IEEE PHM Cloud Computing

1.
Cloud ComputingDr. JosephWilliamsSenior Director – Cloud Connect StrategiesMicrosoft Corporationjosephwi@microsoft.com

2.
Thank you foryour timePHM up in Seattle has historically been associated more with Boeing than with MicrosoftSoftware systems are incredibly complex and they operate in similarly complex ecosystems of Hardware, networks, security, and end-usersWe do pay attention to PHM

3.
It is stillthe wild, wild west out there amongst the clouds…A whole lot of vendors, analysts, and evangelists making a whole lot of noiseAccording to IDC, worldwide customers spent nearly $23 billion on public IT cloud services in 2010Gartner was reporting 2010 spend of $68.3B, including private cloud

4.
Why Enterprise CustomersEmbrace the CloudReduce CAPEX & OPEXLatest Versions with No Server UpgradesPredictable SubscriptionsChoice, Flexibility, & Resource Agility Merger, Acquisition & DivestituresFocus on Market DifferentiationEnergy EfficiencyUp and Running QuicklyPlus CIOs are being told they aren’t “innovative” unless they are looking atthe cloud.

5.
Vision for aCloud EnterpriseSalesCollaborationFor all employeesOperationsAccountingHRR&DMarketing

6.
It is allvery seductiveAnd mystifying

7.
But the Cloudisn’t easy“Cloud” has already disaggregated into Service offerings

8.
Technical platforms

9.
Economic models TheCloud is a BattlegroundThe Battle InTHE CLOUDThe Battle forCONSUMERSThe Battle In The DATA CENTER

10.
The Cloud iscomplexEach Service layer is every bit as complicated as in any large-scale data centerUnlike in a traditional data center, each service layer may have its own service-level agreements (SLAs)Each cloud service layer may need to interoperate with services from other providers; those interactions, in turnmay have their own SLAsExtremely difficult to architect and build for resiliencySecurity is its own dynamic problem

11.
Customer Priorities ForHow they Select Cloud ProvidersIDC Microsoft Hoster Server Infrastructure End User Survey - Dec 2010

12.
Cloud Services arecustomized combinations of servicesInfrastructure(as a Service)Platform(as a Service)Software(as a Service)(On Premises)ApplicationsApplicationsApplicationsApplicationsYou manageDataDataDataDataYou manageRuntimeRuntimeRuntimeRuntimeMiddlewareMiddlewareMiddlewareMiddlewareOther ManagesYoumanageO/SO/SO/SO/SOther ManagesVirtualizationVirtualizationVirtualizationVirtualizationOther ManagesServersServersServersServersStorageStorageStorageStorageNetworkingNetworkingNetworkingNetworking

13.
IT Pro shiftsin management responsibility: Whose cloud is it?On-premise IT departmentCloud service providerWhere things could get “interesting”HighLowLowHighIaaSSaaSPaaSIT has most control over Infrastructure

14.
Theoretically, IT Orgduties won’t change significantly

15.
Initially, increased workresponsibilities for architects

16.
Monitoring processes willchange with greater reliance on host (for security, resource allocation, connectivity, performance, etc.)

17.
IT Pro hasincreased responsibility in terms of maintenance, monitoring, and troubleshooting

18.
Troubleshooting is morecomplicated, support workflow more complicated

19.
A top painpoint

20.
Monitoring processes maychange with greater reliance on host

21.
IT Pro hasleast control over this environment

22.
Lightest touch troubleshootingand support

23.
Relationship with hostwill be mostly routing trouble ticketsVisibility BoundaryVisibility Boundary

24.
Cloud Management PlatformPhasesStandard model for offering cloud servicesThese models take a strong dependency on what kind of SLAs the service expects to offer

25.
Where PHM fitsin with Cloud ServicesHow teams understand the status of their service reporting dashboards alertingpredictionSLA measurement Collection and analysis of data that reflects real-time and historical performance of the service against key scenariostelemetry machine health instrumentation tracingalertingUnified ExperienceCustomer Self-ServiceEasy to UseProactive FocusNext Generation PlatformPerformanceEnablementStability

26.
Some interesting learningssince last yearA lot of enterprises don’t like the self-service model of the cloud and they are willing to pay for elevated supportDealing with regulatory compliance / certification is complicated byLegal interpretationRisk toleranceProcurement maturityCloud interoperability is really, really hardWho controls the end-user experience?Who controls PHM elements?How to do trouble-shooting?

