Cloud Computing as a Value Driven Technology - Report Example

? Introduction Cloud computing is considered to be a value driven technology, as it saves cost along with advanced Virtualization of business functions that is globally accessible. Organizations consider it a cost effective tool, as the requirement of maintaining a complex technology infrastructure along with resources is not essential. Likewise, risk factors are also being considered, as the risk, mentioned in the underpinning contract is now owned by a third party i.e. cloud computing vendors. Martin Sandler, who is a director of HP systems security Lab says, “People often think of virtualization as adding to security problems, but it is fundamentally the answer to a lot of those problems,” (Anthes 2010).In a nutshell, cloud computing delivers major advantages along with negative consequences as well. For instance, information of an organization needs to be protected and is the ultimate responsibility of the board of director for which they are also liable. Likewise, transferring information on the cloud determines that it is not managed by the organization anymore and any consequence or a breach of data occurring on the vendor side will be a prime threat to the organization. Therefore, information security is the part of due care and due diligence that is derived from the responsible employees of the organization. Cloud Deployment Models It is the prime responsibility of the ‘Business Cloud’ to protect intellectual property and confidential information that may be related to customer personal information, trade secrets, patents etc. Breach of any one of these classified information types can result in a permanent loss of business and ultimately bankruptcy that may result in legal and regulatory compliance. Likewise, before making any strategy for transferring critical applications to the cloud, it is important to analyze deployment and service models of cloud computing. The correct choice needs to be made in order to align business requirements to the correct deployment and service model without any unnecessary risk. ‘Business Cloud’ will select the best possible cloud computing deployment method as per their business requirements and compatibility factors. Below are the four deployment methods are available for selection: Private Cloud The private cloud is also referred as a neologism. However, the concept of this term out dates cloud computing by 40 years. Private clouds are recommended for organization requiring advanced security and privacy measures. The private cloud is administered exclusively for only a single organization, in order to maintain strict level of security (, Cloud Deployment Models ). Community Cloud As compared to a private cloud, the community cloud is shared among many organizations having identical business requirements. Moreover, the required infrastructure is shared among all the organization that is connected to the cloud saving the cost and demonstrates one of the advantages of cloud computing (, Cloud Deployment Models ). Public Cloud Public computing is a traditional approach where the resources are accessible on the Internet. Third party providers, known as the cloud vendors, organize the hosting for these resources on the Internet. The services and resources on this cloud are accessible to the public and groups of various industries (, Cloud Deployment Models ). Hybrid Cloud A hybrid cloud comprises of a mixture of all types of clouds i.e. public, private and community. Most organizations deploy this type of cloud as it provides a range of options in the context of accessibility. By incorporating hybrid clouds, issues such as PCI compliance can be eliminated (, Cloud Deployment Models ). Cloud Computing Service Models Cloud computing consists of applications that are represented as a service on the web and the provision of hardware / software services provided by companies operating data centers. Likewise, the services provided over the Internet are referred as (Software as a Service) ‘SaaS’. There are few sellers who use the term (Infrastructure as a service) ‘IaaS’ and (Platform as a service) ‘PaaS’ in order to demonstrate their products and services. However, these terms are avoided and not accepted globally, due to variation (Armbrust, Stoica et al. 2010). The Commerce Department’s National Institute of Standards and Technology (NIST) have illustrated some helpful definitions that focus on three concepts (Ryan, Loeffler 2010): Cloud infrastructure as a service ‘IaaS’ consists of provisioning elementary computing resources. Cloud software as a service ‘SaaS’ access software application that operates on a cloud infrastructure. Cloud platform as a service (PaaS) provides the accessibility to users for implementing and developing applications with programming language and tools supported by the providers. The core components of a cloud consist of the data center hardware and software. When these resources are made available to the public, they are referred as public clouds and the service