Cloud Computing 1

Running Head: CLOUD COMPUTING

Cloud Computing

Prepared by:

Alex Tran & Daniel Tran

IT 486: Critical Issues in Information Technology

Central Washington University

Prepared for:

Terry Linkletter

June 1, 2011
 Cloud Computing 2

Executive Summary

Technology today is shifting technology which is increasing using the Internet. Mobile

technology is increasing network speed and hardware capabilities to allow people to stay

connected at all times for work and personal matters. Accessing media and entertainment has

become easier where content is streamed and stored in the cloud. Cloud computing is starting to

be embraced by businesses as the benefits of cost reduction are important to many. There are

several issues that many organizations are waiting to be resolved before they transition over to

the cloud.

This paper discusses some of the major issues facing cloud computing today that may

possibly stop its adoption as technology progresses. The definition of the cloud can be confusing

to business owners as the word has become synonymous with accessing content on the internet,

but is much more. IT has been dominated by client/server for sometime where businesses do not

trust an emerging technology. Security, privacy and compliance are the largest concerns of many

businesses today. Cloud computing may still be too early for some businesses, but as the

technology matures many will see it is the next phase of IT.

 Cloud Computing 3

Table of Contents

Executive Summary…………………………………….…………………………………………2

List of Figures……………………………………….…………………………………………….4

Introduction………………………………………………………..………………………………5

What Is Cloud Computing?..........................................................................................................5-6

Five Essential Characteristics…………………...…..…………………………………….6
Three Service Models………………………….....……………………………………….6
Four Deployment Models……………………...…..……………………………………...6

Helping Customers Understand and Trust Cloud Computing?.......................................................7

Costs……………………………………………………………………….………………………8

Paradigm Shift……………………………………………………..…………………………….11

Cloud Adoption……………………………………………..……………………………………13

Compliance………………………………………..……………………………………………..14

Data Privacy…………………………………..………………………………………………….14

Security……………………………………….………………………………………………….16

Conclusion…………………………………..…………………………………………………...18

References……………………………………………………..………………………………....19

Appendix A…………………………………………………..…………………………………..21

Appendix B………………………………………………………………………………………22
 Cloud Computing 4

List of Figures

Figure 1……………………………………………………………………………………………6

Figure 2……………………………………..……………………………………………………10

Figure 3……………………………………..……………………………………………………13

Figure 4………………………………………..…………………………………………………13
 Cloud Computing 5

Cloud Computing

Introduction

There is a current shift in the information technology (IT) industry from requiring

customers and businesses to purchase hardware and software needed to run their business. With

cloud computing, businesses can now realistically obtain the functionality they require by using a

leasing model. Leasing is inexpensive compared to owning because organizations pay for

services which they only need. This shift will move business to the “pay-as-you-go” model.

There will be no need to upgrades software and licenses or pay for a maintenance fees. This

paper will focus the method that is needed to educate customers / businesses about cloud

computing, the costs of using the cloud, the shift from traditional IT to cloud computing, and the

issues of adopting cloud.

What is cloud computing?

Cloud computing can be simply defined as the ability to access data and application(s)

from the Internet. Cloud computing is the extension and convergence of virtualization and

client/server technology. The National Institute of Standards and Technology (NIST) define

cloud computing as:

“Cloud computing is a model for enabling ubiquitous, convenient, on-demand network

access to a shared pool of configurable computing resources (e.g., networks, servers,

storage, applications, and services) that can be rapidly provisioned and released with

minimal management effort or service provider interaction. This cloud model promotes

availability and is composed of five essential characteristics, three service models, and

four deployment models.” (Mell, 2011, p. 6)

 Cloud Computing 6

The five essential characteristics of cloud computing are:

1. On-Demand Self-Service – Customers should be able to acquire more resources for their
service without the need to interact with humans.
2. Broad Network Access – Customers should be able to access information from any
location with any device
3. Resource Pooling – Resources should be pooled to fully utilize hardware
4. Supports Elastic Demand – Dynamic expansion or contraction of resources
5. Measured Service – Service can be measured in certain aspects

