost distribution metrics was created. Figure 4 shows the aggregation of these cost metrics which form the foundation of the TCO Index.

Figure 4:

TCO Index Assumptions -- Cost Distribution Metrics

Source: IT Key Metrics Data 2013: Key Applications

Measures: Application Development: Current

Year

The TCO Index methodology begins with a baseline of cloud costs, then iteratively applies each of the comparative on-premise configurations to emerge at an overall TCO index. The foundation of the TCO index is based on Salesforce.com costing for a typical CRM implementation delivered over the cloud. The two indexing values for on-premise applications are Oracle and SAP. Comparing the differences across these three elements normalized the TCO Index to reflect on-p[remise vs. cloud costs as well. One of the key assumptions that the TCO Index is based on are the number of units purchased per year. To fully see the effects of the TCO Index, the assumption is made the 20 seats will be installed in Year 1, 40 in Year 2, 60 in Year 3, 80 in Year 4, and 120 from Years 5 to 10 of the Index.

Results

The completed TCO Index is shown in Figure 5, based on the series of assumptions mentioned in this analysis. For purposes of comparison, trending lines for a typical Oracle and SAP on-premise implementation are also included in the index. Figure 6 shows the TCO trending analysis by SaaS vs. on-premise applications. SAP implementation costs are among the highest in the CRM industry, which are presented by the purple vertical line in Figure 6.

Figure 5: TCO Index

Figure 6: TCO Index Analysis -- Cost Trends

These results indicate that single-instance CRM systems that are on-premise have a significantly higher cost and corresponding TCO impact relative to SaaS-based CRM applications. This analysis also shows the very high costs of integrating on-premise applications to legacy systems, as evidenced by the high initial cost estimates for both Oracle and SAP on-premise applications. The cost analysis also shows that the maintenance fees for on-premise applications continually keep the total cost of ownership very high over a ten-year time horizon. The trending on the TCO index show initially low up-front costs and a scaling of costs that is linear to the continual addition of new users. In latest years of the index there are additional costs associated with new features, with is one of the factors in the rise in costs. They are very limited however compared to the continually increasing costs of SAP on-premise enterprise systems, which show a significant climb over the 10-year period.

Assuming a 2% interest rate to calculate Net Present Value, 2% inflation rate and a 2% cost of living accelerator, the following table provides an assessment of the NPV of the SaaS Index relative to on-premise Oracle vs. SAP. Given how high SAP's integration costs typically is they are nearly double the CRM TCO Index amount.

Table 1: NPV Analysis of Index Relative to in-Premise Cost

Conclusion

The contributions of this study include the validation that a subscription-based model of computing, specifically for CRM, is agile and more capable of staying aligned with customer needs compared to on-premise systems. It also shows that even with increases in maintenance costs and the need for retraining on new releases, the TCO Index for SaaS-based applications is superior to on-premise applications. The potential limitations of this study include the pricing used at this point in time for SaaS and on-premise applications. These costs could have been significantly different in the past and will most likely change significantly in the future. This is an accurate assessment of the cloud or SaaS TCO Index for CRM applications as of April, 2013 given current pricing and maintenance percentages overall. The study illustrates how cloud economics are revolutionizing the enterprise computing market.