Moving into the Cloud

In Pinching Pennies with SaaS (December 2008) we examined Software-as-a-Service and its increasing popularity in these cost conscious times. During research for that article, we found that the term SaaS is often confused with the concept of “cloud” computing. A notable difference between the two is that SaaS is enjoying a certain ubiquity. Due in part to its prevalence in analyst discourse, SaaS has been added to everyday IT vernacular. While both SaaS and cloud computing denote off premise solutions to network, storage or security challenges, (among other things), SaaS, the experts agree, is a part of a larger cloud computing ecosystem.

“My take is that SaaS is a subset of cloud computing,” says Saurabh Bhatnagar, senior product manager for Websense. “Cloud computing is the process of using cloud based resources as, and when, and to whatever extent, needed. Raw processing power for running any application would be an example of cloud computing. SaaS is more about delivering discrete applications over the Internet, it’s more about the application—the scalable computing resource underneath is secondary.”

Amir Lev, CTO of Commtouch offers, “Cloud computing describes a service whose computation power is hosted outside of a singular network. It enables customers around the world to tap in to and reap the benefits of a centralized database or computing body.”

In an October 2008 IDC study, Frank Gens, senior vice president and chief analyst at IDC, found that when people talked about cloud computing, they were usually referring to the online delivery and consumption models for business and consumer services. In most cases, he explains, the “computing” lies behind a more recognizable service, like banking or shopping or online storage. Gens defined cloud services as the consumer and business products, services, and solutions that are delivered and consumed in real time over the Internet. “As the foundation for cloud services, cloud computing consists of a growing list of technologies and IT offerings that enable cloud services, including infrastructure systems (servers, storage, networks), application software, system and application management software, IP networks, and pricing agreements.”

[ header = Heads in the Cloud ]

Heads in the Cloud

Although cloud computing has yet to usurp on premise solutions for mission critical operations, Gens predicts a significant shift in the next five years, “A recent IDC survey of IT executives, CIOs, and their line of business (LOB) colleagues shows that cloud services are ‘crossing the chasm’ and entering a period of widespread adoption. Moreover, IDC expects the cloud adoption trend to be amplified by the current financial crisis.” Gens adds that the cloud model offers a much cheaper way for businesses to acquire and use IT, “In an economic downturn, the appeal of that cost advantage will be greatly magnified. This advantage is especially important for small and medium businesses, a sector that will be a key target in any plan for recovery.”

IDC expects spending on IT cloud services to grow almost threefold, reaching $42 billion by 2012. More importantly, IDC notes, spending on cloud computing will accelerate throughout the forecast period, capturing 25 percent of IT spending growth in 2012 and nearly a third of growth in 2010. Websense, an early adopter of the cloud-based delivery model for Web and email security, feels that cloud-based solutions are a logical evolution, offering their customers lowered complexity, scalability, fault tolerance and predictability of costs.

As an OEM provider of cloud-based threat detection, Commtouch means to harness the vast computing power of the cloud to deliver solutions to their client-base. ”Cloud-based threat detection is the only technique capable of protecting networks from the massive, dynamic attacks that plague the Internet today,” believes Lev. “Commtouch technology facilitates the analysis of billions of daily email and Web transactions by diversified data sources in data centers located around the globe. This analysis, all done in the cloud, enables Commtouch to offer wide-reaching and highly accurate coverage at the zero-hour.”

Lev explains that by leveraging the cloud as the platform for collection, analysis and distribution (basically a nearly infinite database in the cloud), Commtouch solutions overcome local storage limitations, free up valuable IT management resources, provide customers with information tailored to meet their specific needs, and eliminates the need for resource-draining mass-updates needed to protect against the most recent threats. Lev believes that cloud-based security does not require implementing a fully cloud-based or managed solution; detection in the cloud can be one component of any in-house appliance, software gateway or managed service.

[ header = Addressing Cloud Concerns ]

Addressing Cloud Concerns

Gens says that to succeed, cloud services providers need to address a mixture of traditional and cloud concerns. Further, according to IDC survey respondents, the two most important things a cloud services provider can offer are competitive pricing and performance level assurances followed by the ability to demonstrate an understanding of the customer’s industry and the ability to move cloud services back on-premises if necessary.

