165
Mastère Spécialisé – Management des Systèmes d’Information et des Technologies Specialized Master – Information System and Technology Management December 2009 Thesis presented by Cédric MORA [email protected] Tutor: Gilles MAUFFREY Perimeter: Platform / Infrastructure as a Service, SMB & Early Adopters, France. Cloud Computing in France, A model that will transform companies: decision mechanisms and impacts

Cloud Computing In France

Embed Size (px)

DESCRIPTION

HEC Professional thesis. CLoud Computing in France: a model that will transform companies - decision mechanisms and impacts

Citation preview

Page 1: Cloud Computing In France

Mastère Spécialisé – Management des Systèmes d’Information et des Technologies Specialized Master – Information System and Technology Management

December 2009

Thesis presented by Cédric MORA [email protected]

Tutor: Gilles MAUFFREY

Perimeter: Platform / Infrastructure as a Service, SMB & Early Adopters, France.

Cloud Computing in France, A model that will transform companies: decision mechanisms and impacts

Page 2: Cloud Computing In France

2

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Contents Context of the study

Thanks

I would like to thank all the persons that have helped me in the process of writing this professional thesis.

My colleagues who provided me with valuable feedback all along the thesis:

• Lionel Pelletier, with all its experience as a CIO;

• Béatrice Rollet, a great marketing tutor; and

• Isabelle Issert de Braux, for all the legal information.

My family and friends for supporting me:

• André Farand, english proof reader;

• My family; and

• My friends.

My employer for offering me the possibility to work on Cloud Computing and letting me work on this thesis during the internship:

• Francis Weill.

My tutor from HEC for giving precious feedback and helping prepare this thesis:

• Gilles Mauffrey.

The directors of this HEC/Mines Specialized Master:

• Marie-Hélène Delmond; and

• Robert Mahl.

And, of course all the other persons that I had the occasion to interview:

• Guillaume Plouin, from Octo Technology;

• Henry Peyret, from Forrester; and

• Shirish Srivastava, from HEC.

Page 3: Cloud Computing In France

3

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Contents Context of the study

Executive Summary

Page 4: Cloud Computing In France

4

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Contents Context of the study

Cloud Computing offers a new economic model to the IT department: there is a shift from a model where an organization have to invest a large sum of money for limited resources that are managed internally, to a model where the organization can rent resources that are managed by a provider and pay them “for the use”. Platform-as-a-Service and Infrastructure-as-a-Service are two types of services that enable an organization to outsource resources for the purpose of hosting specific applications. A structured approach provides an occasion to the reader to look beyond the marketing speeches, with some insight on the Return on Experience of French organizations:

• PaaS and IaaS can reduce cost but only if the application benefit from the economics (temporal needs, burst);

• PaaS and IaaS can offer operational benefits for some organizations (SMES for example) but it is also a way to choose the appropriate service levels and, thus, differentiate the level of services;

• PaaS and IaaS offer specific new possibilities for the organization, and, for example accelerate innovation;

• PaaS and IaaS raises issues on operational and strategic levels but the maturity of the organization is never questioned, while it should be;

• Some French organization may not be interested in the model as it exists now; or

• Private Cloud does not reproduce a real Cloud environment and it is much more complicated to create than Public Cloud (especially for SMEs).

Those findings are supplemented by decision mechanisms that will help French organizations by creating the right framework for outsourcing. An organization will be able to determine:

• Whether an application can be outsourced or not with an eligibility matrix (according to the Cloud strategy, the technical feasibility, the maturity, the risks, the ROI, the criticality, and the governance);

• What are the needs to be taken into account when calculating the Return on Investment (which also includes the risks, the type of project and the model of billing) what are the other possibilities (Managed Service, Colocation, Private Cloud);

• For what usage a PaaS or IaaS service is best suited for (differentiation between new projects and existing applications);

• How to choose the relationship model with a provider and how to choose this provider (some providers are not in contact with their customer when other focus on a strategic partnership); and

• How to take into account the existing environment when making this choice (internal and external factors could ease or complicate the choice).

French early adopters that will use PaaS and IaaS services will be impacted in all sorts of ways on their organization. When pushing the scenario a little further, we can see that the shift from the “controlling an infrastructure” to “controlling a process” have consequences on the strategy, systems, structure, shared values, style, staff and skills of the organization. This document identify more specifically:

• How the processes of the IT department are impacted (control of provider services, automated management);

• What happens to the projects in Cloud Computing;

• The solution given by the IT department to the Business units;

Page 5: Cloud Computing In France

5

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Contents Context of the study

• The consideration of IT to the strategy;

• The model for contracting with the provider, with Click-wrap contracts or custom-made contracts;

• The potential new organizational model (Network-centric organization); and

• The new skills and values that must be developed by the employees (control of a process, collaboration)

French SMEs and early adopters will be able to obtain information that will be very useful on the processes to implement and consequences of the adoption of Cloud Computing.

Page 6: Cloud Computing In France

6

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Contents Context of the study

CONTENTS

CONTENTS ........................................................................................................ 6

I. Introduction ............................................................................................. 9

I.1. Context of the study .................................................................................................. 10

I.2. Terminology and perimeter of the study .................................................................. 11

I.3. SMEs (Small and Medium Enterprises) versus Large organizations .......................... 19

I.4. Objectives and construction of the thesis ................................................................. 21

I.5. Methodology of the study ......................................................................................... 24

II. Part 1 - Understanding why organizations need decision mechanisms .... 26

II.1. Communication – “Everyone is talking about it” ...................................................... 28

II.2. Cost – “Toward a new economic model” .................................................................. 31

II.2.a. A complicated comparison ............................................................................................ 33

II.2.b. Comparison ................................................................................................................... 35

II.2.c. Platform-as-a-Service .................................................................................................... 37

II.3. Commodity/Product – “What are these services? Operational benefits and new usages” .................................................................................................................................. 40

II.3.a. Benefits for the infrastructure ...................................................................................... 40

II.3.b. New usages .................................................................................................................... 43

II.3.c. Internal/Private Cloud Computing ................................................................................ 46

II.4. Consumer – “What companies are or could be interested in this new model?” ..... 51

II.4.b. Will SMEs use IaaS and PaaS services? .......................................................................... 51

II.4.c. Concerns regarding Cloud Computing for companies .................................................. 52

II.4.d. Cloud Computing: only for mature companies? ........................................................... 66

II.4.e. SWOT analysis of Cloud Computing for organization interested in the model ............. 71

II.4.f. Early adopters ................................................................................................................ 71

II.5. Corporation – "Why is it relevant to the strategy of the organization?" .................. 73

II.5.a. Balanced Scorecard ....................................................................................................... 73

II.5.b. Make or buy? ................................................................................................................. 74

II.5.c. Choice of the applications to outsource........................................................................ 77

II.5.d. Cloud Strategy ............................................................................................................... 83

II.6. Channel – “Provider: who, why and how?” .............................................................. 87

II.6.a. Different relations possible ........................................................................................... 88

II.6.b. Choosing the model ....................................................................................................... 89

Page 7: Cloud Computing In France

7

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Contents Context of the study

II.6.c. Benefits and drawbacks of the models ......................................................................... 91

II.6.d. The providers ................................................................................................................. 92

II.6.e. Choosing the right provider ........................................................................................... 96

II.6.f. Conclusion ..................................................................................................................... 99

II.7. Circumstances – “The environment” ...................................................................... 100

III. Part 2 – Impact on the organization....................................................... 102

III.1. Strategy .................................................................................................................... 103

III.1.a. Outsourcing is, by definition, a strategic decision ...................................................... 103

III.1.b. No longer restrict customers’ demands ...................................................................... 104

III.1.c. The IT Strategy ............................................................................................................. 104

III.1.d. IT, to influence the Business strategy .......................................................................... 104

III.1.e. Strategy maps .............................................................................................................. 105

III.2. Systems .................................................................................................................... 108

III.2.a. Internal reorganization of the IT department’s processes and management ............ 109

III.2.b. Realization of an application VS Migration of an application ..................................... 115

III.2.c. New Tools .................................................................................................................... 123

III.2.d. Impact of the new billing ............................................................................................. 124

III.2.e. Contracting .................................................................................................................. 125

III.3. Structure .................................................................................................................. 130

III.3.a. A important alignment for the IT department ............................................................ 130

III.3.b. A new organization? .................................................................................................... 132

III.3.c. Impacts on the decision making .................................................................................. 134

III.4. Shared values ........................................................................................................... 136

III.5. Style ......................................................................................................................... 137

III.6. Staff .......................................................................................................................... 138

III.7. Skills ......................................................................................................................... 139

IV. Conclusion ............................................................................................. 140

V. Bibliography .......................................................................................... 143

VI. Annexes ................................................................................................ 150

I. A growing interest for Cloud Computing – Google Trends ..................................... 151

II. Layers of Cloud Computing services ........................................................................ 152

III. Taxonomy of Cloud Computing ............................................................................... 153

Page 8: Cloud Computing In France

8

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Contents Context of the study

IV. Nicholas G. Carr’s electricity metaphor ................................................................... 154

V. ITIL - Information Technology Infrastructure Library .............................................. 156

VI. Some Cloud Computing Providers and Consulting Firms ........................................ 157

Infrastructure-as-a-Service providers .......................................................................................... 157

Platform-as-a-Service providers .................................................................................................. 158

Private Cloud Constructors and software firms .......................................................................... 158

Consulting Services ...................................................................................................................... 159

VII. Cloud Software ........................................................................................................ 160

Page 9: Cloud Computing In France

9

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Context of the study

I. Introduction

Page 10: Cloud Computing In France

10

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Context of the study

I.1. Context of the study

Without a doubt, the biggest IT subject this year 2009 in the media, on the Internet, or with the professionals, was Cloud Computing [Annex I]. Behind this expression, being adopted by all actors in this market (vendors or consulting firms), would lie promises of a new economic model to consume IT resources, and a new technological model which was made possible through the underlying technologies gaining maturity.

A first definition, proposed by the consulting firm Gartner is:

Another one, submitted by the National Institute of Standards and Technology, has been largely referred to by all the actors:

Before detailing those characteristics and models, we will try to identify who is creating this trend. Numerous articles have been published on this subject, in all types of press (economic, specialized or generalist) and, every day, we see press releases of companies launching new services related to Cloud Computing. Below are a number of examples of statements that we can read to get an idea of the phenomenon:

• « Cloud Computing will be as influential as e-business » (Plummer, et al., 2008)

• « Not only it is faster and more flexible, it is cheaper. […] The emergence of cloud models radically alters the cost benefit decision » (Financial Times, 2009)

• « IT departments will have little left to do once the bulk of business computing shifts out of private data centers and into the cloud » (Carr, 2008)

The different players in the Cloud Computing sectors are:

• New entrants: Terremark (USA), Rackspace, GoGrid (USA), LinkByNet (France), Ghandi (France), etc.

• Major IT Companies: Microsoft, IBM, SUN, etc.

• Telecommunications companies: Orange Business Services (France), COLT Telecom (Europe), British Telecom, etc.

“A style of computing where scalable and elastic IT-related capabilities are provided “as-a-service” using internet technologies to multiple external

customers.” (Plummer, et al., 2009)

“Cloud computing is a model for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage,

applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model promotes

availability and is composed of five essential characteristics, three service models, and four deployment models.” (Mell, et al., 2009)

Page 11: Cloud Computing In France

11

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Terminology and perimeter of the study

• Constructors and software providers: VMWare, EMC, Citrix, etc.

• Internet companies: Google (USA), Amazon Web Services (USA), Salesforce (USA), etc.

• Consulting firms: Cap Gemini, Gartner, Forrester, IDC, etc.

Figure 1 - Actors of the Cloud Computing market

These companies are closely monitoring the different studies from all the IT professionals with a view to getting a grasp of the trends in the market and respond to the client’s needs. Cloud Computing services market should increase from 46.4 billion in 2008 to 150.1 billion dollars in 2013 (Pring, et al., 2009 ). Inside these Cloud Computing services can be found different types of offers, and therefore different types of usage. We will explain later those following concepts that one always encounter with Cloud Computing: Software-as-a-Service / Platform-as-a-Service / Infrastructure-as-a-Service, internal / external Cloud (Public / Private / Hybrid Cloud), virtualization, etc. It is important to underline that the cloud computing market is segmented in different categories; the impact of the above-mentioned concepts on the companies will differ depending of these categories.

I.2. Terminology and perimeter of the study

The objective of this thesis is not to cover all the questions raised by Cloud Computing services but to focus on a specific and narrower perimeter. Before explaining what is the chosen perimeter and why we decided to focus on this one, it is necessary to explain the different underlying notions.

First, we have to come back on the expression “new model transforming companies” and not only a “new technology”. This is not one new technology called Cloud Computing but multiple existing technologies which have gained maturity. In a first place, we can refer to three technologies presented by Nicholas G. Carr (Carr, 2005):

Page 12: Cloud Computing In France

12

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Terminology and perimeter of the study

• Virtualization, which enables the operation of several logical servers on a single physical server;

• Grid Computing, which enables the utilization of an infrastructure acting as a single device composed of shared, distributed, heterogeneous, remote and autonomous hardware resources; and

• Web Services which enable a communication and data transfer between different applications and heterogeneous environment using standards. The applications are turned into modules that can be assembled and disassembled easily (Service-Oriented Architectures).

We can add other technological factors rendering possible the Cloud Computing model:

• Optic fiber which offers a larger bandwidth limiting latency issues two zones far apart; and

• Consolidation (the average utilization rate of physical servers is very low in every companies but these servers are still using nearly the same amount of energy and cooling; virtualization improves these rates because resources are shared) and new machines that are created to use less energy and need less cooling. This is linked to another big subject: Green IT.

Cloud Computing model emphasizes 5 key characteristics, existing thanks to these technologies, and explained by the Gartner (Plummer, et al., 2009) and the National Institute of Standards and Technologies (Mell, et al., 2009):

• A service-oriented technology, where consumer concerns are abstracted from provider concerns, and that is ready-to-use � SERVICE BASED;

• Services scale on-demand to add or remove resources as needed � RAPID ELASTICITY AND

SCALABILITY;

• Services share a pool of resources to build economies of scale � SHARED RESOURCES;

• Services are tracked with usage metrics to enable the “pay-as-you-go model” � PAY PER

USE;

• Services are delivered through use of Web identifiers, standards, formats and protocols and with an identical access � UBIQUITOUS NETWORK ACCESS;

Cloud Computing professionals also agrees on three types of services [annexes II & III]:

Page 13: Cloud Computing In France

13

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Terminology and perimeter of the study

Figure 2 - Cloud Computing layers (SaaS / PaaS / IaaS)

• Software as a Service (SaaS): The service provided makes use of the provider’s applications accessible through a client interface, such as a web browser (ex: Gmail). The consumer doesn’t manage or control the infrastructure, the network, the servers, the operating system, the storage and cannot add specific development (even if there are limited user-specific application configuration settings).

o Offers: Billing, Financials, Legal, Sales, Desktop productivity, Human Resources, Content Management, Backup & Recovery, CRM (Customer Relationship Management), Document Management, Collaboration Tools, Social Networks.

• Platform as a Service (PaaS): The service provided consists in the deployment of consumer-created applications on the provider’s infrastructure and the use of programming languages and tools supported by the platform (ex: Java or Python available on Google App Engine). The consumer doesn’t manage or control the infrastructure, the network, the servers, the operating system and the storage but he has control over the deployed applications, and occasionally application hosting environment configurations.

o Offers: General purpose, Business intelligence, Integration, Development & Testing, Database.

• Infrastructure as a Service (IaaS): The service provided gives the possibility to rent resources, such as processing, storage or bandwidth, and allows the consumer to deploy and run any software (operating systems and/or applications). The consumer doesn’t manage and control the infrastructure but he controls the operating system, the storage, the deployed applications, and occasionally networking components (firewall, load balancing). Some providers offer to manage the application if the latter is not too specific and is compatible wit the perimeter of their offer.

o Offers: Storage, Compute, Services Management.

Page 14: Cloud Computing In France

14

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Terminology and perimeter of the study

These different Cloud Computing services have been presented in the configuration called « Public Cloud » but it is possible to try to recreate some advantages of Cloud Computing on-premises, creating a Private Cloud to share internal resources. Thus, we are seeing different types of deployment models in the studies or articles being published by Forrester (Staten, 2009), the NIST (Mell, et al., 2009) or the Cloud Security Alliance (Hoff, 2009):

• Public Cloud: Infrastructures are shared with a “Pay-as-you-go” model. This off-premise virtualized infrastructure is easily accessible and can be managed through a portal of the provider. The provider can make economies of scale: the homogeneous infrastructures are shared with all the consumers and managed and updated by the Cloud provider. Consumer can choose the infrastructure they need, and choose all the security elements and the uptime (SLA). The first Public Cloud, and the most popular one, is Amazon Web Services EC2 (Elastic Compute Cloud) that is linked to other offers, such as Amazon Simple Storage. We are also seeing an increase number of External Private Clouds offerings (off-premises): this provides a way for companies to create a logically separated set of virtual machines, a secure VPN connection to their own networks (Virtual Private Network is a secure tunnel through the Internet from a corporate network to provider’s servers). It also enables the use of existing security and management policies. Amazon Virtual Private Cloud is the best-known offering of External Private Cloud.

Figure 3 - Public Cloud (Open Cloud Manifesto, 2009)

• Private Cloud: internal pool of resources inside the Date Centers of a company. Internal Private Clouds are sometimes seen as a simple evolution of the classic Information System of an organization but have some characteristics of Public Clouds (they use the virtualization and dynamic provisioning). Private Clouds are companies who only want to use services that are hosted in-house and do not want to share their infrastructure. This type of Cloud respect the standard process and security policy of the company but doesn’t not offer as much benefits and flexibility to the CIO: he always have to invest in the hardware and software. IBM is one of the manufacturers that offer these types of solution for companies who want to create an Internal Private Cloud.

Page 15: Cloud Computing In France

15

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Terminology and perimeter of the study

Figure 4 - Private Cloud (Open Cloud Manifesto, 2009)

• Hybrid Cloud: combination of different clouds (for example Public and Private Clouds) that allow for transitive information exchange and possibly application compatibility and portability across disparate Cloud service offerings and providers utilizing standard or proprietary methodologies regardless of ownership or location.

Figure 5 - Hybrid Cloud (Open Cloud Manifesto, 2009)

• Community Cloud: infrastructures, shared by several organizations, support a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). The US Government and NASA created a community cloud for all US government agencies. This type of cloud combines two worlds: Public Cloud (different entities sharing their infrastructure) and Private Cloud (specific organizations use their own Data Centers and know with whom they share their infrastructure).

Page 16: Cloud Computing In France

16

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Terminology and perimeter of the study

Figure 6 - Community Cloud (Open Cloud Manifesto, 2009)

The Thesis:

This thesis will discuss of changes and impacts on the Customer (IT departments, organizations) of Infrastructure-as-a-Service, Platform-as-a-Service and the following types of deployments: Public, Private and Hybrid.

We didn’t want to include Software-as-a-Service in the perimeter of the thesis because several studies have been done on the subject in recent years since it is a well-known concept. The global market of SaaS was 5.04 billion dollars in 2008 and should be 20.2 billion in 2013, which represents an annual increase of 32% (Plummer, et al., 2009). We can see that a growing number of French companies are already using, or will soon use, this type of service (Markess International, 2009): communication (mail, calendar, web meeting, project management, …), human resources (human resources, finance, e-learning, …), CRM and marketing, etc.

The Platform-as-a-Service market should represent “only” 2.26 billion dollars in 2013 with an annual increase of 8.3% but the subcategory called “Platform Infrastructure” by Gartner should increase by 50.1% every year.

The most interesting market is the Infrastructure-as-a-Service market which should have an increase of 53.8% every year, going from 0.96 billion to 8.37 billion dollars. This market creates a significant amount of discussion and major companies are planning to sell this type of service: the electricity metaphor is based on this (Carr, 2005). Like electricity, companies may consume IT resources as a commodity: you pay for what you need every hour to a provider [Annex IV]. The term “Utility Computing” is often used to define this possibility.

A look at Forrester’s TechRadar confirms that PaaS and IaaS still are in the creation phase but will certainly bring medium or high value to the organizations.

Page 17: Cloud Computing In France

17

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Terminology and perimeter of the study

Figure 7 - Forrester's TechRadar for Cloud Computing (Staten, et al., 2009)

Infrastructure-as-a-Service is the only component that will reach its next phase, according to Forrester, and this will be possible because of the major investments that providers are doing. Platform-as-a-Service is still interesting because it offers an alternative to IaaS, but that still let an organization to develop specific applications. These subjects and their impacts in the companies will be discussed in this thesis.

I could have only referred to the Public deployment model, which raises different questions and issues of interest. But numerous companies may choose instead to create a Private Cloud and an examination of this approach will tell us why some companies prefer that their infrastructure stay on-premises rather than using Public Cloud services.

Outsourced applications have not been, so far, critical applications (even if all applications of a company tend to be more and more critical) or specific ones (all companies need the same mail or CRM applications: there is no added value). Outsourcing can be considered for all types of organization, but some companies will find it easier to use Cloud Computing services than other companies might. For example, SMEs uses more SaaS than other types of companies (Markess International, 2009). They have an Information System that is rather young and/or simple and it is easier for them to migrate to Cloud Computing services such as SaaS (Forrest, et al., 2009). The first

Page 18: Cloud Computing In France

18

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Terminology and perimeter of the study

hypothesis could be that SMEs will tend, more than larger enterprises, to use all types of services but we will see that they may not be the largest user of Platform and Infrastructure services. We will try to identify which companies could be the “Innovators” and “Early Adopters” of the innovation adoption curve (Rogers, 1962).

SUMMARRY:

The perimeter of the thesis is:

Perimeter Entities observed Customers of Cloud Computing service Services model Infrastructure as a Service, Platform as a Service Deployment model Public Cloud, Private Cloud, Hybrid Cloud Geographic perimeter France Companies SMEs and Early Adopters Focus in the organization IT Department and the relationship with the other

departments

We will not discuss:

• Software-as-a-Service, Green IT, Web 2.0, SOA, Data Center constructions, detailed explanation on Virtualization;

• Countries outside of France (USA in particular where organization are more advanced);

• Impacts on and strategy of the providers, consulting firms, integrators, constructors and globally, the IT ecosystem; and

• Advanced Change Management that must be implemented in the organization.

Page 19: Cloud Computing In France

19

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction SMEs (Small and Medium Enterprises) versus Large organizations

I.3. SMEs (Small and Medium Enterprises) versus

Large organizations

Before detailing how will be constructed the reasoning of the thesis, we will look at the typology of organizations.

In France, SMEs are organizations that have between 10 and 250 employees (IDATE, 2008). “It represents a total potential market of more than 3 million businesses and 13 millions of active workers. These SMEs are not a homogeneous population but consist instead of very varied economic units. […] [They have] ICT integration logics and digital practices in IT and telecom procurement [that replicates] this diversity.”

We can identify two types of SMEs:

• Independent SMEs: they only have their internal resources.

• SMEs that belong to a group: they have access to the resources of the parent company. That occasionally translates into the IT department being more developed and linked to its parent company IT department.

Large organizations have more than 250 employees.

All these organizations can be divided in two groups:

• Organizations where IT is the core business: Independent Software Vendors, eBusiness websites;

• Organizations that uses IT to support the business.

These organizations consume IT services as follows (Jacod, 2008):

• IT and telecommunication services represent 5% of SMEs’ purchasing costs and 8% of large organizations’;

• IT investment of SMEs are divided in services (50%), hardware (34%), and software (16%) (Nassah, 2006); and

• 65% of large organizations use IT consulting and engineering services, where 42% of SMEs in a group and 35% of independent SMEs do so.

The document shows that the arbitration between internal and external use depends heavily on the status of companies. Independent businesses are moving more frequently to an internal solution, while those who belong to a group are more likely to meet their needs both internally and externally. In the latter case, the claimant may belong to the same group: 10% of services procurement, made by companies belonging to a group, are done within the group itself.

The above also illustrates the fact that providing internal solutions for some services may be more cost effective for smaller SMEs because of fixed transaction costs associated with outsourcing (covering for example the search for a provider and the costs for the contracts).

Page 20: Cloud Computing In France

20

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction SMEs (Small and Medium Enterprises) versus Large organizations

Figure 8 - Motivations for IT investment (Nassah, 2006)

We see on the above figure that IT investments for SMEs focus more on compliance than on the consistency with its environment, which may indicate that IT could be perceived more as cost than value.

This information will be very helpful for us to understand the environment in which the organizations work and how Cloud Computing can be consumed by these 3 types of organizations.

Page 21: Cloud Computing In France

21

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Objectives and construction of the thesis

I.4. Objectives and construction of the thesis

The main objective of this thesis is to assist organizations in a better understanding of Cloud Computing services. This “big Cloud” offers the possibility for the organizations to create and host specific applications, using IT resources that will be managed by a provider, something which appears both very interesting and dangerous at the same time. I attended numerous conferences from December 2008 to December 2009 (9 events to be exact) and the reactions of the attendees were quite simple and complex at the same time. They wanted to understand why this new services could be interesting for them and how their use could affect them in any manner.

Only a small number of French organizations have already used these services; consequently they are not completely understood overall.

The objective of this thesis is, essentially, to answer two questions:

• “How will the future organizations will be able to decide if Infrastructure-as-a-Service and Platform-as-a-Service will be relevant for them, and if so in what will be the Cloud strategy?”

• “What is happening on a day-to-day basis for the organizations and their management?”

To answer these questions, we will divide the thesis in two parts:

(1) Understanding why organizations need decision mechanisms

The understanding is an important phase because organizations are facing something new, and like for every novelty, some basics questions are raised. Knowing the new environments will help the organizations establishing the right policies and processes. To globally understand these services, and see at the same time where organizations will need decision mechanisms, we will use an approach that is usually implemented in marketing: Marketing Mix. This approach, proposed by Jerome McCarthy in 1960, is designed to take the right decision when an organization wants to launch a new product or service. This first version is supplier-focused and has two important characteristics: it gives an overview of the complete environment for such new services like Cloud Computing and is very simple to understand, i.e. it only takes a few seconds to do so. A more customer-focused approach of Marketing Mix was recently proposed by Koichi Shimizu in 2003 (Shimizu, 2003) and 2009 (Shimizu, 2009) and called 7Cs compass model.

The seven Cs are for:

• Communication (or Promotion): a lot of communication is done by multiple actors of Cloud Computing and customers can be lost.

• Cost (or Price): Why is Cloud Computing an evolution of the way companies consume IT? What are the principles and benefits of using such a model?

• Commodity (or Product): What are the services and operational benefits of these services? Why Cloud Computing allows organization to do new things? We will see some Return on Experience from Early Adopters and that organizations will have to differentiate two scenarios: the launch of a new project and the migration of an existing application.

Page 22: Cloud Computing In France

22

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Objectives and construction of the thesis

• Consumer: What are the companies which are, or could be, interested by this model? SMEs and large organizations are not interested in every service offered by cloud providers because of the risks entailed by their adoption. We will focus on companies that may find some benefits from deploying custom applications in the Cloud. The question of the maturity will be essential.