The three service models are (see fig. 1):

1. Software as a Service (SaaS) – Consumers can use software in the cloud and do not
control any part of the resources needed
2. Platform as a Service (PaaS) – Consumers are given access to software and can use
custom applications
3. Infrastructure as a Service (IaaS) – Consumers are given control to software and
hardware

Figure 1. Cloud Benefits. These are the benefits of each service model in relation to IT. From
Economics of the Cloud (p. 11), by Harms, H., Yamartino, M., 2010, Microsoft.

The four deployment models are:

1. Private Cloud – Infrastructure of cloud is controlled by organization

2. Community Cloud – Infrastructure is shared among several organizations
3. Public Cloud – Infrastructure is available to public or large industry group
4. Hybrid Cloud – Infrastructure is a combination of private, public, or community
 Cloud Computing 7

Helping Customers Understand and Trust Cloud Computing?

The definition of cloud computing has a perceived definition that does not match the

evolving or current definition of cloud computing. Businesses need a clear understanding of the

cloud framework and industry standards. Explaining the basic premise and technological

capabilities are not enough for companies to become interested because there are conflicting

definitions of the term. At its basic definition, many web based services could be considered

cloud computing like Hotmail, Facebook, and YouTube. However for a business, cloud

computing needs to be clearly defined to help customers make a sound decision on adopting

cloud computing.

There is a shift in businesses being interested in adopting cloud computing unfortunately

many are still unfamiliar on this technology. There is a need for cloud providers to educate

customers and build trust. Customers will need guidance on understanding how to evaluate the

risks and benefits in adopting cloud for their business.  This could be done by providing

certification. Certification should provide a framework and common language for cloud provider

and customers to communicate. Certification will also ensure that cloud providers are meeting all

the required regulations and ensuring their cloud is secure.  Certification should include auditing

of cloud. This will help to comfort customers concerns that the cloud is safe by meeting

recognized standards. Certification overall will allow the customers to be more informed and

make better decision for their business needs (Eurocloud, p. 2).

Cloud computing is not a onetime service such as purchasing software or hardware for a

business. There are other factors involve such as cost, functionality, capability, availability, and

security. This means that cloud computing is an as-is-service model thus business must have an
 Cloud Computing 8

ongoing relationship with their cloud provider. This means that cloud provider must give their

customers a service level agreement (SLA). The cloud providers must create a common standard

for performance levels to help customers understand that type of services they are receiving.

SLA will also help cloud providers manage risks and be accountable for their service

(Eurocloud, p. 4).

By creating agreed upon certification and standard service level agreement this allow the

customer to use a common framework to understanding cloud computing and determining the

type of services which fit their needs. This will also ensure customers streamline and simplify the

confusion of adopting cloud computing technology. Their data will be safeguard and comply

with all required regulations.

Costs

The benefits of cloud computing is largely lowering costs of IT. The CTO of IBM,

Kristof  Kloeckner, estimates that IT labor costs will be reduced by 50 percent and the use of

capital will improve by 75 percent (Garrett, 2010). Cloud service providers currently determine

costs by what subscribers use. Amazon for instance charges based on operating system,

bandwidth usage, storage usage, IP addresses and more to determine costs (Amazon). Each

criterion can increase costs and be scaled up or down depending on the size of the business.

Amazon even provides a calculator that can estimate costs based on different options. This

solution provides potential customers a quick look at what it would cost to move over. Once

costs have been estimated, businesses can then evaluate which in house IT services to move

over.

Larger organizations may have to be selective of the services they move to the cloud.

Services that need to be under full control of the business may not want to be moved over like
 Cloud Computing 9

authentication, user policies, and security. Core functions of IT should not be moved to the cloud

because they may cause the biggest problems when issues arise (Sperling, 2010).  Services like

email, intranet websites, and databases could be moved over to the cloud to reduce costs.

