Cloud_Network_Whitepaper_1123_LowRes
- 1. Understanding & Differentiating Private, Public, Hybrid Cloud & Their Network Access Modalities. There exists tremendous confusion about what different types of Cloud computing services are, what they represent, and what they offer compounded by the blurring of the concepts of Cloud and Internet. We seek to build real-world understanding of the Cloud market and the impact of the various choices in Network access. WHITEPAPER - by Steven Harrison, Lead Technologist & Head of Products - Exponential-e. July 2015
- 2. Contents Introduction 2 Definition of Cloud Computing 3 Different Types of Cloud 4 Private Cloud 4 Public Cloud 4 Hybrid Cloud 4 Clouds fit for Purpose 5 The Nature of Cloud Services 6 Cloud Network Access Choices 7 Private Network Access 8 Security Considerations 8 Appropriate Expectations of Cloud 9 Conclusion 10 Introduction The market for so-called ‘Cloud Computing’ is perhaps one of the least understood but most widely discussed topics in the field of IT this decade. Originally a simple icon for the bits of a Network which customers did not want or need, the humble Cloud has come to represent anything from Networks to computing infrastructure to full applications. Anywhere you see a Cloud you’re also likely to encounter an acronym usually ending in the letters ‘aaS’ which means ‘as a Service’. This tells you more about what’s changed in the IT world than the Cloud itself. We’re beginning the transition to the whole of IT being delivered, not as a collection of parts, but as a ready-to-use service. The challenge the market struggles with is understanding the form and nature of this service. Unlike other established utilities, or other established professions, IT has far more depth and complexity. What a business developing web-based services and software requires is as different from a business selling cars, as one would imagine, however the underlying technology is all the same. Cloud computing attempts to address this by offering many different types (private, public and hybrid) and styles (infrastructure, platform and software) to many different parts (servers, desktops and mobile) of an organisation. What is so often overlooked when examining these Cloud Computing solutions is the humble Network, the piece that first disappeared behind a Cloud. Without the Network, the Cloud cannot function. If your Network is down, your Cloud is down; if your Network is slow, your Cloud is slow; as Exponential-e - leading British Cloud and infrastructure provider famously say “Your Cloud is only as good as your Network”. To be able to really get the most from Cloud you must first understand it, and then apply it to your organisations with the appropriate thought as to how you will connect to and access it. WHITEPAPER - Understanding & Differentiating Private, Public, Hybrid Cloud & Their Network Access Modalities
- 3. 3 The National Institute of Standards and Technology in the USA in 2011 published their ‘final’ definition of Cloud Computing, following more than 15 years of debate. Quoted here is what they determined as the five essential characteristics of any service wishing to be called ‘Cloud’: 1 On-demand Self-service. A consumer can unilaterally provision computing capabilities, such as server time and Network storage, as needed automatically without requiring human interaction with each service provider. 2 Broad Network Access. Capabilities are available over the Network and accessed through standard mechanisms that promote usage by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations). 3 Resource Pooling. The provider’s computing resources are pooled to serve multiple consumers using a multi- tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources, but may be able to specify the location at a higher level of abstraction (e.g., country, state, or datacentre). Examples of resources include storage, processing, memory and Network bandwidth. 4 Rapid Elasticity. Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward to be commensurate with demand. To the consumer, the capabilities available for provisioning should appear to be unlimited and be appropriated in any quantity at any time. 5 Measured Service. Cloud systems automatically control and optimise resource used by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilised service. From these five points you can clearly see that many services advertised as ‘Cloud’ are in-fact not Cloud services by the strict definition of what it takes to be a Cloud service. One could also argue that in many respects, self-built Clouds would struggle to be considered a true Cloud service as they are unable to provide all of the five points above. In fairness some larger organisations certainly qualify as they have implemented their own inter-departmental metering, billing and scaling drawn from a company-wide pool of resources. It is worth drawing special attention to the second requirement, broad Network access and consider for a moment if all Clouds truly provide this? The access will depend on the location and connectivity of the person or device accessing it. Definition of Cloud Computing