• Corporation: The choice and definition of the strategy of Cloud Computing services will be one of the most important parts of the thesis, as it defines what is the global strategy for using such services in coherence with the organization’s strategy. It also addresses what are the applications that can be deployed in Public Cloud and what should you keep on-premises: in other words, how can organization make the right choices?

• Channel (or Place): The choice of the provider is possibly the toughest one: it could be a partner that will be responsible for some of your applications, potentially critical ones. Should a company use multiple providers? What will be the role of the provider in the new organization? What providers should be trusted for what type of customer and/or applications? Answering these questions is essential to understand the place of the most important player in this new organization.

• Circumstances: this part will allow us to conclude why and how an organization could use Cloud Computing services with all the lessons learned, regarding its environment.

Figure 9 - 7Cs compass model

This “retro-marketing” allows me to have a structured approach of what and how organizations will see the arrival of IaaS and PaaS services.

Page 23: Cloud Computing In France

23

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Objectives and construction of the thesis

(2) Impacts on the organizations

Some fundamental impacts will happen in a company that uses Cloud Computing services. This part presents these impacts on day-to-day activities and responsibilities of the IT Department and its organization. So, what will change and what could be the best practices?

To present the impacts on the organization, I will structure the reasoning 7-S model framework used by McKinsey because it is a good tool to understand how a company operates. Knowing how a company operates will help me define the impacts on each factor. I will concentrate more particularly on the Strategy, Systems and Structure parts, the “hard” elements, because they will profoundly impact the other parts.

Figure 10 - 7S of McKinsey (Pacale, et al., 1981)

The 7S are for:

• Strategy: What are the impacts on the strategy when it goes from controlling an infrastructure to controlling a process? What new strategies are possible now?

• Systems: What happen to the processes of the IT department? (ITIL, Build versus Run, contract management)

• Structure: How can the IT department be aligned with the business strategy? Does a company need a new organization? What happens to the CIO and the decision making?

• Shared values: Can an organization be still working in silos? A key element will be developed in the corporation culture

• Style: Does the managers have to behave differently?

• Staff: What happens to the actual employees? New jobs created?

• Skills: What skills does the employees need in this new model?

Page 24: Cloud Computing In France

24

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Methodology of the study

I.5. Methodology of the study

Before making the choice of the subject of this thesis, I have consulted several articles and attended some conferences where Cloud Computing was the main subject. Numerous books and reports have been published on the subject but few talk about the decision and impacts linked to the choice of Cloud Computing, and more precisely PaaS and IaaS.

Knowing that I wanted to focus on these aspects, it wasn’t easy to find valuable articles. Cloud Computing is the most discussed subject of this year and it seems that everybody has something to say about it. Gartner, Forrester or IDC provides companies with valuable information but it is not easy to differentiate the reality and the message they want to convey to sell consulting services. I needed to take factual information with data probing the message. Working for a provider, I was also able to understand better what a customer can really expect for such types of Cloud services.

In the meantime, I have interviewed experts in different fields as I gained maturity on this subject, and I also attended a number of conferences, and webinars covering the mater where I had the occasion to ask various questions:

Interviewee - Organization Position

Henry Peyret – Forrester • Principal Analyst

Lionel Pelletier – COLT • Senior Executive advisor in the consulting team “Professional Services”

• Ex CIO of PriceWaterhouseCoopers France, Sterling Software INTL and SemaSchlumberger

• Participated in the adoption of eSCM in France creating the French association aeSCM and ITIL certified

Isabelle Issert de Braux - COLT • Lawyer, Head of Legal office, France

Shirish Srivastava - HEC • Teacher on Information Systems and Techology, specialized in offshoring

Guillaume Plouin – OCTO Technology

• Director of the Cloud Computing offering (Information Systems Consulting firm)

• Author of the book “Cloud Computing et SaaS”, Dunod 2009

• Blogger of “Tendances.IT”, www.tendances.it

Béatrice Rollet - COLT • Head of Marketing of COLT Managed Services France

Page 25: Cloud Computing In France

25

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Introduction Methodology of the study

Speaker - Organization Conference Position

Christophe Baroux - Amazon Web Services

Amazon Web Services – “Paris Amazon Web Services User

Group" - 09/07/09

• Regional Sales Manager Southern Europe

Laurent Letourmy – Cafe.com

Amazon Web Services – “Paris Amazon Web Services User

Group" - 09/07/09

• CTO

Philippe Honigman - FTOPIA

Amazon Web Services – “Paris Amazon Web Services User

Group" - 09/07/09

• CEO

Fabrice de Biasio – Europe Airpost

IDC – “Infrastructure IT & Cloud Computing” – 09/24/09

• CIO

Karim Bahloul – IDC IDC – “Infrastructure IT & Cloud Computing” – 09/24/09

• Senior Consultant

Régis Mauger – BMC Software

IDC – “Infrastructure IT & Cloud Computing” – 09/24/09

• CTO

Laurent Dupuytout – AVS Consulting

IT Management Partners – “Petit Déjeuner Cloud

Computing” – 12/15/09

• CEO

Page 26: Cloud Computing In France

26

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Methodology of the study

II. Part 1 - Understanding why

organizations need decision

mechanisms

Page 27: Cloud Computing In France

27

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Methodology of the study

Before explaining why Cloud Computing is a new consumption model, it is important to explain what was Information Technology 40 years ago, what it is now and why there is a transformation. We can roughly split this history in four phases.

The first phase begins in the mid-1950s with what we call “Mainframe Computing”. Mainframes are in fact computers that were used by large companies for critical applications such as Enterprise Resource Planning or financial applications (Wikipedia, 2009). A user would login to a simple terminal, carry out his work remotely on the mainframe, and then logout. The work was saved on the mainframe and the user could resume his work later from any terminal accessing that mainframe. All the resources where centralized in large Data Centers.

This centralized architecture phase has been followed by a phase called “Personal Computing” in the mid-1970s: the Personal Computer was accessible at home. All the computing power and storage was in the local machine and not distant like it was the case for mainframes. Of course, it was possible to work anywhere with this computer but it was impossible to access to organization’s data from anywhere.

Figure 11 - IT investment in the years (Gillett, 2008)

The IT investment to GDP (i) ratio has been constantly growing since the 1950s. Each phase described is split in two parts: the first one that experienced an increase of the CAGR (ii) in IT investment to GDP ratio because of innovative technologies or models, and a second one that sees a lower or a decrease of the CAGR.

A third phase began at the beginning of the 1990s, with the coming of enterprise applications and internet, which is called “Networked computing”. During that phase were introduced key technologies and standards that will define the future models.

Since 2008, everybody speaks of a new phase that we will obviously call “Cloud Computing”. We are seeing again centralized architectures where enterprise servers, applications and data are not hosted locally but in distant Data Centers. People can once again use and access those applications and data,

Page 28: Cloud Computing In France

28

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Communication – “Everyone is talking about it”

wherever they are, using any type of devices: computers, laptops or mobile telephones. Like Scott McNealy, founder and CEO of Sun Microsystems, said in the late 1980s “the network is the computer”. In other words, all the intelligence is not anymore in the local computer.

That is not to say that nothing has changed between mainframes and cloud computing (Atos Origin, 2008). The cost is different: a mainframe belonged and was used by a single large company when a Cloud Data Center can be used by multiple companies. Cloud Computing is a shared service: companies can quickly access to cloud services without having to invest in large Data Centers to get a world class infrastructure. Failure management is also different because hardware used to crash even with redundant high quality components, whereas cloud computing is built around the possibility that servers can crash. Failure of one or more servers doesn’t stop the global service: thanks to virtualization, logical simple servers are launched dynamically and enable business continuity. Interoperability is becoming possible with web standards (TCP/IP, HTTP, SOAP, REST, etc.) when mainframes did not offer any possible interoperability. We will talk later of this subject that will be a key success factor for Cloud Computing adoption. We can add the fact that Rich Interface Applications are much more user-friendly than were green screen: an organization can easily access and manage its resources with a user-friendly tool.

II.1. Communication – “Everyone is talking about it”

The previous figure shows that the new “Cloud Computing” phase knows a new growth in IT investment. Does that mean that a lot of companies are investing or will invest in this new model? Well, Cloud Computing providers are a key success factor because they invest massively in cloud services, trying to create new offers and innovating. Every day, companies launch new services that attract media and customer attention on this subject. We see some providers or consulting firms organizing conferences, webinars and workshops, and try to give answers to the question: “how organizations can benefit from these services?” This communication has met the interest of a large number of SMEs and large organizations. The key success factors that are announced for an early adoption are:

• The economic crisis: some studies shows that due to the recession, companies needs to reduce costs and might have an interest in using Cloud Computing services (IDC, 2008). When a company loose staff and reduce budgets, there are not plenty of solutions to provide the same level of service to business units and still plan innovation. The cloud model seems to offer a cheaper way to acquire and use IT and we will explain this new economic model in the next paragraph.

• The quick wins of Cloud Computing (Linthicum, 2009). In theory, it is possible to quickly access a service and thus, end-user can also quickly use new services. This simplicity offers new ways to innovate: organizations can rapidly move from the idea to the implementation and then stop if it doesn’t work.

CIOs are very attentive to these new services and what they can provide them. CIOs have different stakes but one of their primary goals is the control of IT expenses (graphic 2). They need to reduce their budget or allocate it in a different way and this is what the global communication targets.

Page 29: Cloud Computing In France

29

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Communication – “Everyone is talking about it”

How will you budget evolve in the next six months?

Graphic 1 - Cost structure of the IT/IS department (Gruau, 2009)

French organizations will have, in their majority, a global budget that will decrease (Krawczyk, 2009). Moreover, IT is the second department in terms of budget reduction so French CIOs need to find ways to spend less money. If we look at the previous graphic, we can identify some actions that will enable a CIO to reduce his budget (renegotiate contracts, stop new projects, use hardware for a longer period, …) and for a few years, virtualization technology has been a real solution for a growing number of organizations. This technology was and still is massively presented as a good solution by the media.

First of all, virtualization allows consolidation which means that average utilization rate of the servers will be better. It also means that IT departments reduce their energy consumption because the number of servers decreases. Secondly, the time needed to install servers is substantially reduced so that there is a better use of the time by the teams. But virtualization is much more than that: it creates flexibility, a higher availability and real solutions to respond quickly to change. Approximately 50% of French companies have already adopted virtualization. But even if it can procure a good Return on Investment, the upfront payment for physical servers and the virtualization layer can be rather high. That’s why only 26% of SMEs are using virtualization when, for large companies, it represents 80% (Bahloul, 2009). Internal Clouds, created through consolidation of the Data Centre and virtualization, may be difficult to build because of the requirement in terms of investment.

External Cloud Computing uses virtualization and offers a solution for organization to access to these benefits (and more) without paying upfront, as we will discuss later in the economic model

Graphic 2 - Evolution of the IT budget (Krawczyk, 2009)

Page 30: Cloud Computing In France

30

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Communication – “Everyone is talking about it”

paragraph. Thus, Cloud Computing may be an economic response not only to solve some CIO’s issues but also to be more reactive and innovative. The evolution of the IT infrastructure offers more possibilities:

Graphic 3 - Maturity of the Infrastructure (Gruau, 2009)

This trend coincides with the evolution of the role of the CIO from a technological perspective, to a manager that delivers value to the business units. The CIO who was a technical manager and handled only administrative tasks is of a disappearing sort. Today the CIO shall be aware of the needs of the organization, whether IT is viewed as a strategic asset or not. The communication around Cloud Computing incorporates this idea that an organization needs to be more aligned with the business.

Cloud Computing could be a way to focus more on the level of services internal customers need and how quickly they will get access to it, and not how it works or what are the technical difficulties due to flexibility issues. Of course, one of the goals is to spend less money on recurrent - “Run the business” – and more on innovation – “Change the business”. Organizations currently spend 20% of their IT budget on innovation; the spending level could reach 40% in 2012 with this adoption (Gruau, 2009).

From what I have seen during the preparation of the thesis, all the companies communicating on Infrastructure-as-a-Service and Platform-as-a-Service are, in their vast majority, presenting primarily the benefits and only mentioning a few risks. It is becoming difficult to understand what are the real differences between two services, offered by two different companies, and how either set of services could be relevant for an organization. Some are using this trend to sell services which are already being used, with the word “Cloud" labeled on it. In the next parts, we will try to understand exactly what companies can expect from Cloud services and if it is possible to get the benefits presented.

Page 31: Cloud Computing In France

31

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

II.2. Cost – “Toward a new economic model”

Cloud Computing brings a new economic model that attracts different types of directors in an organization (CIOs, CFOs and CEOs). We will try to establish if it is something that may lead to Cloud Computing adoption.

With External Cloud Computing, you pay for a service. It means you pay for an ensemble of operations that you don’t have to do anymore in-house. Usually, when you run an application in-house, you need: a Data Centre, where you will have a managed infrastructure, the operating system and its monitoring, and all the people supervising the ensemble and doing the upgrades. Then, you have the application running on top with all the maintenance, and you need to deploy the system across your organization and train all the users in the organization. In other words, organizations have to pay for everything that makes the ensemble works. In this classic model, organizations need specialized resources in-house that have a lot of knowledge in different areas of IT.

Outsourcing and maintenance has been around for years in software development and companies have learned to pay for this type of service. Cloud model goes beyond by outsourcing the entire infrastructure and its management. In an Infrastructure-as-a-Service model, a customer pays for all the management of its infrastructure (there is only one invoice), letting him handle only the applicative layer, maybe his only business value (sometimes, the provider can also manage some of those specific applications). With Platform-as-a-Service, the organization pays at the same for middleware and other architectural applications. For the information, in a Software-as-a-Service model, a customer pays for the entire application: he only takes care of the deployment and the training in his organization.

Figure 12 - Customers pay for a service (Rollet, 2009)

Page 32: Cloud Computing In France

32

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

We can understand why this type of service could be easier to manage for a CIO. When Small and Medium Businesses, that do not have a high amount of IT skills in-house, only need to pay for a service, this translates in higher benefits, something we will explain later. This is one of the three business benefits underlined by Forrester (Schadler, 2008): “Focus: Outsource non-core competencies to a service provider. Using a cloud-based service provider can free up your IT staff to focus on things that drive the business: customer service application; Web site service innovation, not just another software upgrade.” The more you go down in the layers (from Saas to IaaS), the more you need non-core competencies.

We will address more precisely below the concept of Infrastructure-as-a-Service.

The second difference with a more traditional model is that it is a “pay-as-you-go” service. What it means, is that you don’t need an initial investment (CAPEX – for CAPital EXpenditure) but you only pay monthly for what you use month after month (OPEX – for OPerational EXpenditure).

When you want to use a new application, the first thing you do is try to scale the infrastructure up to the predicted demand (whether it is a business application that you sell to a customer or an application that is for internal use).

With a traditional infrastructure, you need to do an analysis and which shall be very precise: if you don’t have enough resources, your customers (business directions or customers) won’t be able to use the service, whereas, if you over-provision, you will spend a lot of money on hardware you won’t need. Very often, the solution is that you foresee the infrastructure you will need in a few months, hoping that you made a good estimation and that you will have time then to scale it up if needed.

With an elastic infrastructure, you don’t need to predict the demand: you just scale up or down every time you need to do so, which means that you pay for your actual use instead of provisionning for peak.

Figure 13 - The infrastructure follows the actual demand

Page 33: Cloud Computing In France

33

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

We can see the 4 decisive steps on figure 2. The first step (1) shows that with elastic infrastructure, the CAPEX disappears: you use a service, you don’t make an investment. This is the second benefits that underline Forrester: “Funding: Pay as you go rather than spend upfront. Instead of paying upfront for hardware, software, and consultants to set up and run your [service], you pay a [service provider as you go]. This lowers the cost of launching new IT projects, which speeds innovation and increases the number of projects that can be funded.” The main idea behind this is that it is easier to speak with a CFO when he won’t have to make a huge investment and that he can quickly stop the service in case of failure.

The second step (2) shows that when you have a growth in your activity, you must follow the predicted demand if you have a traditional infrastructure. If it was a temporary increase (example : before a crisis), you may have just made a re-investment for no practical purpose. As we saw before, with an elastic infrastructure, it is still possible to scale your infrastructure down (3).

The fourth step (4) is a more threatening one: you lose customers or you don’t answer to business needs because you didn’t rescale your infrastructure.

This scalability, created by Cloud Computing, offers significant financial benefits and reduces the risks. Before Cloud Computing was available, the financial risk was taken upfront with no guarantee on the return; now, financial risk is taken monthly and matches the return. Forrester’s third benefit is more focused on delivery: ”Speed: Accelerate a project rollout. In one project, a financial services company moved its employee portal to a cloud-based service provider and launched it in 60 days. After 18 months, another firm is still building the employee portal in the corporate data center. The difference? The cloud-based solution started with a prebuilt foundation.”

II.2.a. A complicated comparison

This difference between two models doesn’t really reflect the reality, as companies do not have only two choices (in-house or cloud) but more. For several years, companies have already been using different types of offers to manage their infrastructure. Between on-premise installation and Cloud Computing, you can identify two more types:

• Colocation services: a company can put its own infrastructure in a provider’s datacenter that authorizes colocation hosting. The company pays for the physical space, a basic supervision and/or limited activities like backup but still have physical access to the hardware for the management with its own employees. The benefit is that the company gets access to a business class services without actually paying the expensive bandwidth and infrastructure costs of developing its own datacenter.

• Traditional outsourcing (managed services): these IT providers offer defined set of services to their clients: they monitor their client's IT infrastructure (shared or dedicated) and basic applications and resolve any issues that arise within it. The main benefit for a customer is that costs are known for management (provider’s employees manage the infrastructure) with fixed price contracts. These providers may offer leasing solution, thus proposing a service for which a customer doesn’t have to pay upfront all the hardware.

Page 34: Cloud Computing In France

34

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

Colocation services offer an economy of scale by sharing a Data Center, whereas traditional outsourcing offers an economy of skill by outsourcing the management of client’s platforms. Cloud Computing combines best of both solutions, as shown in the following matrix:

Figure 14 - Economies of scale and skill drive cloud computing (Schadler, 2008)

Considering these different solutions, some questions are raised: does a customer pay less when he chooses a Cloud Computing service? Can he make a real Return On Investment (ROI)?

A first answer was given in a study called “Above the Clouds: A Berkeley view of Cloud Computing” (Armbrust, et al., 2009) which propose an equation comparing a Cloud Computing solution to a fixed-capacity Data Center solution (hypothesis: customer’s revenue is proportional to the total number of users-hours):

The left-hand side represents the Cloud Computing model (a usage-based pricing, by the hour): it multiplies the number of users-hours by the net revenue realized per user-hour minus the cost of paying Cloud Computing per user-hour. The right-hand side performs the same calculation for a fixed-capacity datacenter by factoring in the average utilization including so nonpeak workloads (it corresponds to the three other types: colocation, on-premise and traditional outsourcing). The usable capacity of a datacenter is between 0.6 and 0.8, and it always needs overprovisioning when a cloud vendor factor it in ��������. The study says that “whichever side is greater represents the opportunity for higher profit”.

This equation, rather simple, doesn’t really reflect the complexity of the question “Should I move to the cloud?” It shows that, with the average utilization rate being lower than 1.0, the cost of your infrastructure deployed in the cloud should be less.

��� �������� � �������� � ��������� � ��� ������������� � �������� � ���������������. �� �!"����#

Page 35: Cloud Computing In France

35

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

II.2.b. Comparison

Chris Fleck, conference speaker on Cloud Computing, compared the reality of infrastructure cost of different solutions (Fleck, 2008):

Purchase – on Premise Purchase – at Colo Amazon Cloud

Type Price ($) Type Price ($) 1 year 24/7 - 100%

1 year 24/7 - 24% use

1 month – 24% use

• 5 Quad-Core Servers (5x3,000 each)

• 1/2 Rack + Gigabit Switch

• 15,000

• 750

• Quad-Core Servers (5x3,000 each)

• 1/2 Rack + Gigabit Switch

• 15,000

• 750

24x365x5 Amazon EC2 ($.80 per high CPU Server instance hour)

40 hours x 52 weeks

40 hours x 4.3 weeks

Total Hardware cost

15,750 Total Hardware cost

15,750

• Annual amortized cost, 5% over 3 years

• Assuming no incremental real estate cost

• Annual power & AC cost

• 5,800

• 0

• 2,000

• Annual amortized cost

• Colo fee's; 1/2 Rack + power + bandwidth

• 5,800

• 8,000

Total annual cost on premise

7,800 Total annual cost at Colo

13,800 35,040 8,320 688

Table 1 – Comparing costs

One may think that the use of Amazon Cloud Services is quite expensive. But it misses an important cost for the first two types: the management cost of the servers. I believe that calculating the ROI of an application will be very difficult because the management for the different types of the service is not the same:

• On premises, you may not have employees monitoring the servers during the night, the weekend or during holydays;

• At colocation, the servers only have a basic supervision, so employees may have to go to the facilities to handle a problem; and

• With a Cloud solution, your servers are fully managed and you have inherent redundancy. But, you must also have employees that regularly monitor and manage your cloud servers.

It must be emphasized that it is rather difficult to compare these costs, not only because the service provided is not the same, but the underlying risks are also very different. A realistic comparison must take into account:

Page 36: Cloud Computing In France

36

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

• The cost of the infrastructure: hardware and all infrastructure elements;

• The cost of the software: licenses, trainings, new tools;

• The cost of all the employees that are working on these infrastructures and applications: from operation to monitoring, and from design to quality management, etc.;

• The cost of risk: what are the potential risks and cost associated (risk to do / risk to not do)?;

• The type of project: is it a new project, is it a migration? How will it work with the existing infrastructure;

• The model of billing.

Any Return on Investment that does not integrate those parameters will be biased.

In any case, if an organization has a temporary increased activity, the only solution, where an organization do not have to pay for a definitive additional server, is IaaS.

From another perspective, a customer must try to plan the number of servers that will be used during the year even if it is difficult because of the new economic model itself: “You pay for what you use” and do not forecast.

Chris Fleck has selected the provider Amazon Web Services (Elastic Compute Cloud – EC2) for his comparison, and obviously the result would have been different with any other provider. Depending on the provider, you may have to pay more for the storage, or the bandwidth (data in / data out). Also the Quality of Service is not the same: every one of the providers has specificities so that it becomes difficult to make a quick comparison to determine whether you will pay more - or less - at the end with any of the solutions being offered (on-premise, colocation, managed services, all cloud providers, …), except if you realize a real case-study on a specific application.

This complexity in the offers shows that it goes beyond a simple calculation and there are a number of hidden costs in Cloud Computing: for migration, monitoring, having new tools to manage the new virtualized environment (with trainings), growth of costs over time, etc.

But when a company wants to grow its IT infrastructure from zero, it has 2 options:

• Build it on-premise and own or lease the equipment; or

• Outsource the infrastructure (colocation, managed services, cloud services).

Karim Bahloul, senior consultant for IDC, talks about the new issue regarding infrastructure management.

“With virtualization [and Infrastructure as a Service], it is easier to access to new servers. But

when you can quickly add new servers, the lifecycle may easily be not respected. You may pay for more servers than what you really need (and the licenses that you may use on these servers) and if there isn’t a real management with more automation tools, the price that companies pay may

be difficult to predict. The pay-as-you-go model can create some surprises.”

Page 37: Cloud Computing In France

37

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

New SMEs will find it difficult to build an IT infrastructure on-premise and, an up-front for a colocation/managed services approach comes with a heavy burden in the current economic environment. Even if the company can secure the necessary credit, the cost of the loan makes it much more expensive over three years. SMEs will prefer to pay for resources they really use, and not put up with the inherent complexity of the management of the infrastructure.

Existing companies that already have a complex IT infrastructure may have more hesitations if they only look at the financial Return on Investment. But, as mentioned before, Forrester presents other financial advantages for the CFO (Schadler, 2008) such as: “the balance sheet doesn’t carry an ever-depreciating capital asset of hardware and software” or “financial risk is taken monthly and is matched to return”.

Companies will have more benefits if their activities are seasonal (meaning that, very often, a company needs more resources because of a temporary growth in the activity, for example during promotion periods) or if they have an average utilization rate of their servers that is low. But what happens if it is not the case? Even Amazon Web Services is beginning to offer services for a flat monthly fee as opposed to a utility billing basis.

The fact that you may pay less with Cloud Computing services (ROI) is only one factor which has to be weighed against all other benefits: pay-as-you-go (which also means stop-when-you-want), begin simple and get flexibility. We will see the other benefits in the next part.

II.2.c. Platform-as-a-Service

Some recent case studies show that Platform-as-a-Service may offer more savings and a better Return on Investment than IaaS, under precise circumstances. In particular, staff-related savings could be important during the application development period if an organization develops a new application/system. This white paper, published by IDC (Perry, et al., 2009) details the costs of application development for companies that uses traditional application development and companies that uses SalesForce’s Force.com (a PaaS service). At every step of the application development (design, model, coding, configure, assembly and integration, unit and system testing and deployment), the 10 companies considered realized substantial benefits, thus decreasing the overall application development cost savings by 76%.

Laurent Letourmy, CTO of the French company Cafe.com, uses Amazon Web Services to host the Facebook game called “IsCool” (5.5 million users) on 40 servers.

“I do not have a Data Center and certainly do not have employees that could manage the servers.

I had 2 solutions: use Cloud Computing services or Managed Services. I choose Amazon Web Services because of its flexibility and the hardware abstraction: I can easily add or decrease the

number of servers. But the monthly price would have been nearly the same…”

Page 38: Cloud Computing In France

38

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

When dealing with the costs of Cloud Computing, we understand that these are different depending on the scenarios:

• Is it a new project? o The development of this application might cost less using PaaS services because

some tools are already integrated, making it easier to test, develop, deploy, etc. Staff costs regarding the creation of a new application from the design to the deployment

Laurent Dupuytout, CEO of the French consulting firm AVS Consulting, expert in Cloud Computing solutions and realized integrations on PaaS platforms.

“A tender was done early this summer by a French group with international dimension. The goal was to create a specific application to strengthen the IT governance process:

- Have the possibility to link each IT applications to one of the 20 countries where the organization is located, link it to a domain or a function, and map it in the Information System. Describe what are the areas of intervention, the subdomain, the providers who manage the applications, the costs of maintenance, the criticality and the number of users, and compare the results with those obtained in other countries. Being able to link projects and make them evolve. Validate that the projects are consistent with the business strategy. Compare the projects with the trends and other projects, etc. - Creation of good ergonomics for users and administrators (i.e. user-friendly).

Ei Technologies responded to this tender with two solutions from its subsidiaries:

- AVS Consulting, with Salesforce’s Force.com PaaS service: - Technologies: Force.com technologies (configurable data model, configurable user interface, workflow models, models of reporting, do specific developments and integration); - Implementation duration (consulting, analysis, integration): 1.5 months, 81 man days.

