Do you think Cloud is Secure?

With Cloud being the most rapidly evolving concept (service delivery model), the major Question arises in customers mind – Is cloud secure? 

I guess it’s a wrong question to be posted, rather the concern should be: Are the cloud services used by my Organization is secure enough? Is the provider I’m hosted with is providing me cloud services which complies to my companies regulations? Is my data being accessed or viewed by other customers hosted with the same provider?

IT professionals often perceive the cloud as insecure as or less secure than having their applications and data residing inside their own datacenters. But perceptions don't necessarily match reality.

The counter Question to my customers who raise the security concerns have always been: What are their expectations of security on cloud?

We need to start at the top and engage senior management. Cloud needs can no longer be thought of as a technical issue to address, but rather a business asset to embrace.

The potential of consuming cloud services is transforming the IT from cost center to business engine. Several companies have put off moving to the cloud simply because of security concerns. Otherwise, cloud computing with its pay-per-use and get-when-you-demand model seems to be a win-win situation.

I would step back and drive this discussion via Managed hosting provider’s perspective. Most of the companies are driven to outsource their IT or Business applications to a managed hosting provider. The fundamental for this is simple, Orgs don’t need to make upfront investment to build and setup a new datacenter. No need to hire IT admins to monitor and manage the huge complex Infrastructure with no guarantee to the SLA’s or service availability. The real pain is to manage the vendors for license renewal, monitoring tools, upgrades, application management. The typical SLA’s provided by the AMS vendors with basic offering is best effort and if you really need best in business service availability then it comes with big cost. 

As your business grow, the IT hunger for Infra expansion grows as well and this is a never ending story. After 5 years, the H/W refresh is needed and the process becomes more complicated when you don’t have all the inventory documented properly which we see in most of the cases.

The above are some of the reasons why companies choose to outsource it to the managed service providers and concentrate on their core business. As by doing this, they get better SLA’s, scalability on demand and a player to blame on (just kidding).

When you outsource it, the data is already residing with the MSP (managed service provider) either in shared platform or dedicated and customers get only 'sudo' access to the Infrastructure to perform any activities like upgrading apps, maintenance, configurational changes etc.  

It’s time for our customers to start believing that data integrity is bread and butter for the Cloud service providers. They will never play with it as their SLA’s are tied with the services they sell and they also sign NDA. Why do you think that all the major IT players in the market are spending fortune on testing and developing new methodologies of providing Cloud Platform? They are aware of the customers concerns but they have the ways of tweaking the services and making them better and secured before offering them. This is their core business and they are good at it, so let’s leave this job to them and have them help us finding a solution that suits us.

As I have mentioned earlier, that it totally depends on the business requirement and the cloud provider you are interacting with. Because of the risks of cloud computing, many major providers take their security much more seriously. Their policies and physical security on site are often much tighter than traditional hosting platforms, with employees dedicated to actively monitoring how the network is performing, and taking action when an intrusion is detected.

The cloud providers offer services in different profiles like Basic, Balanced and Premier. Each profile comes with different level of security with Premier being the best. Before opting for cloud services, the customers have free will to evaluate the security and do a POC. There are various dedicated security services offered by cloud providers to make sure that your connection, accessibility and data are secured as per your requirement and meets your companies compliance.

The best way to approach cloud security is to integrate it with your overall cloud planning early in the process. That way you can use a threat-based approach to planning for deployments of your specific workload(s), the security requirements, and the specific cloud delivery model and architecture.

The security of the cloud services is the joint responsibility of your organization and your cloud service provider. Depending on the cloud delivery model and services you deploy, security is the responsibility of both parties.

If you are still worried about the security of your data, there are measures you can take to ensure that your information is safe.

If you have already outsourced your IT to a managed service provider then go for a combination of Public and dedicated setup.

Have your DB hosted on dedicated servers and host the external portals on a public cloud. This hybrid option will let you have a taste of cloud services and at the same time you will be settled with your data being resided safely.