Businesses could reduce the costs of their IT service by allowing another business to manage

parts of their IT needs. Smaller to medium sized businesses may want to consider moving all

their IT services to the cloud. The cloud service provider would be managing their IT needs

instead of a consultant or full time employee. Smaller businesses can focus on their business

while having their IT managed properly with support. Costs would be lower for smaller

businesses because they don’t have to invest in hardware, software and infrastructure (Egan,

2011).

One of the main reason why cloud computing is much cheaper than client/servers

platform is because customers only have to pay for what they used. Many companies have clients

and servers that sit there and are inactive and are not fully used, but they are there to ensure

during the busy time that business can handle the larger demand of traffic on their systems. For

example, Nordstrom will be the busiest during the December holiday sale period therefore they

need the extra clients/servers to support their business during that period but during the rest of

the year they will have more clients/servers inactive. This will cost the company more money to

maintain and power these clients/servers. The cloud will allow them to not have to maintain

these extra clients / servers and only pay for what they need. During the slow period of the year,

the company will pay less for cloud computing. This will help the company efficiently manage

their usage and lower their IT budget.

Cloud providers typically have three types of charging models:

1. A pay-as-you-go model – Customers will pay little to no upfront costs
2. Usage-based pricing – Customers will pay for what they use
 Cloud Computing 10

3. Elasticity – Customers will pay for dynamic usage of resources

(Cisco, 2010, p. 1)

CISCO uses a chargeback model to determine how to bill their customers. The

chargeback model requires the cloud provider to analyze and document any associated costs. The

provider must also identify all billable items to detail the costs. Each billable item should have

variable pricing structure for flexibility. Tools must be used to collect data for accurate billing

data and used to determine cost (Cisco, 2010, p. 3). See fig. 2.

Figure 2. Chargeback Methodology. From Managing the real costs of on-demand enterprise
cloud services with chargeback model, (p. 4), by Cisco, 2010.

As companies come to understand the benefits of cloud computing and how they will be

bill for the usages, they will likely start adopting cloud computing to replace their client/servers

platform. Cloud  computing will better allow companies to manage their IT budget by only

having to pay for resources used, instead of maintaining clients/servers all year around to ensure

they have the capacity to deal with high demand during peak periods. No longer will they need to

hire full time IT staffs to mange clients/servers platform, pay for the extra equipments, and
 Cloud Computing 11

electricity to keep hardware running that is often inactive. Companies moving to the cloud will

not have to worry about the large upfront costs of IT.

Paradigm Shift

IT’s focus has been centered on service and the current implementation of client and

server allows businesses to control, distribute, and maintain that service. The initial introduction

of client/server was viewed as a “toy” and believed that it was never going to replace mainframe

technology (Harms, & Yamartino, 2010, p. 2). Eventually client/server technology took over due

to reduced IT operating costs and lowering the entry bar for managed networks. Virtualization

technology was also met with resistance as businesses were concerned about compatibility and

vendor lock-in, but when the potential economics of virtualization showed savings from 20 to 30

percent businesses were again compelled to use the technology (Harms, & Yamartino, 2010, p.

2). Cloud computing has brought new concerns as businesses consider the implications of

moving to the cloud.

Cloud computing is a shift away from centralized control and focused on streamlining IT

as a service. The loss of control has created doubt about the viability of cloud computing.

Amazon’s recent network outage has businesses concerned about backup and recovery, as many

businesses had to wait several days to access their applications and data (Lohr, 2011). Data

security and privacy is another consideration that can slow down adoption as cloud service

providers will have control over aggregated data and information (Goodburn, & Hill, 2010, p. 6).

The data accumulated in the cloud may require new or improved data security and privacy

protection to protect information. Similar to client/server and virtualization, these concerns may

be resolved as more businesses see the cost benefit of moving services to the cloud.
 Cloud Computing 12

The transition to cloud computing for many organizations will change how they see IT.