- 4. Different Types of Cloud Cloud is most broadly defined as being of three types: private, public and hybrid. What’s not discussed here is the impact of location for each of these types of Cloud; the type of Cloud does not tell you its location. When considering important legal and regulatory concerns such as data residency and information privacy, the location of the Cloud can be just as important as the type. The specific definitions of each type of Cloud is a topic of some hot debate however I will endeavour to lay down clear definitions, which are accepted by most professionals in the IT field. Private Cloud The most succinct definition of Private Cloud is to say that it is a Cloud computing system which exists as part of, or one of, an organisations private local area Networks (LANs). This implies that it is ‘behind the Firewall’ and not directly accessible via the Internet, or having direct Internet access, but instead dependent on what other pre-existing Internet access and remote access systems the organisation has in place. When it comes to location, this is slightly more contentious. One could argue that private Cloud can be self-built and even installed on- premise, whereas the most common accepted belief is that private Cloud is always supplied by a service provider, external to the organisation which is consuming the services of the Cloud. For the purposes of this paper we will limit ourselves to the former, where the term private Cloud simply means it is within the corporate perimeter and internal to one or more LANs, regardless of where it is physically located or who is operating it. Public Cloud If Private Cloud is defined as a Cloud located inside the corporate perimeter, then we can easily accept that public Cloud is one which is not. By definition then we understand that the primary mode of access will be Internet, though this does not preclude the availability of some other means of access. Hybrid Cloud Hybrid Cloud then becomes a simple concept to understand in that it’s the combination of two or more Clouds, each of which can be of the type ‘private’ or ‘public’. While it is most commonly thought of as being the combination of at least one private and at least one public, there is no such limitation. A Cloud comprised of two different private Clouds, for example one outsourced and one built internally is still every bit a Hybrid Cloud. WHITEPAPER - Understanding & Differentiating Private, Public, Hybrid Cloud & Their Network Access Modalities Cloud Infrastructure Service YOY Growth Source: Synergy research Group Figure 1 81% 96% 51% 48% 37% 5 4
- 5. 5 Q2 2014 Market Share & Revenue Growth (IaaS, PaaS, Private & Hybrid Combined) Clouds fit for Purpose Having established a clear understanding of the different types of Cloud, it is appropriate to highlight briefly why these different types of Cloud have come into existence. If we can accept that ‘Cloud’ is nothing more than the most current model of outsourced computing it should be safe to say that each type of Cloud has evolved to serve particular customers or applications. Whereas the mainframe time-sharing of the 1980s was intended primarily for computing applications that required periodic access to larger memory and processing power than most businesses utilised; and the managed hosting of the 1990s provided faster Internet access than most businesses required; each Cloud has evolved to meet a particular need. The dominant Cloud player today is undoubtedly Amazon Web Services (‘AWS’) with nearly 30% of total Cloud market share (Synergy Research Group, 2015) shown in Figure 1. What many people fail to realise is that Amazon Web Services (AWS) was never initially developed as a product or service from Amazon. Their entire Cloud ecosystem was born of the frustrations of running the world’s largest e-Commerce site. Traditional hosting technologies were simply not fit for purpose, and so the engineers at Amazon set out to create a new internal service which would be more scalable (elastic), cost efficient and reliable for hosting Amazon’s own online empire. This in many ways became the first true ‘public’ Cloud. If we think of the Internet in terms of physical real estate, Amazon is the biggest vendor on the high-street, and most of the foot traffic they receive is public, not private or by invitation only. One of Amazon’s most famous case studies is surprisingly Netflix , another online high-street brand with a massive public audience, but one which actually competes directly with Amazon. Why would Netflix have chosen to host their service with a potentially serious and deadly competitor? Their reasoning was made clear in the detailed blog post by Netflix’s own Director of Engineering (John Ciancutti, 2010). Key business issues identified by Netflix were that they were not very good at forecasting and planning for their own growth and storage usage and that by outsourcing their datacentre activities to Amazon allowed them to focus their efforts on selling their products and services. This is one of the key tenants behind the transition to Cloud, focusing on what makes your business different and better than your competitors, not on the day- to-day operations. It shouldn’t be surprising then that public Cloud is the ideal type of Cloud when your users are primarily, the public. When it comes to more sensitive systems and information however, other considerations come into play. If we use the analogy of banking, we have different types of banks (some private, some high- street) and we have different services or ‘products’ offered by these banks, some daily accounts with cards that can access cash and pay for services from a multitude of points on the high-street to safe deposit boxes that require multiple signatures and ID to gain access in a designated private room. We all intuitively understand that we put our day- to-day (i.e. public) funds in the daily account and our most precious documents and savings behind layer upon layer of security. The same principal applies to using private Cloud. ConsiderthecaseoftheiCloud‘hack’ofSeptember 2014 (BBC, 2014). Apple immediately confirmed that accounts had been compromised but denied any security breach had happened. Those not clear on their understanding of Cloud immediately blamed Apple and the Cloud for failing to