- 1Genia, with a traditional solution: - Technologies: J2EE development, BIRT Java reporting tool framework, Linux OS, Tomcat servers, any DB; - Implementation duration (consulting, analysis, integration): 4 months, 230 man days.

For the Total Cost of Ownership, the results where the following:

- Less than 3 years: advantage for the PaaS solution because the licenses are paid on a subscription basis, and therefore there is no significant CAPEX, whereas the second solution needs 230 man days to start; - More than 3 years: balance between the two solutions (if we do not take into account the ease of scalability).

An integrator will necessarily be more attracted by the second solution (occupation of the teams) but, of course, the first solution was chosen.”

Page 39: Cloud Computing In France

39

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Cost – “Toward a new economic model”

of the project are reduced because it is designed to work in the environment. We can imagine that the experience curve effects might play a big role in reducing the costs after the trainings. Development/Test, using IaaS services, has a main impact: the resources needed for these steps are paid for a short period of time.

o Does the management of the infrastructure and platforms underlying the applications will cost less on this environment (activity peaks, etc.)?

o Does the addition of new features will be simpler and, thus, less expensive?

• Is it an existing application that we want to migrate in the Cloud? o What is the cost of the migration? Migration to PaaS services indicates major

developments because there are specific frameworks whereas the use of IaaS will less impact the application.

o Will the application benefit from the new economics?

Figure 15 - Costs: New Project vs Existing Application; PaaS vs IaaS vs Internal IT

The main idea behind this new economic model is that companies can now consume IT infrastructure more like a utility service, gaining new advantages. It doesn’t mean that everything is better with this solution, and companies must create case studies and benchmark all the solutions before using these types of services whether they are SMEs or large organizations.

Page 40: Cloud Computing In France

40

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

II.3. Commodity/Product – “What are these

services? Operational benefits and new usages”

We have seen that the new economic model, offering “pay-as-you-go” solutions, may provide financial benefits for some organizations. We will develop below what are those services, and more precisely what are the operational benefits that organizations can expect.

II.3.a. Benefits for the infrastructure

As we mentioned already, External Cloud Computing may offer access to a massively redundant infrastructure and this, from the time of first payment. An organization that does not have sufficient financial or human resources and, moreover, has not yet installed the processes to manage such an infrastructure will be able to access a better and clearer uptime and availability - for example: Amazon EC2 offers a 99.95% uptime (Amazon Web Services, 2009). That organization will also be able to obtain different services, such as prebuilt foundation, provisioning or upgrades, and also have access to a 24/7 customer support providing an immediate response to emergency situations. Obviously, the latter is very difficult to create, either in SMEs or large enterprises. Depending on the SLA needed for an application, the organization will have to choose whether Cloud services are suitable or not.

The fact that companies do not own the infrastructure offers other benefits, such as space for additional servers or the management of electricity and air-conditioning. Virtually, they can access an infinite amount of resources.

I will present more extensively the three major benefits with a Return on Experience from various organizations.

Figure 16 - 3 major benefits for the organization on an operational level

Page 41: Cloud Computing In France

41

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

Stop planning and doing tasks that does not create value with “Storage-as-a-

Service”

The best example for this is storage and archiving which, as Infrastructure services, can now be also consumed with a “pay-as-you-go-model”. In a study carried out by Forrester on the growth of data volume (Yuhanna, 2007), the 150 senior IT executives being surveyed worldwide indicated that:

• The volume of enterprise data is growing at 50% per annum, driven by a new-generation of applications;

• There is a strong demand to retain data for business analytics, and trend analysis; and

• Data retention for legal requirements had increased (Winter, 2008).

This growth is causing serious performance and storage challenges. With 85% of the data production comprised of inactive records, and 64% of the respondents saying that their enterprises have over half of their databases residing on tier one storage solutions (iii), the costs of holding inactive data in an environment are significant and unnecessary. A storage solution in the cloud could offer a way for organizations to store non-critical data. Here also, companies get a clear SLA that they can match with different types of use (legal archiving, data accessed on a more frequent basis, etc.). They don’t need to order, and wait for, hardware storage to be accessible: the thin provisioning can be done easily with cloud storage solutions and the installation and configuration tasks are now done by the provider.

We do not find many organizations that publicly acknowledge that they use cloud services, but some case studies of internet-based companies have been released. For example, 37Signals, a company that is a developer and provider of business and personal productivity web applications, hosts its data on Amazon Simple Storage Service (Amazon Web Services, 2009). More than for the cost reduction entailed by the service, 37Signals has been attracted by such a service because of its ability to deliver on a complicated task: “the […] time associated with maintaining a 1 terabyte file server with full backups and zero downtime are significant when you’re living off managed hosting”. This organization was facing the challenge of managing a booming issue, and storage-as-a-service allowed them not to focus on non-core activities: “[…] turning up our storage offerings no longer involves planning how to extend our cluster or deal with huge backups”.

Get access to enterprise class services with Infrastructure-as-a-Service

SMEs do not always have the resources to pay for an infrastructure that offer security, higher availability and 24/7 management capability. One of the operational benefits of Cloud Computing is to enable SMEs to obtain a higher level of operations service than the one they could normally afford.

A French B2B company called Ftopia offers a secured and easy way to share documents on the web between professionals. It offers an alternative to documents shared by mail or accessible by FTP, that users may not find user-friendly. That company has already one hundred customers, including HEC that uses the service to host the documents of students that create companies in the “Incubateur HEC”.

Page 42: Cloud Computing In France

42

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

Speed development with Platform-as-a-Service

IDC identified the operational benefits of the use of a PaaS solution on 10 companies - SE, medium and large companies - in the world, compared to traditional in-house developments (Perry, et al., 2009). The result of their study showed three key operational benefits:

Benefits Details

Faster to market Custom applications developed and deployed in 76% less time and required 76 to 85% fewer developers hours

Higher quality Reduced Annual Downtime by 97% and 60% less time dealing with the service desk

Accelerated pace of innovation

Tripled their output of custom applications and doubled annual enhancements from 1 to 2

Table 2 - Three key operational benefits of a PaaS solution

Key operational benefits are truly those which organizations are searching for, along with a new economic model. With Platform-as-a-Service, developers from small, medium or large organizations have an easier access to the services they really need, and their productivity is enhanced because all areas of modeling, development, deployment or integration are already integrated. They don’t have to focus on infrastructures and software, since those are managed by the service provider. No longer does the IT personnel need to worry about keeping software up to date: this management is automated. The essential goal for organizations is to become more reactive by delivering an innovative application quickly (for example, before a peak season), something which will contribute to a high customer satisfaction (gain new customers, reduce churn, etc.). I would have liked to see a study comparing multiple platforms, other than one tested (Salesforce’s Force.com) because these types of service are really new and we don’t see a lot of Return on Experience.

Philippe Honigman, CEO of the French company FTOPIA.

“I needed a secure infrastructure to host this service. We do not own the infrastructure: the servers are in Ireland and managed by Amazon Web Services. Without such a service, it would have been difficult to find resources to manage the infrastructure and offer a service suited for

companies. We let a professional operate on the infrastructure.”

Page 43: Cloud Computing In France

43

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

II.3.b. New usages

Cloud Computing offer the possibility to do things that organizations would not do usually, or enable the user to do things in a more efficient or easy way. In a word, these services enable them to do new things with IT.

Temporal needs

The most well-publicized new use of Cloud Computing is the one done from The New York Times. As Nicholas Carr says, “What does the cloud allow us to do that we couldn't do before?” (Carr, 2008). The New York Times wanted to offer a website presenting all its archives. After scanning all newspapers (11 million articles) in a format not suitable for online viewing and articles cut in multiple documents, the NYT decided to translate four Terabytes of documents in a PDF format. After uploading their documents on Amazon, they simply paid for 100 virtual servers for 24 hours to convert them in this new format. What would have been impossible to do in-house (use several NYT servers for a long period of time, or pay for servers they won’t need after their initiation use), is now possible. In this case, an organization decided to create a temporary architecture to make a calculation (like we can see with Grid Computing), a usage now accessible for any company.

Self-service for a punctual utilization

A more impressive use comes from a European company, The Server Labs, which was contracted out by a client, the European Space Agency, which needed to carry out a set of calculation during two weeks every six months, for a science project called Gaia. That project is a global space astrometry mission with a goal of making the largest, most precise three-dimensional map of our Galaxy by surveying more than one billion stars (Amazon Web Services, 2009). What that client is looking for is essentially data processing. The fact that the clients don’t intend to use the servers all the time makes them good candidates for Cloud Computing: when they need servers, they pay for it, and they stop using them at the end of the calculation. The above-mentioned client was able to benefit from the new economic model that transformed a 1.5 million euros in-house project (cost of servers during several years to get the result in the same amount of time, management, electricity, etc.) in a 343.000 euros cloud project spent “as-you-go”. Also, a characteristic of the cloud made the situation possible: the self-service aspect.

Page 44: Cloud Computing In France

44

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

Table 3 - Using Cloud Services offers a way to pay for an infrastructure only when the organization needs to make a calculation

Quickly access the service to support an impressive growth

French companies have been created around such new possibilities. Below is a study case from Laurent Letourmy, CTO of the French company Cafe.com that was presented in July 2009. This company created a game on Facebook called IsCool where the goal is to give points to friends that are cool. The one that has the most points is the coolest person on Facebook. Behind this simple game, hides the most played game of Facebook in France and in the Top 10 in the world. Already, 5.5 million persons have played this game once in 229 countries in the world. What is impressive is that the number of active users went from 1 to more than 800 000 every day in 8 months.

Table 4 - IsCool has been able to repond to an impressive growth

To understand better, if it was a website, IsCool would be the 25th most-viewed website in France and the 2nd most played game website. The website faces a number of challenges, very similar to those faced other organizations such as banks: an activity peak of 160 pages seen/sec, translating into 10 000 transactions every second! The business model is also simple: online advertising and selling of IsCool images.

0

50

100

150

200

250

300

350

0 10,5 20,5 30,5 40,5 50,5 60,5 70,5

Num

ber o

f ser

vers

Months

Number of servers over the next 6 years

In-house Cloud

0

250000

500000

750000

1000000

0 1 2 3 4 5 6 7 8

Mois

An impressive growth

Number ofunique userseveryday

Page 45: Cloud Computing In France

45

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

Like the New York Times, IsCool uses the Amazon Web Services to host its platform. IsCool went from a few virtual servers at first, adding 10 other servers after a few months, to approximately 40 servers in order to serve efficiently a million users. The global service only stopped for around 20 minutes to transfer data on these new servers.

Cafe.com was able to absorb the peak without having to plan a long time ahead: this is something new for an infrastructure. Admittedly, many companies would like to take advantage of this, and that is precisely what they expect when told about the potential benefits of Cloud Computing.

“Disaster Recovery Plan… as a Service”

We will see plenty of new usages around this new model under where you pay only when you really need to use the resources. Another usage is the possibility to create “in the cloud” a backup site on which will be hosted all the virtual servers. What is new here is that organizations that did not have the financial resources to pay for backup Data Center (creating at the same time a Disaster Recovery Plan or a Business Continuity Plan) can now have access to a second Data Center for which they will pay only in case of an incident happening on their primary site. Numerous French and European providers already offer this type of services (Frascaria, 2009).

Laurent Letourmy, CTO of the French company Cafe.com, uses Amazon Web Services to host the Facebook game called “IsCool” (5.5 million users) on 40 servers.

“This growth would not have been possible if we had hosted the servers in-house or through

classic managed services providers that do not offer such reactivity. There is a very long process around hardware provisioning: purchase, negotiate, deliver, install, renew. In our case, we no

longer need to forecast or anticipate equipment orders and have virtual access to infinite resources: the infrastructure, the network or the storage can be very easily scaled up and down. Rapidity is a key element in the service but the largest benefit is flexibility, which is also good for

the team. An infrastructure that does not change frequently is a dangerous infrastructure. Our project is now to officially launch IsCool in the United States and if we have the same

success, we could face two million unique visitors every day.”

Page 46: Cloud Computing In France

46

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

Graphic 4 - A few examples of new uses with Cloud Computing

Those few examples help to understand what French companies may find in Cloud Computing services, and what they can expect. The common point for those companies is that Cloud Computing can be used for new projects within the IT department or the organization; thus, there is no actual migration of existing applications. It is relatively easy to launch such projects because of this new economic model that does not oblige an organization to invest in the acquisition of hardware from the very beginning. SMEs, as well as large organizations could be interested in this.

II.3.c. Internal/Private Cloud Computing

Companies that want to benefit from this new model without outsourcing their infrastructure can create what everyone calls now a “Private Cloud” (Babcock, 2009): recreate the services inside the organization. But what is exactly Internal Cloud Computing and is it financially and operationally interesting? Who will use this type of services and why? The goal of this paragraph is to understand if private cloud can be more relevant than Public Cloud Computing and, at the same times, help us understand better what choices organization will have to make.

Basically, Private Cloud Computing (meaning internal Cloud Computing) is simply a new layer of new technologies that organizations add over their existing infrastructure like virtualization, self-service portals or chargeback systems.

What are the differences between Private and Public Cloud Computing?

If we look at the different notions underlying Cloud Computing, we can see that there are real differences between Public and Private Cloud:

Page 47: Cloud Computing In France

47

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

Factors Public Cloud Private Cloud

Resource pool Thousands of homogeneous servers used by a large number of customers

Hundreds of heterogeneous servers from the internal departments

Service management

Done by the provider with tools created to manage a large number of computers (the headcount for 1000 servers is optimized) on a 24/7 basis

Done by the IT Department (or outsourced with external human

resources) but less optimized

Pay-as-you-go Enabled (pay-per-use without any

upfront fixed costs, except migration costs)

Upfront costs to acquire the hardware (or leasing)

Chargeback Inherent chargeback tools provided

with the service Chargeback can be configured with

the right tools

Scope of licenses

Variety of software choices (operating systems, application servers,

databases, middleware components, …) with negotiated prices

Limited heterogeneity because of the smaller scale of the operations

Operational efficiency

Large amount of servers with highly automated operational management

tools

Cannot compete with the investments made by a provider in

automating the process

Flexibility / Scalability

Benefits for the customer who can have potentially access to a massive

number of servers and resources very quickly

More flexibility and quick provisioning but does not offer the

same level of flexibility as the resources are, in fact, limited

Service Level guarantees

SLAs can be defined. No framework guaranteeing SLA in a

private environment

R&D investment Core business of the service provider Investment is limited as it is constrained by the IT budget

Human resources Best in the industry (power architect, cooling architect, systems architect)

Existing data center personnel that has to be trained

We can conclude from the above that Private Cloud Computing is not a revolution in IT but simply the convergence of all the technical trends.

Some examples of Private Clouds

Europe Airpost is one of the first French companies that created a private Cloud using VMWare for the virtualization layer in 2008. The private cloud was presented with VMWare at a conference in September 2009.

Fabrice de Biasio, CIO of the French airline company Europe Airpost.

“Europe Airpost is unique in Europe because the company works day and night. During the day, we have en activity of passenger transport and during the night, we have an activity of freight (Quick-change). Our activity is important 24/7 and thus virtualization offered us a way to use more efficiently our servers by consolidating the infrastructure. With a Private Cloud, we have

been able to create more easily a Business Continuity Plan.”

Page 48: Cloud Computing In France

48

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

As we have seen with the previous comparison, a Private Cloud offers more than the usage that was made of it by Europe Airpost. A case study from Robert Lemos (Lemos, 2009) shows what a travel booking firm gained by creating its Private Cloud using VMWare and BMC’s BladeLogic software tools to manage its virtualized data center in 2007. Before using a private cloud, the organization had some issues that impacted the business in some way. The SaaS software that was updated very often contained bugs and configuration issues that had to be corrected on each physical server. Also, when the demand increased for its SaaS service, it had to deliver, install and configure very quickly new servers.

Creating a private cloud (meaning, virtualizing the data center and using tools to automate all the processes) helped the organization eliminating errors due to update deployment to application (incidents caused by configuration mistakes dropped by 90%) and deploying more quickly new servers in case of activity peaks. The company has saved 1.15 million euros since 2007, including staff savings, by reallocating resources to other areas of the business. If it simplified the infrastructure, the Private Cloud also added challenges: “develop and implement best practices” around the virtual environment and all the toolsets, and a greater capacity to manage the “on-demand capacity” that can be delivered very quickly.

I think this technology (we can cannot speak here of new economic model) is the normal evolution of IT infrastructure. Private Cloud Computing promotes all these new technologies and enables organizations to make a first step on a service approach.

Reality of the Private Cloud

A Private Cloud also enables consolidation of resources, and thus a better consumption of resources (think Green IT); but it can also be quite expensive to establish and operate. With a Public IaaS, you pay for a number of virtualized servers whereas, with Private Cloud Computing, you have to pay for physical servers, the virtualization software/maintenance and the installation and configuration of the hypervisor. Some constructors are offering “black boxes” containing all these parts together, such as IBM CloudBurst, but you must either pay upfront (140 000€ for the simplest one) or lease it

Henry Peyret, Principal Analyst at Forrester, is working on Enterprise Architecture.

“Private Cloud Computing is not Cloud Computing: there is no debate. Private Cloud only tries to recreate in-house some benefits of the Cloud using the same technologies like virtualization. The

problem is that only large companies will be able to create a Private Cloud that may offer the same service level, whereas Cloud Computing is accessible to companies of any size.”

Page 49: Cloud Computing In France

49

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

(4000€ a month for 36 months) which either way is a commitment. Thus, the Return On investment must be carefully calculated.

So, why would companies create a Private and not use Public Cloud Services? We will see in the second part that the decision for an organization to put an application “in the cloud” shall take into account some security, privacy, compliance and other legal issues and not only be considered based on the technical feasibility, the maturity or the price.

The Private Cloud is also presented as a first step for organization by all the vendors, like VMWare, that promote a solution where organizations start using a Private Cloud and then will access Public resources when needed.

Figure 17 - Linking a Private Cloud to a Public Cloud could be easy with the right technology (Cavalliere, 2009)

The resultant solution is by definition a hybrid cloud that use resources from different clouds. And that’s the reason why we are talking about Private Cloud Computing in this thesis because the solution is not “everything in the cloud” neither “nothing in the cloud” as we will see later.

The creation of such a Private Cloud can be difficult to implement as SMEs may not have the financial resources to invest in an all-inclusive box, which is also the case for large companies that need to virtualize big parts of the existing infrastructure. Forrester indicates that the benefits are more important for large companies because of the economics of scale, and the adoption of scalable and standardized infrastructures (Ried, et al., 2009): “the economically required volumes can only be achieved if the private cloud is available across all organizational units and for various kinds of enterprise applications.” Forrester concludes by saying: “If [we] consider only the technological infrastructure, the new private cloud paradigm is nothing more than the next generation and evolution of adaptive and elastic infrastructure concepts.”

This subpart ends with the following figure presenting a global view of the detailed services to sum up what the organizations will be paying for when they will use them.

Page 50: Cloud Computing In France

50

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Commodity/Product – “What are these services? Operational benefits and new usages”

Figure 18 - A better understanding of Cloud services

Page 51: Cloud Computing In France

51

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

II.4. Consumer – “What companies are or could be

interested in this new model?”

The Consumer part addresses the expectations of the organizations regarding these new services. A company facing this innovative trend has to consider if the services are answering some needs, respecting security and policies, and if this company is mature enough to use them. Throughout this part, we will see emerging the points of attention, that will define whether this model will be suitable or not, and the decision mechanisms if a company chooses to use Cloud services.

II.4.b. Will SMEs use IaaS and PaaS services?

Our first hypothesis was that, because SMEs used heavily SaaS services, they could be the enterprise using first Infrastructure services. As we can see in Figure 19, SaaS offers more business value than IaaS and PaaS (subjects discussed in the thesis): business processes are addressed and not the technical infrastructure.

Figure 19 - Navigation in the Cloud (Ried, et al., 2009)

It is easier for SMEs to buy business applications rather than just a basic infrastructure on which they would have to deploy a specific application (and they usually use less customized applications). A report from Forrester confirms that the first hypothesis is wrong: large companies will use more infrastructure services than SMEs (Ried, et al., 2009): 62% of enterprises of more than 1 000 employees consider that IaaS may be a priority for 2009 (15% as critical, 21% as high priority, 26% as low priority) when it represents 43% for SMEs (9% as critical, 15% as high priority, 19% as low priority). Even if this report covers organizations in Europe and other continents, the numbers are quite important and we understand that this is true for French organizations.

Page 52: Cloud Computing In France

52

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Does that mean that all SMEs will use only SaaS and all large companies will prefer PaaS and IaaS? To answer this question, we can ask another question: do large companies only use custom application and, vice versa, does SMEs only use off-the-shelf applications? Obviously, the answer is negative because every organization needs to develop custom applications (using PaaS or IaaS) that will create competitive advantages and will buy “off-the-shelf” applications when there is no added-value expected. This represents the strategy of an organization which considers that there is a need to spend money on services that would help differentiating that organization from another.

II.4.c. Concerns regarding Cloud Computing for

companies

Cloud Computing is a new model and we can understand why companies may find an interest in such a disruptive model, as we mentioned previously. Asking the question of the suitability of the services

Béatrice Rollet, Head Marketing for COLT Managed Services France, a European provider

“French SMEs are stakeholders of the large organization’s ecosystem. They have very often the same needs that these large organizations have regarding: IT industrialization, collaboration, traceability, etc. But SMEs will tend to favor more pragmatic solutions, simple to deploy, and

providing a quick Return on Investment.

Yet, Information Technologies are sometimes a strategic lever for differentiation for SMEs to play against large organizations. These SMEs will be the quickest one to adopt IaaS and PaaS

solutions.

We can still observe that small enterprises, those that do not have a CIO, have a purchasing behavior quite close to the behavior of an individual. Therefore, only technophile CEOs will

make the choice to use IaaS and PaaS offerings. SaaS solutions will certainly be preferred by this type of organizations.”

Henry Peyret, Principal Analyst at Forrester, is working on Enterprise Architecture.

“Cloud Computing adoption will be easier for SMEs because they do not always have the human skills in-house, cannot hire resources that have a deep knowledge, maintain the applications and

infrastructure, and their business can grow very quickly. But this adoption will happen at the SaaS level where they can still make use of some settings like Salesforce. PaaS and IaaS services won’t be much used by SMEs that will prefer “on-the-shelf” applications that are based on best

practices. Those services will be preferred by the large companies.”

Page 53: Cloud Computing In France

53

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

for the organization raises the questions of the potential areas of concerns. Some companies may prefer to continue using internal resources (with a Private Cloud), or continue to rely on existing resources, instead of entering into “the public cloud”. We will refer below to the concerns that have been expressed in France on Cloud Computing, assess the likelihood that these concerns could materialize and examine what impact they may have on the companies.

But first, it is interesting to analyze the concerns expressed by French CIOs. Five major concerns are on their minds: (Markess International, 2009): data privacy (31%), business continuity (28%), quality of service (28%), network issues (23%) and provider lock-in (20%). The other concerns were, in descending order: identity and access management, interoperability, network dependency, sustainability of the model, backup and data recovery and data location.

The list of concerns above is not based on experience but rather on the perception of French CIOs of what could be the relevant issues. The concerns are mainly related to the fact that an external entity will have its hands on the data and application of their organizations. Thus, they formulate a number of questions, as follows: are the data safe? Will there be a reliable service that resolves business continuity issues? Can I stop using the service easily? Those are the most common concerns when we are talking about outsourcing.

Forrester recently published a checklist of all Cloud Computing issues that pretty much covers all those CIO’s fears (Wang, et al., 2009) and help classifying those fears in three categories: Security and privacy, Compliance and Other legal and contractual issues. We selected below those fears that are relevant to Platform-as-a-Service and Infrastructure-as-a-Service and added the Maturity of the model’s concern.

Area Topics Detailed issues

Security and Privacy

Data segregation and protection

No separation of data from other customers, data-at-rest protection, data-in-motion protection, data leak prevention, third party access to data (subcontractors), no destruction of the data at the end of the service

Vulnerability management

Evidence of such a program, no external assessment

Identity management Can directly integrate with customers’ directories, no Single Sign On

Physical and personnel security

Access to critical assets, no background checks for all relevant personnel, no employee access document to customer data, no SAS 70 audit

Availability Low SLAs, no DDos protection, not enough capacity during peak load, no plan for upgrades or patches

Application security No third party components testing

Incident response No procedure for handling a data breaching (notifications), response procedures violate customer’s own incident response requirements

Privacy Critical data is not properly masked, data collected about the customer (logs), data storage, third parties might have access to customer’s critical data (such as

Page 54: Cloud Computing In France

54

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

government agencies) Compliance Business continuity and

disaster recovery BC and DR not as robust as those of the customer

Logs and audit trail Cannot accommodate timely forensic investigation (eDiscovery), logs and audit trails for customer’s regulatory compliance are not kept or no dedicated storage to store those are available

Specific requirements (e.g., PCI, EU privacy, Basel II)

Local compliance requirements violate those of the customer, not ISO 27001, SAS 70, CPI or Basel II compliant

Other legal and

contractual issues

Liability No recourse actions in the event of a security incident or failure to meet SLAs (financial compensation)

Intellectual property Data or applications (including replicated and redundant data) are owned by the provider; rights to information by the provider

End of service support No specification on what happens at the end of the service period (data delivered back to the customer: when, how; data destruction: when, how), fees accruing at the end of the service

Auditing agreement Provider does not accept any audit

Personal data Location of the data Maturity of the model

Provider lock-in Lack of standards to easily switch providers or back-source a service

Interoperability Lack of standards to be able to use different services from different providers

Network issues and dependency

A network going down may be synonym of a service cut

Sustainability of the model

Providers currently offering those service may stop doing so in the future, as trend could go down the investment regarding this model cease

Table 5 - Cloud Computing issues checklist - Adaptation from Forrester’s "How Secure is your Cloud" (Wang, et al., 2009) and Security Guidance for Critical Areas of Focus in Cloud Computing’s

report (Cloud Security Alliance, 2009)

Depending on the choice of the provider and the service, an organization is likely to face different issues. We will detail those issues in the “Channel” part.

Below are outlined four areas that organizations need to analyze before using Cloud Services; a fifth area which is generally underestimated, is also mentioned. Companies that have issues regarding those areas may find Public Cloud Services not suitable for them.

Security and privacy

Security is and always will be a major concern in IT because an information system of an organization that is not protected may have a significant financial impact on that organization’s activities, or even

Page 55: Cloud Computing In France

55

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

endanger its existence. Most large companies, and some medium organizations, even have a Chief Information Security Officer (CISO) who is responsible for security communication throughout the organization, Risk and Control Assessment, threat and vulnerability management, and Identity Access Management. With Public Cloud Computing, the CISO and/or organizations may find it more difficult to define security rules and use the same processes on-premises and off-premises. But all security issues do not have the same impact on the company and the majority of these issues can be resolved by choosing the right service, asking all the necessary questions and updating the processes that will supervise the service.

Figure 20 - Classification of the issues regarding Security and Privacy

As we can see in Figure 20, several issues can have a serious impact on a company. Some of them, underlined in Table 5, need to be described as they will create “Go” or “No Go” situation for some organizations.