Bhatnagar points out that many IT managers are required to provide their internal customers (i.e., their organizations) with service level agreements (SLAs), so it’s natural for them to expect SLAs from vendors. We believe that predictability of cost and predictability of service are key advantages of our offerings. Since customers’ price expectations are tied to value—both in terms of feature delivery, and also relative to the cost of ownership of an equivalent on-premise solution—we have just initiated new simplified packaging at very compelling price-points.” Bhatnagar adds that their commitment to value comes backed by standard industry SLAs—reliability (service availability of 99.999 percent) and protection (99 percent spam detection rate, 100 percent protection against known viruses). To better address their customers’ needs, Websense offers both an on-premise solution and a hosted service for email, offering flexibility in terms of moving between the two deployment methods—their commitment is such that they have developed engineering driven best practice documents specific to enabling hybrid deployments.

“Frank Gens’ study touches excellent points,” comments Lev. “As an OEM provider, Commtouch does not sell directly to end users, but offers a cloud-based security solution to security vendors and service providers, allowing them to better meet the needs and demands of their customers. Our more than 100 OEM partners cover a wide variety of markets and delivery methods, enabling individual IT managers to choose a Commtouch licensee that is right for them. Regardless of what solution is selected, Commtouch cloud-based detection services provide dynamic real-time protection against email- and Web-based threats.”

“Privacy is a concern that many customers have,” notes Farley Steward, product marketing director for Websense. “It’s critical that cloud-based services are routinely audited for security and privacy. Websense services regularly go through a stringent review process and are certified ISO 27001 compliant. This global standard is only awarded to those companies who can demonstrate global best practices for the protection of data confidentiality, integrity and availability.”

[ header = What’s Recession Got to Do With It? ]

What’s Recession Got to Do With It?

Many have pinned the interest and uptake in cloud and SaaS services to cost effectiveness. As with any new technology or methodology, a mix of money, ease of use and practicality tend to coalesce to create the next best choice for the organization. Steward believes that there are several driving factors behind customer adoption of cloud-based solutions.

• Many organizations have several remote locations yet require the same level of security protection for each that they get from their on-premise solution—without the need for hardware. Cloud solutions are flexible and can be used layered on top of on-premise solutions for added protection.
• Service level agreements providing specific, measurable performance commitments.
• Early adopters paved the way for them—as early adopters of the technology have successfully implemented cloud-based solutions, other companies, who may have first been reluctant, are following their lead.

IDC found that the shift toward cloud computing is being driven by three market forces: the search for growth (and revenues) in important new segments, including emerging markets like Brazil, Russia, India and China (BRIC), as well as the small and medium business (SMB) sector; the shortcomings of traditional approaches in capturing the growth in these increasingly important markets; and competitive pressures from new players with little to lose and everything to gain from pushing the new model.

The word “cloud” seems to have found its way into descriptions of products and services that are only very slightly (if at all) related to the concept and practice. Lev believes that enabling customers to separate the hype from the benefits involves a better understanding of their own needs. “Just because a service is offered in the cloud does not necessarily mean that it is better than a locally-based service,” explains Lev, who believes that in the case of security, the detection and analysis must be done in the cloud for the most accurate coverage.

[ header = What to Look for in a Cloud Solution ]

What to Look for in a Cloud Solution

Researching cloud-based solutions can be a daunting task, especially, as mentioned earlier, when the word “cloud” is used interchangeably (and erroneously) with SaaS. In addition, many organizations are still grappling with the ambiguous nature of the “cloud” concept whereas others are unsure of how to weigh the pros and cons of off premise versus on premise solutions. We asked the vendors to provide a few things customers should consider when evaluating a cloud solution.

“Potential customers should first examine who and what is behind the delivery model—the domain expertise of the company providing the service should be the first step,” advises Farley Steward, product marketing director for Websense. “A novel delivery model alone is not enough. Customers should also look for service level agreements to ensure the reliability and security of the solution and their data,” adds Saurabh Bhatnagar, senior product manager for Websense who also says that an objective assessment of cost of ownership—including hardware, software, maintenance, upgrades, and associated resources—is a necessary step in finding the right cloud-based solution.

“Clients should consider the flexibility of the service components,” believes Amir Lev, CTO for Commtouch. “Because threat detection and analysis is most effectively handled from the cloud, customers should look for a solution that provides comprehensive security—including analysis and detection from the cloud—and then decide what level of control they prefer over the local policies. For IT managers that want in-house control over email, some services allow them to locally manage network security policies and threat quarantines. Meanwhile, other companies may prefer to move administration functions to the cloud through a managed service solution in order to reduce management overhead.”