Information security in cloud computing platforms

Cloud Computing

INFORMATION SECURITY in CLOUD COMPUTING PLATFORMS

Cloud computing manipulates and alters our way of understanding of how current computing systems are aligned. The economics of cloud computing are re-ordering the enterprise software industry globally, bringing greater value at a lower price to companies needing to stay in step with customers (Ambust, et al., 2009). The continued growth of cloud computing is also driving more digital content and information into data centers and the cloud than has ever been the case in the past, completely redefining the development methodologies of applications as well (Rajkumar, Yeo, Venugopal, 2008). Information and data are banished to a hypothetical land of bits and bytes that really exist nowhere but the cloud. All digital information in cloud computing relinquishes its presence on specific sets of computer, hard drives, and other storage components (Durkee, 2010). Cloud computing changes the locality of digital information which can be universally distributed to any geographic location. As a result, the command and control of this data is significantly diffused. This technological diffusement gives rise to new problems as well, including the need for managing security more effectively than has been the case in the past with enterprise applications (Kaufman, 2009). The most impactful concern dealing with cloud computing services is the customers' concerns dealing with the potential limitations that this trend leans towards including confidentiality of data and the need for greater fidelity of data platforms and their underlying technologies (Lin, Fu, Zhu, Dasmalchi, 2009).

In order to understand these limitations it is important to investigate the finer points and details that give cloud computing its definition. Many differing expectations and opinions must be explored to fully grasp the relative perspectives that arise from this idea. The thesis of this exploration deals with the legal, technical and economic viewpoints of cloud computing (RN Calheiros, et al., 2010). Specifically, this problem requires an identification process that potential customers should propose to cloud computing service providers before agreeing to their specific terms of contracts. This area specifically is focused on the area of Service Level Agreements (SLA) and their relative value for enterprise customers including their potential to re-order the economics of enterprise cloud computing in the enterprise (Balachandra, et al., 2010). The continual evolution of cloud computing from a technology standpoint continues to show significant potential for reduction of Total Cost of Ownership (TCO) while also reducing the incremental costs of aligning a specific application to the needs of a segment or larger audience of enterprise computing users (Ambust, et al., 2009). The lowered costs that cloud computing platforms are enabling and accelerating today are being further strengthened by how quickly applications on these platforms can be aligned to the specific, very precise needs of customers. Also what unified all of these strategies together is the continual reliance on Service Level Agreements (SLAs) and their role in stabilizing the nascent yet very fast moving aspects of cloud computing in the enterprise. The goal of this pursuit addresses the problems that might arise related to the capabilities and performance of software applications that are executed in cloud computing scenarios. The argument focuses upon previous research and personal experimentation in designated cloud computing scenarios. Ultimately, the goal is to distinguish the specific contributions affecting performance and, simultaneously provide some possible recommendations or solutions or to potential cloud users that might affect performance problems that are all initially defined through SLA benchmarks and continually monitored through real-time analytics of service performance including reliability and security metrics of performance (McQueen, M. (2008).

II. Project Proposal

i. Problem Description

As was defined in the problem description, the legal, technical and economic viewpoints of cloud computing form the foundation of this thesis, with specific focus on the issues that enterprise customers are facing in the context of extended service agreements including Service Level Agreements (SLAs). The cloud computing industry has however found that SLAs are often not enforceable with cloud computing services providers, as many of them do not allow for their contracts to be binding from a legal standpoint (Rajkumar, Yeo, Venugopal, 2008). This is because the performance of their back-end systems defy a purely scientific level of management; there is no clear cause-and-effect of how to manage a highly integrated and complex cloud computing architecture with the same level of precision as a desktop operating system for example (Balachandra, et al., 2010). Even the most well-known enterprise software companies who have cloud computing applications running on the Software as a Service (SaaS) platform are not offering legally binding SLA contracts, and this includes Salesforce.com (Stolfo, et al., 2012). For these very large, rapidly growing cloud computing and SaaS-based enterprise software companies, SLAs are more for marketing and less for actually managing the overall performance levels of the applications they deliver (Stolfo, et al., 2012). In many instances the SLA commitments made are not enforceable legally and are meant to be offered as miles per gallon (MPG) ratings for new cars; as in each buyer's and company's mileage may vary (Durkee, 2010).

