How should we navigate the pitfalls of IT’s newest ‘big opportunity’? For individuals and small business, Cloud computing via the Internet offers unprecedented access to systems, software and technologies, previously restricted to the corporate world, at little or no cost. But for mid-sized and large organisations, the reality of adopting Cloud computing presents a whole new set of costs, risks and governance implications, quite different to those in traditional in-house IT systems. This public lecture provides a concise, plain English overview of Cloud computing and what it means for businesses in Australia. It explores the privacy, security, commercial, regulatory, cost, risk and internal governance challenges that organisations, as well as the wider community, should be aware of.

1. UTSpeaks: Clearing up the Cloud
19th
July 2011
THINK.CHANGE.DO
1

2. UTSpeaks: Clearing up the Cloud
What I’ll be covering:
1. Cloud computing definition and attributes
2. Key differences between Public and Private Cloud
3. Migrating to the Cloud: A ‘Ready-reckoner’.
4. The consumerisation or democratisation of IT
5. The intrinsic appeal of Cloud
6. The key considerations, such as :
• Privacy
• Risk and Security,
• Statutory and Legislative,
• Cost and commercial,
• Regulatory
• Internal governance
7. Cloud: The utility computing model
8. Cloud – The future is Now!
9. Open questions and discussion
2

3. UTSpeaks: Clearing up the Cloud
1. Cloud computing definition and attributes:
• Cloud is a very broad term for ‘IT systems accessed via the
Internet’.
• The various components are all run by an external party, and
you do not own anything, other than the data that you load into
the system.
The primary attributes of Cloud systems are:
a) You subscribe to the service
b) The system is accessed via the Internet
c) You neither have control or title over the Cloud system
d) You have limited to full title over the data that you upload
3

4. UTSpeaks: Clearing up the Cloud
2. Overview: Public and Private Cloud
Public and Private Cloud
– Key differences
4

5. The Public Cloud:
•is hosted on ‘somewhere in the universe’
•you own nothing, except your data that you upload.
•is only accessible via the Internet.
•Well known Public Cloud providers include Salesforce™,
Google™ and Amazon™
•There are a myriad of smaller Cloud providers coming
onto the market
• Some of which run on the major provider’s platforms, but
branded separately
UTSpeaks: Clearing up the Cloud
2. Overview: Public and Private Cloud
5

6. A Private Cloud:
•Conceptually, uses same technology (ie: virtualisation)
What is meant by ‘Virtualisation’?
•It is a technology that permits many ‘virtual’ servers to
run off a single physical server, as if they were separate
machines.
UTSpeaks: Clearing up the Cloud
2. Overview: Public and Private Cloud
6

7. A Private Cloud:
•Conceptually, uses same technology (ie: virtualisation)
•Is owned by you, or your nominated service provider.
• In the latter case, you generally have the contractual rights to
access and manage the system, as if it were yours.
•May reside on your own premises, or on a data centre of
a provider of your choosing.
•Grants you control over the underlying infrastructure
•Gives you visibility over the design, operation and
integrity of the overall system.
UTSpeaks: Clearing up the Cloud
2. Overview: Public and Private Cloud
7

8. UTSpeaks: Clearing up the Cloud
Migrating to the Cloud
Looking to move some of your
systems from onsite to the Cloud?
3. Migrating to the Cloud: ‘Ready reckoner’.
8

9. UTSpeaks: Clearing up the Cloud
3. Migrating to the Cloud: Cornerstone questions.
If the answer to these questions are YES, then you should be able to
progress relatively swiftly through your journey to Cloud computing:
1.Is the system standalone? (i.e. you do not need to build any system
interfaces)
9

10. UTSpeaks: Clearing up the Cloud
3. Migrating to the Cloud: ‘Ready reckoner’.
If the answer to these questions are YES, then you should be able to
progress relatively swiftly through your journey to Cloud computing :
1.Is the system standalone? (i.e. you do not need to build any system
interfaces)
2.Are your business requirements likely to remain relatively static?
3.If the vendor goes out of business do you have a workaround in
place?
4.Is the migration cost (Incl. write-off) for outgoing systems minimal?
5.Are the Cloud system boundaries clearly defined?
6.Are managerial accountabilities clearly defined and assigned?
7.Is there an immediate ‘crisis’ on your hands and Cloud is the only
realistic alternative?
10