provided by the cloud is called as utility computing. Moreover, private clouds are only available to private organizations and are not accessible by the public. Accordingly, cloud computing is the combination of ‘SaaS’ and utility computing (ARMBRUST et al., 2010). There are three service models for cloud computing i.e. infrastructure as a service, platform as a service and software as a service (Wilshusen 2011). Infrastructure as a service (IaaS) is comprised of three components i.e. software, platform and infrastructure. Organizations only provide software and platform and infrastructure is provided by a third party cloud computing vendor. The second service models i.e. platform as a service (PaaS) also comprises of three components i.e. software, platform and infrastructure. Organizations only provide a software or application that will be executed on the third party or the vendor’s platform and infrastructure. The third service model also includes the similar three components as mentioned before and called as software as a service (SaaS). Organizations only utilize the services provided by the vendors in terms of applications that can be accessed by the Internet. All the three components i.e. software, platform and infrastructure are the property of the vendor (Wilshusen 2011). In figure 1.1, cloud deployment models are demonstrated Figure 1.1 (Retreived from :Wilshusen, G. C. (2011). INFORMATION SECURITY: Additional guidance needed to address cloud computing concerns. GAO Reports, , 1.) Cloud computing four service models are shown in Fig 1.2 Figure 1.2 (Retreived from :Wilshusen, G. C. (2011). INFORMATION SECURITY: Additional guidance needed to address cloud computing concerns. GAO Reports, , 1.) ‘Business Cloud’ must choose the relevant client model, as it will be proportional to the business or customer requirements and may differ from organization to organization and business types. The first service model is called as the ‘Private Cloud’. A private cloud is solely a property of the organization i.e. software, platform and infrastructure is the property of the organization (Wilshusen 2011). The second service model is called as the community cloud that is accessible to several organizations that may be similar to business types and will focus on customer requiring a similar technology. The third model is the cloud known as ‘Public Cloud’. This type of service model is accessible to the public or global industry group. Lastly, the forth service model is called as the ‘Hybrid cloud’. It considers to be combined with two or more infrastructures that may support two or more clouds. However, the interaction between different clouds is bound on a standardized approach and proprietary technology (Wilshusen 2011). Cloud Computing Advantages and Challenges Cloud computing will derive many valuable benefits for ‘Business Cloud’, as they are discussed below (Wu, Shen et al. 2011): The first factor is justifiable, as there is no requirement of managing or maintaining software, hardware and infrastructure associated with network area storage (NAS) because cloud is taking care of the application as a whole. Secondly, the most important factor is the cost. For instance, an information security manager needs to sell security to the business by using an efficient business case. Total Cost of Ownership (TCO) is the core component of the business case that may justify the cost required for implementing security on the cloud. Therefore, low TCO enables information security managers to justify minimal expenses and more cost savings for getting approval on security projects. Likewise, availability of cloud services is also high resulting in value delivery i.e. low cost of ownership and high availability. Moreover, cloud services also eliminate the requirements of a high profile hot site that may involve a lot of cost. In case of unplanned service outage, cloud computing ensures reliable delivery of core business applications that eliminates the needs for off-site storage. On the other hand, cloud computing also reflects significant risks, principal risks of cloud computing is associated with federal agencies and regulations. Any vulnerability found in the software, platform or infrastructure of the vendors will expose serious exposures, as information may be related to more than one organization. Moreover, employees working internally on the cloud computing premises of ‘Business Cloud’ may also expose a serious threat if no proper background employee checks were performed during recruitment procedures. Furthermore, if any governmental agencies for instance, military or other sensitive body is also using the same cloud from the same vendor is also most likely to be compromised, if any breach of any one of these fundamental concepts Confidentiality, Integrity and Availability is successful. In addition, the incident response function may not be efficient and effective if any incident occurs and affect the customer or employee. For instance, if a security incident affects the customer, the incident