In addition to the lack of enforceability of SLAs often cloud computing and SaaS-based enterprise software companies rely extensively on maintenance fees and annual maintenance contracts to generate the case they need to operate on a daily basis. The reliance on maintenance fees within enterprise software is commonplace and often doesn't lead to greater innovation in new product development, instead making the enterprise software companies even more complacent over time due to the lack of urgency of generating revenue (Leavitt, 2009). For the typical enterprise software customer, this is often the case. They pay often up to 22% of the purchase price of their applications on a yearly basis, only to be given periodic, small updates that only incrementally deliver value (Rajkumar, Yeo, Venugopal, 2008). Cloud computing vendors including Salesforce.com, and others have created a strong business model by concentrating their efforts on selling against the maintenance fee model of on-premise software vendors, promising to deliver a continual stream of new product updates in exchange for the maintenance fees they charge, which ironically are in the same range as their on-premise counterparts (Balachandra, et al., 2010). The cloud computing enterprise software vendors also claim that their maintenance fees are also delivering more value because they refresh their entire application suite online every 30 days or less; which is significantly faster than any on-premise application can (Kaufman, 2009). Even with all these commitments to deliver a continual stream of new product and feature updates seamlessly over the Web via their cloud platforms, many cloud computing software companies still are not keeping the majority of commitments to their customers. Also, the SLAs they promise are not legally binding given the complexity of wording and lack of accountability and traceability of results (Pronto, JP (2008).

These factors taken together leave the enterprise software buyer with little protection from cloud computing-based software vendors from delivering on their commitments to increased levels of application performance and greater availability of enterprise-grade applications over the Internet. Today the economics of cloud computing are compensating for the lack of accountability of long-term performance (Stoddard, M. (2005). Yet from a legal, technical, and economic standpoint, the broader implications of cloud computing growth are at stake with how these enterprise software vendors choose to manage the distance and dichotomy of their promises and what they deliver. The SLA as a legal instrument needs to continually improve and gain a strong legal precedent to ensure it will be able to protect customers over time and ensure they get the value they are promised. This extends to their reliance on security, scalability of the cloud computing platforms as well, in addition to the development of more effective accounting and performance monitoring systems as well. Salesforce.com has been a leader in this area, as the value proposition of moving CRM systems off of on-premise; highly expensive to maintain systems to cloud computing has been a very profitable selling strategy. The creation of trust of salesforce.com is an example of how cloud computing vendors are working to create a more effective approach to quantifying and verifying their performance over time.

ii. Solution or Approach to Solving the Problem

What is needed to alleviate the obfuscation and confusion that enterprise software vendors are propagating on this issue is an independent entity such as a standards organization to benchmark the SLAs of enterprise cloud computing vendors and report the results publically. This index needs to also take into account customer satisfaction levels and show how cloud computing, when properly implemented, can lead to significant gains in enterprise performance from a profitability and workflow perspective as well (O'Bryan, 2006). The indexing of corporate performance also needs to include a TCO (total cost of ownership) component to evaluate the real value of cloud computing in the enterprise.

iii. Expected Results of the Project

By creating an index of cloud computing performance and defining its attributes from a TCO standpoint, the industry will have a truer measure of the real value of cloud-based applications. This approach to defining a performance-based taxonomy will also allow for a more effective comparison within industries as well. All of these factors taken together will provide enterprise computing buyers with more effective foundations of arguing for more thorough measures of application performance. The net result will be much greater visibility into how cloud computing is actually changing the global economics of the enterprise computing industry.

III. Final Report:

Introduction

The foundational aspects of cloud computing's economic advantage are predicated on how efficiently this approach to propagating enterprise-wide applications across entire organizations at a very reasonable cost. The technological factors of this technology platform, along with its accompanying infrastructure stability, fault redundancy, multitenancy, security and user experience advancements, have made it an area of continued research & development focus by many leading corporations and universities. As a result there is a wealth of both empirical and theoretical knowledge with regard to cloud computing as a technology platform alone. The myriad of those developments form the foundation of a disruptive shift in the economics of enterprise software, including a complete redefinition of how Total Cost of Ownership (TCO) is used today for evaluating and choosing SaaS-based applications over traditional, and more expensive on-premise applications (Bhutta, Huq, 2002). While the TCO advantages of cloud-based applications and platforms are very compelling, there is a lingering doubt in the minds of many Chief Information Officers (CIOs) with regard to their long-term viability and value. CIOs are given the responsibility of stabilizing the enterprise it infrastructure for the companies they work for; their ideal situation is having no risk and no strategic challenges to deal with during their tenure (Carr, 2011). They are in essence the keepers of the it infrastructure dial-tone.