11. UTSpeaks: Clearing up the Cloud
3. Migrating to the Cloud: ‘Ready reckoner’.
If the answer to these statements are YES, then you should be able to
progress relatively swiftly through your journey to Cloud computing :
1.You will not need IT programmers to maintain the system
• ie: Configure to suit your requirements through a control-panel
2.You will not need to do a major re-design of your business processes
3.Your data is not highly sensitive or subject to legislation (Eg Privacy
Act, caveats on major client contracts)
4.Your most critical and important intellectual property is remaining in-
house
5.Serving a short term need
6.Is your information largely in the form of pictures, files etc requiring no
specific (granular) security and access controls?
11

12. UTSpeaks: Clearing up the Cloud
The ‘consumerisation’ of IT
… also known as the ‘democratisation’ of IT
I see it, I like it, I want it, I buy it (or it’s free!), I use it – Now!
12

13. UTSpeaks: Clearing up the Cloud
4. The Consumerisation of IT
1. Individuals have unprecedented access to all type of IT
systems, from email, file storage, banking, shipping, social
networking (eg Facebook™ ).. The list is almost endless.
2. What is meant by ‘consumerisation’ of IT?
• Individuals can use / buy systems as they see fit.
• Personal choice and immediacy reigns supreme
• Buy it / use it without necessarily a long term in mind
• ‘Apps’ – for iPhone™, Android™, etc
3. For businesses, however, this presents a number of
challenges
13

14. UTSpeaks: Clearing up the Cloud
The intrinsic appeal of Cloud to business
14

15. UTSpeaks: Clearing up the Cloud
5. The intrinsic appeal of Cloud to business
Common influences include…….
1. It is available immediately
• Potentially, the system can be operational with hours, days or
weeks.
2. It allows you to ‘Buy before you try’……
• buy a few user subscriptions and try the system. If it does not
meet your needs, the walk-away costs are negligible
3. Avoids dealing with the IT Department !
• avoids having to possibly deal with an internal IT department
that may appear to be slow, inflexible or indifferent to Cloud.
4. Avoids the need for up-front capital / financing
• ‘pay as you go’
5. Appears to be low cost
• $100/user/month is a lot cheaper than $2Million upfront
… or is it?
15

16. UTSpeaks: Clearing up the Cloud
5. The intrinsic appeal of Cloud to business
6. Users already have had a positive personal experience with
Cloud…..
• Personal experience in using Cloud applications (e.g.
YouTube™ , Linkedin™, Gmail™, etc…) are invariably positive
7. Cloud eliminates the need for on-premises IT infrastructure
• The provider does the maintenance, operation and support of
the system.
8. Is a result of a compelling vendor offer……
• It is not uncommon for Cloud vendors to bypass the IT
department and go directly to the non-IT executive levels of
organisations with an ostensibly compelling offer.
• The difficult questions of cost, security, risk and governance
may be relegated to a later date (provided you know what
questions to ask, that is!) as the focus is on the usability of the
application.
16

17. UTSpeaks: Clearing up the Cloud
The key considerations for business
… could apply to businesses of all types
17

18. UTSpeaks: Clearing up the Cloud
6. The key considerations for business
• Privacy
• Security
• Risk
• Statutory and legislative
• Cost
• Commercial, legal and contractual
• Regulatory
• Governance
18

19. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Privacy
1. Privacy:
• What National Privacy Principles apply [under The Privacy
Act 1988] to your instance of the Cloud system?
• If your vendor is an overseas entity, how can you assure that
Australian Privacy legislation mandates are met, not only
now, but should they change in the future.
2. International jurisdictions
• On some foreign legal jurisdictions, Government agencies are
able to demand access to your system. Examples of this are
USA Patriot Act (2001).
• Emerging Chinese Cloud providers
• Concerned about sovereign ownership?
• Data crossing multiple international regulatory and legislative
jurisdictions 19

20. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Security
• Cloud concentrates the risk of security breach.
• One provider can service thousands of customers
eg Distribute.IT lost 4,800 websites in a recent hack
• Unauthorised or accidental access
• Denial of service attack (ie: Saturation attack of the service)
• What data transmission standards and protocols are guaranteed
by the Cloud provider?
• Which security standards apply, and to which components of the
vendor’s infrastructure?
• Review the statement of applicability (SOA) of the
appropriate Certification
• Is your Cloud solution in-scope of the SOA?
20

21. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Security
http://trust.cased.de/AMID
21

22. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Risk
1. Risk transfer
• Can I buy insurance in the event of a problem with the Cloud?
2. Can you implement a Cloud escrow* arrangement in case the provider
folds?
• Some Cloud providers cannot offer escrow due to the technical
design of their infrastructure
3. Does the provider have a disaster recovery plan?
• What form does it take, and what scenarios does it cover?
4. Are you concerned about the unauthorised deployment of Cloud
applications?
• The risk of a ‘viral’ cloud is real, and may be hard to detect
• Do you have a Cloud computing policy?
* Escrow: The system (or software source code) is released to the licensee by the escrow provider if the
licensor files for bankruptcy or seriously breaches the terms of the agreement.
22

23. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Cost
1.Do the TCO* over the
expected life-span of the
system
2.Do not exclude on-premises
(Private Cloud, or traditional
hosted) if these options exist
3.Understand the hidden costs
(integration, 3rd
party, etc)
4.Understand the exit costs
5.Understand the implications
of an ‘enterprise’ or
‘unlimited’ offer.
6.Compare on a like-for-like
basis in terms of cost (buy
vs. rent)
* TCO = Total cost of Ownership. The total cumulative cost over a defined period, and includes all cost elements, not just the up-front, or
most obvious costs.
Illustrative example only
23

24. UTSpeaks: Clearing up the Cloud
6. The key considerations for business:
Commercial, legal and contractual
24

25. UTSpeaks: Clearing up the Cloud
6. The key considerations for business:
Commercial, legal and contractual
1. Total Cost of Ownership
• Is the TCO known with certainty?
2. What are the key drivers behind the adoption of Cloud?
Are they to …
• Drive innovation?
• Lower cost?
• Increase flexibility?
• Global mandate (for a multinational business)?
3. Level of protection under the contract
• Do the remedies for service failures make commercial
sense?
4. What is the cost of seeking legal recourse?
• If you provider’s contract is in an overseas legal
jurisdiction, how practical will it be to seek damages?
25

26. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Vendor contracts
1. What’s your Cloud contract duration?
• If this is truly utility Cloud, why commit to a contract for a long period of
time?
2. Can you scale up and down as you see fit at any time?
• Easy to scale up – what if you want to scale down?
3. If marketed on ‘per user per month’ pay on that basis.
• Some request annual pre-payment. You are the vendor’s banker.
4. Watch for automatic renewal and, in particular, sunset / termination clauses.
• You should be in control of the process
5. Request a copy of the draft contract early
• The procurement cycle can be time consuming for large projects.
• All that effort could be wasted if there is a major sticking point in the
contract.
6. Global Cloud providers are reluctant to change standard contracts
• Standardisation is the cornerstone of Cloud
• Some vendors will amend terms if you have large buying influence 26

27. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Vendor contracts
7. Contract refers to website terms & conditions?
• May extinguish or override your written contract at any time?
• Seek perpetual, fully encapsulated contract that extinguishes any online terms
and conditions including the ‘I Accept’ checkbox at logon
7. Purchasing additional subscriptions.
• Subject to the existing contract or an online contract at the time of purchase?
7. Recourse for non-performance.
• Is the compensation adequate in the event of non-performance?
7. What warranty exclusions or limitations apply to all services offered.
• Are these important to your organisation
7. Data transmission encryption standards and methods used
• Specifically stated? If so, are these standards adequate for your purposes?
7. Right to Audit
• Do you have the right to request an independent audit of the provider?
7. Jurisdictions
• Which international legal and regulatory jurisdictions apply? 27

28. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: 3rd
Party contracts
Proprietary 3rd
Party Cloud providers
• Some vendors encourage an eco-system of third party developers
who market their applications independently of the provider, but on
their proprietary Cloud platform.
• Has the potential to increase the ‘pain of disconnect’ when switching to
another provider at a later date
Examples
• Salesforce™ App Exchange
• Google Android™ Market.
• Apple™ App Store (‘Apps’)
• Software plug-ins
Perform due diligence of the risks, costs and benefits associated with
these 3rd
party applications
28

29. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: 3rd
Party contracts
1. Will the Cloud provider charge anything for access to these 3rd
party
apps?
• Some may charge an additional access fee for smart phones
2. Performance guarantees
• What obligations exist for the Cloud provider to assure the quality,
security, integrity and performance of the third party applications
hosted on their infrastructure?
3. 3rd
Party contract
• What are the terms and conditions of any 3rd
party contract?
• Are there any conflicts between the 3rd
party and the vendor’s
contract
• Do they offer the same levels of security, governance, etc
as the primary vendor?
29

30. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Regulatory
• Planned 2012 changes in International Accounting standards will have
a reporting impact for off-balance sheet financial commitments
• All leases, regardless of their terms, should be accounted for in a
manner similar to how finance leases are treated today.
• May put Cloud costs back onto the balance sheet in businesses
[ Standards published by the
International Accounting Standards
Board (IASB) ]
30

31. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Regulatory
• Planned 2012 changes in International Accounting standards will have
a reporting impact for off-balance sheet financial commitments
• All leases, regardless of their terms, should be accounted for in a
manner similar to how finance leases are treated today.
• May put Cloud costs back onto the balance sheet in businesses
• What National Privacy Principles (NPPs) apply under the Privacy Act
(The Privacy Act 1988)?
• What document and information retention requirements apply under
the applicable Federal or State laws? (eg: Corporations Act 2001).
• Are there any industry specific regulations that apply to your
organisation? For example, APRA (Australian Prudential Regulation
Authority)
31

32. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Governance
The ‘Viral’ Cloud
1. A viral Cloud is characterised by a localised initial installation of a Cloud
system (approved or otherwise!) which expands in an uncontrolled
manner.
• Additional subscriptions are gradually purchased for others outside
of the initial user pool to approve workflows, access documents,
process information etc.
2. The low barrier to entry could mask the potential for additional cost,
unmitigated risk and breach of minimum governance standards.
• A leading Australian University experienced an unauthorised
deployment of a Cloud system that was funded from one Faculty’s
discretionary budget, as it fell within their prevailing local
discretionary expenditure approval limits. This was only noticed
when data integrity issues within their core student enrolments
databases started occurring. 32

33. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Governance
Change and version Control
You may have no control over the timing and types of changes
Is this important in your organisation? 33

34. UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Governance
Change and version control
Scenario: Upgrading your Cloud 1 ’other system’ interfaces
34

35. Change and version control
Scenario: Upgrading your Cloud 1 ’other system’ interfaces
1. Usual practice to take a ‘point in time’ backup as a restore point
before implementing the upgrade.
• This is in the event of needing to fallback to the pre-upgrade
point should the upgrade fail for whatever reason.
2. If your Cloud provider cannot restore designated elements of, or
your entire system, in an acceptable timeframe*, what can you
do?
• Core to effective governance of IT is change control and
recovery processes
(eg SOX Section 404 – General controls, to name but one).
* - eg: Restore may be needed immediately. Some providers can take a few days
UTSpeaks: Clearing up the Cloud
6. The key considerations for business: Governance
35

36. UTSpeaks: Clearing up the Cloud
7. Cloud: The ‘utility’ computing model
Or is it?
Cloud computing ……
The ‘utility’ computing model
36

37. UTSpeaks: Clearing up the Cloud
7. Cloud: The ‘utility’ computing model
A utility service is characterised by:
a) Pay for what you use
b) Switching providers is effort free and painless
What’s this got to do with Cloud Computing?
• Understanding these concepts are important when
matching the various vendor’s marketing messages to the
reality of what you are buying.
• This applies particularly to ‘Software as a Service’ (SaaS)
Let’s consider these two points …..
37

38. UTSpeaks: Clearing up the Cloud
7. Cloud: The ‘utility’ computing model
Pay for what you use
SaaS is generally on a Named user subscription basis
How does it work?
• One subscription is assigned to a unique logon (user
name), irrespective of how many times the users access
the system.
ie: You pay the same whether you log on once in a month, or 1,000
times in the same time period
The analogy:
• This model licenses you for the number of light bulbs in
your house, whether you switch them all on, or some,
some of the time. 38

39. UTSpeaks: Clearing up the Cloud
7. Cloud: The ‘utility’ computing model
Pay for what you use
Consider for a moment the information on a leading SaaS
provider’s website …
39

40. Painless barrier to changing providers
The ‘Pain of change’ :
• Switching is neither painless or trivial as there are no
common interchange standards
• Can extract your data, but not the business logic and
application software
• Your software is left behind on the outgoing Cloud
• You will need to re-configure or re-build any system-to-
system interfaces
UTSpeaks: Clearing up the Cloud
7. Cloud: The ‘utility’ computing model
40

41. UTSpeaks: Clearing up the Cloud
8. Cloud – The future is now
1. Cloud technology, as with any other innovation, has the potential to do
things cheaper, faster and better.
2. Cloud has the potential to be a real game changer for the astute
3. Define your strategy now:
• Be an early adopter, or
• A fast follower, and leap-frog the early adopters be capitalising on
their experiences
4. To achieve these benefits understand:
• the true cost
• the value
• the risk
• when to buy
• what to buy, and
• when to exit the technology and/or switch horses. 41

42. UTSpeaks: Clearing up the Cloud
9. Open questions and discussion
Thankyou
I trust that you have found this presentation informative, and of value
Rob Livingstone
rob@rob-livingstone.com
42

43. Thankyou
THINK.CHANGE.DO
43