Regarding Data Segregation and Protection, organizations need to know that one of the benefits, which is “Shared resources”, can be an issue. If the organization has a policy prohibiting or limiting the sharing of resources among multiple providers, the CISO won’t be able to choose a provider offering shared storage services, or cloud services that share storing. He will need to specify that he needs dedicated storage and thus, won’t be able to benefit from the economics of scale. Most of the providers also have subcontractors that can have access to data that are not encrypted: some outsourced tasks can be storage, archiving, monitoring or support. Customers of those providers should ask if their provider have subcontractors, where they are located and what are their roles.

As most providers offer different services that do not encrypt data, organizations need to apply the maximum level of security possible to the service provided. For example, an organization should never put any data in the cloud without encrypting them first. In this connection, Amazon Web Services stipulates in its contracts: “You are solely responsible for applying appropriate security measures to your data, including encrypting sensitive data” (Amazon Web Services, 2009).

Page 56: Cloud Computing In France

56

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Vulnerability Management is one of the strategic roles of the CISO and he needs to know what is the program of the provider to ensure that it matches the one of the organization. Organizations need to be aware that not all providers will give details regarding matters such as how often they scan their infrastructure and applications for vulnerabilities, what is their vulnerability remediation process or whether they have the possibility to externalize vulnerability assessment.

The physical and personnel security issue might be very difficult to resolve as we cannot imagine large providers (international or French) communicating information, before the signature of the contract, on what type of verifications are done on the employees that have access to the customer organization’s data. Nevertheless, we can easily imagine, for extreme cases, the seriousness of what could happen if there is no restricted and monitored access to critical asters on a 24x7 basis and no background checks have been realized on the personnel.

With the incident response issue, organizations face something much more problematic: the fact that they don’t get informed when there is a data breach or other incidents. The majority of providers will not carry out pro-active monitoring, or inform the customer of what the incident response procedures were in a particular case, if the customer does not pay an additional fee. The danger, of course, is that the provider may not respond appropriately to security issues of all the types of companies that use the service, as all of them have security specificities.

Finally, privacy issues constitute the second major category of issues generated by the Cloud Computing services because if critical data are stored in the Cloud, organizations know that they lose some kind of control over those data. Even data collected about the use of the service (logs) mean something that can be critical information for an organization.

Of course, when we consider all the potential security and privacy issues, we tend to be afraid of what could be the impact of those issues on the organization; however, such fear misses the point on two aspects:

• All SMEs and some large companies may not have all the security policies that some of those providers offer. How many organizations have an ISO 27001 (Information Security Management System standard) or SAS 70 (professional standards used to assess the internal controls of a service organization) certification? Providers can make significant investments

Lionel Pelletier, Senior Consultant at COLT, has been the CIO of numerous French organizations.

“Security is the biggest concern around Public Cloud Computing Services. CIOs will need a proof that the data and applications are safe, otherwise they may continue to use internal resources.

Even if Cloud Computing abstracts, by nature, the location and operational details, organizations will need more transparency on where the calculation are done and what are the rules and

process in place to handle the risks. CIOs will certainly put non-strategic applications in the Public Cloud: this will impose a new

division of applications depending on the type of cloud.”

Page 57: Cloud Computing In France

57

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

in the security of the infrastructure because this is a core activity; they may also employ experts in this field, with a dedicated security team.

• Major security threats are, in the reality, created by organizations’ employees when they lose some data on private storage components, or change job from one company to another.

The main difficulty for an organization is to accept that some providers will not make arrangements for an external audit. As a consequence, the organization will have to trust that its providers actually implement the right level of security depending on the applications or data outsourced.

A recent study from Forrester showed that on 231 French decision makers interviewed, security is on top of their mind (Gillett, et al., 2009):

• 39% of large organizations; and

• 50% of SMEs.

The problem is thus shared by all the size of organizations.

Compliance

Even with Cloud Services, organizations have fundamental protection requirements for business continuity, disaster recovery, forensic investigation or other specific requirements. It is their responsibility to choose the right service and still achieve compliance.

Figure 21 - Classification of the issues regarding Compliance

Christophe Baroux, Regional Sales Manager Southern Europe at Amazon Web Services.

“We understand that our clients need guaranties regarding security and privacy issues. We

produced a white paper that defines what is security at Amazon Web Services (Amazon Web Services, 2009). Organizations face everyday security issues that Cloud Computing can solve when employees lose their unprotected USB key or laptops. Of course, we know that some

companies like Thales or the CEA won’t be able to use those services because they need a high level of security and their policy forbids it.”

Page 58: Cloud Computing In France

58

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Cloud Computing brings the idea that organizations may not have the possibility to preserve or produce required digital information business information and records. Organization that have programs on Records Information Managementi will have a serious difficulty to integrate those services in the programs. This subject is often an integral part of corporate governance and should be treated very carefully with a provider, as it is used in legal proceedings for compliance audits, regulatory reporting (tax records, environmental discharge reports), internal investigations and civil litigation. Applications and data hosted in the provider’s environment should be analyzed within a global Information Lifecycle Management. The chosen provider for such applications will need to be able to give access to these logs as long as needed, even when there is multitenancy.

Business Continuity and Disaster Recovery can be offered by some providers when they have multiple Data Centers but there are two difficulties:

• The service may only use one Data Center; and

• The organizations should understand what the provider’s plan is because they need to integrate it into their own Business Continuity Plan.

Finally, all organizations having specific requirements must choose services from providers that can respond to them with documented practices, whether it is an ISO 20001 certification for large companies or a PCI certification for eBusiness companies.

Behind these 2 issues, we understand that companies that have high requirements in terms of security and compliance for their data and applications should analyze carefully the providers’ services before entering the cloud; in other words, they should not select a provider only by trusting the brand when:

• They do permit external audit;

• Limited logs are available; and

• Forensics is possible.

Christophe Baroux, Regional Sales Manager Southern Europe at Amazon Web Services.

“Amazon and some over providers have developed their infrastructure knowing that the data will go down, and thus, the Data Centers have been built with this possibility in mind and with

consideration given on how to bring an effective solution to it. With Amazon, a customer chooses the region where he wants to store and host his applications: a European organization

can choose to use Data Centers located in Europe. We have Data Centers in Amsterdam, Dublin, Frankfurt and London. In terms of Data recovery and Business Continuity, Amazon

replicates data inside the same Data Center but if the Data Center goes down, data are at least in two other Data Centers. Regarding requirements, Amazon Web Services should be certified

SAS 70 before the end of the year.”

Page 59: Cloud Computing In France

59

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

As I mentioned before, an organization shall select the “right services” when using public cloud services. A low-cost provider will evidently raise more issues that won’t solved.

Henry Peyret, Principal Analyst at Forrester, is working on Enterprise Architecture.

“The question ‘Is the Cloud less or more safe?’ can be answered in two steps:

• Privacy: this is a real danger because some providers will not explain and tell the customer the reality of such services. Therefore, organizations may find difficult to carry out due diligence processes. Also, even if an organization decides to encrypt the data in the Cloud, it has to know that with money and time, everything can be decrypted and consequently, encryption may not provide a 100%-proof level of security. Everyone in

the IT department should be aware of Risk Management: architects, CIOs, etc.

• Back up / Business Continuity / Disaster Recovery: providers are experts of this subject and have a know-how that is greater than the majority of internal IT department. We

have to understand here that most SMEs didn’t have Business Continuity plans and Cloud Computing will surely improve that. Before, some organizations bought AS400

servers just because they were known as easy to reboot in case of problem…”

Page 60: Cloud Computing In France

60

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Legal and contractual issues

Some organizations may find legal barriers in the adoption of Cloud Computing services. But first, it is important to underline that Cloud Computing is a form of outsourcing and the clients will face issues that they may already know. The contractual solutions will resemble, broadly speaking, to a standard outsourcing contract. But new challenges are created as Cloud Computing can abstract how a service is done and where exactly are the data.

.

Figure 22 - Classification of Legal and Contractual issues

When Cloud Computing seems to potentially offer operational benefits on Business Continuity, the outsourcing of data and servers constitutes a worsening factor in terms of confidentiality violation.

Isabelle Issert de Braux emphasizes that organizations need to be particularly careful regarding personal data that are governed by the French law “Loi informatique et libertés” – for “Information Technologies and freedom” (Loi n° 78-17, 1978). Treatment of those data, in a virtual environment where they can be dispersed across, and stored in, multiple data centers all over the world (which is also true for a “private cloud”), can lead to violations entailing the organization’s responsibility. Thus, data in the cloud can be transferred across multiple borders and this has a significant legal implications: transfer of personal data out of the European Union is subject to certain formalities and a strict control from the French IT and Freedom National Commission (CNIL). The best practice, from a legal standpoint, would be to locate the servers inside the European Union and keep control over these servers.

An issue that can come up regarding data in the cloud is the protection of intellectual property rights in the data. Few providers (and mainly SaaS providers) have a clear position on the ownership and rights of some data. Fortunately, a serious IaaS or PaaS provider will not propose hosting services where data of an organization would not be owned only by this organization (even replicated or

Text approved by Isabelle Issert de

Braux, lawyer at COLT Telecom

Page 61: Cloud Computing In France

61

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

redundant one). But it does not mean that legal or compliance teams should not be involved in the process.

It may be impossible for some companies to use Cloud Computing services because they do not meet all the applicable constraints. This may be the case, for example, with companies that need to store health-related data and comply with specific requirements defined in the “Code de la Santé Publique” (Code of public health), or credit institutions that are subject to specific safeguards security. An organization needs to check that all specific legal requirements can be respected in the new environment: this will depend on the data, the company, the provider, the services used and the location. Some organization may already have a policy that preclude them from relying on services that store data on servers installed outside Europe, such a policy having the effect of restricting the Cloud Computing services to European providers and services. Also, organizations will have to approach the liability discussion individually; this is because applicable regulations generally do not impose as a requirement that the service provider shall contractually acknowledge its responsibility for protecting the client’s data. Legal teams will often insist to include in contracts specific terms and conditions on the various aspects of their potential liability, and on the consequences of that liability (rights of recourse actions, financial compensations etc.) and include the corresponding provisions in the SLAs.

But as we will see in the “Channel” part, there are two types of providers: those who are offering services directly through an internet web page where the client sign a click-wrap contract (no negotiation on the contract) and those who create a custom-made contract. Isabelle Issert de Braux is rather skeptical on the fact that click-wrap contract providers let their customers enter into a genuine contract negotiation and she believes that organizations that need specific SLAs will need to choose providers that negotiate custom-made contracts.

We can identify several other potential legal issues (see below); however, the probability that these issues will materialize is rather remote:

• Easier for a litigant to discover data on the cloud. During litigation, the adverse party may seek the discovery of the organization's data directly from the cloud provider and serve on the latter a subpoena from a judge even before the organization owning the data is informed of the process. This situation is somewhat improbable under French law because such a process is much more difficult to realize in France.

• Disposal of organization’s data if the latter does not pay (under the reciprocal requirement where one pays and the other offers the service). This will probably not happen as providers will prefer to cut the access and reestablish it later rather than dispose of sensitive data. And there is a need to take into account the “proportionality principle”: a provider won’t stop the service because the organization is 2-day late in its payment.

The use of Cloud Computing is not inadvisable, but lawyers will recommend generally to limit its use to the less sensible applications, and refrain from such use particularly for personal data. Also, some organizations (including SMEs) will need that the cloud computing provider agrees to external audit procedures and produce the necessary security certifications required by some business sectors.

Page 62: Cloud Computing In France

62

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Maturity of the model

Companies will face another issue related to the maturity of the model itself. Cloud Computing is based on multiple technologies that are more mature but suffers from a lack of standards. Providers can choose between several virtualization software (VMWare VSphere, Microsoft HyperV, Citrix Xen, Parallels, Red Hat Enterprise Virtualization, etc.) and there are numerous clouds (since each provider has its own cloud). Standards are only beginning to be created with the global awareness from all the actors in the cloud. Some of those actors do not want to see providers going back to proprietary solutions, partly because open-source solutions are increasingly used. The Open Cloud Manifesto (iv) (Open Cloud Manifesto, 2009) points out that providers should not lock-in the customers in order for them to move their data and applications easily from one provider to another, by using “open” standards adopted by all the companies. Behind this manifesto hides some giants from the IT industry like IBM or the SaaS and PaaS provider Salesforce.

Some initiatives have already been created (not linked to this manifesto):

• OVF standard that describes a virtual machine and them to be deployed on any platform supporting this standard (VMWare, 2009);

• SLA@SOI 3-year European Commission project that will define a holistic view for specifying, negotiating and managing the conditions under which services are provided. Those specified “Service Level Agreements will allow these conditions to be expressed at both business and IT levels”. (SLA@SOI, 2008); and

• Alliances between providers (Google’s App Engine and Salesforce’s Force.com for the PaaS provider)

But all SaaS/PaaS/IaaS won’t have the same need in terms of standards. Technically, it is easier for a company to change its IaaS provider than changing from a PaaS provider to another one. The reason is that IaaS provider only has the infrastructure, when a PaaS provider adds the middleware layer and the SaaS provider adds the application layer. When selecting a service from a provider, organizations will need to know that they could face a lock-in issue, or an interoperability issue, when trying to link services hosted from one cloud platform to another one.

Another dependency is the network: “what happens if the network is down and some major applications are hosted in the cloud?” Of course, it is a source of major concern for an organization to realize that, if there is an issue on the network, it could go from applications user inconvenience to direct loss of revenue. This risk must be relativized as it does not happen more often than a power outage and, even if it is costly, it can be redounded.

The sustainability of the model is occasionally questioned. Some large providers are massively investing in Cloud Computing services and we must consider that a large number of companies will “jump into the cloud”. But if providers stop investing in this model because they do not think it is a viable model, or if customers have too many negative experiences, this could result in the end of this model.

Those issues need to be taken into account when doing a Risk Analysis: using something new always raises viability issues. Companies that have an exhaustive risk policy will certainly be constrained by some departments inside the organization.

Page 63: Cloud Computing In France

63

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Application and data Migration

The migration remains one of the most important technical issues: the transfer of existing applications and infrastructure will not be transparent in the majority of cases. It will be more difficult than simply “putting them on the cloud”: the architecture imposed by some providers is dissimilar to most architecture of enterprise applications and existing infrastructures are not developed to benefit from all the new possibilities offered by the cloud (Golden, 2009).

Of course, this is even truer when an organization wants to use providers that offer their services only online (Amazon, Google, Salesforce) because there is no customization possible. Bernard Golden adds that “once [enterprises] find out how difficult it is to move an application to an external cloud, their enthusiasm dwindles”. With Amazon, organization will face storage issues because the framework is completely different from the existing, and database issues as they do not work as well in virtualized environments. It will be even more difficult with PaaS providers: Salesforce’s Force.com uses a proprietary architecture that will demand organization to redevelop big parts of their applications. And no tools exist to automatically convert yet an application into one that can directly be used with Cloud Computing services. Of course, re-writing an application to a prescribed public cloud model leads back to the lock-in issue described before.

We can see three scenarios for companies that want to migrate their custom applications (and infrastructure) in the cloud:

• Migrate the entire application: some non-complex applications will have minor modifications needed to be migrated, but will not obtain all the benefits out of such migration (minor scalability). Only Infrastructure-as-a-Service offers this possibility.

• Rewrite major portion of the application: old applications may use old programming languages or models that need to changed (and redeveloped) in order to exploit cloud computing benefits. Deploying the application in a PaaS environment will surely mean redeveloping major portions of the application as most of those services support new languages (Python, Java). And

• Migrate some parts of the application: some key part of an application can be outsourced that will really benefits from the cloud. Organizations will also face new issues (latency because of the distance, security because there is no secure tunnel encrypting data, etc.).

The changes that are needed to outsource the application will rarely involve business logic, but rather more infrastructure logic. Thus, organizations that have an old IT environment will have more difficulty to migrate their applications and gain real advantages.

Human Resources

After referring to technical, compliance or legal issues, the last issue to consider may be the most sensitive one: the actual IT staff. Using cloud computing services means outsourcing, automation and virtualization. All of those will certainly cut jobs in IT departments and transform others. There will be certainly less systems administrators that are doing administrative tasks (maintenance, storage, …) or operations research analyst in-house which jobs will be taken by the provider. IT departments may

Page 64: Cloud Computing In France

64

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

need more human resources around cloud-monitoring solutions and cloud-service management software, but the difference between these new jobs and the ones being cut will be negative. The IT staff will need new trainings on subjects like web-scale developments and service monitoring to benefit from cloud computing services without risks. We will develop this impact in the second part with more precision.

Organizations (usually large ones, but also smaller ones to a certain extent) that have difficulties with Change Management or have a difficult social context, will be hesitant to use Cloud Computing services.

Operational and Strategic issues

We have referred above to several issues; some companies that have specific requirements regarding those issues may find public PaaS and IaaS Cloud Computing not suitable for them. Those issues are more detailed in a document recently published (November 2009) by the European organization ENISA (v) (ENISA, 2009). I categorized the issues relevant for the thesis in terms of, for example, security, compliance or legal requirement but it is also interesting to analyze what has happened with another type of outsourcing: offshoring. When organizations refer to their return on experience (Hugon, et al., 2009), the cause of their negative experience in offshoring is related not only to the quality of the service (38%) but also the complexity of the management of the provider (56%), the change management (56%), the loss of knowledge (31%), a cost reduction less important than originally planned (31%) or hidden cost (25%).

Those issues are very different from the fears related to security and low quality that were on the top the organizations’ concerns when they were beginning offshoring activities and had no experience in that field. In fact, two similar types of issues have been identified for Cloud Computing and offshoring: some are operational issues and others, less easy to understand for a company, strategic issues. The first ones are, for example, the security issues and the day-to-day operation issues while the strategic issues could be the management or the transfer of jobs.

Karim Bahloul, senior consultant for IDC.

“Some companies will limit the use of Cloud Computing services at the beginning. They know that the adoption of these services will replace the job of some employees that have been in the

organization for a long time. What would happen then? Job transformations at best, staff reduction otherwise. Companies that will find it difficult to carry out such transformations will

certainly prefer to wait and see what could be the impact of Cloud Computing.”

Page 65: Cloud Computing In France

65

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

We understand that we could rapidly see a transition on the actual fears on security, quality of service and business continuity to real issues on change management or vendor management. This transition already happened with offshoring which raises basic issues that are identical to those applicable to Cloud Computing.

One of the main reasons why French companies want to use Cloud Computing services is to reduce the cost of IT (Markess International, 2009). If the organizations want to solve all the issues before using Cloud Computing services, it will certainly reduce the financial gain they were hoping to realize. Hidden costs exist, not only in the migration phase but also during the use of those services:

• Security tools, devices and processes;

• Compliance audits;

• Develop risk analysis;

• Contract negotiations;

• Changes in application codes;

• Change management.

Thus, an organization that implements new processes and try to resolve these issues could be financially impacted; but not to address these issues will also have financial consequences.

Shrish Srivastava, teacher on IT/IS at HEC.

“Like offshoring, Cloud Computing is facing 2 types of issues. First, when companies start something new, the companies only think in terms of operational issues. What will be the problems that affect the day to day operations? And initially, the operational problems are

more important but very quickly, companies will realize that there are strategic issues. When an organization start outsourcing to a vendor, it doesn’t really know all the issues that will

come up and, as it will go along the implementation and use, more issues will come up. We can make a simple analogy with learning a new programming language where there are many

more things which are simply more than the programming logic. The same case happens here, because once an organization gets into the things, it will realize that it is much more complex.

The fears that were around offshoring are pretty much identical to the fears around Cloud

Computing now. But the issues around offshoring really are more different now. Cloud Computing have specific issues on operation but is quite similar with offshoring on strategic

issues. The basic problems are the same because Cloud Computing is not only about technology like we could think. A company, that puts its IT in the cloud, gives some of his work to a vendor. This is a real human problem because employees are not happy about the whole

thing and organizations have to think about that.”

Page 66: Cloud Computing In France

66

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Figure 23 - CapEx to OpEx cost savings versus Cost of Risk for cloud computing (Linthicum, 2009)

One could ask whether the organizations are mature enough to use Cloud Computing when we see developing, in parallel, operational issues and strategic issues that had not been really envisaged and evaluated?

II.4.d. Cloud Computing: only for mature

companies?

Behind this question of process organization maturity lies a number of questions. Organizations that have already implemented the ITIL referential (Annex V) will want to know if Cloud Computing will have an impact or not on their mature, or maturing, processes. Organizations that have not implemented ITIL or equivalent processes that industrialize the IT department, will want to know if they are prepared to use Cloud Computing services. Will it be less complex to manage the infrastructure and software and all the activities and resources with new Cloud Computing services? Could it be a way to begin the implementation of a framework like ITIL if that wasn’t the case?

These are important questions to understand whether an organization can use PaaS and IaaS Cloud Computing services. We can already make two observations:

• Some companies have already used Platform and Infrastructure services without even asking themselves those questions; and

• Having good processes and a reliable data management is already important even without Cloud Computing services.

Before using new services or even a new technology, organizations should understand what they really need, what they are paying for these new services and how the use of a shared infrastructure

Page 67: Cloud Computing In France

67

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

will impact their processes (workflow, policies, etc.). At first, one may believe that there is less complexity in a cloud infrastructure: this is very often because some complexity is hidden from the customer. In reality, there still is some level of complexity in the management side with a cloud infrastructure when you use Infrastructure-as-a-Service (Hurley, 2009): staff, servers, patches and updated applications, network latency, etc. Some of those issues are eliminated with the Platform-as-a-Service but, as we have seen above in this part of the thesis, there are new issues being generated.

Complexity of the environment

Gregor Petri has described what could be the adoption of Infrastructure-as-a-Service at the beginning (Petri, 2009) and, in this connection, has observed intelligently that, what we call “the Cloud”, will be an “additional set of infrastructure” combining inside resources and Public and/or Private Clouds, Hybrid Clouds. Organizations will certainly use services from “multiple vendors [in order] to optimize cost and balance risk”. We can understand that, even if infrastructure services were less complex to manage, the introduction of new types of services may actually add more complexity because an organization would have to manage different types of resources, situated in different locations, and accessed from different providers at the same time.

Considering that organizations can now use services for which all resources can be dynamic and paid “as-you-go” by the hour, we can conclude that the maturity of an organization can be a critical factor in the adoption of such services. The combination of the growth of the number of servers, the need to preserve the flexibility offered by virtualization and Cloud Computing, and the obligation to maintain a good operational service level, leads to industrialization of the processes and development of change management.

Shirish Srivastava, teacher on IT / IS at HEC.

“We should be talking about the maturity of an organization that will use Cloud Computing services even though some people might think otherwise. Actually, organizations will need to be

more mature on human side than the technology side and organizations need to understand what they will give out to the vendor. But human and technical issues will be in the work and will

be very different for every company.”

Page 68: Cloud Computing In France

68

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Frameworks like ITIL or COBIT will surely help to understand and respond adequately to the complexity of managing multiple forms of services. In the next part, we will address how to develop a Cloud strategy and insist on the fact that it is important to build a governance around goals, risks, costs or interdependencies. For G. Petri, the goal is to “offer a transparent view across the various infrastructures platforms [and] dynamically move applications to the cloud platform that is the most cost or energy efficient” and this will possible only if some of “those [ITIL or COBIT] procedures are deployed”.

In conclusion, SMEs or major organizations can use Cloud Computing services without implementing frameworks like ITIL or procedures that have such best practices. But companies that want their deployment with a Cloud service to be the most successful will imperatively need to have mature processes: strategy and organization management, asset and configuration management, service portfolio management, information security management, etc. G. Petri (Petri, 2009) is rather blunt when explaining that: “Cloud Computing offers more options, more flexibility, more opportunities for efficiency and automation [but] automating chaos will only give one thing, automated chaos”.

Cloud Computing and ITIL: a good combination?

To make IT work, organizations have to follow processes, configurations tasks, problem management scenarios, change requests and ITIL is the best way to manage the IT resources within the IT department and the Data Center. Of course, companies using SaaS will have solved most of the issues linked to those processes because the provider will be managing a wide variety of elements. With PaaS, and even more with IaaS, an organization still needs to be concerned about the management of software configurations, the deployment of new versions or about how security is

Lionel Pelletier, Senior Consultant at COLT, has been the CIO of numerous organizations.

“To get all the benefits from Cloud Computing and try to avoid major issues on security or management, the organization and the provider need to have a good level of maturity. An organization will need to create a framework to understand and monitor all activities, both

inside and outside the company. For example, a company using Cloud Storage Infrastructure services that does not create a policy, where the usage rules are defined, will face several

issues. What type and amount of data can an employee store? I have faced that type of issues and I believe that CIOs will quickly understand how Cloud Computing will accelerate the

implementation of such policies.

Both companies will need to be structured and the use of frameworks can be important. The best frameworks in this situation are ITIL V3 where an organization will be able to develop management policies inside the IT department, and eSCM where an organization will learn

how to interact with a vendor. This last framework will give best practices on the organizational and technical parts: establish Proof of Concepts to see the maturity and issues,

work with specialized consulting firms if needed, etc.”

Page 69: Cloud Computing In France

69

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

being administered (Oestreich, 2008). The following figure (Figure 24) shows some services that will be important in the management of Cloud Computing.

Figure 24 - Business services based on ITIL that have a role in managing a Cloud Computing environment (Mauger, 2009)

Page 70: Cloud Computing In France

70

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

Only automated procedures and transparency of mechanisms will allow the IT department to retain an effective control on an increasingly unstable and virtual environment. Although IaaS and PaaS Cloud Computing services get rid of some management issues, it does not suppress the need for organization or discipline. And their effect on a given organization will be the direct consequence of the planning and management put into their deployment, operation and supervision. In the second part, the impacts of the adoption of PaaS and IaaS Cloud Computing services on the processes of the IT department will be detailed.

Régis Mauger, CTO at BMC Software.

“We have developed a tool base on ITIL principles that allows Cloud management for infrastructure-as-a-Service. Organizations that have implemented ITIL will have less difficulty to manage these new services so using them really does not cancel the frameworks in place,

quite the contrary. Of course, the goals are to enable the use of Cloud Computing services and manage those services.

For example, to industrialize a change request, we can identify the following actions:

• 1. Plan a new project,

• 2. Make a request (Service request management),

• 3a. Record the request (Change and release management),

• 3b. Record the change (Change and release management),

• 4. Initiate orchestration tasks (Processes and task orchestration),

• 5. Provisioning the cloud server,

• 6. Configure the cloud server (Configuration automation),

• 7.Check the cloud server (Governance and compliance management, Financial management),

• 8. Manage the cloud server (Vendor Management, Human capital management),

• 9. Terminate the request (Service request management, Change and release management).

These actions correspond to business services like planning, support or operations where there will be employees from the IT department. It requires a certain rigor for an

organization to maximize the benefits of Cloud Computing and let users ask for new resources in a “self-service” way. So, organizations need to automate orchestration, allocation, change requests, monitor those cloud resources, implement and manage

different level of services to the different users, and make forecast to analyze the costs.”