secure these individuals accounts; however if we use the banking analogy, that’s like blaming the ATM for handing out cash when someone enters their card and PIN code. The iCloud (like the ATM) was simply performing its designed function, in this case to store and then later retrieve photos. Its function is not to ensure with certainty that the person retrieving the photos was the authorised user, it simply waits for the correct name and password to be entered. Someone with a better understanding of the Cloud would know that you wouldn’t put your private content in a public Cloud, any more than you would put your entire life savings in a current account. Private Clouds, such as those built by a number of smaller boutique service providers and major players, like IBM Softlayer and VMware Air, are purpose built and do not serve Internet connected users. Instead, they put layers of security and isolation between themselves and the Internet and only serve authorised, authenticated and audited internal users. It is at this point that Hybrid Cloud begins to make sense, as few businesses today are either entirely public facing or entirely private. On balance most organisations will find that they have several different needs across the spectrum of their business, from public to highly confidential content, and so it is more appropriate that they use multiple Clouds and Cloud types simultaneously. Market Share 0% 5% 10% 20% 25% 30%15%
- 6. WHITEPAPER - Name of whitepaper here 1 Software as a Service (SaaS). The capability provided to the consumer to access the provider’s applications running on a Cloud infrastructure. The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email)or a program interface. The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, storage, or even the individual application capabilities, with the possible exception of limited user specific application configuration settings. 2 Platform as a Service (PaaS). The capability provided to the consumer so that they can deploy via Cloud infrastructure consumer-created or acquired applications developed using programming languages, libraries, services, and tools supported by the provider. The consumer does not manage or control the underlying Cloud infrastructure, which includes network, servers, operating systems or storage, but has control over the deployed applications and possibly configuration settings for the application-hosting environment. 3 Infrastructure as a Service (IaaS). The capability provided to the consumer so that they can provision processing, storage, networks, and other fundamental computing resources so that they can deploy and run arbitrary software, which includes operating systems and applications.Theconsumer doesnot manageorcontroltheunderlyingCloudinfrastructure but has control over operating systems, storage, and deployed applications; and possibly limited control of select networking components (e.g., host firewalls). Much like the decision on what type of Cloud to use, the decision on what style of service to employ will often depend on the target audience (user) and application. A business which has little IT differentiation from its competitors will be best served by SaaS, as it offers the easiest on-boarding solution and requires the least amount of technical skill to support it. Businesses which use bespoke IT systems, but do not themselves build and design technology are most likely to use IaaS, as this allows for infinite creativity in what is built and deployed and most closely matches traditional IT models. A business which focuses on software creation for their differentiation will likely want to employ a PaaS service as it frees them from the underlying architectural choices IaaS offers, but still allows them a large degree of control over the final application or service offering. The Nature of Cloud Services The Cloud, like everything in IT, is built around the structure of the OSI model (International Organization for Standardization, 1996). What this model fundamentally offers, and which is different from most other areas of technology, is a clear framework around which a service or technology provider can offer only the ‘layers’ they wish and rely on other players in the industry to complete the offering. Open systems are not necessarily open source, the standards simply provide a framework for when one service ends and another begins. Cloud takes this model and extrapolates it into three broad styles of service, which are defined by the NIST (Peter Mell, Timothy Grance, 2011): WHITEPAPER - Understanding & Differentiating Private, Public, Hybrid Cloud & Their Network Access Modalities
- 7. 77 Cloud Network Access Choices Having established the type and style of Cloud services on offer the consideration must then shift to the question of how to access these Cloud services. This is often the most overlooked part of Cloud migration. Many have suggested that the Internet is the only Network we need in 2015; however this shows ignorance for the very foundation of the Internet - a ‘Network of Networks’. It was never intended by the founders of the Internet that we would all share one massive public Network. The best way of thinking of this is to consider how today multi-modal transportation works is. We do not all exclusively ride in the largest public transport vehicles together with the freight, cargo, waste and everything else being transported. We have roads on which many different types of vehicles travel, we have different types of trains, many shapes and sizes of aircraft, boats and then purpose built pipelines. Internet access is most fundamentally useful for those individuals, devices or systems whose physical location is not known. This is the brilliant