Small to midsized businesses then do not have to invest in hardware, software, and personnel to

support their needs, but they also give up control of their entire IT infrastructure to another

business. This can be a larger risk as many smaller businesses were affected by Amazon’s

network outage (Lohr, 2011 Larger organizations may not have this risk as they would invest in

network redundancy or a private cloud. Start-ups and small businesses may carry a larger risk

because they may not fully understand their IT needs. ). There is also a concern of cloud provider

lock-in. This means the cloud providers will control the customers’ data and will not allow

access due to contract disagreement. Government and large organizations are hesitant of the

cloud because the technology is fairly new, untested, and fear of the unknown (Malik, 2009).

In the future many industries will find adopting cloud computing a benefit to their

organization. A survey from Accenture in 2009 found that beside IT and telecom such industries

as media, government, education, and health care will be affected and influenced by cloud

computing (World Economic Forum, 2010). There are many current and future benefits that

organizations are looking into for cloud computing. Among these benefits are enable new

services / products, information sharing, reduce cost, focus on core businesses, and mitigate

business risk. A survey from the World Economic Forum and Accenture found that creating new

services was more important than reducing costs. See fig. 3.

 Cloud Computing 13

Figure 3. Potential benefits rated by cloud users. From Exploring the future of cloud computing:
riding the next wave of technology-driven transformation, (p. 4), by World Economic Forum,
2010.
Cloud Adoption

Companies are starting to realize there are benefits to adopting cloud computing. Cloud

computing have a low upfront and maintenance costs, and lower utility billing. It is on-demand

scalability and allows access to enterprise-level software. It seems that cloud computing is the

perfect solution for many companies but there are also concerns which cloud providers must

address before companies are willing to adopt that cloud. Among these concerns are compliance,

security, and data privacy.

Left Chart: Major Customers Concerns for buying Right Chart: Governance Concerns about
cloud service. cloud service.

Figure 4. From Exploring the future of cloud computing: riding the next wave of technology-
driven transformation, (p. 10), by World Economic Forum, 2010.
 Cloud Computing 14

Compliance

Businesses are concern about regulatory compliance when adopting cloud computing.

The government is currently dealing with issue of data privacy in different ways. It is making

compliance a concern which company must deal with. Customers are often time storing

statutorily protected information in the cloud. This is forcing cloud providers to focus on how to

manage their customers statutorily protected information and meet data security regulations.

Traditionally, vendors can disclaim non liability for failures of data security compliance but with

data security statutes as HIPPA and Massachusetts Data Privacy Law require companies to

ensure third-party service providers to meet these security compliance requirements (Scotts,

2010).

Businesses must make sure that the cloud providers that they are using understand all

regulatory compliances. It could be helpful to come up with a certification which cloud providers

can use to ensure they meet all the data security issues and compliance requirement. Since there

is no such service available at the moment then companies must ensure there cloud providers can

provide them with such thing as SAS70 Type II compliant and any other regulatory compliance

requirements. This can be done by having the cloud providers provide documentation of their

regulatory compliance or having the cloud provider audited. The difficult part is determined

which type of compliance will apply to the company.

Data Privacy

Customers are not aware of data privacy issues for cloud computing. If you are using

service from the cloud then government can subpoena the company for the information. If a

person from a small business used a spreadsheet from Google and the company has tax issue

then the government can subpoena the spreadsheet which was used from a cloud service. Or
 Cloud Computing 15

there is a concern that some online cloud provider of SaaS might be willing to share sensitive

customer’s data to market firms.

“Google's privacy policy states that the company will share data with the government if it

has a good faith belief that access is necessary to satisfy any applicable law, regulation, legal

process or enforceable governmental request (Greenberg, 2008).”

There is a concern by privacy advocates that companies providing cloud services might

not be careful with users’ data. "Putting your data in someone else's hands always introduces

risks," says Lee Tien, a senior attorney and privacy analyst for the Electronic Frontier

Foundation. Once a cloud providers has a customer’s data then this person crossed the threshold

of not having control of their data. They cannot be guaranteed the cloud provider will not pass

their data to marketer or get subpoena by the government.