Page 71: Cloud Computing In France

71

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

II.4.e. SWOT analysis of Cloud Computing for

organization interested in the model

Knowing all the benefits and concerns, the actual economic environment and the IT market, we can now present the SWOT matrix that shows the information previously presented.

Graphic 5 - SWOT of Public Cloud Computing services

II.4.f. Early adopters

The first organizations that will use Public PaaS and IaaS Cloud Computing services can be identified with the benefits and drawbacks developed before. Those innovators and early adopters will want to realize at least one of the following benefits:

• Save money (pay less on staff, hardware, …) because of seasonal/temporary needs;

• Change the way they spend on IT with a new Business Model (following the growth of the activity: pay per number of clicks, the bandwidth, number of tasks done, etc.);

• Get operational benefits;

• Quickly create an infrastructure without investment;

• Focus on core business and innovation;

Page 72: Cloud Computing In France

72

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Consumer – “What companies are or could be interested in this new model?”

• Access to virtually infinite resources;

• Access to Overflow platforms (to get more resources than those offered in-house);

• Use services used by the competition;

• Are already using colocation services or managed by a provider in-house; or

• Launch projects that do not have a clear ROI, avoiding CAPEX investment and having the possibility to stop at any time.

Figure 25 – Innovation Adoption Curve (Rogers, 1962)

Organizations that may use Cloud Computing services (late majority/laggards) at a later stage are those that have at least one of those characteristics:

• Existing infrastructure that is complicated to migrate;

• Difficult social context because of IT staff reduction;

• Important legal issues regarding to private data;

• Compliance requirements;

• Sensitive organizations that need extreme security; or

• No seasonal activity.

Based on those hypotheses, we can draw a picture of the first cloud users:

• eBusiness web sites (seasonal activity within the year: marketing campaigns, sales);

• Independent Software Vendors (no management of the infrastructure, capability to grow easily, development of the SaaS model for their software, possibility to have multiple Data Center across different countries to be near the final users);

• Small IT integrators (that have a lot of test/development/pre-production servers and developer teams);

• New companies that needs specific applications (easier to use Cloud services than create your own Data Center with all operational expenses); or

• Large companies that do not work in Defense, Health, Finance and some Government agencies or International organizations (avoid legal, compliance, security issues).

This is not an exhaustive list and it does not mean that other companies will never use Cloud Computing services for some applications and we will see in the next chapter what type of applications are eligible to “go in the Cloud”. But these companies have the potential to massively use Public Cloud Computing Services.

Page 73: Cloud Computing In France

73

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

II.5. Corporation – "Why is it relevant to the

strategy of the organization?"

We described the new economic model, the benefits that some organization can expect from Cloud Computing, and the risks that those companies will have to manage. This part on Corporation will develop more precisely what type of custom applications, organization will be able to put in the Cloud, always with the idea that:

• It addresses business needs;

• It should be cost effective; and

• It must remain coherent with the Information System (policies, governance, etc.).

We will see that new questions are raised:

• What applications are best suited for the cloud? Is there an eligibility matrix?

• Are there some frameworks that an organization can use to make this choice?

• What are the best practices?

• Is there a way to migrate an application to the cloud?

• Does it need to be in an overall strategy?

• Can an organization get some help to decide?

II.5.a. Balanced Scorecard

Answering these questions will be a very important step for companies that want to start using such type of services. From what we have seen before, the use of Cloud Computing service has to address business needs. A Balance Scorecard allows an organization to see if its operational activities are aligned with its objectives and strategy. PaaS and IaaS Cloud Computing services will have an impact on those 4 perspectives:

Page 74: Cloud Computing In France

74

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

Figure 26 - Balanced Scorecard of Cloud Computing, Adapted from the Balance Scorecard by Kaplan and Norton (Kaplan, et al., 1996)

The Cloud Computing strategy chosen will have to be in coherence with this Balance Scorecard, where we will be able to create targets and track the performance with Key Performance Indicators.

II.5.b. Make or buy?

Every company needs to differentiate itself because it is in a business environment that is filled with an increasing number of competitors. A way to accomplish this is to simply focus on what the company does best: its core expertise and added-value activities (product innovation, customer relationships or strategic business growth initiatives). We are back to a typical outsourcing question: should the IT department do a task in-house or outsource it?

The Gartner consulting firm described the concept of a next-generation IS organization with the IS Lite model (Gartner, 2003). Like Cloud Computing and other trends, this organization is “slimmed down to lighter, more flexible organization with a smaller internal staff and more-focused competencies” (Gartner, 2009). The basic idea is that this transformation is possible through the outsourcing of many functions (such as infrastructure services) and the migration of others (such as system development) to business unit IT groups.

Page 75: Cloud Computing In France

75

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

Figure 27 - Gartner’s IS-Lite model

Cloud Computing services enter into the same trend, letting a provider manage a part of the Information System, that does not create value, to a company, and could offer some benefits. I will not detail this model longer but we can still observe a major characteristic with one of the key roles (in yellow circles) which is the management of the provider that will be a sensitive process.

Page 76: Cloud Computing In France

76

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

To first answer the ‘Make or Buy’ question, one should determine whether it is financially more interesting to outsource a service. We have already identified this characteristic in the first part of the thesis that explained the new economic model and some examples of ROI.

SaaS versus PaaS and IaaS

When organizations choose between building their own solution and buying the solution of a provider, they face a second level of choice: do they buy an application on-the-shelf (Software-as-a-Service) or do they develop a custom application (Platform-as-a-Service and Infrastructure-as-a-service)?

As we said before, choosing a SaaS solution allows a company to focus on core activities but it will not help it differentiating itself from others on the outsourced service. And this is vital to a company: differentiation. Otherwise, what make the difference between two companies? IaaS and PaaS services offer a way to develop and host custom applications in the cloud that will help a company differentiate itself. We can consider that when 80% of the need for applications would be covered with Software-as-a-Service, the last 20% will be the most important part since it would allow a company to use specific applications on the Cloud.

Lionel Pelletier, Senior Consultant at COLT, has been the CIO of numerous organizations.

“Depending on the maturity of an organization, a large organization will be able to outsource or not. All organizations have this need but only mature ones will know what to outsource the right way: operate on the infrastructure by itself or let a professional operate it and focus on the core business. The next step is simply a ‘Make or Buy’ study which will analyze risks and

costs. Large companies will have to make precise Business Cases, leverage all the issues with the Return on Investment of such a decision. It will depend of the business sector where the IT

budget is not the same. If a company is unable to manage its growth curve (volumetric storage for Business Intelligence or no policy on storage can be managed by a provider if an IT department decide to subscribe to storage-on-demand) or temporal growth of the activity (ex: eBusiness website), isn’t it more simple to outsource the management of this infrastructure? If we take the IS Lite model from Gartner representing the activities of the IT department as a

triangle from the strategy to the infrastructure management, we see that there is a large zone that doesn’t need to done by the organization because there is no added-value. Cloud

Computing services may satisfy needs to outsource the management of servers, storage, network, some applications and middleware, and desktops. An in-depth risk analysis will help the CIO answer some questions regarding what to outsource: what are the risks to have a pre-

production platform that is down whereas I want to be sure that my production platform needs to have the maximum of security and availability. We will probably see a gradual

outsourcing from the test and development architecture, to the pre-production and Business Continuity resources: those services could benefit from the Cloud economics.”

Page 77: Cloud Computing In France

77

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

Of course, depending on the strategy of a company and its business sector, a strategic application for an organization will not be as strategic for another (Human resource management system for Consulting firms, Property management for real estate agencies, etc.) and thus will need to be differentiating.

Control versus agility

As we have seen in this part, some companies may not be interested in such a new model: we face here a second question that opposes the control which organizations have over their services against the agility offered by Public Cloud Computing services.

We see that “too much control results in lack of agility [but] too little control exposes the organization to risk” (Behnia, et al., 2008). When an organization will make a choice whether to use PaaS and IaaS services, elements outlined in Figure 28 following will have to be borne in mind because, when the business will want to have the maximum of agility possible, some employees will want to apply the maximum degree of security possible. A balance point will have to be found by the organization when the IT strategy will be established.

Figure 28 - Control vs Agility (Behnia, et al., 2008)

II.5.c. Choice of the applications to outsource

Knowing that some organizations should have a significant interest in using Infrastructure and Platform services, there is a need to identify applications that could be hosted in the cloud.

We can understand that, as of now, certain applications (such as banking and stock-trading systems or telecommunications infrastructure) will have to be managed locally due to legal requirements, security threats or stringent uptime requirements. But, in the application portfolio of an organization those applications are not the only ones and some other applications may not impose such strict uptime requirements. It is necessary to differentiate low-critical applications from mission-critical applications because they actually may be managed with the same management framework and under the same operations costs.

Applications that could be outsourced are also the ones that could get the more benefits from being in the cloud, with the new economic model offering greater flexibility.

Page 78: Cloud Computing In France

78

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

James Staten, from Forrester, rightly saw emerging three patterns for IaaS services:

Figure 29 - Three emerging patterns for IaaS services (Staten, 2009)

For PaaS services, the emerging patterns are similar. We can identify:

• Volatile web applications;

• New SaaS providers developing their applications on top of PaaS services, that often integrate tools to test and develop their program quite easily from an environment to another.

Those services are less mature than IaaS services, and as we saw that the risks are different. But providers offer a wide range of new services that some companies are already trying for Proof of Concepts (see Annex III).

The following figure proposes a manner to define what are the best applications to host in the cloud, based on all the previous findings and assumptions. Four dimensions are represented on this priority matrix:

Page 79: Cloud Computing In France

79

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

• Size of savings: basically, an application that have temporal needs or needs elastic capacity will create more savings if it is in the cloud. We can also suggest applications that have low SLAs to be hosted on low cost services for financial reasons. Also, depending the use of an application by company, the savings will be different (some ERPs will always have the same traffic when others will have for example a great variation during the fiscal year end).

• Ease of realization: the migration part is addressed (described in this part).

• Size of spends: the budget needed to outsource an application.

• Criticality of an application: this is the more difficult dimension because it is very often specific to a company but we tried to take general cases.

Figure 30 – Example of priority outsourcing matrix

This exercise needs to be done by every company that would like to know what applications could be outsourced. It will give this company some priorities and help it in the definition of a roadmap.

Primarily, organizations will certainly look at areas that offer quick wins with simple ROI calculations. Applications that are low in business value but offers substantial savings and easy to move into the cloud will be preferred.

Page 80: Cloud Computing In France

80

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

The selection of the outsourced services can be realized with different methods (Hugon, et al., 2009):

• Comparison with best practices: using this method will be difficult because there isn’t a real return on experience on the use of IaaS and PaaS services and the only best practices have already been explained above. But it is still possible to compare it with other outsourcing best practices and some new frameworks (Risk IT and Val IT from ISACA); and

• Eligibility matrix.

Eligibility matrix

The eligibility matrices offer a way for organization to elect the right applications for something based on criteria and policies created by an organization. This proven method has been developed by a large number of organization and we will not detail here all the questions and explain how to rank the answers. But it is still important to indicate that this matrix will need to be realized with a clear strategy (see Balance Scorecard): reduce costs, improve customer satisfaction, innovate, etc.

Lionel Pelletier, Senior Consultant at COLT, has been the CIO of numerous organizations.

“At first, an organization will identify all critical and non-critical applications within a business

process. All data must be classified in terms of security and sensitive data should not be treated off-premises. Applications that are non-critical could be hosted in the Cloud if the ROI is interesting. Applications that are critical may have backup resources (Data Recovery resources)

that could also be hosted on the Cloud because they are rarely used. The idea is to elect the right applications to outsource.

But I think the first use of Cloud Computing services will be on-demand resources: Grid

Computing where an organization can rent out resources for a short period of time. Some organizations such as banks have created internal Grids for important calculations. The cost to buy and manage this Grid is impressive when we know that this is not their core business and they do not always use it at full capacity. This type of applications could be good candidate for

Cloud Computing. Another good example is an eBusiness website which needs additional resources for a promotional activity. The storage and in-house servers will still be on-premises but the additional resources will not be. This use of a platform that enables overflow is non-

intrusive which is more interesting as a first step.”

Page 81: Cloud Computing In France

81

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

Figure 31 - Cloud Computing applications funnel

Some criteria of this matrix are the following (but organizations are invited to add any necessary additional criteria which they would consider as being more relevant):

• Cloud strategy: this is the most important criteria as it will define the importance of the others. This strategy will have to be aligned with the business and the strategy of the organization.

• Interesting economics (Return on Investment): see Economic model.

• Technical feasibility: see Migration issues.

• Internal maturity: with every form of outsourcing, the maturity issue of an organization is raised and this criterion should not be rejected.

• Core activity: a company should decide if it wants to outsource only non-core activities or more if the benefits are more important.

• Acceptable risk: what are the policies of an organization in terms of security, and SLAs for an application?

• Legal issues: what are the requirements for a service?

• Mature provider services: the analysis of the services offered by the providers is also important. A lot of new services are created each month: some are mature, some others are not.

• Monitoring resources: is the company ready to monitor the application in its new environment and ensure that the SLAs are respected?

A criterion does not appear in this funnel: the possibility to buy a SaaS off-the-shelf and not host a specific application in the Cloud. This issue was discussed previously in the ‘Make or Buy’ paragraph.

The result of this eligibility matrix can be represented with the following figure.

Page 82: Cloud Computing In France

82

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

Figure 32 - Result of an eligibility matrix (Hartman, et al., 2009)

When large organization may have internal resources to realize this matrix, SMEs may have more difficulties. Precisely, we are seeing a lot of new offers that propose Cloud Audit to see which applications could be outsourced in the cloud.

Shirish Srivastava, teacher on IT / IS at HEC.

“An interesting question is the interest of outsourcing critical application for the organizations. If we look at offshoring, we see that organizations are offshoring and outsourcing key things: development of critical applications, Research & Development, etc. Some companies offshore

heavily, like Boeing that offshored the development of a critical application in engineering. And this is a very critical issue for a company like Boeing.

Cloud Computing is still in its early stage. We will see a large number of people experimenting

with it and thus, organizations don’t know what they can face. At first, organizations offshored the development of applications to reduce the cost but, now, some organizations are offshoring to get an expertise to develop critical applications. With Cloud Computing,

organizations are still mainly looking to save costs, even if some companies are also looking for an expertise, SMEs for example. We will possibly see the same evolution with Cloud

Computing: using it for cost reduction only without outsourcing critical applications and then using it for critical applications.

This is the normal way of things: with something new, people try to experiment it and then go

for bigger things and probably that will happen in the case of Cloud Computing.”

Page 83: Cloud Computing In France

83

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

II.5.d. Cloud Strategy

Implementing a Cloud strategy will be essential if an organization wants to use Cloud Computing services. Without a proper strategy, Cloud Computing could be a real threat to the CIO and the IT department: bad ROI, reduced control of the IT services, failure of migration projects, poor SLAs for a critical application, security threats. The CIO should lead this strategy because if something happen with a Cloud service, he will have primary responsibility. Conversely, Cloud Computing could be a huge opportunity for the CIO and simply add another string to his bow: he can deploy an application in-house or on the Cloud if it corresponds to the right characteristics.

Hybrid Cloud: the obvious solution

We can envisage that no company will only use Public Cloud Computing services (except maybe new ones and some eBusiness or ISV companies) and every company will have at least one Public Cloud Computing service project. The underlying idea of this thesis has always been that none of those two extreme solutions will prevail. We will rather see the apparition of what is called a Hybrid Cloud, mixing internal and external services, to create an environment that provides the level of service tailored to each solution, combining agility and control (Figure 28).

If we consider an organization with its traditional IT at this stage, we can plan a simple roadmap where the first step could be the creation of a Private Cloud and then the common use of Public Cloud services, creating at the same a Hybrid Cloud (Figure 33). This is what predicted IBM presenting the IT roadmap of the IT department.

Figure 33 - A possible IT roadmap (Zhu, 2009)

The vision is shared with consulting firms like Gartner who says that “Private Cloud Computing will not just be a viable term [but] a significant strategic investment for most large organizations”, this being “a stepping-stone to future public cloud services” (Gartner, 2009). Forrester also asked the question to IT decision-makers defining the same trajectory for a roadmap.

Page 84: Cloud Computing In France

84

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

Figure 34 - Server Virtualization Is A Top Priority For Most Enterprises In 2010, But Cloud Is Not (Gillett, et al., 2009)

Of course, we have seen in this thesis that some companies will not create a Private Cloud first but will certainly use different services: traditional IT and experiment with Public Cloud services.

The segmentation, between applications that could be hosted in the cloud, the ones that should stay on-premises and others which will be cut in different parts (possible with a Service-Oriented Architecture) distributed according to the risk and benefits, will be gradual. Some companies will possibly test and develop applications in a more agile environment (the Cloud), and those first quick wins will enable the IT department to publicize their success to the business world. At that time, organizations will start considering more challenging deployments, with new tools and best practices.

A certain maturity has been established by itself and this is what we will present now.

Cloud Maturity Model

Creating a Maturity Model is always difficult as it is always criticized, and exceptions for certain projects or companies are common. The goal is to propose an adoption model with milestones for IT loosely modeled after the Capability Maturity Model from the Software Engineering Institute at Carnegie Mellon University. Jake Sorofman proposed the following 5-step Cloud Maturity Model:

Page 85: Cloud Computing In France

85

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

Figure 35 - 5-step Cloud Computing Adoption Model (Sorofman, 2008)

This model proposes for each level: “strategic goals, key investment requirements, expected returns, risk factors, and readiness criteria for graduating to the next steps”. Of course, this model won’t always be true for every company because, for example, a new organization may be able to access directly the 4th phase due to the economic environment. But this model is fairly consistent in its construction because it takes into account the psychological dimension of the adoption of something new, and also the maturity of the processes needed to fully exploit the benefits offered by Cloud Computing. A large majority of SMES and large organizations will recognize themselves in this model, and always apply it with a view to be aligned with the business.

Page 86: Cloud Computing In France

86

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Corporation – "Why is it relevant to the strategy of the organization?"

Guillaume Plouin, Head of the Cloud Computing offering at Octo Technology and author of the book “Cloud Computing and SaaS” (Dunod).

“I differentiate two types of services in Cloud Computing: Location of application (SaaS), and

Run a specific application on demand (PaaS & IaaS). We have a clear idea of the type of applications that are used with SaaS by French early adopters, but we still see a small number of users that run specific applications in France. Those PaaS and IaaS early adopters that we are working with are experimenting. They can initiate innovative approaches for new tools,

applications. At the same time, this is a way for them to test services mentioned by the press and consulting firms. They will be able to have their own opinion on these services and then

consider it as a platform for outsourcing. In this context, the risk of data security is lower and the organizations will be able to benefit of the rapidity of deployment, which is very

interesting for an experimental approach. For example, a large company recently created a center of competence to test these services in its innovation department. That way, the IT department can prevent that the use of such

services be covertly tested without supervision. My point of view is that some companies will start using these services that way and,

eventually, start using it for more traditional applications.

We are also seeing a significant number of startups and Independent Software Vendors starting using the Cloud to run specific applications. For startups the reason is obvious, since they can quickly launch a service without CAPEX. For example, a French company called Run My Process uses Amazon Web Services for the infrastructure layer of its information system. ISVs are following the shift launched by SaaS which offers a new model of consumption of IT resources. All these vendors are asking themselves how to propose their software with this

new model and, of course, using a PaaS or IaaS service is a good solution. We can even envisage that, eventually, those vendors will only propose SaaS services to their customers

without managing the underlying infrastructure.”

Page 87: Cloud Computing In France

87

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Channel – “Provider: who, why and how?”

II.6. Channel – “Provider: who, why and how?”

After defining a cloud computing strategy, an organization will have to choose the right provider for the applications it wants to outsource. Unlike traditional outsourcing, in most of the case, we don’t see any relationships between the provider and the organization that uses Cloud Computing services. This could be normal if we think of the electricity metaphor created by Nicholas Carr: an organization does not have a special relationship with its electricity provider.

This model correspond to some major actors like Amazon Web Services (Elastic Compute Cloud, Simple Storage Service, …) or Google (Google App Engine) where we don’t see how a relationship could be relevant. But the integrators and other cloud providers know that a number of organizations will need a closer relationship than just a web page interaction. We will first describe all the models of cloud computing providers and the relationship that organizations can expect.

First, a map of the different providers shows their positioning in terms of offers and business readiness.

Figure 36 - Cloud Computing providers, France 2009 (Markess International, 2009)

This matrix is the only one that presents the French actors, but it may not be fully adequate since some actors do not have Cloud Services but rather rely on traditional managed services and offerings. Furthermore, several of the above providers have multiple offerings, thus multiple relationships with customers are possible. Trying to integrate all services providers in one matrix may complicate the comprehension.

Page 88: Cloud Computing In France

88

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Channel – “Provider: who, why and how?”

II.6.a. Different relations possible

No relationship - European providers

In this model, a provider offers services through a simple web interface. The contract is a click-wrap contract where the organization needs to accept all the clauses without negotiation possible. The quality of service is clearly known as is it a standard approach. The customers have to adapt their architecture and needs to the ones proposed in the different services: the provider does not take into account the specificities of an organization.

The customer and the organization do not need to meet each other, and no advice is given on how the service could be optimized or improved. The service given is just a tool and it is expected that the customer will use it by itself. This relationship represents best the utility metaphor. The business model of these providers is clear and customization is really not appropriate, even if the provider tries to offer a wide range of services. Thus, the access to such type of services, when there is no relationship with the provider, is very quick.

When based in Europe, and more particularly in France, the service will tend to raise fewer issues but this type of providers does not always specify where applications and data will be located.

For the moment, European providers’ services are less developed than some services that we can see in the United States for example. Without commitments from the provider, the services remain simple and are less expensive than those offered through a strategic relationship.

No relationship - Non-European providers

The same relationship can exist with providers that do not have a Data Center in Europe. It raises more issues as the data and applications may not be located in Europe and communications with the provider are more complicated.

Interface between the organization and the provider

A relationship is possible with an organization that will be the interface between the customer and the provider. Different roles are possible:

• The prescriber: it will give advice to the customer on how to use the service from a provider, helps it realize a Proof of Concept, and sometimes realize integration activities. Usually, the prescriber does not have a relationship with the provider (often non-European provider);

• The consulting firm: it will package some offers from various providers into consulting services;

• The Provider/Reseller with added-value: some provider will be able to develop new offers on top of other Cloud providers (ex: a Paas offering that uses IaaS services);

• The broker: that will choose for an organization what is the best relationship and the best provider for it.

Strategic relationship – Providers that have a presence in Europe

With this model, organizations can expect to receive more from the provider than a simple service. Those providers are closer to the customer, are providing customized and less standard solutions

Page 89: Cloud Computing In France

89

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Channel – “Provider: who, why and how?”

(security, architecture, …) and offering specific SLAs in a negotiated but flexible contract. This model is the evolution of the classic hosting/managed services model with cloud computing benefits added.

With a strategic relationship, organizations won’t be able to stop using a service automatically just like when there is no relationship. This is a long term contract with some consulting/professional services at the beginning (migration, integration), and ongoing services with a service manager handling the relationship.

Global Approach

The relationship can be even closer when cloud computing services are provided together with other services (data and voice solutions: optic fiber network links, etc.). In this case, the global approach offers the organization the possibility to have more responsibility taken by the providers than it would be the case with simple SLAs.

This approach is possible with Telecom providers that control the network and the infrastructure.

“Internal providers” - IT department as the service provider

When talking about Private Cloud Computing, the IT department is seen as an “Internal provider” that has a service approach which takes some benefits from the Public Cloud Computing. This can be a simple room for SMEs, up to multiple Data Centers for large companies that are consolidated through virtualization. As we have seen before, the gain is not identical but it will define the new relation that organizations have with their respective IT departments.

Figure 37 - Different relationships with a provider

II.6.b. Choosing the model

To choose the provider and the relationship needed, the organization will have to analyze some criteria: Cloud Computing strategy, maturity of both sides, complexity of the solution (bespoke, special needs), legal issues, price, in-house resources, risks, provider’s characteristics and ability to stop the relationship.

Page 90: Cloud Computing In France

90

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Channel – “Provider: who, why and how?”

Cloud Computing strategy

What does the organization want? A provider that only offers IT resources or use more services from the provider and be in a position to partner with it? Will there be only one provider (combining SaaS, PaaS and IaaS services) or multiple contracts with different providers? Does one provider can offer solutions for all services to outsource consistent with the Cloud Computing strategy of the customer?

Maturity of both sides

Is the organization mature enough to use Cloud Computing services? What are the current processes in place to manage the infrastructure, applications, data, and human resources? No management can create significant issues if an organization decides to simply use a “no relationship” strategy: from a bad ROI to complex compliance or legal issues.

Complexity of the solution

Organizations searching for complex solutions will tend to have a strategic or a global approach that will enable them to obtain exactly what they need with custom SLAs. A simple platform that is standard (security, architecture, no sensitive data, etc.) could be easily hosted off-premises, without interaction with the provider. So, what type of applications does the organization want to outsource?

Legal issues

Obviously, depending on the model chosen, the organizations will not take the same legal risks. A strategic relationship, where a provider takes more responsibility and may offer consulting services to advise its customer, provides a level of protection that the model without relationship does not offer.

Price

Outsourcing the infrastructure will be more expensive when there are additional services on top of the infrastructure service, with a long-duration contract. But companies which are only looking to cut costs may choose low price models that offer the simplicity to stop the payment at any time. Of course, organizations that do not successfully calculate the ROI of a model will tend to use Private Cloud Computing services.

In-house resources

Organizations that already have in-house resources and want to keep them for any reason may be encouraged to choose the internal provider solution. It still may need some Change Management but it will require less transformation than for using Public Cloud Computing services, which may create social issues in the end.

Risks

All the risks described in the second part are not identical with all the models because of the absence of real visibility in what the provider offers in the no-relationship model. Furthermore, the use of non-European providers accentuates those risks. If the security risks and other risks are too important, companies will tend to use the internal provider model. Also, Service Level Agreements are very explicit when addressing Public Cloud Computing services, but there may be a need for them to be more customized in terms of strategic or global approaches.

Page 91: Cloud Computing In France

91

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Channel – “Provider: who, why and how?”

Provider’s characteristics

Does a provider offer different types of models? Is it possible to switch from one model to another one or combine different models?

Ability to stop the relationship

Global approaches and even strategic approaches mean a long relation with the provider (contract lock-in) whereas a simple model offers the possibility to stop the service in case of failure, even if it may be harder to migrate the platform easily (technical lock-in).