27.
Regulatory and JurisdictionalChallenges for the Cloud are the same as always10 years ago…Security and privacy top of mindHacking, virus propagation, cyber-espionage and cyber-warfare on the riseEnforcement officials need tools & trainingVehicles for cross-border collaboration inadequateToday…Security and privacy top of mindHacking, virus propagation, cyber-espionage and cyber-warfare on the riseEnforcement officials need tools & trainingVehicles for cross-border collaboration inadequate

28.
Still Unresolved :Jurisdictional TensionsWhere is the data?Tensions created by different countries asserting jurisdiction over dataTension between privacy rules requiring minimization of data retention obligationsLaw enforcement accessHuman rights concernsHow much should the location of the data matter?

29.
Data SovereigntyA SeriousProblemGreenlandEfficiencies and benefits of cloud computing are best achieved when data flows freely across bordersPrivacy laws that restrict such flows will continue to be an impediment European restrictionsCanadian provincial rulesAustralia National Privacy Principle #9Blackberry problems of 2010AlaskaNorwayFinlandIcelandRussiaIrelandSwedenUnited StatesCanadaGermanyBelarusGreat Britain IrelandPolandUkraineNetherlandsKasachstanFranceMongoliaRomaniaUzbekistan Kirgisistan ItalyNorth KoreaSpainPortugalUSATurkeyTadschikistanJapanGreeceSyriaTurkmenistanChinaSouth KoreaHong KongTunesiaLibanonIraqAfghanistanIranMoroccoBhutanIsraelNepalKatarAlgeriaLibyaPakistanBahamasSaudiArabiaWestsaharaMexicoV.A.ETaiwanEgyptMyanmarCubaIndiaBelizeLaosDom. Rep.OmanMauretaniaEritreaBangladesh NigerMaliVietnamJamaicaTschadHondurasGuatemalaSenegalYemenSudanKambodschaNikaraguaBurkinaEl SalvadorGuineaPhilippinesVenezuelaNigeriaThailandZ. R.Bangui Ethiopia Costa RicaGuyanaSierra LeoneKamerun PanamaSurinameColumbiaSomaliaMalaisiaLiberiaTogoUgandaFr. GuyanaGhanaGabunEcuadorCote d‘IvoireKeniaD. R.Congo IndonesiaCongoPapua New GuineaTansaniaBrazilPeruAngolaMozambiqueZambiaBoliviaZimbabwe NamibiaSingaporeMadagascarParaguayBotsuanaAustraliaSwazilandSouth AfricaLesothoChileUruguayArgentiniaNew Zealand

30.
The Big Battlesin the CloudService descriptions do not rise to legal clarityNeed for standardizationNeed for clear articulation (service catalog)OpEx is not always preferable to CapEx, contradicting one of the generally assumed benefits of Cloud ComputingFor many, CapEx is perceived as an easier and faster expense to justify, and OpEx is something they’re continually pushed to reduce.

31.
Final Thoughts –The Good NewsWorkforce mobility, supporting branch locations, and granting partners access to enterprise resources are becoming realConceptually there are significant Cloud benefits, including flexibility, resiliency (i.e., failover / DR), reduced internal management burden, faster provisioning, pay-as-you go, and anywhere access.Licensing complexity will eventually be reduced:Subscription easier than perpetual

32.
Compliance is muchsimpler

33.
Underutilization and undeployedsoftware easier to manageEase and speed to deployment are benefits will arise from the CloudCentralized Cloud IT will embrace collaboration and reduce complexity

34.
Final Thoughts –Some Grim NewsInternet has enjoyed ‘light touch’ regulation – That will end soonData is becoming ‘stateless’:Cross platforms

35.
Cross providers Governments and Enterprises are very worried about this

36.
Cross borders“Best ofBreed” Clouds stiil need to integrate:Developers need certainty to build globally relevant applications