response function of the organization will trigger in a timely manner to isolate and investigate the root cause via root cause analysis. In a cloud computing scenario, it may be a different case and result in ambiguity, as from where the investigation should begin. If an incident is triggered from the vendor’s site, evidence is required to act accordingly and may consume more time that is always a critical success factor. Therefore, compliance of cloud computing vendors and implementing security controls as per the governmental information security requirements is the major concern of organizations associated with services on clouds. Moreover, organizations have also concerns on assessment of security controls and independent audit and limitations of the vendor because data of many organizations are located at the vendor site that may increase risk of the CIA (Wilshusen 2011). Therefore, an agreement is in process for establishing an independent organization that may conduct security audits and assessment. In this way, organizations can select vendors who are approved by these independent organizations maintaining the required security controls and standards. Cloud Computing Storage The storage of cloud computing requires a lot of space, in fact humongous data centers where data is collected and managed. These data centers pose several threats and security risk that may impact these data storage machines. The threat may be from a professional hacker and also in the form of the cloud provider itself, if data is not adequately dealt with. A minor security incident or mis configuration can lead to a system failure or unavailability. For instance, in 2008, only a tiny corrupted bit integrated with a message that was used by the servers of Amazon’s Simple Storage Service (S3) that provide services of online data storage imposed a system shutdown for many hours (Talbot 2010). Moreover, another security breach occurred in 2009, password of an employee working on Twitter was hacked that resulted in breaching the email security questions page that was located in the Google apps account (Talbot 2010). In relation to that, one more incident occurred when data was erased from one million T-mobile smart phones due to a server failure that was managing the data of these smart phones (Talbot 2010).As Peter Mell, who is a team lead of cloud security team at National Institute of Standards and Technology (NIST) says, public cloud computing models are more vulnerable to threats, as every customer has access to a broad range of services and levels. Therefore, if any one of the services is breached, they gain access to all the data. Cloud Computing Layers Cloud computing is associated with five layers that works as an architecture. These layers contribute functionality with each other to support the features of cloud computing services. The hardware layer has no fault tolerance concluding that if the hardware fails, there is no alternate except to replace it with the new one. The redundancy and fault tolerance is managed by the applications. However, the risk can be minimized by providing alternative power supplies to the hardware etc. The Virtualization layer comprises of virtual machines (, The Five Layers within Cloud Computing). However, these software applications use a single hardware platform but are presented in many instances. The mainstream server is virtualized by this method, and the vendors can provide Infrastructure as a service (IaaS) to the customers. VMware, Citrix, Microsoft are the popular ones (, The Five Layers within Cloud Computing). The IaaS acts as a layer of the cloud computing technology by illustrating a mechanism to administer the services of Virtualization. Moreover, the API allows the users to construct templates, which can be deleted anytime. The administration of API facilitates the vendors to save cost (, The Five Layers within Cloud Computing). Furthermore, IaaS facilitates storage services that are administered by an API. For instance, Amazon has implemented IaaS storage services for its customers. The next layer is the PaaS layer that facilitates the IaaS layer by eliminating the management of specific virtual machine instances (, The Five Layers within Cloud Computing). PaaS also contributes in the deployment of an application in cloud computing. A programming interface is made available for the developer to develop API. One of the examples of PaaS is the Google application engine in which Google has demonstrated an API utilized for storage and database along with a platform. PaaS provides the platform for the developers to code a program and initialize it in the cloud. SaaS has its significance on organizations, which do not want to possess or maintain any application in their premises. Email services, customer relationship management (CRM) services is accessible online via the cloud. The storage and security is the responsibility of the vendor (, The Five Layers within Cloud Computing). However, user credentials are required to log in the application on the