II.6.c. Benefits and drawbacks of the models

Benefits Drawbacks

No relationship – European provider

• Easy to start a new service

• Easy to stop a service (no contract attachment)

• Offers all the benefits of Cloud Computing services

• Low cost

• No interaction with the provider and no dedicated support

• Difficult to get information from the provider whether he will be compliant with legal and security standards or not

• Potentially low SLAs

• Difficult to manage the infrastructure or platform services without the right tools and processes

• Difficult to recreate the same in-house platform (standard security and architecture)

No relationship – Non-European provider

• Wide variety of services easily accessible online

• Price lower than European competitors

• Easier to provide good global services for all end-users (geographic location)

• Difficult to do something against the provider in case of problems

• Bigger risks

Strategic relationship – Providers that have a presence in Europe

• Easier to get real interactions with the provider (integration, …)

• Custom SLAs

• Choose the right business model

• May offer less flexibility as this a contract with a duration

• Price is higher than the one for a “no-relationship” model

Global Approach • Possibility to recreate the • Difficult to stop the relation as other

Page 92: Cloud Computing In France

92

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms

same level of security with end-to-end control (network and infrastructure)

services like network will be built around the Cloud services

“Internal providers” • Keep more in-house resources in case of difficult social environment

• Easier evolution of internal IT where process can be created progressively

• Cost is more important

• No “infinite” resources

Consulting firm Interface

• The consulting will help the organization choose the right provider for the customer/project (broker role)

• Major commitment of the firm to balance Cloud Computing concerns

• Cost is more important because of the consulting services

• All risks may still exist with the provider

Prescriber interface • Provide guidance from the prescriber (expert in Cloud Computing services)

• Cost is more important because of the consulting services

• All risks may still exist with the provider

Reseller interface • Reseller may offer more business value

• The customer may end up dealing with risks from the reseller and the provider

Table 6 - Comparison of benefits and drawbacks of all the models

II.6.d. The providers

Organizations will be able to choose between multiple providers that can provide some of these models. We are seeing 3 types of genuine providers that are presented below.

Page 93: Cloud Computing In France

93

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms

Figure 38 - 3 generic models of providers

The “No relationship model” will be possible with some providers like Google, Salesforce or Amazon. Most PaaS offerings will be proposed with this model. Professional-managed hosting companies will give access to their infrastructure to customers as a simple managed “extension” of customer’s infrastructure but will not provide any added-value on the outsourcing part.

The “Custom contract model” is the evolution of classic outsourcing that integrates Cloud Computing services. Some typical actors will be:

• Traditional IT software integrators will have a closer relationship to help the client in the migration, the integration or, occasionally, the strategy. Here, IT is definitely a sensitive subject where an organization will need consulting services to help it choose the right services.

• Network infrastructure and services providers can provide packaged services where an organization will really create a cloud that will have at the same time: infrastructure and network.

The “interface model” will provide added value services on top of Cloud Computing services. For instance, some consulting firms do not host data and application but can provide the services that will help in the management and integration of Cloud Computing services. They can also have the role of brokers of Cloud Computing solutions proposing the best solution for an organization. For example, Capgemini offers consulting services, development, migration and back-up with Amazon Web Services offers (Capgemini, 2008).

A recent study (Portio Research, 2009) showed that French companies would trust more network infrastructure and services providers (45%) than traditional IT software integrators (23%) and professional-managed hosting companies (32%). This particularity is typically French because, with the global European results, professionally-managed hosting companies are preferred over network infrastructure and services providers.

Page 94: Cloud Computing In France

94

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms

It is important to underline that some providers can offer multiple models of relation, and that an organization can work with multiple providers and consulting firms at the same time.

Also, these providers will target different types of organizations and, thus will have different strategy. A look at Porter’s generic strategies allow us to understand that the “No-relationship model” will have for strategy the Cost Leadership and that the “Custom contract model” could be a differentiation or segmentation strategy depending the degree of the relationship.

Figure 39 - Porter's Generic Strategies (Porter, 1980)

Evidently, an organization, wondering what would be the best relationship, will have to wonder if it is looking for cost and accept all the risks, or customization.

Page 95: Cloud Computing In France

95

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms

Béatrice Rollet, Head Marketing for COLT Managed Service France, a European provider

“We will see two dominant types of relations between an organization and its provider. The

first one is the relation offered by some actors like Google and Amazon where the companies tend to consume like would do an individual. There is a notion of trust because the organization does not control everything and there is not a total transparency. The second one is the relation with a provider that is used to manage outsourcing deals and that can answer to all questions

regarding: data privacy, backsourcing and custom guarantees offerings. At the end, if an organization wants a service where a simple commodity is looked for, it will use the first

relation, but if it is looking for added value to manage a complex environment that is more structured, it will choose the second.

If we look at SMEs, it is likely that they will be turning to brokers to help them decide what would be the best provider and what would be the adapted solution. This form of supply will grow with the maturity and interoperability of Cloud Computing solutions. Some companies,

such as 8K miles, are beginning to offer these types of service to SMEs.”

Guillaume Plouin, Head of the Cloud Computing offering at Octo Technology and author of the book “Cloud Computing and SaaS” (Dunod).

“My vision of the relationship, between a provider and an organization in Cloud Computing

services, is that there should not be human or commercial contacts like it exists with a normal outsourcing contract. For me a Cloud provider must offer a self-provisioning API and there is no custom contract, just a service that you can access in a few clicks. So all the resources are

standardized and a customer is compelled to only use the proposed services. Only this solution offers the maximum benefits because you have a complete access over your resources and the

services can be stopped, no matter what, at any time.

Thus, the close relationship with the provider does not exist anymore. Some IT integrators or telecommunication providers offers Cloud Computing services where

there are professional services and custom contracts. For me, those services do not enable the customer to fully exploit what we can expect from Cloud Computing (Self-provisioning, stop

using the service anytime, etc.).

It’s true that all the major providers offering this maximum of opportunity are American (Google’s App Engine, Salesforce’s Force.com and Amazon’s EC2/S3/…) and French companies would prefer European services. To help, some prescribers will intervene between the provider and the organization. This third party will be able to give some best practices and what would

be great opportunities.”

Page 96: Cloud Computing In France

96

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms

A survey, involving French CIOs and other IT representatives (Portio Research, 2009), shows that some providers already have been preferred for different type of solutions:

Figure 40 - PaaS providers (Portio Research, 2009)

Figure 41 - IaaS providers (Portio Research, 2009)

We can be somewhat critical about this study that includes only major actors and no new entrants. Also, some actors are positioned as only IaaS providers (IBM) or PaaS providers (Amazon) when, actually, they provide a wide range of services.

II.6.e. Choosing the right provider

Depending on the type of relationship you need with the provider, and having defined the strategy that would be the best for the applications, the organization needs to choose the right provider. Obviously, the risks described in this part will have a deep impact on the choice as an organization cannot work with all the providers due to security, compliance, legal or technical issues.

Organizations that want to put custom applications in the cloud, using PaaS or IaaS services, have obtained information on all the potential benefits, and are also knowledgeable of all the issues that may arise under the different types of relations and services; they need to start asking question to

Page 97: Cloud Computing In France

97

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms

the potential providers to the extent this is possible, and benchmark these different providers (Wang, et al., 2009).

A checklist of negotiable and non-negotiable requirements

A good start for the development of the contract would be the creation of a checklist that defines negotiable and non-negotiable requirements. To create this checklist, an organization needs to search for all requirements:

• Certification requirements;

• Geographical limitations;

• Regulatory requirements against multitenancy;

• Security.

Internal resources can be used from different departments to obtain all the necessary information: compliance, risk, legal, IT departments. SMEs and large organizations that do not have internal resources and possess sensitive data and applications should contact specialized consulting firms to do a feasibility study.

Once that study completed, the organizations will be able to evaluate the offers received from the providers. All the information must be clearly defined before using the services of a provider, either on the website (electronic documents, white papers, …) if there no direct relation with the provider or by asking more questions directly when needed. Other ways of obtaining information are like customer reviews in public or private groups, and investigations or interviews from specialized magazines (for example, the MagSecurs magazine is currently carrying out a study on Cloud Computing providers that should be published soon).

Providers that do not accept the non-negotiable requirements should be avoided. When negotiable requirements are not respected, negotiations should be conducted with the provider in terms of recourse actions or financial compensations. But those negotiations are only possible when there is no click-wrap contract as we will see in the next paragraph.

Audits

Most of the providers that offer a “no-relationship” model will not accept external security audits because of the business model itself (Hogben, 2009). An audit entails costs for both the customers (financial) and the provider (time). Only companies that will outsource either several applications or critical ones will categorically want an audit, but only providers with custom-made contracts will propose this type of service. The audit should reveal useful information on provider’s infrastructure, applications and operations without impacting on the activity of the provider.

This will be very costly for independent SMEs, but SMEs that are part of a group could contact its parent to work together, thus optimizing the costs of the audit.

Service Level Agreements

SLAs will have a key role in the choice of the provider. Having defined the right SLAs needed for each application outsourced in the third part, organizations just have to focus on providers that respond to such needs. But these companies will need more than just a number (i.e. a price): they will have to understand how it was calculated and what are the architecture and operations in place to establish this number. Some providers can propose SLAs that are over their real level of service by taking the

Page 98: Cloud Computing In France

98

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms

risk that nothing will happen: it is a marketing and legal risk (Golden, 2009). Organizations will be able to use services that offers 99.45% uptime (4 hours downtime) a month to 99.999% or even 100%. A simple example is the outage suffered by some providers that exceeds the uptime guarantee.

Review the solution that is the best suited for the final users

Obviously, the most relevant factor to take into account, when evaluating what is the best solution, is the final user’s satisfaction. Moving an application to the cloud should not degrade the end-user experience. If we are considering the development of a new application, a particular attention should be given to the quality of the service.

Some basic analysis should be done, addressing questions as follows: where are the final users? Are they all located at a single work place or rather distributed in several locations worldwide? Does the service offered by the provider meet user’s expectations?

Carrying out such an analysis will help the organization in dealing with geographic redundancy and latency. In this connection, large organizations will tend to look for a service that can be provided from multiple locations.

Different business models for each provider makes it difficult to compare

We saw in the economic model that for each solution, there can be a specific business model. For example, some providers do not charge for the use of incoming bandwidth, but they do charge a significant price for the use of outgoing bandwidth. Another model would be for a provider to charge the same lower price for incoming and outgoing bandwidth. We see that, according to the behavior of the application, an organization will prefer to put an application in a cloud rather than another. This is an example, among others possible, of the wide range of the existing business models.

Test the provider

Possibly, the best advice is to test a provider by actually using the service within a Proof of Concept approach (generally three months). This is the best way to judge some services and what is the quality of service of the provider on:

• Flexibility;

• Pricing (truer when there is no relationship with the provider);

• Service management and customer relationship (truer with strategic relationships).

Of course, the risk in the case of a strategic relationship is that during the time of the Proof of Concept, the quality of the service will be actually better than the average service given at a later stage.

But, it will help an organization to know whether this is the right relationship and the right vendor or not. An approach could be for a customer to test multiple providers at the same time before really choosing one, and thus determine which one suits that customer the best. Of course, there is an impact on the cost, but this is an interesting test that organizations can try very easily with click-wrap contract solutions, and also with most of the strategic vendor solutions that will help the organizations test their services.

Page 99: Cloud Computing In France

99

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms

II.6.f. Conclusion

For the moment, most of the PaaS providers only offer click-wrap contract solutions whereas it is easier to find IaaS solution with custom-made contracts. The choice of the provider and the model of relation is a complex one as it will define the way you manage and use IT services. To sum up what we said, we will repeat the key points of that exist when choosing the vendor:

• Start choosing the vendor after defining your cloud strategy;

• Create a checklist that shows what are your requirements;

• Choose the model of relationship that is right for the organization;

• Do not hesitate to make some Proof of Concepts on provider premises;

• Partner legal and technical teams to analyze and then launch audit if really needed;

• Do not only choose a provider only on the price but also the services;

• Clearly review the contracts and solve issues that may have an impact on the activity of the organization.

Page 100: Cloud Computing In France

100

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Circumstances – “The environment”

II.7. Circumstances – “The environment”

Over the 6 previous parts, a clear environment has been defined that will influence every decision of an organization. I will rapidly highlight the elements creating this environment and present the lessons that I have drawn.

Choosing to use IaaS/PaaS Cloud Computing services is the result of simple elements that an IT Department may not control. I have already referred to the economic situation that encourages companies to reduce all cost, including IT costs. Cloud Computing allows to transform capital expenditures into operational expenditures immediately. A CFO could ask the CIO to use these types of services in order to respond to the challenges imposed by the economic environment in which the organization operates. Over the long term, and possibly in different circumstances, an organization would prefer the opposite (bad ROI, impact on accounting, etc.).

Something else could have an influence on a more political level as certain awareness is appearing about how much resources companies are consuming. Green IT, which I won’t detail in this thesis, is part of a global movement that promotes a better consumption and less pollution. Consolidation, virtualization and, thus Cloud Computing for example, could be a way for organizations to only use resources they need. Some actions already exist in the United Kingdom, which forces companies to pay a tax when they do not respect the rules of environment sustainability. Conversely, organizations respecting these rules will receive compensation.

Then, if the competition starts using these services and either find a way to get a better service level or is stronger because it dedicated its resources to added-value tasks, would an organization continue denying this new possibility? A company needs to evolve to be successful on the long term and this is only possible with an adequate strategy, and by listening to customer needs (either internal or external customers). The CIO will have to take into account their interlocutors who will not want to hear that something is impossible because of the existing IT infrastructure and applications; and if it is actually impossible, these interlocutors will require a credible explanation.

Figure 42 - Factors driving change (Behnia, et al., 2008)

Page 101: Cloud Computing In France

101

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 1 - Understanding why organizations need decision mechanisms Circumstances – “The environment”

This will always be true for every IT Department and Cloud Computing represents a solution for some of these needs for change. I developed a number of risks and issues associated with Cloud Computing and obviously some organization won’t be able to use these services (legal or compliance issues). But some other organizations, that have less sensible issues, will certainly rapidly adopt some services as some responses will be given soon regarding:

• Technology (we can envisage a manner to bypass issues related to DataBase, migration, etc.);

• Security (this being the major threat for every companies, we can envisage that large investments will be realized to address this issue);

• Availability (new solutions will be created to enhance actual solutions);

• Lock-in, interoperability, Data location, etc.

An organization does not have any control over these issues but providers, consulting firms, software vendors and legislators are expected to provide solutions for these issues, letting the organization the possibility to deal only with issues it can work on by itself. The only remaining blocking points will then be:

• The maturity of an organization which processes or management, for example, may be heavily impacted; and

• The absence of real strategy and governance processes.

To find a way to resolve this, the right governance will have to be applied by the CIO with the appropriate decisions based on the identified mechanisms:

• Strategy alignment: identify how the strategy can be improved with Cloud Computing (Balance scorecard);

• Eligibility of the applications: how can an organization choose the right custom applications for outsourcing;

• Choice of the relationship with a provider: what is the best relationship for an organization depending on the expected services;

• Coherence with the internal maturity: evaluate the gap between the existing and future situations;

• Gradual rise of this maturity: define phases, roles and objectives to reduce the gap.

The above is even more relevant for SMEs or startups that already have, or will have, specific applications in their information system. For them, spending a large amount of money upfront on something that may not be their core business (infrastructure and platform management) should be less and less compelling. Their processes can still be quite easily changed to develop the right mechanisms from the start. The lesson is that the environment may require, in the end, the adoption of Cloud Computing services by the CIO. Some circumstances will create the right situation for such a use and it would be nonsense not to integrate Cloud Computing services in the strategy, with all necessary precautions being taken of course. Actually, it may offer a solution for the famous saying “Do more/better with less”.

Page 102: Cloud Computing In France

102

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Circumstances – “The environment”

III. Part 2 – Impact on the organization

Page 103: Cloud Computing In France

103

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Strategy

Cloud Computing services offer a new way to consume IT resources, thus providing organizations with a way to be closer to the needs of their customers, while still have differentiating applications and focus more on value-added services. Organizations that have chosen to use this type of service have been able to understand all existing risks and realize that a genuine strategy is needed to still be able to keep some control. Depending on the relationship with the provider and the type of services outsourced, consistent with the global strategy, an organization will experience some transformational changes as it integrates technological, process and human factors:

• An internal reorganization of the IT department’s processes and resources;

• A new positioning of the IT department causing a paradigm shift in the structure of the organization; and

• A better alignment with the business strategy and how the organization works.

We will develop our analysis according to the 7S model from McKinsey (Pacale, et al., 1981) with a focus on the Strategy, Systems and Structure how they influence the other “Soft” elements: Shared values, Style, Staff and Skills.

III.1. Strategy

Strategy is the key for an organization to develop its activities and achieve the long-term objectives. As we have seen in Part 1, choosing to use Cloud Computing is already a strategic decision; however, we only had a glimpse of the decisive impacts it has on the overall strategy of the organization.

III.1.a. Outsourcing is, by definition, a strategic decision

Using PaaS and IaaS services for the migration or the development of an application will be mainly for cost reasons at first, if the economics are interesting. But Cloud Computing is about outsourcing a number of tasks that were done by an organization, whether there is a strategic relationship with a provider or not:

• Maintenance of servers, storage and other components;

• Advanced provisioning with the constructors;

• Middleware management (for PaaS services).

Doing so, two aspects are appearing: a focus on the core business and some employees that will not have to do this job anymore. Some particularities of PaaS and IaaS Cloud Computing services over traditional outsourcing are:

• Business Process Outsourcing of operational tasks (and not a complete service that is built around the process of an organization, like Human Resources Management or Event Management);

• A possible relationship is the absence of relationship, and one key characteristic of Cloud Computing is the idea that the customer has a certain freedom (self-provisioning, etc.); and

• Migrate an application in the cloud does not necessarily mean cost savings.

However, this particular outsourcing raises as many questions as traditional outsourcing do and, if generalized, operates a radical change in the strategy.

Page 104: Cloud Computing In France

104

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Strategy

III.1.b. No longer restrict customers’ demands

The first impact is on the perception of the final users. One time limited, Business Units do not have to limit their strategy to the existing infrastructure. Resources that were once onerous, limited and complex are now accessible, easy to configure and paid by use. The strategy of an organization or a business unit should not be curbed because the IT department does not have the reactivity or enough resources for a new project or an event.

The customers of the customers also have some needs and a way to reduce customer churn is to deliver better: have a significant user experience for critical applications (low latency, availability), business continuity for web application and sites, and continue innovating by introducing tangible value.

III.1.c. The IT Strategy

The Business Strategy should reflect what an IT department can do and what the IT strategy shall be. Decisions made without the participation of the IT department could create some of the risks we already talked about. We will detail more extensively in the Structure part the consequences of bypassing the CIO when the decision to outsource or not some specific applications is taken. But in order to be proactive, the IT department must implement an IT strategy, preferably based on a roadmap, to understand what benefits are accessible and what policies must be implemented.

III.1.d. IT, to influence the Business strategy

The IT strategy can even influence the Business strategy. Cloud Computing introduces new usages: for example the use of resources for a short period of time or the punctual use of resources. Organizations can experiment with the Cloud and create Proof of Concepts for innovation for example. In other words, the organization can test new projects relatively quickly and stop them if the return is not satisfying or the project is a failure. We can imagine the introduction of a new capability in a software if the organization is an Independent Software Vendor or an online application for eBusiness website (the example of the New York Times).

Béatrice Rollet, Head Marketing for COLT Managed Service France, a European provider

“Cloud Computing will be important for the strategy of the organization. I have in mind the

example of a French company that produces ophthalmic lenses. This medium enterprise wanted to improve its production line by reducing the delay for production and distribution. IT enabled

this company to achieve its objective and allowed it to gain important market shares. For it to be possible, the company should not be hampered by the engine, the IT.”

Page 105: Cloud Computing In France

105

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Strategy

On the one hand, Cloud Computing can facilitate innovation through these new usages and, on the other hand, the corresponding cost savings can be reallocated to finance other things, like innovation, process optimization and maximization of performance.

III.1.e. Strategy maps

A strategy map is a visual representation of the strategy of an organization (Kaplan, et al., 2001). It illustrates how the organization plans to achieve its mission and vision by means of a linked chain of continuous improvements (Wikipedia, 2009). For a commercial business (here an eBusiness web site or Independent Software Vendor), the strategy map illustrates the long-term game plan or competitive strategy to achieve increased profitability. For a nonprofit or governmental organization (here the IT department), it illustrates the plan by which the organization intends to improve performance of its mission.

The following strategy maps does not present the real strategy of an organization, nor provide best practices, but simply illustrates what could look like a strategy map where Cloud Computing services are used to achieve the fixed goals.

The IT Department – “Large Organization”

Figure 43 - Strategy map of an IT department

The customer perspective has been replaced by the partner perspective: the business departments. We see from the above Figure that the strategy has an important place and must follow the business

Page 106: Cloud Computing In France

106

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Strategy

needs. The right combination between innovation and control will have to be found in order to “deliver according to plan”.

e-Business web sites/ Independent Software Vendors – “SME”

Figure 44 - Strategy map of an eBusiness web site or an ISV

Those types of companies are intimately linked to their information systems as it is very often their only source of income. Flexibility, rapidity and innovation are their only way to differentiate themselves from competitors. Cloud Computing services need to address those needs.

Strategic measures and targets will have to be defined by the organization, based on those strategy maps. For the Internal perspective, which explicitly underlines the role of those services, organizations could have the following characteristics [Strategic objective – Strategic measure - Target]:

• “Create new projects quickly” – Time to launch a new project – Reduce time by 50%;

• “Offer flexibility and scalability” – Number of users that were not able to access the service, or accessed to a low quality service – Reduce by 90%;

• “Cloud Strategy and Governance” – Review applications and infrastructures in a committee responsible for the eligibility – Analyze 50% of those applications and infrastructures;

• Etc.

This exercise to develop a strategy map will help a company to understand where it is now, where it wants to be and how to get there. An organization that spends large sums of money to “Run IT”

Page 107: Cloud Computing In France

107

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Strategy

could find it beneficial to develop a new strategy based on the use of Cloud Computing services (either migrating custom applications or launching transformational projects).

Page 108: Cloud Computing In France

108

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

III.2. Systems

Cloud Computing will obviously have a transformational impact on the systems of an organization because with the Cloud Computing, the IT department will move from the control of an infrastructure to the control of a process. The information system is divided in multiple geographic locations that can be controlled by different actors: the IT department, French providers, non-European providers, etc.

Before explaining all the impacts, it is important to understand what is the maturity of an Information System for a given organization. The simple figure below shows that four types of situation exist: from an IS that is very expensive and does not offer value, to an IS that can provide a competitive advantage.

Figure 45 - Path of progress for the Information System (CapGemini, 2008)

With Cloud Computing, early adopters from SMEs and large organizations could theoretically access the first and second situations:

• Part of the maintenance on the infrastructure level can be outsourced;

• High flexibility and agility;

• Project can be stopped any time with certain providers;

• Outsourcing of certain applications provide cost reduction; and

• More time to think and urban the Information System.

Startups could even start directly with a “controlled” information system giving them a good base to develop their activities and evolve easily when necessary.

CapGemini consulting firm calls the “abyss” the situation where an organization start investing in IT without the returns it was waiting for. PaaS and IaaS services could help the CIO to “jump the abyss” but he will have to understand the overall impacts on all processes in order to benefit from these services.

Page 109: Cloud Computing In France

109

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

III.2.a. Internal reorganization of the IT department’s

processes and management

Some IT departments have a strategic place in an organization, others are considered as cost centers, but they are all trying to get more maturity to improve the service they provide. SMEs and large companies know that information is one of the most strategic resources inside an organization. The early adopters that will use PaaS and IaaS services in the next months will still need to collect, analyze, product and distribute information without problems. Thus, they need to understand what the potential impacts on the IT department are, regarding: management, realization of new projects, assurance of quality and employees. To help us understand what the changes are, we will look at the ITIL framework which deals with those types of issues.

ITIL Service strategy

The first service of ITIL, Service Strategy, suggests that the “[IT department’s customers] do not buy products but the satisfaction of particular needs” (ITSMF - The IT Service Management Forum, 2007). To provide the right services, the IT department needs to have a clear strategy on: “the services offered, the providers offering the services, the perception and measure of the services, the financial management, the allocation of resources, the combination of internal and external services”, etc.

The Cloud Maturity Model outlined in the third part shows that, initially, organizations will experiment Cloud Computing with an additional set of infrastructure that would co-exist with the existing traditional infrastructure. Thus, the first key process that will be impacted will certainly be the Service Portfolio Management because the use of a new service leads to the complete description of the new service which includes at least the business case, the value of the service in the portfolio and the approval. Those 3 characteristics will be difficult to complete because the comparison between the services offered is not easy (why is the business model better?) and some policies could limit their use.

Financial Management is also impacted in 3 ways. First, we will see an improvement of the chargeback to the departments that use IT services if the virtual servers, storage, or applications developed on PaaS platforms are correctly managed, because organizations will be able to trace the final users more easily. Second, the economic model “pay-as-you-go” shows that an organization can take less financial risks with an allocated budget, for the IT department, that is more closely linked to the revenues. But this model can represent a danger if the management of the IT resources is not controlled because of the dynamic and automated nature of the environment. The estimation of the budget on a one-year period will be based on the growth of the activity of the organization, but server sprawl is a reality in a virtual environment.

The last key process impacted is Demand Management because Cloud Computing represents a solution which allows for the “uncertainty of the demand”. With the Cloud Computing, organizations will not experience an excess capacity issue since the capacity will automatically meet the demand. Such an improvement does not mean that an organization does not have to control the demand.

ITIL Service Design

Service Design, within the business change process, is defined as the “design of appropriate and innovative IT services with the following goals”: “identify and manage risks, design secure and resilient IT infrastructure and environments, design measurement methods and metrics, maintains

Page 110: Cloud Computing In France

110

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

processes and policies, and develop skills and capabilities within IT” (ITSMF - The IT Service Management Forum, 2007).

Some processes of Service Design will be automated when others will have a greater importance. For example, Service Level Management and Capacity Management are task that can be easily automated with the right tools because it is easier to have an overview of the entire infrastructure and platforms, and the corresponding agreements. A point to emphasize is that, although the CIO will get clear SLAs on the provided services, the monitoring part of those 2 processes will still be necessary for determining whether the provider meets the requirements. The nature of Cloud Computing is also to address availability issues deferring part of the problem of Availability Management to the provider according to customer needs. Still, Service Design has to focus on what is the needed availability: a non-critical service may only need a 95% availability rate when a critical service (for example an eBusiness website) should need the maximum availability possible because a lower percentage would result in a loss of revenue. With a proper management and classification of the services (see CMDB in ITIL Service Transition), the IT department will be able to really choose and improve the availability needed for the service and not the availability of the underlying systems and infrastructures.

IT Service Continuity Management can be addressed with Cloud Computing solutions by introducing risk reduction measures and recovery options at technical level. We have seen in the second part above, however, that some risks may be too serious for a company (lock-in issues for Platform-as-a-Service, or network issues need to be taken into account). Those services need to be integrated in the global Business Continuity Plans. The choice of services from providers that cannot be trusted will have a direct impact on this process. The same problem exists with Information Security Management where security issues that could appear in Cloud Computing need to be addressed with the overall corporate governance framework. This will be difficult if the existing policies are not applicable in the Cloud environment. An organization may have to compromise between the strategy to outsource a service and the need for security. This process may also be responsible for the result of potential audits of providers as explained in this thesis.