37.
Customers need confidencethat their data is protected

38.
Service providers needclarity to build the platform and infrastructure for the cloudTaxation will have caught up with the Cloud pretty soonHow legal and regulators frameworks view ‘interoperability’ could change things

39.
Questions?

40.
Appendix: Questions ToBe AnsweredThe next few slides contain questions that really need to be addressedMost enterprises will demand satisfying answers before deciding to move significant workloads to the cloudUltimately there is no right or wrong answer, there is just an answer which reflects the enterprise and its requirements

41.
Compliance and RiskManagementWhat certifications does your provider possess?ISO 27001:2005How often do they re-certify?Do you have access to the audit reports?Who conducts the audits?How seamless are the processes to move in to the cloud and back?How is the collaboration between the cloud provider and you with regards to essential processes like:Incident ResponseForensic AnalysisRisk ManagementBreach NotificationLaw Enforcement Enquiries?

42.
Compliance and RiskManagementHow do you handle dispute resolution and liability issues?How can you ensure policy compliance?How can you prove that you follow your internal policies in the cloud as well? What is needed?What is needed to prove policy compliance towards any regulation you have to follow?What industry or government standards do you comply with?How is your infrastructure and processes audited and by whom? Do I have access to audit summaries?How are you able to monitor your risks all across your infrastructure?Are there clearly defined metrics for the cloud service to be monitored?How are eDiscovery and criminal compliance requests handled?Are the audit logs forensically and legally sound?

43.
Identity and AccessControlHow can you integrate the provider’s identity metasystem with your identity management processes?Who owns your identity?Is there an in-person proofing for identities you will trust (if this is necessary from your risk assessment)?How can identities federate across different services and from your internal environment to the cloud?How do I federate with my partners, vendors, and other enterprises?Is the application writer responsible for access controls or is there a service to do that?How are the databases protected for access?Do the software API’s have cryptographic keys in use?Is all of your software signed?

44.
Service IntegrityHow doesyour provider ensure the security of the written code?Have they implemented a Security Development Lifecycle?How do they do Threat Modeling?How do they test against their Threat Model?How is process consistency ensured?What is the hiring process for the personal doing administrative operations?Are they background checked?What levels of access do they have?

45.
Service IntegrityHow isthe software protected from corruption (malicious or accidental)?Is there a secure development and software integrity process enforced for all the code within the responsibility of the provider?Who does the cloud supplier use as their critical suppliers and transparency into how those relationships are managed for security and availability?What is the Security Update strategy of the cloud provider?How does the cloud provider manage vulnerabilities? Including incident response and triaging?

46.
Other IntegrityEnd-Point IntegrityHowis the client integrated into the trust relationship with the cloud (e.g. Cardspace)?Information Protection and Transaction IntegrityWho owns your data?Can it be encrypted?Who has access to encryption keys?Where is the backup located and do you have an on-premise backup? How is the backup purged?Where is your data stored? What requirements do you have with regards to the physical location of your data?

47.
Key Findings –Cloud Migration of ApplicationsThe sensitivity of app data has significant influence in determining which workloads/ apps IT departments would even be willing to consider moving to the Cloud.

48.
Firms won’t movemission-critical apps or highly sensitive data sets into the Cloud. They want them on-premise for control, performance, and security reasons.

49.
Highly integrated applications(e.g., ones that touch multiple internal databases or systems) are impractical to move to the Cloud in isolation.

50.
Firms are generallynot willing to re-write their legacy apps for the Cloud. The rare exception was if a positive ROI could be proven at the outset. Most Likely Candidates for CloudPackaged apps (SaaS)

51.
Less mission-criticalapps

52.
New and/orsmaller LOB apps

53.
Infrequently usedapps

54.
Apps builton Web standardsLeast Likely Candidates for CloudMission critical apps

55.
Running highlysensitive data

56.
Legacy apps/systems

57.
Custom orspecialized apps

58.
Highly integratedappsThank you!© 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

IEEE PHM Cloud Computing

More Related Content

What's hot

Similar to IEEE PHM Cloud Computing

IEEE PHM Cloud Computing

Editor's Notes