The General Counsel of Microsoft stated that 75 percent of senior business leaders are

concerned about privacy and security as a major risks with affect the adoption of cloud

computing. There is a degree of lost of control once customers use cloud computing (Prinsley,

2011, p.1). European Union has data protection law which is in place to protect customers’ data.

Unfortunately, the United States does not have such laws for American citizen. It will be a

concern to the American citizen as cloud computing become more popular and as many

companies start providing such services. It is suggest that customer must determine if it worth

storing their personal data in the cloud or keep is in their control on their personal storage device.

There need to be laws created in the USA to protect customers’ personal data.

The UK information Commissioner’s guidance is good guidance for companies to

consider when implementing cloud based solution that has to do with personal data.

This guidance indicates that businesses should take steps to:

 Cloud Computing 16

 Confirm the supplier will only process personal data in accordance with the customer’s
instructions
 Understand the supplier’s ability to recover from technological or procedural failures
 Understand the remedies in the event of loss or corruption of personal data
 Understand the level of assurance given in relation to processing of data in countries with
weak data protection regimes (Prinsley, 2011, p. 2).

These guidance should be written up in a service level agreement when a company is dealing

with cloud providers to ensure the safety and privacy of their data.

Security

In a 2008, analyst firm Gartner made the assessment that cloud computing was filled with

security risks (Brodkin). The security risks could affect data, personal information, and

operations of a business if not planned for and analyzed. Gartner outlines seven security risks

that businesses should be concerned about (Brodkin, 2008):

1. Privileged user access

Data stored in the cloud could be accessed by privileged users who have access to the hardware,

software and network. For government institutions this may be an important due to the security

needs of government communication. Strict security may be needed for people who work on the

cloud.

2. Regulatory compliance

Organizations that store information in the cloud are still responsible for the security of their

data. The cloud provider should be willing to agree to external audits and security certifications

to ensure data is protected.

3. Data location

Cloud providers may not store data in one location and may choose to keep data in another state

or country. The data is subject to the jurisdiction of its physical location. Cloud providers should

allow businesses to select locations or find out where their data is located.
 Cloud Computing 17

4. Data segregation

Data may possibly be stored in a shared environment that could be accessed by others.

Encryption should be used but tested before large amounts of data are encrypted. Encrypted data

may also slow down access/service to data.

5. Recovery

Cloud providers should explain their contingency plan in the event of a disaster. Larger providers

may offer back-up while smaller ones will require additional services.

6. Investigative support

Investigating and analyzing logs and data may be more difficult than before. Data may be shared

and logs that span multiple data centers. Check with cloud providers on how well they support

investigations.

7. Long-term viability

Smaller providers may get bought or merged into a larger business that may have different

policies regarding data. The provider should be a long-term partner and has policies regarding

acquisitions, mergers and data privileges. If the provider dissolves, then access to the data be

restricted or sold.

Securing the cloud will be an important factor for many businesses before they shift

services to the cloud. Governments and businesses want to move to cloud services to reduce

costs, but must make sure that services are secure enough for their requirements. Cloud service

providers will have to evolve and secure their service as cloud computing enters uncharted

territories.
 Cloud Computing 18

Conclusion

There is a future in cloud computing. Users of the Internet are using cloud computing

even if they are not aware of it. Such things as email fifteen years ago were desktop application

now almost everyone is using SaaS to access their emails. Companies are starting to realize

providing their customers with SaaS might be in their best interest for new business

development. Small and Midsized companies will find it financial beneficial to have a cloud

provider manage their data than maintaining expensive equipments and hiring IT staffs  in order

to run a data center.