Of course, the largest impacts will be on the Supplier Management process, simply because the number of providers will be higher. This will result in an increased complexity and a larger perimeter for the process, for example to determine whether the providers perform according to the terms and conditions of their contracts.

ITIL Service Transition

Service Transition “delivers services that are required by the business into operational use” (ITSMF - The IT Service Management Forum, 2007). The purposes are: “ensure that the service can operate in foreseeable extreme or abnormal circumstances, identify the stakeholders within suppliers, customer and other areas and adaptation of service design where the need is detected during transition”.

The Change Management process is the key activity of the Service Transition because all changes are “recorded, evaluated, authorized, prioritized, planned, tested, implemented, documented and reviewed". PaaS, IaaS and virtualization in general provide a fast access to the IT resources, accelerating at the same time the process of Change Management. This evolution to a real-time management is important in terms of Financial Management. Since resources are paid when they are used (often by the hour), the organization will still pay for these resources, whether or not they are

Page 111: Cloud Computing In France

111

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

needed, in case the process to stop using them has not been implemented. Impacts of automation on Change Management can have serious consequences and need to be analyzed by the IT department as this is something which could jeopardize the estimated ROI.

The process of Service Asset and Configuration Management controls internal and external resources and Cloud resources add a complexity over this management with new Configuration Items. The number of Configuration Items could increase significantly and this is why the importance of the CMDB (Configuration Management DataBase) will also increase. Thus, mapping the data, the services and their dependency relationships will become vital so as not to lose visibility on the new assets. Change Management requires real-time management and the CMDB will have to support this characteristic when, before, it was updated only on a daily or weekly basis.

As a first step, it is important that some processes be strengthened. The Service Validation and Testing and the Evaluation processes will be the right services to analyze with a Proof of Concept if a project is right for Cloud Computing services. This process will have to define what the right SLAs are and if the other processes implemented will be mature enough for the adoption of a new Cloud service. An interesting point is that with Platform-as-a-Service and with some Infrastructure-as-a-Service solutions, the Service Validation and Testing and Release and Deployment Management will simplified because they will be integrated and automated in a global solution.

ITIL Service Operation

Service Operation’s purpose is to “deliver agreed levels of service to users and customers, and to manage the applications, technology and infrastructure that support delivery of the services”.

Due to the nature of Cloud Computing and virtualization, which offers new possibilities for business continuity (automated resolution of problems), some processes like Problem management, Event management or Incident Management will likely be easier to achieve on the infrastructure level. The staff can focus then on the custom applications or development issues that are really important for the organization. Routine interventions may be automated and recurring incidents eliminated.

Particular should be given to the Request Fulfillment and Access Management processes because of the self-service access to IT resources. Agility and control must be balanced so that users still have the benefits offered by Cloud Computing (simplicity of access to resources, etc.) but within a frame defined by Service Operation and respecting the policies of Service Strategy. All Cloud Computing issues regarding confidentiality, integrity of data and intellectual property are managed within the Access management process. The impact of Cloud adoption on this process is very serious and should be emphasized.

ITIL Continual Service Improvement

While Service Strategy and Service Transition is highly significant at the time of the decision of Cloud adoption is taken, Continual Service Improvement will certainly reveal issues that had not been detected before, when using these services. The purpose of this service is to “maintain value for customers through the continual evaluation and improvement of the quality of services”.

The CSI service will present how it is possible to improve the value of a service: the establishment of goals and measurable targets will determine if an organization will increase the use of Cloud

Page 112: Cloud Computing In France

112

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

Computing services in case of success or stop using such services if there was no improvement or worse.

We can see some obvious metrics that can be used to analyze the impact:

• Technology metrics: SLAs for a specific PaaS or IaaS service, average time to solve an incident, utilization rate of the resources, etc.;

• Process metrics: Number of problems or incidents automatically resolved in Incident or Problem Management processes, Time needed to add a change request in the CMDB, gap between allocated budget and consumed budget in the Financial process, etc.;

• Service metrics: Response time (time needed for an end-user transaction to complete), System agility (alignment of IT versus workload over time), etc.

Lionel Pelletier, Senior Consultant at COLT, has been the CIO of numerous French organizations, is ITIL certified and he had the opportunity to implement ITIL on several

occasions for large groups.

“If we look at the ITIL processes, we can see some important impacts on the internal services and processes.

Configuration Management will become more complex with Cloud Computing. I think that the entire model should be rethought because of the introduction of the virtual dimension in

comparison with the existing dimensions that are: - Identity;

- Hardware; and - Software libraries.

Continued Service improvement will become important. The acceleration of the service will create new issues around the fluidity of the processes. Thus, the management of the processes

will have to be significantly improved.

Finally, Service Transition will impose deployment acceleration as a general rule.”

Page 113: Cloud Computing In France

113

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

The following figure is a graphical overview of the impacts on the processes of the IT department:

Figure 46 - Control the process, overview of the ITIL schema (ITSMF - The IT Service Management Forum, 2007)

Towards Greater maturity

Looking at the impact Cloud Computing may have on the ITIL services allow us to understand that the adoption of new services will certainly create management issues within the IT department, being overtaken by the events.

Even a Private Cloud can create some of the issues as I recently heard at a Conference on Cloud Computing (vi). One of the participants with whom I was discussing told me that he was tasked with the deployment of virtualization inside his organization and that he experienced numerous problems with the management of these servers. The different users created hundreds of virtual machines that where not stopped at the end of their utilization. The administrators were not able to understand who was using these servers and so, didn’t know if they could get rid of the virtual machines. The organization ended up paying for a large number of licenses for the operating systems and the

Page 114: Cloud Computing In France

114

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

applications on those virtual machines. He said that he considered the possibility of stopping using virtualization as the projected ROI has not been reached. He questioned whether the adoption of IaaS services would not aggravate the problem since some resources would be paid for use.

Whether an organization is ITIL certified or not, those impacts will be real on that organization. We can understand from all those findings that the adoption of Cloud Computing is not transparent for the customer. Without the proper processes and Service Value chain (ITIL or not), an organization will certainly create new issues that will reduce the expected benefits.

We already addressed the question of the maturity and we can say that the more the organization is mature, the more it will benefit from these services. At the same time, this is a significant opportunity for organizations to implement mature processes.

Guillaume Plouin, Head of the Cloud Computing offering at Octo Technology and author of the book “Cloud Computing and SaaS” (Dunod).

“Cloud Computing is a great opportunity to have services with clear SLAs with cost controls because organizations always have serious difficulties in establishing service guarantees in-

house and knowing what is the benefit of IT against the cost. Cloud Computing providers are capable to charge on CPU utilization, bandwidth or storage for example. Cloud users are

becoming more mature than what I can see in other companies because they directly have to use best practices. In a way, Cloud Computing is more in line with ITIL than what IT is in most of

French companies. An organization that uses Amazon Web Services knows exactly what services it pays for and

maybe this is also a way for startups and SMEs to structure their processes like major organizations and maybe better. This is possible because Cloud Computing providers are very

well structured because they are industrials of infrastructure and platforms operation.”

Page 115: Cloud Computing In France

115

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

III.2.b. Realization of an application VS Migration of

an application

From the beginning, we have identified two moments where Cloud Computing can be used:

• For the realization of an application (new project); and

• For the migration of an application in the cloud (existing application).

If we look at the complete lifecycle of an IT application, we have the following overview:

Figure 47 - Application lifecycle, adapted from the project (Hugon, et al., 2009) and operational lifecycles

The three identified phases are:

• Analysis and Conception: “Writing a project plan”; o The requirements of an organization launch this step; o This is the traditional step where the perimeter, budget and resources are chosen

with the inputs of the project; the planning, quality, governance and risks are defined regarding to goals and policies of the organization; and documents are realized to specify what needs to be done (by in-house staff or a third-party integrator).

• Development to Production: “Realization of the project”; o The project is realized (it depends on the method of development – iterative, V cycle,

agile -, but usually Development, Test, Recipe and Documentation) and deployed;

Page 116: Cloud Computing In France

116

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

o The projects ends with the capitalization of knowledge where everyone on the project make an assessment;

o Project management will be very important here as it controls this important phase (All projects failure happen during this phase). Also, throughout this phase, communication to and change management of the future users will be important if an organization wants to successfully install a new application.

• Operate on the application in production: “Operational/Production and maintenance phases”

o This phase differentiates the operation and maintenance of the applications and the underlying infrastructures. We often associate it with the “RUN” phase: organizations dedicate here 80% on their IT budget on average.

o We learned from ITIL that the Continual Service improvement helps in the management of application and infrastructure. It can go back to “defining requirements” if the organization needs an evolution on the application.

o The last possibility is for an organization to stop using an application (“death”).

This figure will help me identify the phases that will be impacted on a French SME or Early adopter, with the use of PaaS and IaaS Cloud Computing services.

Page 117: Cloud Computing In France

117

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

Infrastructure-as-a-service

Infrastructure-as-a-Service allows an organization to obtain servers, storage and bandwidth resources at any time. During a project, the organization can decide to make all the realization in the Cloud or after developing in-house. For an existing application, the organization will do it while it is still in the operational phase. If we use the previous application lifecycle and highlight the specificities, we obtain the following figure.

Figure 48 - Application lifecycle with Infrastructure-as-a-Service

The realization of an application in the cloud using Infrastructure-as-a-Service will not change fundamentally but project preparation is essential. In effect, Cloud Computing introduces the following possibilities:

• Use servers in the Cloud for development, test or recipe, or a combination of those;

• Deploy applications, which were developed in-house, in the cloud or deploy in a private environment an application that were test and developed in the cloud;

• Mix services from different providers (including the IT department) for one phase (ex: production); and

• Use services from different providers (including the IT department) during each phase.

We have seen some specificities of IaaS services in different parts of the thesis and we will see more precisely below what an organization should take into consideration when realizing a new project or a migration project.

Page 118: Cloud Computing In France

118

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

Governance and risks

• Issues & Best practices: o Potential risks, which were explained in the first part, are found in the project.

Outsourcing the infrastructure that will be used during the project realization phase may create sensitive issues regarding security because the project may contain classified or personal data. Even if the resources used are for simple test and development, security can be necessary (firewalls, etc). As a rule, the best practice for test, development and recipe, should be not to use real data and even more if there is only basic security.

o Non-compliance with policies. It is still possible that during the realization, an organization finds that the policies defined in the governance are not respected. It will certainly be the case if the organization uses for the first time such services and the project preparation phase was not thought through. The right approach is to list all the potential issues regarding the adoption of IaaS and matching it with specification of the project.

o Backsourcing a project that is being developed in the Cloud can be either an easy or difficult task depending on the solution of the provider. We can still make two observations: it will be easier with IaaS and the issue needs to be dealt with at the beginning. Moreover, some providers have self-service solutions that can be specific to cloud environments. Specific developments need to be the less specific possible in case of backsourcing.

o Lifecycle of the resources used for the project. A project will consume resources and now an organization has the responsibility to manage temporary resources that have now a life duration which is not traditional (a few months, a few days, a few hours, etc.).

Quality

• Issues & Best practices: o Loss of quality may occur when using a different environment for development, test

and production. Obviously, the cloud environment has some specificities and test and recipe rarely recreate the exact production environment if the project is deployed in-house at the end. The same type of quality issues exists if one organization decided, for example, to develop and test an application with a low-cost provider and then deploy it into another environment (different SLAs, geographic position, etc.). The main idea is to integrate the overall process in a quality test plan that will identify the needs (scalability, security, robustness, etc.). For example, a rule might be to use the same level of SLAs, or the same provider for test and production environments.

o Integration with the existing Information System. Quality must be analyzed also with the existing infrastructure and applications because the combination of both outsourced infrastructures and on-premises ones can create some problems: latency, new errors. This could ultimately impact some applications that were not outsourced but are part of a process that use outsourced services.

Page 119: Cloud Computing In France

119

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

Communication

• Issues & Best practices: o Lack of communication with the provider during a project. Some Cloud Computing

services are accessible online with no contact from the provider. Using these new services without any help or recommendation can definitely be a time bomb because bad practices will have been established from the beginning. The “Interface model”, where a prescriber will accompany an organization to establish basic scenarios, is definitely a good solution.

Page 120: Cloud Computing In France

120

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

Platform-as-a-service

Platform-as-a-Service allows an organization to access an environment where there can be configurable data models, configurable user interface, workflow models, integration APIs, middleware, etc. During a new project, developers will find all the tools necessary for a specific task. Migrate an existing application to a Platform-as-a-Service for production will quasi impossible without development as we saw in the first part. If we use the previous application lifecycle and highlight the specificities, we obtain the following figure.

Figure 49 - Application lifecycle with Platform-as-a-Service

Using a Platform-as-a-Service will really change the way an application is realized. IT departments will be able to:

• Choose to develop an application with the specific PaaS framework from the provider;

• Use PaaS platforms to test (typology of the service) an application developed in-house; and

• Mix different PaaS services with internal services for production, creating an hybrid cloud.

Governance and risks

• Issues & Best practices: o Specificity of some developments. Some PaaS services offer a simple test

environment while some others offer a complete environment integrating development, test, deployment, also offering integration with other services and

Page 121: Cloud Computing In France

121

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

specific services (database, language frameworks, etc.). The right risk analysis should be done during project preparation, and consistent with the strategy.

o New services that have not been approved by a committee. We are in a phase where providers launch numerous new services. It is quite possible that, during a new project, the provider offer the customer to use a newly-created service. The organizations must be careful with services that were not approved by the Cloud Computing strategy and roadmap, and that were not planned in project preparation.

Quality

• Issues & Best practices: o There could be problems if there is a separation of the development and test

phases. PaaS services accelerate the creation of an application because developers can focus only on the development part. Also, we can imagine that, as a first step, an organization will develop applications that are not very complex because this is something new. The testers will generally join the project at the end but it would be interesting to integrate them at the very beginning. This is possible because some providers have services that allow multiple views by different profiles, thus enabling the testers to do unit testing very quickly. Otherwise, the organization would lose not only the time that it has gained through the collaboration, but also the possibility to have a complete view.

o Quality of the service for the development part is not sufficient. During the development, the staff involved in the project may encounter difficulties to proceed easily with that development because of the lack of adapted tools, or of the necessary degree of freedom for conducting the activity, and consequently the quality of the final product could be at risk. Clearly, the possibilities are limited to the environment proposed in the service. A way to avoid this is to test the service on small projects (proof of concept), look at the quality of the service and then start using it for more complex projects.

o Faulty assessments of the technical specifications. During the development, a project manager can discover that some faulty assessments were done and that the technical specificities of the project are not suitable for a PaaS environment. Project failures are not as disastrous as they were before because the resources are consumed only for the duration of the development and of the project itself, without a large investment upfront, and it is possible to stop at any time that activity.

Communication & Change management

• Issues & Best practices: o Use the time saved for more Change Management. Launch a project with PaaS

services is very quick because the entire environment is already available and developers can start as soon as they have the technical specifications. The time saved on development can be spent on change management: train the users, implicate them, etc.

Third-Party integrator

Page 122: Cloud Computing In France

122

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

• Issues & Best practices: o Shorten developments mean closer relationship with a third-party integrator. An

organization can choose to outsource the development of the application but still choose to host it with Cloud services. This could complicate the relationship with a third-party integrator as the project will be shorter but more intense in terms of exchange between the two organizations. In effect, with some PaaS solutions, the organization will be able to see what the third-party integrator is doing (it is an online platform) and give some feedback.

I have tried to emphasize earlier some possible impacts of PaaS and IaaS services on the way projects are planned; however, some new impacts will certainly appear as these services will be increasingly used. Only a small number of companies have used IaaS services, and a smaller number have used PaaS services. Consequently, the first Return on Experience will be key elements in the success of this type of services.

Laurent Dupuytout, CEO of the French consulting firm AVS Consulting, expert in Cloud Computing solutions and realized integrations on PaaS platforms.

“The governance tool that was realized on Force.com PaaS platform was finished very recently

and we got a very interesting feedback from our customers.

First, there was a global respect of timing and costs, even if it was postponed by one week and a half because the need evolved during the project.

Second, because the customer has the same access to this platform as the integrator, he has the ability to see the application evolve in real time during the buildup phase. It enables both

sides to share ideas and test these ideas at the same time.

Third, regarding the project management, we have seen that the clients’ teams appeared to be totally overwhelmed. Indeed, while AVS consulting team was 100% on the project, the client’s team had to perform other tasks in parallel. Thus, there was a bad estimate of the workload

for them (software design validation and recipe). In the recipe phase, there have been changes in design, and we have seen that allowed us to make the changes.

Four, there were more developments than expected in order to let client’s administrators, that are not computer experts, make the application evolve easily with simple click and drops. The

specific development represented 20 days, which is not a very large number. In case of problems, even if we had to throw out everything and start all over again, it would not

jeopardize this major international group.”

Page 123: Cloud Computing In France

123

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

III.2.c. New Tools

With this new model, an entire ecosystem has been created around these services to help with management issues, risk issues, supervision issues, etc. Of course, new processes have to be implemented and others have to be strengthened, and this is because the processes need to be automated, or are becoming critical in terms of risks, as we have seen when we analyzed it with ITIL.

Obviously, using Cloud Computing services will have an impact on the tools that are currently used, and those which will be used in the future, by the different organizations. Software currently available in the organization do not have the necessary reactivity and cannot interface with Cloud Computing resources. Thus, to help the organization overcome these issues, some companies have created new tools to:

• Manage resources when they are in the “No-relationship model”; o Using the services from Amazon where there is an API to manipulate the resources is

great for self-provisioning and letting users do what they want. But, if new processes are developed around these services for change request, access management or infrastructure lifecycle management, the organization will want to manage more efficiently the off-premises resources.

• Provide a unique interface to manipulate on-premises and off-premises resources from multiple providers;

o If an organization does not want to have multiple environments for each provider, including the IT department, it will need a unique interface that authorizes the management of resources that can be anywhere in internal or external clouds. Complexity is thus reduced and it is easier to have an overview of the global infrastructure.

• Integrate ITIL best practices in a software created for all Cloud environments; o If an organization has or is implementing ITIL, it will need to be able to use the

services according to those principles. It is not the case for a majority of APIs from the providers.

• Data governance (organize data between those that should be hosted in-house and those that can be in the cloud);

o Data security and privacy is a big issue for organizations. Having a tool that will enable a company where all data are and be able to control any movement, destruction for compliance and business continuity will be an essential task.

• Apply policy enforcement for all Cloud Services. o An organization will possibly need to apply policy enforcement measures for all

applications in the Cloud with a defined governance: authentication, confidentiality, routing, SLAs, alerts, events, authorizations, integrity, audit, monitoring, etc. Those policy enforcement measures can be applied on incoming traffic (ex: a third party PaaS application that need to access data locked on-premises), outgoing traffic (ex: unsanctioned use of PaaS components by well-meaning developers, monitoring of authorized cloud service activity) and Cloud services (ex: protect data and applications from unauthorized use, manage the distribution of requests to application instances between vendors).

Page 124: Cloud Computing In France

124

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

See Annex VII for more information.

III.2.d. Impact of the new billing

The new economic model will have an impact on all activities that are connected to budget construction. The traditional model, under which an organization created the budget for the following year, is being questioned. At the same time, an organization knows exactly what it is paying for (resources consumed, etc.) and it is assumed that it can pay more for a short period if there is a growth of the activity. Organizations have to forecast over the years how will evolve the application and prepare the budget accordingly. This model will be difficult, for example, for French government agencies which cannot exceed the budget when it is fixed at the beginning of a year.

All Information Systems that cannot integrate this model will have some issues:

• Forecast management may need to allow re-planning;

• Purchasing management is changed because resources are not bought but rented (pay for use);

• Order fulfillment and logistics management: resources bought in the cloud are available very quickly whereas the logistic may impose a lengthy process in reality; etc.

Is this new model interesting for an organization? A first answer is that, if the billing that is chosen corresponds to the business model of the organization, it will certainly result in a significant advantage. For the moment, the appearing business models mix different elements: number of users, CPU consumed, incoming and outgoing traffic, and storage used, etc. This call for two remarks to be made: these models may not be integrated in the existing information system, thus creating new issues, and these models may not be the ones that will be of interest to the organization.

I recently discovered that employees in an organization used Amazon Web Services to access quickly servers with a view to developing and testing an application. There was no management whatsoever around this action (security management, purchasing management, etc.) and these employees presented afterwards an expense claim to the organization. Obviously, this needs to be integrated in the management of the expenses, with a dedicated process, including because of the possibility for abuses.

Henry Peyret, Principal Analyst at Forrester.

“Billing will be very important: the real flexibility for the organization will be its ability to select the billing model that is interesting for it. A small number of providers are offering the possibility to choose the billing model, not imposing their own new model but rather offering a wide range

of billing models when the organization contracts the service. Obviously, the organization will know the billing model that will best answer to its own need for flexibility and for now the

flexibility is closer to the provider’s consumption (CPU, bandwidth, etc.). An example of model for the organization could be a transaction payment model, a time spent model or volume used.”

Page 125: Cloud Computing In France

125

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

III.2.e. Contracting

We indicated previously that a Cloud Computing contract looks like a usual outsourcing contract with some specificities. Unlike outsourcing contracts, there is no return on experience from the first contracts that were subscribed. Surely, those contracts will not be as rigorous as some organizations would like them to be. Besides, Cloud Computing introduces the click-wrap contract in the professional sphere: this is a contract where there is no negotiation possible and that is not even read

or analyzed. Cloud Computing contracts can be established between two French companies but it is more likely that they will be done in an international context since a large number of providers are non-European. These situations underline issues that must be controlled in a contract.

Click-wrap contracts

By definition, a click-wrap contract is a contract where a customer can only have two options:

• Accept all the clauses – “Validate”; and

• Refuse the contract if only one of the clauses does not meet the requirements – “Refuse”.

Those contracts are used every day on internet by final users that do not read what the conditions are. The easiness to access those types of services by anyone is proportional to the risk that organization may experience. Here are the issues and best practices for those types of contracts.

Issues

• ① No customization of the contract: the specificities of the organizations or applications are not taken into account because it is impossible to contact the organization and negotiate the contract with their lawyers. If the SLAs do not respect the requirements, or if some clauses do not respect the internal policy, it will be the responsibility of the customer to determine if it is acceptable to take the risk under those conditions.

• ② No legal officer in the process: any employee can easily access the services and accept the click-wrap contract without validation from the legal department. The provider does not require any assurance from the customer who can be anyone in the organization. Basically, anyone can use those services and put on the cloud data or application that does not respect the internal policy and that can entail serious legal issues, resulting in financial penalties for the company. Some clauses from the providers could create a genuine risk, like “Provider can change the terms of this Agreement without prior notice to customer”.

• ③ Privacy and Intellectual property clauses: the contract needs to answer to basic questions regarding privacy or intellectual property issues. The protection to be granted to information collected on the use the client is making of the various services should be stipulated (the contract containing indications where this information is stored and on who can have access to that information etc.), and in particular whether the provider have some rights on the corresponding data. Although PaaS and IaaS are less impacted than SaaS (for example with advertising on the screen based on organization data), the users of the services need to be aware of the different risks related to privacy and intellectual property issues.

• ④ SLAs not indicated or do not have metrics: some SLAs are technical and may not be formulated in a precise manner, different possibilities being offered depending on changing

Text approved by Isabelle Issert de

Braux, lawyer at COLT Telecom

Page 126: Cloud Computing In France

126

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

situations. For example, incoherent information may be given in the contract for Guaranteed Response Time and Guaranteed Fault Repair Time that can expressed either in monthly or annual numbers. If no metrics are given for the client to understand the information, those numbers should not be trusted.

• ⑤ Financial compensations: compensations must be clearly indicated in the contract with the SLAs. Some services will not provide sufficient compensation to balance the loss in case of non-respect of the SLAs. This type of contract does not address the specificity of the application, and consequently it is the sole responsibility of the customer to manage the risks. For example, in Amazon EC2, the contract generally provides that compensation will be granted only for failure of the hardware, and thus no commitment is made based on the potential loss related to the specificity of the application: “You are personally responsible for all Applications running on and traffic originating from the instances you initiate within Amazon EC2”.

• ⑥ Other data issues (data retention, data movement, duty of care, etc): these elements must clearly be indicated in the contract.

• ⑦ Arbitration and Mediation in International Contracts: some contracts may stipulate dispute settlement procedures particularly burdensome for the client (for example imposing arbitration and excluding mediation), or an attribution of national law jurisdiction which is not favorable to the client.

Best practices

• ❶ Partner legal and technical teams to analyze the contract: lawyers are generally called to intervene only when the organization could face a threatening issue, and they may not be involved in the early stages of the negotiation, something which can create dramatic situations. As much as possible, legal teams and technical teams should decide whether it is desirable to use a service, and if so in which configuration (data location, securities), before actually start using such a service, even if it would appear very simple to access the service without bothering with much advance scrutiny.

• ❷ Do not accept a contract that has a clause which does not meet the requirements. This looks like very strict advice but, if a client would accept such a thing, any application or data hosted in the provider’s premises should then be considered as compromised. Thus, specific uses like simple test projects that do not contain sensitive data may be used on those types of service and nothing else. Even those simple projects should be closely monitored by the legal, compliance and technical teams because the contract does not reflect the kind of engagement desired.

• ❸ Create a list of authorized providers: the best way to be proactive is to choose a number of providers that offer services in a click-wrap contract way after having carefully reviewed the conditions and find them acceptable; this would normally apply to SLAs of providers that really explain the nature of their services with sufficient transparency, and this, for a certain type of applications and data.

Custom-made contracts

Custom-made contracts are obviously the preferred ones because they provide the organization with the possibility to negotiate, enabling the service provider to take into account the specificities of the

Page 127: Cloud Computing In France

127

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

client. By definition, if this is a custom-made contract, organizations and their lawyers will be able to enter into a genuine dialogue with the providers, but that doesn’t mean that there are no potential issues to consider.

Issues

• ⑧ End of contract: the major issue is the end (expiration or termination) of the contract which will rarely be covered adequately in the contract. This raises the concern, already referred to in the thesis, regarding the reliability of the services or providers for a long period (recovery, long-term viability). The best example is the company called The Linkup which closed in August 2008, letting 20 000 customers paying for storage without the possibility of getting their data back (Krigsman, 2008). Obviously, nothing was specified in this contract regarding what would happen if such a situation, i.e. the unexpected closing of the company, would materialize.

Best practices

• ❹ Assurance of legal and compliance requirements: all requirements regarding compliance need to be detailed in the contract. This will be an assurance for the customer in case of audit, and, by the same token, it will demonstrate good faith on the part of the client.

• ❺ Use Professional Services and specify how the provider interact with the organization: the use of experts is a good choice as it is will consolidate the strategic relationship and help the provider getting a better understanding of the organization’s activities and of the sensitivity of some data and applications for that organization. This solution really defines how the organization really collaborates with the provider: this is a win-win situation for the relationship of the parties (i.e. contributing to establish confidence between the two parties and supporting the potential evolution of the perimeter). The contract must stipulate how is conducted the communication between the organization and the provider (form, duration, timing etc.). The conditions for enabling the provider to intervene efficiently must be formulated precisely for the different steps: the call, Guaranteed Response Time and Guaranteed Fault Repair Time, all this being dependent on how critical the applications are.

