Engaging the Hybrid Cloud (Complete Post)

What is a “hybrid cloud”?

Is it 1) an environment where applications and processes exist both in the public and private cloud and on premise? Or is it 2) a combination public/private cloud without an on-premise component?

For the sake of this discussion, we’ll concede definition 1. Clarifying this concept is important because the vast majority of cloud-adopting organizations — which is to say the vast majority of organizations, period — are about to become hybrid-cloud-adopting organizations, and for good reason: they’re not ready to simply switch off their existing on-premise systems — legacy systems that already have significant business and operational value — and re-invent them in the cloud.

Let’s solidify this hybrid notion with a simple example of a business process nearly all organizations are familiar with: the HR onboarding process.

1. Onboarding begins. A cloud-based recruiting system like Taleo is used to identify a candidate. When the candidate is hired, the business process moves from the cloud-based recruiting system to the on-premise HR system.

2. Onboarding continues. The candidate is given systems access, login credentials, and an e-mail account. IT is cued to furnish the candidate with a laptop and other equipment. The office manager assigns the candidate an office space.

3. Onboarding concludes. HR moves the business process back to the cloud by using a cloud-based performance-management system like SumTotal, where new-hire details are updated.

Cloud. On-premise. Cloud again.

This isn’t some supposed future scenario. This hybridized process is happening now, throughout most organizations, and in many other departments besides HR. To ensure the success of those departments in a hybrid cloud environment, organizations should address three key issues: security, service level agreements (SLAs), and application integration.

Security

The move to the cloud does mean that security and data privacy — something that was previously your IT department’s concern — is now your cloud provider’s concern. Yet it doesn’t mean your organization is absolved from ensuring that the cloud provider is doing its part. You need to demand that the cloud provider is clear about how they secure and protect your customers’, partners’, and employees’ data — both when it’s stored in the cloud and when it’s transferred to and from your on-premise systems.

A cloud-based application in isolation is reason enough for insisting on a clear understanding of how your cloud provider stores your data. Imagine, then, how imperative a clear understanding becomes when that cloud-based application is no longer isolated but integrated into a hybrid cloud environment. It’s now transferring data out into the world — perhaps from an Amazon data center in Europe or the Pacific Northwest to your offices on the other side of the globe. Or perhaps it’s transferring data to your trading partner’s systems, where you have much less control over security and protection.

This spawns several questions you should ask your cloud provider:

• Is the data encrypted both when it’s in motion and at rest?
• If cloud-application access is via an application programming interface (API), is the security token secured and encrypted when it’s used in the API core?
• What’s the security token’s lifetime? Is it per-session or permanent?
• How easily could this security token be hijacked and reused?
• Is the security token tied to IP addresses?

Getting solid answers to important questions like these will ensure that the cloud part of your hybrid environment is always serving your business and never compromising the strength of its security profile.

SLAs

What is your cloud-based application’s availability and reliability? When an application is hosted on-premise, availability and reliability is your responsibility, and if it’s critical to business operations, you put a lot of effort into maintaining it.

Again, with the move to the cloud, this becomes the cloud provider’s concern, but you still need to keep in mind the application’s role in the bigger picture. How well would the business tolerate moments of application unavailability and unreliability?

For example, if a cloud-based HR application wasn’t available for a day or two, it probably wouldn’t impact a supermarket’s business process.

However, if a cloud-based supply-chain application wasn’t available for even an hour or two, it would wreak havoc on a supermarket’s business process. The lack of availability would mean a lack of deliveries, empty shelves, and loss of revenue.

A thorough SLA will communicate to your cloud provider in no uncertain terms which applications your business counts on the most, and what the consequences will be should those applications fail.

Application integration

In order to reap the benefits and realize the full potential of your new cloud applications, you must embrace the term “hybrid” by fully integrating them with your existing, on-premise applications and business processes.

Questions to ask include:

• How are you going to get data into or out of the cloud application and into your on-premise systems?
• Does the cloud application have an API and/or support on-demand exchange of data?
• Does the cloud application have a scheduled exchange (e.g., daily updates instead of on demand)?
• Does the cloud application support standards like Web services, XML, etc.?

Further, how will integrating cloud applications affect your existing business processes?

For example, if you move from an old, back-end integration to an on-demand, real-time integration, will this have a knock-on effect (i.e., a secondary effect) with other applications, especially your on-premise applications? How will the applications accommodate this effect (particularly in light of the fact that you actually have less flexibility when integrating applications in the cloud, as you have to work with the integration points provided by the cloud application itself, not the on-premise points you’ve provided)?

By considering the above three key issues and answering the questions surrounding them, the daunting implications of our initial question, “What is a ‘hybrid cloud’?” will diminish. Organizations that aren’t ready to simply switch off their existing on-premise systems and re-invent them in the cloud can rest assured that they aren’t losing anything from holding onto a legacy system. Instead, they can benefit from a new approach — one that draws on the incomparable agility of the public/private cloud and the time-tested security profile of on-premise systems — and enjoy enhanced business operations using a hybridized whole that’s truly greater than the sum of its parts.