The only issues is how will companies approach cloud computing. It is fairly new and

most companies are not sure how cloud providers will bill them for such services. This is why is

important for cloud provider to educate customers about cloud computing.   It is also

recommended that there is certification and service level agreement implemented to help

customers understand the type of service they are receiving and to ensure compliance, security,

and data privacy. These things must be address for customers to be willing to adopt cloud

computing.
 Cloud Computing 19

References

Amazon. (n.d.). Amazon ec2 pricing. Retrieved from http://aws.amazon.com/ec2/#pricing

Brodkin, J. (2008, July 2). Gartner: seven cloud-computing security risks. Retrieved from

http://www.infoworld.com/d/security-central/gartner-seven-cloud-computing-security-

risks-853

Cisco. (2010). Managing the real costs of on-demand enterprise cloud services with chargeback
model. Retrieved from

http://www.cisco.com/en/US/services/ps2961/ps10364/ps10370/ps11104/Cloud_Services

_Chargeback_Models_White_Paper.pdf

Egan, P. (2011, January 28). In the cloud or the cabinet: where should you store your data?.

Retrieved from http://www.businessnewsdaily.com/small-business-data-storage-options-

0936/

Eurocloud. (n.d.). 16-point action plan for cloud computing in europe. Retrieved from

http://www.pcxvs.com/eurocloud/16PointPlan.pdf

Garrett, O. (2010, June 4). Keeping cloud costs grounded. Retrieved from

http://www.forbes.com/2010/06/02/internet-software-zeus-technology-cloud-computing-

10-garrett.html

Goodburn, M. A., & Hill, S. (2010, December). The cloud transforms business. Retrieved from

http://www.kpmginstitutes.com/financial-reporting-network/insights/2010/pdf/fei-

reprint.pdf

Greenberg, A. (2008, Feburary 19). Cloud computing's stormy side. Retrieved from

http://www.forbes.com/2008/02/17/web-application-cloud-tech-intel-

cx_ag_0219cloud.html
 Cloud Computing 20

Harms, R, & Yamartino, M. (2010, November). The economics of the cloud. Retrieved from

http://www.microsoft.com/presspass/presskits/cloud/docs/The-Economics-of-the-

Cloud.pdf

Lohr, S. (2011, April 22). Amazon’s trouble raises cloud computing doubts. Retrieved from

http://www.nytimes.com/2011/04/23/technology/23cloud.html?_r=2

Malik, O. (2009, August 9). Cloud computing: washington vs. washington. Retrieved from

http://www.businessweek.com/technology/content/aug2009/tc2009087_879073.htm

Mell, P, & Grance, T. U.S. Department of Commerce, National Institute of Standards and

Technology. (2011). The nist definition of cloud computing (draft) (Special Publication

800-145 (Draft)). Gaithersburg, MD: Retrieved from

http://csrc.nist.gov/publications/drafts/800-145/Draft-SP-800-145_cloud-definition.pdf

Prinsley, M. (2011, March 7). Cloud Computing and Privacy Concerns. Retrieved from

http://www.mayerbrown.com/news/article.asp?id=10588&nid=20

Scott, R. J. (2010, September 16). Taking the risk out of cloud computing. Retrieved from

http://www.corpmagazine.com/technology/digital/itemid/1805/taking-the-risk-out-of-

cloud-computing

Sperling, E. (2010, January 4). Not everything will move to the cloud. Retrieved from

http://www.forbes.com/2009/12/31/rackspace-cloud-computing-technology-cio-network-

engates.html

World Economic Forum. (2010). Exploring the future of cloud computing: riding the next wave

of technology-driven transformation. Retrieved from

https://members.weforum.org/pdf/ip/ittc/Exploring-the-future-of-cloud-computing.pdf
 Cloud Computing 21

Appendix A

Appendix A. Impediments to Broader Cloud Computing Adoption by Region. From Exploring

the future of cloud computing: riding the next wave of technology-driven transformation, (p. 9),
by World Economic Forum, 2010.
 Cloud Computing 22

Appendix B

Appendix B. Potential Initiatives for Governments to Accelerate the Adoption of Cloud. From
Exploring the future of cloud computing: riding the next wave of technology-driven
transformation, (p. 14), by World Economic Forum, 2010.