capability of the Internet, the ability to route traffic from any Internet connected Network or system to any other. There are certainly encryption and other technologies which can be used to add additional security to Internet access but it should never be considered 100% safe in the same way as the motorway, even with all the rules and regulations, is still subject to that one random mistake that costs lives. The 2014 Verizon Data Breach Investigation Report (Verizon Enterprise, 2014) shows how the number of successful breaches that occur in days or less is increasing dramatically, which only highlights that there is no total protection. Virtual Private Networking (‘VPN’) is often cited as the answer to doing business over the Internet but as shown in the 2005 report from NTA (VPN Flaws - Whitepaper, 2005) it can’t provide total assurance of security. As technology advances and complexity increases there is ever more risk of serious flaws in security. The best and only answer is to not use the Internet. 2004 Time to Discovery Time to Compromise 25% 50% 75% 100% 2005 2006 2007 2008 2009 2010 2011 2012 2013 Percent of Breaches Where time to Compromise / time to Discovery was days or less.
- 8. WHITEPAPER - Name of whitepaper here Private Network Access Given the security concerns mentioned above users shouldn’t access by internal devices across the Internet, but rather via private Network, the question becomes how do you build these private networks. Most providers today use MPLS or IP based technologies that are reliant on access control lists to ensure privacy. While infinitely superior to pure Internet access, this still has the risk of compromise. While Network security breaches (attacks on routers and switches) are much less common than other types of attack, they do still happen. Considering that the Cloud is intended as a replacement for internal systems, the ideal network access mechanism for Cloud is one which most closely resembles the LAN on which traditional internal systems would be based. Security Considerations When anyone thinks about Cloud, thoughts of security are never far behind. The reality is that the question of Cloud security can be addressed by using the right type of Cloud, with the right service and the right network access. Regardless of whether you move to a more connected, server-centric IT ecosystem the threats are constantly evolving to better target the Cloud. Figure 2 shows some of the results of the 2014 Verizon Data Breach Investigation Report (Verizon Enterprise, 2014). What we can plainly see is that directed attacks on the user devices and network are down considerably, however attacks on the server and kiosk public access points have increased dramatically. It must be assumed that some of this activity can be attributed to more organisations putting their critical systems and content in locations that can be easily accessed via the public domain. This is a fundamental mistake that users of the Cloud need to consider and avoid. WHITEPAPER - Understanding & Differentiating Private, Public, Hybrid Cloud & Their Network Access Modalities 2000 10% 20% 30% 40% 50% 2010 2011 2012 2013 Percent of Breaches Per asset category over time. Person Network User Devices Kiosk Media Server Figure 2
- 9. 9 Appropriate Expectations of Cloud Having established a clearer understanding of what Cloud really is, how it’s used, and most importantly how it’s accessed it’s worth briefly discussing the benefits that best practice and appropriate use of Cloud will bring to businesses. Firstly it’s apt to clarify that while on balance organisations migrating to the Cloud do save money, this should not be the primary motivation for a change in IT strategy. The easiest way to understand the mechanics of this reality is to think about the Cloud in the same way you consume any other utility service you depend on. While in theory it may be cheaper to generate your own electricity or store and treat your own water, in practice it is rarely a cost saver simply because most organisations lack the specialised skills to scale this model to meet the changing demands of the business. In IT these two factors are far more pronounced, which is why most direct cost comparisons are invalid. The primary aim to move anything to the Cloud should be (for all organisations) the increase in agility and reliability offered by having an external service provider. The biggest reason we should outsource items like electricity and water is so that we can use as much as we want, when we want, and then turn it off. It’s this agility brought to the realm of computing that is so exciting. The second part of this advantage is the increase in reliability, which goes hand-in hand with the nature of being a service provider. While businesses can to a certain extent tolerate small amounts of downtime for upgrades and maintenance, service providers cannot. A 2013 study by Twin Strata (2013 Trends: Cloud Storage & Disaster Recovery, 2013) demonstrated that even two years ago, those businesses solely using Cloud versus those still using internal IT, a far greater percentage (61% vs 44%) claimed they were confident of recovering their data and applications “within a couple hours”; yet on average the Cloud users spent less time re-couping information. This illustrates, that while someone may make a convincing business case to continue buying tape and other local backup technologies, in the end, generally, companies that convert to using private Cloud will have a better, more reliable service for less cost and more peace of mind. “The primary aim to move anything to the Cloud should be (for all organisations) the increase in agility and reliability offered by having an external service provider.”