(This post was first published at http:blogs.axway.com)  

Engaging the Hybrid Cloud: Part 3: Application Integration

Application integration

In order to reap the benefits and realize the full potential of your new cloud applications, you must embrace the term “hybrid” by fully integrating them with your existing, on-premise applications and business processes.

Questions to ask include:

• How are you going to get data into or out of the cloud application and into your on-premise systems?
• Does the cloud application have an API and/or support on-demand exchange of data?
• Does the cloud application have a scheduled exchange (e.g., daily updates instead of on demand)?
• Does the cloud application support standards like Web services, XML, etc.?

Further, how will integrating cloud applications affect your existing business processes?

For example, if you move from an old, back-end integration to an on-demand, real-time integration, will this have a knock-on effect (i.e., a secondary effect) with other applications, especially your on-premise applications? How will the applications accommodate this effect (particularly in light of the fact that you actually have less flexibility when integrating applications in the cloud, as you have to work with the integration points provided by the cloud application itself, not the on-premise points you’ve provided)?

By considering the above three key issues and answering the questions surrounding them, the daunting implications of our initial question, “What is a ‘hybrid cloud’?” will diminish. Organizations that aren’t ready to simply switch off their existing on-premise systems and re-invent them in the cloud can rest assured that they aren’t losing anything from holding onto a legacy system. Instead, they can benefit from a new approach — one that draws on the incomparable agility of the public/private cloud and the time-tested security profile of on-premise systems — and enjoy enhanced business operations using a hybridized whole that’s truly greater than the sum of its parts.

(This post was first published at http:blogs.axway.com)  

Engaging the Hybrid Cloud: Part 2: SLAs

SLAs

What is your cloud-based application’s availability and reliability? When an application is hosted on-premise, availability and reliability is your responsibility, and if it’s critical to business operations, you put a lot of effort into maintaining it.

Again, with the move to the cloud, this becomes the cloud provider’s concern, but you still need to keep in mind the application’s role in the bigger picture. How well would the business tolerate moments of application unavailability and unreliability?

For example, if a cloud-based HR application wasn’t available for a day or two, it probably wouldn’t impact a supermarket’s business process.

However, if a cloud-based supply-chain application wasn’t available for even an hour or two, it would wreak havoc on a supermarket’s business process. The lack of availability would mean a lack of deliveries, empty shelves, and loss of revenue.

A thorough SLA will communicate to your cloud provider in no uncertain terms which applications your business counts on the most, and what the consequences will be should those applications fail.

(TO BE CONTINUED)

(This post was first published at http:blogs.axway.com) 

Engaging the Hybrid Cloud: Part 1: Security

What is a “hybrid cloud”?

Is it 1) an environment where applications and processes exist both in the public and private cloud and on premise? Or is it 2) a combination public/private cloud without an on-premise component?

For the sake of this discussion, we’ll concede definition 1. Clarifying this concept is important because the vast majority of cloud-adopting organizations — which is to say the vast majority of organizations, period — are about to become hybrid-cloud-adopting organizations, and for good reason: they’re not ready to simply switch off their existing on-premise systems — legacy systems that already have significant business and operational value — and re-invent them in the cloud.

Let’s solidify this hybrid notion with a simple example of a business process nearly all organizations are familiar with: the HR onboarding process.

1. Onboarding begins. A cloud-based recruiting system like Taleo is used to identify a candidate. When the candidate is hired, the business process moves from the cloud-based recruiting system to the on-premise HR system.

2. Onboarding continues. The candidate is given systems access, login credentials, and an e-mail account. IT is cued to furnish the candidate with a laptop and other equipment. The office manager assigns the candidate an office space.

3. Onboarding concludes. HR moves the business process back to the cloud by using a cloud-based performance-management system like SumTotal, where new-hire details are updated.

Cloud. On-premise. Cloud again.

This isn’t some supposed future scenario. This hybridized process is happening now, throughout most organizations, and in many other departments besides HR. To ensure the success of those departments in a hybrid cloud environment, organizations should address three key issues: security, service level agreements (SLAs), and application integration.

Security

The move to the cloud does mean that security and data privacy — something that was previously your IT department’s concern — is now your cloud provider’s concern. Yet it doesn’t mean your organization is absolved from ensuring that the cloud provider is doing its part. You need to demand that the cloud provider is clear about how they secure and protect your customers’, partners’, and employees’ data — both when it’s stored in the cloud and when it’s transferred to and from your on-premise systems.

A cloud-based application in isolation is reason enough for insisting on a clear understanding of how your cloud provider stores your data. Imagine, then, how imperative a clear understanding becomes when that cloud-based application is no longer isolated but integrated into a hybrid cloud environment. It’s now transferring data out into the world — perhaps from an Amazon data center in Europe or the Pacific Northwest to your offices on the other side of the globe. Or perhaps it’s transferring data to your trading partner’s systems, where you have much less control over security and protection.

This spawns several questions you should ask your cloud provider:

• Is the data encrypted both when it’s in motion and at rest?
• If cloud-application access is via an application programming interface (API), is the security token secured and encrypted when it’s used in the API core?
• What’s the security token’s lifetime? Is it per-session or permanent?
• How easily could this security token be hijacked and reused?
• Is the security token tied to IP addresses?

