NOA Monthly Seminar
Cloud Computing – Sponsored by IBM
Tuesday 15th February 2011

As the world of industry changes, the outsourcing sector has found it increasingly important to adapt to new technologies which are continuing to drive forward new, innovative services. If 2010 was the year of the Cloud, then 2011 looks to be no different as the market matures, and Cloud services continue to gain momentum.
The NOA Monthly Seminar on Cloud computing focused on a comparison of traditional methods versus current Cloud computing, Cloud models, risks, security, G-Cloud and case studies.
Andy Rogers, NOA Board Member and Chris Mole, IBM, chaired the event and outlined that the seminar would be based around the practicalities of Cloud along with the risks.
Chris said: “There has been a fundamental gear change regarding Cloud. Most organisations now have a ‘Cloud first’ IT policy and it is absolutely imbedded into our strategy. Although it is important to mention that Cloud will and can not solve all problems.”
John Willmott, NelsonHall, looked at why companies should move to the Cloud and focused on a comparison of Cloud computing models, Cloud’s use in private and public sectors, differences between SMEs along with the medium and large corporate enterprises use of Cloud.
Attitudes Towards Public Cloud
• While private cloud has benefits of security it tends to lose on every other measure. The scalability isn't present and the level of internal management makes it difficult to see where the benefit would lie.
• The main benefits in public cloud are very transparent - private cloud still relies too heavily on investment and administration time. There is not the same level of scalability.
• Public cloud is the only way to achieve good scalability and companies would probably struggle to find cost benefits in implementing private systems
• Buying SaaS lowers security risks when compared to with core applications in the cloud therefore public systems would meet cost and security criteria best.
Attitudes Towards Cloud Delivery: Hybrid Cloud
• To meet cost expectations, elements of public cloud are needed to provide the acquired scalability - the private cloud element, although easier to add resources to, is still less scalable but may be necessary to achieve a higher level of security.
• To ensure improved privacy, better control and still benefit from the scalability
• It looks likely NelsonHall will opt for some sort of hybrid and are less concerned about the data security for cloud based applications and more concerned about what access that application has to internal enterprise systems and the potential security gaps they may have to deal with.
Regarding the initial adopting of Cloud, John believes that SaaS will be present in several forms. “Email is likely to move that way as are desktop office suites and the specialist applications used within some sales teams and niche product support teams. We already have some SaaS in administrative and management desktops.
“Cloud is limited to applications around the periphery of the business. We think this will change through 2012 with some desktop applications, email especially being largely hosted in the cloud. Major infrastructure will remain internal until we can be certain of security risks.”
Half of organisations expect to begin to implement Cloud in production environments by end 2012. The production environment that will initially be moved to Cloud are typically those with high and variable storage environments such as contact center systems and CRM systems and those already regarded as being exposed to outside scrutiny such as Web-based and e-commerce systems.
NelsonHall Conclusions
• Despite the hype, Cloud is real
• Improving the business’ access to technology, and pay-per-use scalability are key drivers
• Hybrid cloud favored in short-term
• Initial adoption around email, collaboration, and desktop applications
• Initial production applications will be storage-intensive and web-based
• SaaS will be used for fringe functionality
Shiv Kumar, Executive Vice President, Zylog Systems Limited discussed the options and advantages of the various Cloud models and what Cloud computing can offer in its various forms.
Shiv said: “Cloud computing can provide more dynamic, resilient and cost-effective IT systems. A different user experience and business model which can offer standardised offerings, rapid provisions and flexibility on price.
As an infrastructure management and services delivery method it utilities virtualized
resources, it can be managed as a single large resource and has the ability to deliver services with elastic scaling.
Cloud Competency Focus
• Establishing cloud reference architectures and framework – Cloud/SaaS -> BPM/SOA
• Delivering cloud enabled business solutions/products pro-actively . Enterprise 2.0 SocNet, PowerCube DaaS, PowerMigrator, Business Solutions & Mobile Solutions
• Best practices to address the known challenges and limitations – Compliance and Regulatory issues
• Providing consulting and implementation services
• Address the time to market and TCO/ROI
Rob Sumroy, Head of Information Technology and Outsourcing Practices, Slaughter and May, outlined the risks associated with Cloud computing however emphasis was placed on risk being a good thing – risk is why we do business.
Risks associated with data include locality, security, confidentiality, retention / preservation, access and deletion.
Most standard Cloud contracts will carve out typical liabilities – even direct losses for standard services. Pay as you go provides no guaranteed income for service providers.
Cloud risks include service availability (service credits), warranties and indemnities, liability, governing law, jurisdiction / arbitration and variation - reserving right to vary Ts&Cs without notice to customer.
Risk Conclusions
● Risk is not inherently bad
● Greater rewards often flow from higher risk
● Challenge: to find the right level of risk in the relevant circumstances
● Cloud contracting presents altered risks and new circumstances
● Informed engagement with Cloud providers
● Strategic embracing of Cloud opportunities
Darren Argyle, IBM UK Security and Compliance Offerings Leader, IBM,said: “There is no other tech trend like Cloud that has put security in the spotlight. Like any technology, we need to take a risk based approach.”
Darren provided an overview of Cloud security and describe how to address the challenges to ensure security.
“The right security must be embedded in the Cloud. Every business today has an element of their business outsourced –Cloud risks are similar to the key outsourcing risks. If security is approached properly, it can actually be an enabler.”
Companies moving to Cloud should:
Define a Cloud strategy with security in mind
• Identify the different workloads and how they need to interact.
• Which models are appropriate based on their security and trust requirements and the systems they need to interface to?
Identify the security measures needed
• Using a framework such as the one IBM uses, the IBM Security Framework and Blueprint, allows teams to capture the measures that are needed in areas such as governance, architecture, applications and assurance.
Enabling security for the Cloud
• The upfront set of assurance measures you will want to take.
• Assessing that the applications, infrastructure and other elements meet your security requirements, as well as operational security measures.
After the break, users of Cloud provide case studies which included presentations from Mark Farrell - CSC, Adrian Steel - Royal Mail, Paul Davies – Verizon and Pete Beevers – IBM.
Copies of all the case studies and presentation slides can be found on the NOA website - http://www.noa.co.uk/