Yet cloud computing, with its disruptive economic forces and as this study shows, significantly lower Total Cost of Ownership (TCO) indexed to SLA performance, can deliver significantly greater business gains over time. As has been often cited in Dr. Clayton Christensen's book the Innovator's Dilemma, the role of new market entrants is to often change the economics of a given industry by making more streamlined, cost-effective technologies more strategic over time. This is the identical paradigm that is reshaping the cloud computing industry today globally, and is especially evident in the area of Customer Relationship Management, which is experiencing the most rapid adoption rates of any category. For purposes of this study, a comparison of TCO performance between on-premise CRM applications and cloud-computing CRM applications has been made. These results are indexed by services revenue of each company, which is an indicator of how profitable Service Level Agreements (SLA) is for each vendor. From the cloud computing vendor's perspective, SLAs are often used as a means to gain trial and eventual adoption of enterprise-wide cloud computing applications. For the o-premise vendor, their maintenance revenue stream, as has been mentioned before, form the majority of their recurring revenue stream over time. To ensure complete coverage of the market, the top three market share leaders will be covered in this analysis. The following chart provides an analysis of the worldwide CRM market share leaders in 2012, which is the latest available data from it research advisory firm Gartner Inc. In their report Market Share Analysis: Customer Relationship Management Software, Worldwide, 2012 published April 18, 2013 this firm showed that Salesforce.com has the majority of worldwide CRM market share with 14%, followed by SAP at 12.9%, Oracle at 11.1% and Microsoft at 6.3%. Only Salesforce.com generates all of its revenues using a cloud-based architecture. Figure 1, Worldwide CRM Software Spending by Vendor, 2012 illustrates the distribution of worldwide CRM software sales by vendor.

Figure 1: Worldwide CRM Software Spending by Vendor, 2012

Source: (Gartner, 2013)

SAP, Oracle and Microsoft each rely on the traditional enterprise software model of having a series of relative high up-front costs, followed by a recurring maintenance fee over time. This is in contrast to the business model cloud-based application providers use including Salesforce.com, who relies on a subscription-based business model. Large-scale enterprise deployments that are on-premise often take several months to gain funding approval of, and in the case of 400 seat implementations or more, must also go through a rigorous budgeting process (Stanic, 2003). This is because the initial costs of enterprise-wide application support and platforms can be well over $1 million or more. For cloud-based applications however, enterprises pay subscription fees and consulting fees for business process reviews. An emerging best practice today by early adopters of cloud computing in the enterprise is to use the implementation of a cloud-based application to also completely redefine several business processes that the new cloud-based system will automate (Read, 2011). Of the many areas where early adopters of cloud-based applications are making process, the one with the most use cases and evidence of business process management (BPM), business process re-engineering (BPR) and significant gains in corporate performance is CRM as a result. Given the wealth of CRM use cases, this area of enterprise software is the basis of this TCO and SLA analysis. on-premise enterprise software companies have long relied on BPM and BPR-based projects to increase the size and profitability of sales for on-premise applications (Shackleton, Saffre, Tateson, et.al. 2004). This has especially been true in CRM, where process latency from isolated, often customer-centric workflows can be quickly determined, and the isolated effects of a new CRM system quickly quantified as a result. This is lucrative for traditional enterprise software vendors including SAP, Oracle, Microsoft, IBM, Infor and many others that it is common to see the costs of these BPM and BPR projects are at least ten times those of the actual costs of the software itself. This 10X multiple for services, the majority of the time driven by BPM and BPR-based work, is often managed b y the CIO and their staff. In contrast, BPM and BPR-based work on cloud computing application are typically at a much lower multiple, nearly 5X at most, given the highly iterative nature of cloud-based applications and the ease of modifying them in real-time (Denne, 2007).

The discussion of BPM and BPR strategies for on-premise enterprise applications vs. those that are cloud-based is especially relevant from the funding perspective of the enterprise adopting them. For on-premise applications with heavy requirements for BPM and BPR custom programming professional services, funding is treated as a capital expense (CAPEX). CAPEX-based spending on a project requires approval not just of the CEO but of the board of directors of a corporation as well (Katzan, 2010). If the corporation is public, the expenditure will also need to be mentioned in the financial reports, filed with the Securities and E. change Commission (SEC) as a material event if the company is publically-held in the U.S. To ensure compliance with the Sarbanes-Oxley Act of 2002. While lengthy, complex and very time-consuming, corporations often tolerated this purchasing process to gain the potential value of an enterprise software application in their company. CRM, with its strong focus on driving top-line revenue, have historically been the most efficient at navigating the CAPEX process as the Return on Investment (ROI).