Getting solid answers to important questions like these will ensure that the cloud part of your hybrid environment is always serving your business and never compromising the strength of its security profile.

(TO BE CONTINUED)

(This post was first published at http:blogs.axway.com)  

An Example of User Innovation

In an earlier post, I talked about user innovation and how to harness this inventive power for your products. I want to give an example of user innovation that I have come across when working for my previous company, SirsiDynix.

 SirsiDynix builds software for libraries. The software products run many aspects of a library's operations, including the library's web presence. The web site allows library users to search for library materials online, check their availability, and, if desired, reserve them (to be picked up later). This functionality is termed the OPAC (Online Public Access Catalog) and is a basic component of almost all library management systems. SirsiDynix also provides a feature rich  Web Services API for their library management system (called Symphony) which allows developers to access the data and functionality of the system. The Web Services API provides an interface to the Symphony system and is intended to allow developers to enhance and extend the base product.

The Role-Playing Game — How Enterprise IT Should Prepare for Cloud Adoption

I’m often asked, “What’s the biggest thing standing in the way of enterprise IT getting on board with cloud adoption?”

My response is always the same: “The biggest thing standing in the way of enterprise IT cloud adoption is IT’s unwillingness to accept that business units (BUs) are already adopting the cloud.”

By 2012, BUs are eager to flout IT authority and circumvent IT constraints in order to solve problems now rather than see their requests languish in IT’s backlog of special projects, hostage to unreasonable wait times.
Those days are over. IT now has two options: Get on board or get left behind.

I’m seeing this exact scenario in our customer organizations as well. Customer BUs approach IT seeking solutions, without ever involving IT in the preliminary decision making process. They prefer instead to drag IT in at the very end and inform them of what is going to happen, rather than consult them about what may happen.

IT’s role has changed, whether they choose to recognize it or not. Their long-standing position as “policy police,” arbiter of good taste in applications, judge over whether an application requires IT policy and corporate security standards or not — it’s all coming to an end.

IT must face the fact that BUs are increasingly adopting the cloud, and support that move by:

• Becoming more aligned with the BUs and their goals;
• Providing security in the cloud;
• Managing service level agreements with cloud providers;
• Following escalation procedures;
• and advising the BUs on how — not whether — to adopt the cloud.

Don’t wait for cloud adoption to start getting your house in order. If IT stays in reactive mode as BUs make cloud decisions, they’ll end up with “integration” minus “strategy” — applications will be integrated on an ad hoc, project-by-project basis, creating a proliferation of point-to-point connections that is a repeat of the fragile, “spaghetti” integrations of the past.

IT must act now to get ahead of the curve — meaning ahead of BU demand — defining a solid integration strategy before the cloud apps start building out (or as early in that process as possible).

Does moving to the cloud mean that IT will lose some control? Yes. But I challenge them to be big-minded about it: Support BU adoption of the cloud, embrace your new role, shed your service-manager chrysalis and spread your trusted-adviser wings.

(This post was first published at http:blogs.axway.com) 

Page One

By 2015, the cloud will become the preferred mechanism for software delivery, which means organizations everywhere will have more choices when selecting an application provider, and fewer reasons to maintain their own applications on-premise.

Compare that to 2012. Today, if you use on-premise business application suites like SAP or Oracle, you’re effectively tied to those applications.

But not so in 2015. By then, you’ll be able to be selective when it comes to components. In fact, that level of selectivity is already becoming commonplace: Today, organizations everywhere are moving away from big packaged business suites, and toward best-of-breed components for their CRM and HR applications (e.g., Salesforce and Workday, respectively).

But the organization’s new advantage of increased selectivity puts a burden on the IT department to manage multiple vendors, transforming their role from providers of on-premise services to managers of off-premise cloud applications. The increased complexity IT will have to manage will be substantial and will add new dimensions to their role. IT will have to be ready and able to:

• Work with different types of providers
• Enforce a host of widely disparate SLAs
• Evaluate varying levels of performance
• Prepare for different disaster-recovery scenarios
• Implement a variety of support and escalation processes
• Accommodate different subscription and billing models (whether transaction- or api-based).

Not all IT departments will be ready to manage this level of broadened responsibility, so they’ll consolidate all of their multiple vendor agreements with one of the many cloud brokers we can expect to appear on the scene – intermediaries who will integrate various applications and services, aggregate it all to create a single view, and manage the service vendors on behalf of the IT department.

We can even expect that cloud brokers may end up doing going beyond vendor-agreement stewardship, to provide value-added services as well.

For example, it is not at all out of the question to expect that cloud brokers will map the data collected across the services their client organization has charged them to manage, integrate it with free services like Google Maps, and empower the client’s HR department to get a better idea of how the organization’s employees are spread out around the world – which could then inspire new, previously inconceivable tactics for employee-enablement initiatives.

The writing is on the wall: 2015 will mark the end of the cloud’s lengthy foreword and the start of its first chapter, and it will be exciting to witness, in 2013 and 2014, which organizations won’t be able to resist flipping to page one.

(This post was first published at http:blogs.axway.com)