Internet or a VPN connection. In this way, organizations save the application maintenance cost, cost of physical security measures, security measures etc. (, The Five Layers within Cloud Computing). Cloud Computing Security As cloud-computing usage is increasing with its connection to the public through an Internet, new opportunities also originate for hackers, cyber terrorists, viruses and worms. These threats will increase and focus on cloud computing enables services and applications for stealing classified data, denial of service attacks on data centers etc. ‘Google apps’ is the major player in the market for providing ‘SaaS’, it was attacked and hacked. The report from cyber forensics indicated that the attacks were originated from China (Bisong & Rahman, 2011). The security and privacy in cloud computing are associated with data storage and data protection. Moreover, monitoring the utilization of resources available on the cloud by the service providers is also included. In order to secure the data in the cloud, it can be stored internally in the organization’s premises. Moreover, the Sarbanes-Oxley Act (SOX) in the US and Data Protection directives along with the EU are only two compliances from many other compliance concerns related to data and application of cloud computing. Moreover, the EU has backed up with a legislative data protection for the entire member across the globe. However, the US data protection differs from the EU, as it varies in each state (, PLI: Seminars & Webcasts and Corporate & Securities). Moreover, the service provides incorporates the highest level of security in the clouds of their inbound technical intelligence, but these measures is affected due to government regulations country by country. For instance, if a cloud computing service providers is located within a country, the service provider is bound to slipshod provisions on privacy that may lead the involvement of the government enforcement agencies to peek in the hosted data of a particular organization (, Information Security Short Takes: Cloud Computing Data Protection World Map). Open Source Licensing Most of the open source applications are associated with the cloud and it is governed by various obligations included in the relevant open source license. Likewise complying with the software license is similar to any other compliance process, as an efficient compliance processes address issues and mitigate risks. Similarly, cloud computing services do not introduce any new risks but applications associated with these services introduce risks. However, applications that are operational in the cloud are distributed as compare to other software applications that are not shared. Likewise, there is less visibility and no evaluation or examination of the industry, therefore, cannot be categorized or fall under many obligations incorporating copyleft licenses. Open Source and the Cloud Cloud computing continues to benefit business by lowering down the cost associated with hardware, software and human resource. However, some of the debatable issues including personal privacy, lack of security control and sharing data are still seeking a solution. Likewise, providing superior benefits for ease of development, minimized costs, high scalability along with next generation architecture are facilitating Information technology to evaluate cost benefit analysis while doing risk assessment (, Cloud computing and open source face-off ). At the same time, open source has played a vital role in cloud computing and facilitated to enable low cost input that can also be considered as free of cost and rich features for cloud service providers. Moreover, buzz in the industry concludes that the cloud computing service will utilize the open source to gain power and control to establish next generation proprietary platform-as-a service that is similar to Web 2.0 (, Cloud computing and open source face-off ). Moreover, if Linux operating systems are used for cloud computing, there will be no licensing cost as compare to a Microsoft operating system environment. IBM clearly states in the economics of scale that one of the primary drivers for expanding the cloud is open source. Moreover, software or application is considered as a component in a computing environment, though an expensive one. However, open source software is not always successful, as they only become partially in some organizations (, Cloud computing and open source face-off). Workstations, Printers, Internet Connection and Network Justification For accessing cloud computing online services via a web browser requires an updated or couple of years old workstation that supports all features of current Web browsers. However, for a fast and rich experience of cloud computing applications, a fast Internet connection is required along with an updated operating system with all critical updates installed. Likewise, upgrading old systems to Windows 7 will cost around ?70, however, hardware compatibility issues must be addressed, as Windows 7 or Vista does not support