- 10. Works Cited: 2013 Trends:Cloud Storage & Disaster Recovery. (2013, September). Retrieved from Twinstrata: http://info2.twinstrata.com/l/19712/2013-09-23/6j7j9/19712/27932/WP_ DR_Survey_Sep2013.pdf • BBC. (2014, September). Nude photo iCloud hack angers celebrities. Retrieved from BBC: http://www.bbc.co.uk/news/entertainment-arts-29017642 International Organization for Standardization. (1996, June). Information Technology - Open Systems Interconnection. Retrieved from ecma-international: http://www.ecma- international.org/flat/activities/Communications/TG11/s020269e.pdf • John Ciancutti. (2010, December). Four Reasons We Choose Amazon’s Cloud as Our Computing Platform. Retrieved from Netflix Blog: http://techblog.netflix.com/2010/12/four-reasons-we-choose-amazons-cloud-as.html • Peter Mell, Timothy Grance. (2011, October). The NIST Definition of Cloud. Retrieved from NIST: http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf • Synergy Research Group. (2015, February). AWS market share reaches five year high. Retrieved from SRGResearch.com: https://www.srgresearch.com/articles/aws-market-share-reaches-five-year-high-despite-microsoft-growth-surge • Verizon Enterprise. (2014). Verizon Data Breach Investigation Report - 2014. Retrieved from Verizon Enterprise: http://www.verizonenterprise.com/DBIR/2014/reports/rp_Verizon-DBIR-2014_en_xg.pdf • VPN Flaws - Whitepaper. (2005, January). Retrieved from NTA Montior: http://www.nta-monitor.com/files/whitepapers/VPN-Flaws-Whitepaper.pdf Conclusion Cloud computing is certainly the future, this cannot be denied. What we are witnessing in 2015 is nothing less than the simultaneous birth of a new utility and a new profession. The confusion of Cloud is not unexpected, but certainly unwarranted. Once the various typesand services are understood choosing the solution that is fit for purpose is easy. Hybrid Cloud is ultimately the answer for nearly every organisation; as very few organisations will have such a simplistic business model that they will find their needs met by just one Cloud. The often forgotten element that resolves much, if not all of the security, privacy and availability concerns is the network access. Far from the Cloud being synonymous with the Internet we now understand that aside from public Cloud, most Clouds should not be accessed via the Internet. Furthermore even on private connections you should ensure that Cloud access is as LAN-like as possible in order to ensure the easiest transition and the best possible service. Moving to the Cloud with knowledge is a simple and pain-free experience, which allows a business to shed the complex and technically challenging components of their internal IT and retain the important and unique aspects that differentiate it as an IT organisation. “Hybrid Cloud is ultimately the answer for nearly every organisation; as very few organisations will have such a simplistic business model that they will find their needs met by just one Cloud.”
- 11. 11 How Exponential-e can help you? Professional Services: Our highly qualified and experienced Professional Services team at Exponential-e will examine your existing infrastructure, consider your business’ future needs and mitigate any risks to ensure a successful transition from Windows Server 2003. These practitioners are multi- skilled and uniquely placed to drive your business to an IT environment that will enable growth, flexibility, mobility of data, added security and compliance. www.exponential-e.com/professional-services IT Audit: Avoid the headache of manually reviewing your IT estate with our IT Audit solution. Monitor all activity across your infrastructure with our single reporting tool, allowing you to see minute detail on things such as software installations and the utilisation statistics for individual users. The performance of individual machines will also not be affected due to the non-intrusive nature of the install. www.exponential-e.com/it-audit Your Cloud is only as good as your Network.
- 12. www.exponential-e.com REF:1127 Exponential-e Ltd 100LemanStreet,LondonE18EU Telephone +44 (0) 845 470 4001 Visit the website www.exponential-e.com