SaaS-based applications including CRM are sold on a subscription basis, where payment is made only on the functionality and in some cases, measured value delivered. This has over time lead to Salesforce.com and a myriad of other software companies creating pricing that aligns with operations budgets of enterprises. This budgeting approach is called OPEX (operating expense) and is under control of the line-of-business manager or leader of a given department. Selling software using the OPEX model leads to sales cycles that average less than two months, have in-build value accelerators to provide customers with incentives for using the software across more of their companies while also streamlining the BPM and BPR-based process improvements that enterprises typically put in place as they also introduce a new enterprise software application.

This shift in enterprise software economics, from CAPEX to OPEX, has its foundational elements in the compelling financial advantages TCO shows cloud-based applications have. SLAs are the accelerators of TCO-based change throughout the enterprise. Quantifying just how much of an impact SLAs have in decision-making is outside the scope of this research, which centers on indexing TCO performance of cloud-based applications. These fundamental shifts in the economics of cloud computing are a threat to the status quo CIOs so religiously attempt to protect. Yet the economics of cloud computing, in this era of economic uncertainty, are so pervasive that the role of the CIO is also being changed.

Change management is often the most critical success factor of any enterprise software deployment. The economics of cloud computing in general and the continual influence of TCO-based decision making in enterprises, is accelerating the pace of change in enterprises. CIOs can no longer rely on the status quo and a risk mitigation strategy to resist change, even when cloud computing platforms offer such compelling financial benefits to their organizations. CEOs, board of directors and shareholders all realize the pace of change itself is changing in the enterprise, and all calling on the CIO to become a strategist first, technologist second. In those empirical studies of cloud adoption in the enterprise, it was found that cloud-based architectures provided CIOs with less resistance in adopting their role as business strategist first (Read, 2011). The ease of configuring cloud-based applications is one of the key determinants of their ability to gain greater adoption in the enterprise. This agility and permeability of cloud-based applications also allow the CIO to more precisely align these specific systems and their features to the process needs in their business (Ledford, 2004). While cloud-based applications require CIOs to relinquish a proportion of their control over all it assets, it does free them up to be strategists. Throughout the background research completed the recurring theme of the CIO emerging as business strategies resonates through much of the research completed.

The paradox of the CIO and their need to retain control over it assets yet at the same time being an increasingly active participant in the strategies ot the enterprise is further amplified by the wide variation in TCO analysis of on-premise relative to Cloud or SaaS-based applications. This paradox is made more complex when the SLAs of enterprise vendors offering on-premise vs. cloud-based applications are taken into account. The intent of this study is to index TCO values, comparing on-premise to cloud-based implementations, while also factoring in SLA impact from a purely financial standpoint. To measure the impact of SLA influence on the software, vendor and functionality evaluations would require a comprehensive attitudinal analysis of completed purchasing cycles of enterprise cloud applications. Given the breadth and depth of this analysis and its longitudinal nature to ascertain the effects of SLA on long-term funding decisions, it is considered outside the scope of this research.

The Problem

Total Cost of Ownership (TCO) analysis indicates that cloud-based applications designed to align to only the most critical business processes throughout an organization deliver greater performance at a significantly reduced cost compared to on-premise applications. Process complexity, maturity and uniqueness vary significantly across each departmental, functional and strategic area of an enterprise. For purposes of this analysis the Customer Relationship Management (CRM) strategies, systems and processes are used. There are three factors why CRM is chosen above other areas of cloud-based adoption in the enterprise. First, CRM is the most mature of all process areas adopting cloud computing today, with an estimated 49% of enterprises in a recent Gartner group study choosing to deploy cloud or SaaS-based solutions as for their net-new applications. 30% of new CRM systems are replacement, 28% are a replacement to an existing system and 22% are replacements for projects that never were implemented, which had been shelfware in the past. Figure 2, How SaaS Is Deployed by Application, 2012, illustrates why CRM is chosen as a specific strategic and process area for this study.