all VGA drivers or chipset available in the old system. As ‘business cloud’ websites are text based and no significant multimedia capture or editing is required, a nominal Internet connection is required. Moreover, for addressing storage requirements, all the documents, critical files and other stuff can be stored online that will significantly save the cost of maintaining and installing large storage devices. As shown in figure 1.1, only a generic overview of the network design is demonstrated. The network is built on a CAT 5 cable with a star topology. Likewise, 2 switches are adequate to connect the 11 staff members of ‘Business Cloud’. Moreover, printers are also connected to the network and can be shared among all the users connected. Furthermore, to avail cloud servicer, a WAN connection is required. In general, cloud computing service providers recommend bandwidth of the Internet connection required to establish fluent and robust connectivity between applications that are accessed from the cloud. We can assume that a broadband connection is used for establishing connectivity with the cloud service provider. Moreover, the router is connected with the two available switches. For security purpose, a firewall is installed after the DSL router or MODEM that will establish connectivity with the WAN. Furthermore, three servers are proposed that includes Customer Relationship Management Server, Email server and Application server. We have calculated Cost of 11 workstations is calculated below (Prices are taken from Amazon.co.uk): One HP Pavilion p6-2035 Desktop PC costs ?392.65. Hardware specification for this desktop are PC (Intel Core i3-2120 3.3GHz Processor, RAM 4GB DDR3, HDD 500GB, Intel HD Graphics, Windows 7 Professional 64). If we calculate the cost of one workstation ?392.65 x 11 = ? 4319.15 (Total Cost of 11 Workstations) Cost of High quality A3 Printer Canon PIXMA iX 6550 x 1 = ?201.07 Cost of High speed A4 Printer Brother HL3070CW x 1 = ?204.30 For calculating price for a broadband connection following are the details that are included in a plan from ‘Talk Talk’ (, Broadband Providers Comparison for UK ADSL, Cable and Satellite ): ?3.25 per month for up to 14Mb TalkTalk Broadband and calls 12 months half-price broadband (save ?39) Unlimited evening & weekend calls to local & national UK landline numbers 40GB monthly usage allowance included (heavy user) Customize your broadband plan with Boosts - only ?4 a month each Mega Download Boost increases usage allowance to 80GB Super Secure Boost adds F-Secure security protection for 3 PCs Special offer - now only ?2 a month with 30-day free trial Landline Boosts also available ?7.25 per month for up to 14Mb TalkTalk Plus Broadband and calls 6 months half-price broadband (save ?43.50) Free anytime calls to UK landline numbers (including 0870/0845) Free wider-range wireless 'N' router Unlimited monthly usage allowance included Switch to TalkTalk phone line rental from ?9.50 per month (required) No need to pay BT line rental or change phone number Only ?9.50 a month when paying 12 months in advance (usually ?13.80) Free connection for online orders - save ?30 Free wireless router - save ?30 30 day trial - option to cancel the service within 30 days Free technical support calls from your TalkTalk phone Single bill for broadband and phone Bibliography ANTHES, G., 2010. Security in the cloud Communications of the ACM, 53(11), pp. 16. ARMBRUST, M., STOICA, I., ZAHARIA, M., FOX, A., GRIFFITH, R., JOSEPH, A.D., KATZ, R., KONWINSKI, A., LEE, G., PATTERSON, D. and RABKIN, A., 2010. A view of cloud computing Communications of the ACM, 53(4), pp. 50. WILSHUSEN, G.C., 2011. INFORMATION SECURITY: Additional Guidance Needed to Address Cloud Computing Concerns. GAO Reports, , pp. 1. WU, J., SHEN, Q., WANG, T., ZHU, J. and ZHANG, J., 2011. Recent Advances in Cloud Security. Journal of Computers, 6(10), pp. 2156-2163. TALBOT, D., 2010. Security in the Ether. Technology review, 113(1), pp. 36. , Cloud Deployment Models | BizCloud® Network . Available: http://bizcloudnetwork.com/defining-cloud-deployment-models [4/29/2012, 2012]. RYAN, W.M. and LOEFFLER, C.M., 2010. Insights into Cloud Computing. Intellectual Property & Technology Law Journal, 22(11), pp. 22-28. , The Five Layers within Cloud Computing | Cloud Computing Journal . Available: http://cloudcomputing.sys-con.com/node/1200642 [4/29/2012, 2012]. , Information Security Short Takes: Cloud Computing Data Protection World Map . Available: http://www.shortinfosec.net/2010/03/cloud-computing-data-protection-world.html [4/29/2012, 2012]. , PLI: Seminars & Webcasts and Corporate & Securities . Available: http://www.pli.edu/Content/_/N-3jZ7r?Ns=sort_date|0 [4/29/2012, 2012]. , Cloud computing and open source face-off | ZDNet . Available: http://www.zdnet.com/blog/hinchcliffe/cloud-computing-and-open-source-face-off/543 [4/29/2012, 2012]. , Broadband Providers Comparison for UK ADSL, Cable and Satellite . Available: http://www.broadbandchecker.co.uk/broadband-checker.html [4/29/2012, 2012]. Read More