The security and reliability of Cloud provider platform is fundamental to their business. They provide complete rigorous audit on the safety of the services by leading security firms. The audit reports can be shared with the customers as well.

To me, the security of the services hosted on cloud totally depends on the way the end users are connecting to the applications and how they are integrated at the back-end with the databases.

Much of the information in this document comes from my own experience dealing with large Enterprise customers.

I would suggest that you talk to the cloud provider and give them a chance to create a Cloud service that caters to your business need keeping the kind of security you want for your services.

What is your Perception of Cloud Computing?

This document is not to propose the definition of CLOUD COMPUTING, rather an open forum where we can put our idea of what we think cloud computing is?

Of all the blogs and web posting I have been through, I always learnt different aspect of cloud services.

Every customer I have met has its own idea of Cloud, all the proposals I have referred created by experienced Solution Architect s have a different aspect of cloud computing which is as per their product portfolio and every cloud service provider has their own architecture.

But I could never find a complete product list or components that make CLOUD COMPUTING as a complete service. It always changes with resepect to customer and Cloud Service providers. Different scenarios comes with different images of cloud services.

As per me, the concept of Cloud is another revolution in IT which is still evolving and very immature. All the definitions seem right because a service can include no. of components and it would depend what service provider you are talking to and what kind of services he has made public to offer like IaaS (Infrastructure, Network, Security ), PaaS, SaaS, Network, Security etc.

In Sept 2011, an Aberdeen Group study found that disciplined companies achieved on average 68% increase in their IT expense because cloud computing and only a 10% reduction in data center power costs.

The misbelief of just virtualizing the servers does not content to Cloud which people call it as Private Cloud. To me a cloud is a service where any component from the end user connection till data you are trying to access resides either public or private but on a shared platform.

We have tons of Public cloud providers (AWS, SAVVIS VPDC etc) in the market which have ginormous product portfolio to cater to the customer requirement of having either Application, Middleware, Database, Infrastructure, Network or Security components on a shared platform which could be public or private.

Yes, Private shared platform because that is not made public but is shared within set of customers, typically what you get from Managed Hosting service providers like SAVVIS, Terremark, Rackspace etc.

This amazing concept of Cloud Computing is a great way to reduce on the IT expenses which does not mean only Infrastructure but Power, Cooling, Space, manpower etc.

The biggest facility Cloud Computing provides in wide range of type of services like IaaS, PaaS, SaaS, Network, security etc. One of the major benefits of cloud computing is that there is no limitation of place and medium. We can reach our applications and data anywhere in the world, on any system.

These services are easily available globally and Organizations need to worry on investing on building datacenters, huge cost to the Network and Security gear, build up in-house IT team for management of the H/W and Softwares, pain of managing the vendors for software licenses, facility management and many more things. The customer just pays for what he uses as these services are available on hourly billing – ‘Pay as You Go’.

The scalability of these cloud services is the most attractive prospects in the revolutionary phenomenon. It provides a useful safety net for when your needs and demands alter. Cloud computing offers organizations the means to scale (increasing or decreasing) their computing resources whenever the Business need be. So if it’s not a peak time for your business, you can reduce the computing resources with minimal requirement and lower the TCV for your Org. It’s the smarter idea to make your bosses happy, but it’s not cost cutting rather a smart way of cutting on resources that you don’t need. The companies often do cost cutting by laying off the employees due less business but that was not possible for the Infrastructure that they have invested for the business – it’s all possible now.

This ability to alter your plans due to fluctuation in business size and needs is a superb benefit of cloud computing especially when experiencing a sudden growth in demand.

The offerings like IaaS on Cloud let Organizations not invest on heavy machines to run applications. If data security is the concern then it could be a Hybrid option – run Applications on Public cloud and DBs on the dedicated servers which is a huge cost drop.