Figure 2: How SaaS Is Deployed by Application, 2012

Source: (Columbus, 2012)

The problem of ascertaining just how accurate TCO is as a metric of cloud application performance is exacerbated by the following critical capabilities that enterprises rely on when planning and implementing their CRM strategies (AMR Research, 2003). These include accessibility of data and the administration-level functions to tailor the application to specific needs, manageability of the application and customization options, pricing, resiliency or fault tolerance, security and compliance, and value-added services (AMR Research, 2006). CIOs often rank order each of these attributes, assigning specific percentage weighting to each as a means to further clarify and ensure consistency in their TCO analysis.

The problem is that CIOs are often in-equipped to complete accurate TCO analyses to truth-test the reports given to them by vendors (AMR Research, 2005). CIOs have to not only manage the complexities of this challenge, they must also gain insights into the full aspects of cloud computing economies as they relate directly to their own firm, with just 5% of CIOs being able to replace the deemed curve shown below in Figure 3. The following figure illustrates why the economics of cloud computing are so compelling for any enterprises who, due ot their reliance on-premise applications alone, have statistic capacity alone (the light blue line in Figure 3). What these enterprises need is dynamic scalability across their enterprises, which is what cloud computing is specifically designed to provide. This graphic also illustrates why it is so critical for TCO analyses to be accurate and report the true demand curve for a business. When this can be accomplished, the TCO analyses can be considered trustworthy. The top CIOs today are using this type of analysis to get beyond SLAs to require their vendors to write specific conditions not in the SLAs, but in the actual services contracts (AMR Research, 2005). The demand curve shown in Figure 3 is for the computing resources of the enterprise; it can be computed relatively easily yet takes an excellent it system to achieve it. For TCO to be an effective decision-making tool it must align to these economics and provide decision makers including the CEO, CIO and others with the insights necessary to make the best possible decision possible (Denne, 2007). An excellent TCO methodology in place within a larger enterprise will be able to determine these curves and plan cloud-based strategies accordingly.

Figure 3: Defining the Economics of Cloud Computing Strategies in an Enterprise

Sources: (Balachandra, et al., 2010). (Kaufman, 2009). Durkee, 2010).(Wetterman, 2008)

The three most critical factors of any TCO calculation are the costs to operate, costs to support and maintain, and cost to enhance and extend the software application (Ellram, 1993). When all three of these costs are combined in a TCO analysis the financial value of the demand curve can bet determined.

Creating a TCO index to evaluate the financial viability of cloud vs. on-premise applications takes each of these three components to a line-item level that CEOs, CIOs, line-of-business leaders and often board members need to have visibility of in order to make effective decisions (Ellram, Siferd, 1998). Costs to operate in TCO calculations of enterprise applications often include infrastructure and operations one-time and recurring costs, in addition to investments aimed at increasing performance of specific applications including availability and fine-tuning usability to drive up user adoption (Faletra, 1997).

The costs to support and maintain form the second set of costs included in a TCO analysis. These are the costs associated with off-the-shelf software applications prior to their customization to specific business processes that enterprises need to align them with to get the most value from then. Costs to support and maintain are also inclusive of the first, second and third levels of maintenance and support (Ferrin, Plank, 2002). This is the component of the TCO model that includes the 22% maintenance fees that companies who are using on-premise enterprise pay on a yearly basis. The costs to support and maintain also include adaptive, corrective, preventative and perfective maintenance categories. These four components vary significantly between cloud-based and on-premise applications, and often make the difference in a cloud-based application delivering greater levels of TCO over time.

The third component is cost to enhance and extend an application. These are the costs for adding new capacities and features to a given application. These also include minor and major updates, in addition to the costs of integration on-premise or cloud applications to legacy systems (Julie, Schuff, Robert, 2002). CIOs are increasingly demanding this be done to ensure that their entire enterprise is represented in the new could-based systems. The costs to enhance and extend an application can often become 2X to 3X the cost of the software itself, depending on the complexity and extent of integration (Hurkens, Wynstra, 2006). When a company is paying for an on-premise application using CAPEX-based budgeting techniques this will also show as a line item in that budget as well (Geiger, 2006). For cloud-based implementations, this is integrated into OPEX-based charges, or-rated over the entire length of the subscription contract (Ledford, 2004). All three of these types of costs are also charted against it demand to determine how a proposed could-based system will impact future costs of an enterprise as well.