In a cloud computing system, there's a significant workload shift. Local computers no longer have to do all the heavy lifting when it comes to running applications. The network of computers that make up the cloud handles them instead. Hardware and software demands on the user's side decrease. The only thing the user's computer needs to be able to run is the cloud computing system's interface software which can be as simple as a Web browser, and the cloud's network takes care of the rest.

The Platform-as-a-service offering in the cloud is defined as a set of software and product development tools hosted on the provider's infrastructure. Developers create applications on the provider's platform over the Internet. PaaS providers may use APIs, website portals or gateway software installed on the customer's computer.

The Public Cloud offerings like SaaS allow end users to access the business applications without installation and access their personal files. SaaS is a very broad market. Services can be anything from Web-based email to inventory control and database processing. Because the service provider hosts both the application and the data, the end user is free to use the service from anywhere.

Cloud computing is broken down into three segments: "application" "storage" and "connectivity." Each segment serves a different purpose and offers different products for businesses and individuals around the world.

I would appreciate if you can put in your thoughts about Cloud Computing. It’s still evolving and getting it to understand from different perspectives would be really great. Atleast it will help the solution guys to pitch in different solutions to their customer and win some good business for their Orgs.

Basic Overview of hosting a DR (Disaster Recovery) site from Managed Service provider eye

I would like to keep this as an open forum for discussion over various DR scenarios so that everyone can pitch in and share their experiences while setting up a DR site. This would help in sharing and learning from our experiences.

Let me describe the bookish definition of what an actual DR occurrence is:

“An occurrence that disrupts the functioning of an Organization resulting in loss of data, loss of personnel, loss of business or time”

The actual DR planning and design involves lots of consideration about the nature of the business and what is the impact on the Business if Primary site is down.

Several factors need to be considered when establishing a DR. It depends on the business type of the organization and its dependent items, eg, vendor services, telecom links, material availabilities, etc. Choice of DR site should also consider political, geographical, natural, human and other risks associated with the DR site location. For example, a software development company that is heavily dependent on international telecom links cannot have its DR site located in a rural area where the telecom vendors cannot provide data and voice links. Whereas another organization, eg, a manufacturing company could probably have its DR site with some essential equipment located anywhere where there is an electrical supply and transport facilities.

It makes business sense to have the DR site located at an acceptable distance from the main site from a logistics perspective. If essential services have to start rapidly within hours or a business day from an alternative location, the DR site should be located reasonably near your main site to avoid long travel and associated logistics problems. The time to travel to a DR location is a key factor in deciding where it can be located.

There are many potential disruptive threats which can occur at any time and affect the normal business process. We should consider a wide range of potential threats and the results of our deliberations should be included. Each potential environmental disaster or emergency situation should be examined. The focus should be on the level of business disruption which could arise from each type of disaster.

The call of hosting the DR site at a particular location or when DR site should be made active with all the services available to the business users is not a game of an individual. A DR plan must be created by involving various departments within the organization as the DR activity itself is dependent on various kind of users. Before creating a plan, every organization must classify its functions in terms of priorities and impacts.

It’s not just the DR site planning but a proper process document should be in place which would define how and what users will be making the connections to the DR site and how will the end users will be notified about the availability of the services at the DR site.

The game is just not to host a DR site but proper monitoring should be there to track the data and configuration changes compared to the primary site. The possibility could be there that at the time of actual disaster when the DR site is made active, the users may not find the last data entered in to the system or the users are not able to login to their portal due to configuration mismatch. Once the DR site is implemented, IT  does not have visibility and confidence whether the deployed solution is meeting the business RPO metrics and whether the services will be made available during actual disaster within stipulated RTO.

Inorder to avoid such situations, regular drills should be planned (may be once in a quarter) and proper monitoring tools should be installed at the DR site.

Some Orgs have their DR setup with manual switch over of the Infrastructure at the DR site and for DB data they use native DB replication technologies. For Application switch over and monitoring we have solutions like Sanovi etc which may cost a fortune to the company but are very affective.

We also have host based solutions for the wintel and Unix environment which provides complete automated replication and switchover/failover of the services from Infrastructure to Application at the DR site.

For the Organization which can afford an RPO/RTO of few days, they prefer low cost replication solution like taking Backup at the Primary site and sending the tapes for restore at the DR. The failover of the Infrastructure and Application is a manual process.

Such solutions should be included and implemented very carefully and is completely dependent on the nature of the Organizations business.

DR situations: that affects Physical facilities or environment, health, welfare or safety of Personnel or public & affects Business Operations due to:

• Earthquakes or Nature Catastrophe
• Terrorist Attacks
• Riots
• Strikes etc

DR can be broken into:

•  Business Planning & preparation
•  Business Systems & Technology preparation
•  Incident Response Planning             

What to Protect in a DR? A disruption in IT infrastructure can put customers business in offline mode for several days, when even a few hours of system downtime can critically harm your organization. There are 100’s of data protection and service availability solutions present in the market. But the challenge for the Orgs is to decide what needs to be protected and which order the services should be made available.

I would just list the dependencies of the DR site on various components and how BCP planning should be done to protect the critical data and business affecting services to be made available.

• Business Functions - Functions which provide products or services
• Critical Support functions - Functions without which the Business functions cannot work(e.g Facilities, IT)
• Corporate level support functions – Functions required for effective operations of Business Functions (e.g H.R, Finance)
• Most important Resource: Personnel – Although there are other critical resources, the actual product or service in most Organizations depends on actions performed by, and decisions made by people

HA (High Availability) Solutions – Not Actual DR:

The high availability setup for various IT components at the Primary site cannot be equalized to a real DR site. The customers expectation of the DR site is the availability of the services as it happens in HA. The financial Orgs looks for near line DR and actual DR site for data protection and fast recovery of the services as a minute of data is crucial for them.

But the service availability could be different for different verticals. Its always a challenge for the Service Providers to make customer understand that what kind of DR setup would be best suited for their business.

Not a DR site scenarios:

• IT equipment failure at the DC site - Failed over to the other redundant H/W – which may take less than 30mins and the services will be available to the Business users.

•  Data Protection – keeping tape backups and recovering once the original is lost – Not actual DR.
•  Near line DR – RPO = ‘ZERO’ (Location <30kms)

–    These kinds of setup are mainly implemented for the Organizations which cannot afford to loose the data even for a minute – specially Financial firms or Investment banks etc.

–   Typically, this setup will be 1:1 mapping of the Infrastructure and services at the Primary site and NLDR.

–   Almost like having a high availability solution for your complete Primary site and not a single equipment or service failure.

The actual DR site falls under the criteria where a Service Provider will take care of the Infrastructure and Business needs and will provide Services/Business continuity from a different site.

• RPO is never equal to ‘0’ and the site to host the protected Infra should be atleast >50Kms (typically Tier3 DC and different Geographic Location)
• Complexities / Challenges:

–  Recovery of Business Application – Which department applications to be brought  up on priority.

–  Prioritize on the time of the Month – Payroll, Taxation, Billing transactions etc.

–  Under Provisioned DR – limited load is transferred to the DR site.

–  Connectivity

–  Human Behavior

The DR Infrastructure should be UP within the minutes but Applications or Services may not be available to the Business users. Hence, RTO cannot be defined as users may take more time to start the business operations.

Every time when Org starts about DR site hosting, the first thing that comes to discussion is RPO/RTO. The service providers agrees and commits on the asked RPO/RTO values but there are always various caveats to it. The solution Architects designs the best solution to achieve the asked values and drives the solution by its uniqueness but almost all the Service Providers have the same concept while designing the DR solution. The only thing that varies is the components included in it and not the concept.

Sample DR process flow:

To conclude, the DR site should be planned by involving different departments in the organization which directly or indirectly affects the business. The DR process flow may vary from one Org to other but the concept remains the same. Most importantly, it’s not just the DR site planning but a proper process document should be in place which would define how and what users will be making the connections to the DR site and how will the end users will be notified about the availability of the services at the DR site.