• ❻ Integrate audit clauses: to ensure continuity in the compliance, it is necessary to write how often and in what perimeter the audit need to be done. This is an assurance that the provider will comply with the necessary requirements throughout the duration of the contract. The contract will have to specify the human and organizational resources, and the information and different tests being required.

• ❼ eDiscovery should be discussed: this matter can be a sensitive one because it can result in a substantially more complex contract, thus inducing delays in the negotiation and adjustments in the pricing schedules. But if the contract is silent on this aspect, the cooperation and costs of the service provider will be unpredictable.

• ❽ Information on subcontractors: providers can also have subcontractors that can realize some specific tasks like migration, archiving or backup. Of course, the lawyer will prefer to select a provider that does not subcontract, since this will facilitate compliance with the requirements and for obvious security reasons. If sub-contracting cannot be avoided, it would be important to regulate it carefully in an appropriate framework.

• ❾ Difficulty of changeover periods: Isabelle Issert de Braux underlines the need to regulate precisely the changeover periods, during which you move from the existing service to the

Page 128: Cloud Computing In France

128

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

new one (migration), and the case of reversibility and transfer so as to be able to prepare the end of contract. All the conditions must be explained, and more particularly those that would trigger the changeover period. In the case of reversibility, the perimeter of the information recovered must be defined, and more importantly the manner in which such reversibility will be realized (processes, technics) has to be specified.

• ❿ SLAs defined with Key Performance Indicators: during the operational phase, the SLAs must be clearly respected and analyzed with KPI specified in the contract to control the quality.

• ⓫ Analyze in case of non-respect of the SLAs: with the financial compensations, it is advisable to indicate in the contract that all failure to the SLAs will result in documented diagnoses addressing, for example: What caused the issues? For how long? and How was it solved?. The contract must clearly indicate that providers have to provide the maximum degree of transparency on their analysis, because the default solution would be for the provider to give minimal information, without revealing what faced the organization in reality.

• ⓬ Benchmarking clause: this clause is possible because of the nature of the contract that has a longer duration than click-wrap contracts, for which the service can be stopped at any time. That will be important if you need to compare the service that you pay for and the same one offered by other companies at a significantly lower price. As a result of that comparison, the organization may consider it appropriate to renegotiate the contract.

18 subjects to look for in a contract (①: issue; ❶: best practice) Scope of services (cover the services being delivered): ⑥, ❷, ❸, ❹, ❻, ❼, ❽

Innovation (evolution): ❺

Performance (you would like to achieve): ①, ❸

Investment (how willing go we want to invest and actually improve it): ❺

Responsibilities (who is doing what?): ❹, ❻, ❼, ❽

Change (if someone want to change the contract or the service): ②, ❸

Contact points (within both parties): ❺ Confidentiality (who is allowed to access what type of information): ⑥, ❶, ❸, ❽

Communication (what form, what media, how often): ❺, ⓫

Announcements (how are we going to make announcements?): ⓫

Reporting (what form, what media, how often, the contents of the reports): ④, ⓫

Intellectual Property and Copyrights: ②, ③, ❶, ❽

Review (how often do we review the contract, under what terms and condition): ❿

Liability (who is liable if something happens, what amount are we liable): ①, ②, ❸, ❿

Dispute (how do we deal with disputes): ①, ②, ④, ⑤, ⑦, ⑧, ❸

Termination (what about early termination cases that could create heavy fees): ⑦, ⑧, ❸, ❾

Price and payment (for the various services being delivered): ①, ❿, ⓬

Obligation: ❷, ❼

Table 7 - The contract

We can conclude from the above that the choice of the provider will be also based on the contract that defines the relationship between an organization and a provider. Isabelle Issert de Braux considers that the price that a customer is paying will reflect the level of service the organization will be getting. Thus, contracts under which the provider offers low cost services may present an

Page 129: Cloud Computing In France

129

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Systems

unacceptable risk level. A risk analysis, which was described in the previous part of the thesis, is needed and lawyers have to be integrated in the corresponding decision. It is important to underline that, when click-wrap contract offers an increased level of flexibility, they could be considered as being more risky, whereas custom-made contracts are precisely designed to establish trust, openness and collective responsibility. The risks are shared, so are the rewards.

Page 130: Cloud Computing In France

130

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Structure

III.3. Structure

The structure of an organization depends on its culture and objectives. Cloud Computing solutions will have an impact on the way the IT department is working with other departments. A possible consequence of this closer relationship is a real change in the organization, as suggests Henry Peyret, analyst at Forrester. One may ask: what will happen to the existing decision-making processes and the role of the CIO in it?

III.3.a. A important alignment for the IT department

The first objective of the IT department / CIO is to be aligned with the business strategy in order to support the business. But strategic alignment also means that constraints and opportunities need to be included in this business strategy. Thus, some reasons for a non-alignment are given in the document published by CIGREF (CIGREF, 2002):

• “No IT strategy”;

• “No dialogue between the business, the General Directorate and the IT department”;

• “No consideration given to the potential of new services”; or

• “No proactivity in the IS function”.

To counteract these issues, Cloud Computing will present natural answers but some issues will be resolved only by creating the right structure and processes between all the departments.

Thereby, the new economic data will show exactly what the organizations are paying for, and for what is the level of services. It introduces the possibility to:

• Know what is the level of expenditure;

• What department is using the service (chargeback); and

• Know if expenses are made efficiently, and what is the return on these expenses.

This is therefore consistent with the trend in all organizations to develop a service approach with clear SLAs. Furthermore, the IT department can now have all the tools needed to create a flexible Information System.

Those natural answers are not sufficient for Cloud Computing adoption to be a success; they must be supplemented by a genuine collaboration between the IT department and all the business units. Investment in IT does not create results without proper thinking and actions on the strategy, structure, processes and skills at all levels of the organization, which is what I try to develop in this part. The following figure from the CIGREF document shows the alignment of these functions.

Page 131: Cloud Computing In France

131

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Structure

Figure 50 - Alignment of the functions (CIGREF, 2002)

Obviously, looking at this figure, it is unavoidable to think about Venkatraman’s model, which explains the relations between Business Strategy, IT strategy and the internal processes (Venkatraman, et al., 1993). The findings I gathered from the interviews I have made, and researches I conducted are as follows:

• Cloud raises interest from all managers in the departments as they are impacted through their exposure to articles in the general press. Those managers become aware of the subject without necessarily understanding all the ins and outs.

• Alignment models chosen by the organizations will be easier to achieve: o Experimenting in the Cloud with new business models for “Investment centers” (IT

innovation); o Support an intensive growth through flexibility for “Growth centers” (Business

innovation); o Benefit from cloud economics by reducing maintenance for “Cost centers” (IT

implementation); and o Develop customer value by delivering the right solutions and clear SLAs for “Profit

centers” (Business implementation).

IT can be seen as a “necessary evil” and outsourcing it to a provider does not mean that an organization gets rid of it. I believe that it is quite the opposite because, at this stage, organizations will not only focus on the technical dimension but also on the value IT will bring to an organization, and on the services and solutions can help the organization. The structure must evolve accordingly.

Page 132: Cloud Computing In France

132

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Structure

III.3.b. A new organization?

Organizations do not all have a unique model as they have specificities on:

• The relationship between the General Directorate, the IT department and the business units;

• CIO’s role (strategist, technician, organizer);

• CIO’s position within the organization (for example in the board of directors or under the responsibility of the CFO); and

• The operational and functional organization.

A simple adoption of a few Cloud Computing services could be certainly transparent for the organization of a company but, as the environment will be more complex, some experts see a potential evolution for the company itself. In fact, it is not Cloud Computing only that could push companies to adopt a new organization but a set of novelties (Web 2.0, social technologies or a changing environment for example). The experts call this organization: the Network-centric organization or Network organization.

Figure 51 - Evolution of the organization (BIT Group, 2008)

The new eco-system for an organization created by the increasing number of providers (but also consultants, key Business partners, etc.) offers more flexibility: “the informality, interactivity and adaptability of small teams of people retains a space for what we traditionally call ‘common sense’ for both understanding and action amid the accountability and constraints of the formal enterprise” (Wikipedia, 2009).

I am somewhat suspicious whether such a new model will be easily implemented inside a company because the management of such a model becomes very complex. Changing the organization of a

Page 133: Cloud Computing In France

133

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Structure

company is a long process and Cloud Computing adoption will not necessarily push a company to go along such a transformational change. But this is clearly a good evolution as the “Distributed It” organization does not have a global management of all the Information System, making it difficult to have a coherent IT strategy and governance for the Business Unit. Also, the “Centralized IT” solution is not the best solution because the IT department will not be able to offer a specific service to a Business Unit.

I will not explain in more details this new organizational model since it is now a well-known model; I believe, however, that it is still interesting to have a look at its impact on the functions of the IT department.

Figure 52 - Impact of the network organization on the IT department (BIT Group, 2008)

Infrastructure-as-a-Service can bring a real revolution because providers will “run” the infrastructure, and we have seen that the right service with the right SLAs can be applied. Establishing the same service levels for all resources is a bad idea. Platform-as-a-Service is more difficult to position on the figure because we have seen that it will be certainly used for new projects (“Change”).

SMEs and large organization will not be impacted the same way, simply because the number of employees in the IT department of a SME will certainly not allow the network organization showed above. At the same time, large companies may have more difficulty to change their organization model while SMEs can maybe be restructured more easily.

Page 134: Cloud Computing In France

134

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Structure

III.3.c. Impacts on the decision making

The last interrogation concerns the decision-making process which is an important factor in the management of the new services. We detailed in the first part some decision mechanisms to help a CIO choose what could be outsourced in the Cloud, and referred to some key decisions that he needs to make regarding the governance, the strategy and the circumstances.

But an element must be taken into account when specifying the decision-making process: the CIO may not be the only decision maker. Providers do not only target the CIOs but also the CEOs, CFOs an all the business units when they are offering Cloud Computing services. For the information, it is known that SaaS services have been bought by Business Units, which did not inform the IT department. Is this possible with PaaS and IaaS services? Although it seems quite impossible for it to happen in SMEs, this could certainly be possible in large organizations where there could be IT developers, or when a contract is passed with a consulting firm to develop a new tool.

This could be an apparent loss of power because IT resources are now easily accessible to everyone and outsourcing means a perimeter that is reduced; however, the CIO and the IT department still have important decisions to make:

• Establishing the IT strategy and the services that can be used;

• Establishing governance and security rules in the overall organization;

• Urbanize the global Information System; and

• Monitor and control the services.

Henry Peyret, Principal Analyst at Forrester.

“Cloud Computing is not a simple new technology but rather a real transition for companies. The relational model is changing from a matrix model, where Business Units are not

independent, to a model called the network model. This is not a new model but some changes will happen:

– Business Units can be entirely responsible with their customers; – Business Units have their own accounting to get the flexibility they need to meet customer

needs; - Business Units will need new differentiating services; and

- Contractualize internally with flexible contracts.

Why describing this for Cloud Computing? Well, a large number of organizations are considering the opportunity of outsourcing through Cloud Computing, so as to learn how to

contractualize internally after. This is what is at stake for the next years: offering more flexibility, a service which is specific for a Business Unit. These Business Units do not want to

hear about the smallest common denominator at the highest price. This is a very profound change.”

Page 135: Cloud Computing In France

135

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Structure

The most important thing is to be proactive because if CIOs do not experiment with these services and publicize internally their results (is it possible to use these services? Under what conditions?), they will certainly be bypassed and the door will be opened for all kinds of abuse.

Henry Peyret, Principal Analyst at Forrester.

“A company will have to adopt the model offered by Cloud Computing in the right way. If the IT department does not prepare itself and does not accompany the internal customers for the adoption of Cloud Computing and the identification of the right services, it will fail. The IT

department must become an orchestrator/broker of internal and external offers, and know what the limits of the internal contracts are. It will also need to learn how to say: ‘no, I don’t

know how to offer the service requested by the Business Unit so I will use external services’. To offer predictability, the IT department must determine the limits of internal and external offers

in terms of risk and billing model. This is what most organizations try to obtain with Cloud Computing: transparency and predictability. It also means that the IT department must become

more flexible in terms of governance: to be able to tell very quickly if it is possible to offer internally the requested service or if it needs to be obtained through a Cloud services provider. Thus, it needs to be flexible in the systems but also in the decision-making, whether we choose

to buy an external service or not.”

Page 136: Cloud Computing In France

136

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Shared values

III.4. Shared values

The “Shared values” element is fundamental for an organization as it defines the common goals of all employees in the organization. We have seen in the previous elements a common factor which is the relationship becoming closer between the IT department and the business.

This is the main consequence from the adoption of Cloud Computing services. Thus, a shared value will be the collaboration between the departments. The organization is changing and for such a change to be a success, it is important to have this value shared as a common one among all employees. Employees acting only based on their own personal goals, which could be contrary to this value, could severely affect the expected benefits.

We realize that it is becoming a value that every organization should adopt. Functioning in silos must disappear because all types of issues can surface:

• Lack of consideration for business needs (collaboration between the business division and IT);

• Dangerous use of Cloud services (collaboration between the legal department and IT);

• Limited innovation (understanding by the business of the new possibility offered by the IT department);

• Bad monitoring of the services (collaboration between the internal teams of the IT department); or

• Bad governance (creation of policies that should then be explained to the IT staff)

Of course, this value is added to the other existing values, provided they do not conflict among themselves, such as to make money or achieve excellence in a particular field.

Béatrice Rollet, Head Marketing for COLT Managed Service France, a European provider

“We will see some specific values between the early adopters of Cloud Computing:

- Innovation: the directors of the organization must be interested in new possibilities, change, new horizons. For example, a director who is technophile will have in the culture of its company

the idea of trying new things even it can end with a failure. - Flexibility and rapidity: dynamism in all the organization.

- Trust: to outsource carries evidence of confidence. It may simply not be in the culture of the organization, which happen very often with French organizations. We see a lot of organization

that are consulting externally but that, at the end, prefer to work internally. - International: SMEs may not have a culture that would favor the international dimension of

activities. For the moment, most of the providers are not French.”

Page 137: Cloud Computing In France

137

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Style

III.5. Style

In order to ensure that “collaboration” is a shared value, managers inside the organization will have an important role to play. They will need to inform their staff members that collaboration is not only required to maximize the benefits of the organization but also to avoid severe risks. Failure to respect the new processes that impose on employees to collaborate with other departments can have not only financial impacts but also legal ones.

Actually, moving from the operational control of an information system to the contractual control of a risk constitutes already a real change.

Managers will have two combine at the same time two qualities:

• Be rigorous: Cloud Computing introduces new risks and issues. The policies and governance that have been implemented have to be strictly respected by staff members. It does not mean that the management style of the manager should be a military style but rather that the rules must be explained sufficiently. Employees should be keenly aware that It is not possible to do everything, nor to do things without due consideration being given to the manner in which they are being done.

• Let the staff have a certain freedom of action: Cloud Computing introduces new possibilities and change the way some of the things were done in the past. This creates an environment conducive to innovation. So, creation and imagination should not be constrained but rather controlled appropriately.

These two characteristics may appear to be, to a certain extent, opposite ones but in order to promote collaboration, both are important.

Of course, depending on the overall strategy of the organization, and the IT strategy in particular, some managers may insist on some specific characteristics rather than on others.

I don’t really see here some specificities for French organization or SMEs in comparison with large organization because it will be more about what the objectives are, and what is the culture it wants to develop.

Page 138: Cloud Computing In France

138

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Staff

III.6. Staff

Employees will, of course, be very impacted by the transformational change triggered by outsourcing issues. If we have a closer look at the staff inside the IT department, below is what would result from such a change according to ITIL services.

ITIL Service strategy

A role that will become more important is the one of Chief Sourcing Officer (CSO), whenever such a role exists within an IT department since this function is not commonly available in SMEs for example. The CSO is responsible for leading and directing the sourcing office and for the development of the sourcing strategy. Together with the CIO, the CSO will need to coordinate the Cloud Computing strategy depending on the type of relationship they have with the providers.

ITIL Service Design

Obviously, the key roles or functions for IT departments that use Cloud Computing services will be the Supplier Manager, the Security Manager and the IT Service Continuity Manager. This reflects all operational and strategic issues we have detailed previously. Other individuals will have a role that is likely to be significantly transformed: the Capacity Manager or the IT Designers and Architects, because of the outsourcing of some services and the automation of some manual tasks. One of the goals of Service Design is to develop skills and capabilities within IT: this will constitute the cornerstone for a beneficial use of Cloud Computing services.

ITIL Service Transition

The staff delivering Service Transition, generally composed of the same group of people already providing other types of support, will help determine whether a certain type of Cloud service is best suited for the enterprise, and if so, under which conditions.

ITIL Service Operation

Globally, the IT department is changing from controlling an infrastructure to controlling a process. Consequently, Technical Management functions, Application Management functions and IT Operations management functions will see their respective scopes changing. Some operational aspects, and resources management, will be carried out by the provider and the monitoring and control tasks will have more importance (status of services, Configuration Items, appropriate corrective actions).

Jobs and functions of the IT department of large organizations are described every year in the CIGREF nomenclature. Adoption of PaaS and IaaS services has a particular impact on the family called “Method, quality and security support” which regroups all the “functions linked to definition, the implementation, the control and audit of all quality, security and methods frameworks and norms consistent with IT governance”. It is not surprising to see appearing in the version of 2009, a new function called “Contract Manager” (CIGREF, 2009) whose main role is to “manage and monitor the orderly implement of the contracts with providers”. This function has a clear resemblance with the Chief Sourcing Officer in ITIL, and this confirms that it is an function which is essential, and that it is imperative to fill up the corresponding position in the organization.

Page 139: Cloud Computing In France

139

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Part 2 – Impact on the organization Skills

We see the shift that generalizes the idea that the organization needs more resources to control if the new services are working well. By outsourcing a number of tasks, some employees will not be able to continue doing their actual job or will change the perimeter of their function. We may see thus a certain law of conservation of jobs inside an organization but will the IT department need all its employees? Sadly, there is no in-depth study on the evolution of the number jobs in the IT department of French organizations, and categorized by functions. Forrester only published this year a report showing “Where the Jobs are in IT” in the United States of America (Bartels, et al., 2009). Despite the fact that computer programmer jobs continue to fall due to offshoring (-6.4% from 2008 to 2009), Forrester announces the number of computer operators will also decrease (-7% from 2008 to 2009) because of automation tools, virtualization and Cloud Computing. Simon Yates from Forrester also added to the full report a commentary: "Managed hosting, SaaS, Cloud, traditional outsourcing all threaten to move IT jobs outside the business. This is driving a change in the character of IT departments. Service integration roles (including administrators, software engineers, and network analysts) are becoming the core of IT, while programming and operations research are increasingly provided by outside vendors.” I really think that this trend will be identical in France as Cloud adoption is just beginning.

We see that French early adopters may see quickly a gap between the existing staff and the one they may require if they start outsourcing their infrastructure.

III.7. Skills

We just saw in the “Staff” element that there will be a gap between the existing skills of the employees and the skills they will need to “control a process”. Therefore, with the new functions to which employees will be assigned, and also considering the availability of new tools, the IT department will have to propose dedicated training sessions.

In order to promote new shared values, the employees will have to develop new skills, in particular collaboration tools and awareness.

We can see that, if a large number of new projects and application migrations in the cloud are carried out, the employees will clearly not have the capability to do the job as it requires specific skills. A way develop these skills is to experiment and get some Return on Experience because, as of now, only few people have these capabilities in the job market.

If we look at the global staff situation in the organization, we can suggest that a broader sensitivity for IT in general shall be developed, including at the decision makers level.

Page 140: Cloud Computing In France

140

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Skills

IV. Conclusion

Page 141: Cloud Computing In France

141

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Conclusion Skills

In a time of economic and financial crisis, the new economic model offered by Cloud Computing draws the attention of all organizations, from SMEs to large organizations. Like a large majority of outsourcing projects, Cloud Computing provide the means to reduce operational costs, thus enabling the organizations to focus on their core business and on innovation.

The subject of Cloud Computing is broadly discussed in the context of Information Technology: the general press and media are publishing numerous articles regularly on the subject and significant investments in the field are decided by every major IT companies. All consulting firms and specialists release new studies almost every day which predict a large adoption of Cloud Computing in the coming years, more precisely after 2012 according to the Gartner.

But all the economical and operational benefits still weight little compared to the perceived risks. Security is the largest type of risk for French decision makers, as emphasized by Forrester. This issue and all the others will need to be resolved before French companies start massively using Cloud Computing services.

This study aimed to focus on the French early adopters of these services, and more precisely on Infrastructure-as-a-Service and Platform-as-a-Service, Software-as-a-Service being a more mature service. The study has been divided in two parts, with a view to exploring more efficiently some of the ins and outs of these 2 services that allow an organization to host specific applications in the Cloud. The first part followed the 7Cs of Marketing to analyze everything that organizations must take into account before entering the Cloud and what are the decision mechanisms associated: eligibility, risk analysis, choice of the relationship and governance. The second part followed the 7Ss of McKinsey to analyze the impacts of Cloud Computing on the IT department and its relations with other departments. We also saw that SMEs and large organization may have different reasons leading to adoption of this model.

This study has been illustrated by numerous interviews of CIOs, consultants, lawyers, teachers and marketing managers. These interviews and all the conferences I have attended helped me understand what the organizations wanted to know on this particular subject as it was very difficult to find, at the same time, some real Return on Experience from French companies.

I believe that Cloud Computing is truly a revolution in the world of Information Technologies, and that revolutionary trend is likely to continue to in the future, despite all the marketing hype. The major investments being made are real ones and all indications show that, with this solution maturing, French organizations will adopt these services, a situation similar to the one experienced by Anglo-Saxon companies which are starting to use Cloud Computing in increasing numbers. But these French companies have to understand very quickly what are the real issues of Cloud Computing, issues that needs strategic decisions as they have an important impact on the human resources and the management. The IT department will have to offer rapidly these types of service, whether internally with a Private Cloud, that consulting firms see as a first step, and/or become cloud brokers of the public clouds to give the best services to the Business Units.

The second part allowed us to identify where there could be some transformational changes in French organizations. I can conclude that there is some urgency for these organizations to prepare their Change Management plans, taking into account a number of remarks and concepts which I have outlined in that second part. In Change Management, most of the issues are hidden as such a change depends on the attitude and behavior of all the employees, i.e. the promoters, opponents and

Page 142: Cloud Computing In France

142

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Conclusion Skills

hidden opponents. This appears with all transformational changes (changes on the technology, the processes and human), and particularly in France around outsourcing.

Organizations should start in a simple manner, by experimenting with Cloud Computing as a first step, as proposed by Guillaume Plouin, and then go for more complex uses. We have seen that there are two major scenarios with these services: migrate an existing application to the Cloud, or start developing one in the Cloud. When migrating an application could be easier with IaaS, developing in the cloud be easier with PaaS. We will then see that it can combine both needs from the CIO: pay less for IT and innovate more quickly with IT.

I will conclude this thesis by quoting Nicholas Carr, an American writer who made famous the electricity metaphor, in a report in which, among other things, he speaks about IT in 2018 (Carr, 2008):

“Just as the last century’s electric utilities spurred the development of thousands of new consumer appliances and services, so the new computing utilities will shake up many market and open myriad opportunities for innovation”.

Page 143: Cloud Computing In France

143

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Skills

V. Bibliography

Page 144: Cloud Computing In France

144

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Bibliography Skills

Academic sources

Armbrust, Michael, et al. 2009. Above the Clouds: A Berkeley View of Cloud Computing. s.l. : UC Berkeley Reliable Adaptative Distributed Systems Laboratory, 2009.

Bahloul, Karim. 2009. De la modernisation des infrastructures au développement de nouveaux modèles. Paris : IDC, 2009. Technologies, Conception, Green, Ressources et Compétences vers une nouvelle génération d’infrastructures IT.

Bartels, Andrew H, Daley, Ellen and Ashour, Madiha. 2009. Where the jobs are: 2009 US IT Occupation Trends. s.l. : Forrester, 2009.

Bittman, Thomas. 2009. A Better Cloud Computing Analogy. A member of the Gartner Blog Network. [Online] Gartner, September 22, 2009. [Cited: October 22, 2009.] http://blogs.gartner.com/thomas_bittman/2009/09/22/a-better-cloud-computing-analogy/.

CapGemini. 2008. IT Strategy. s.l. : CapGemini, 2008. Course: HEC MSIT.

Carr, Nicholas. 2008. IT in 2018: From Turing's Machine to the Computing Cloud. s.l. : an Internet.com IT Management eBook - Jupitermedia Corp., 2008.

CIGREF. 2002. Alignement stratégique du système d'information. s.l. : CIGREF, 2002.

—. 2009. Nomenclature 2009 - Les emplois-métiers du SI dans les grandes entreprises. s.l. : CIGREF, 2009.

Finishing off IT. Marquis, H. A. 2006. 4, s.l. : MIT Sloan Management Review, July 1, 2006, Vol. 47, pp. 12-15. 1532-9194.

Forrest, Will and Barthold, Charlie. 2009. Clearing the air on Cloud Computing. s.l. : McKinsey, 2009.

Gartner. 2009. Gartner says IT Organisations will invest more in Private Cloud Services than in External Cloud Providers through 2012. Gartner Newroom. [Online] October 5, 2009. [Cited: December 7, 2009.] www.gartner.com/it/page.jsp?id=1193913.

—. 2003. The Reality of IS Lite. Gartner. [Online] September 2003. [Cited: December 13, 2009.] http://www.gartner.com/resources/118500/118504/executive_summary_the_realit_118504.pdf.

Gillett, Frank E, Lee, Christina and Daley, Ellen. 2009. The State Of Emerging Enterprise Hardware: 2009 To 2010. s.l. : Forrester, 2009.

Gillett, Frank E. 2008. Future View: The New Tech Ecosystems Of Cloud, Cloud Services, And Cloud Computing. s.l. : Forrester, 2008. p. 17.

Gillett, Frank E., et al. 2009. IT Buyers Prioritize Virtualization Over Cloud. s.l. : Forrester, 2009. p. 5.

Hugon, Jean-Christophe and Loupy, Fabien. 2009. Les sociétés françaises et l’externalisation offshore - De la stratégie d’externalisation à la mise en oeuvre opérationnelle - Le cas des développements informatiques. s.l. : HEC Paris - Mines de Paris, 2009. p. 113, Thesis. Mastère Spécialisé Management des Systèmes d'Information et des Technologies.

IDC. 2008. IDC Finds Cloud Computing Entering Period of Accelerating Adoption and Poised to Capture IT Spending Growth Over the Next Five Years. IDC - Press Release. [Online] October 20, 2008. [Cited: October 15, 2009.] http://www.idc.com/getdoc.jsp?containerId=prUS21480708.

ITSMF - The IT Service Management Forum. 2007. An Introductory Overview of ITIL V3. s.l. : Best Management Practice Partnership, 2007.

Jacod, Claudine. 2008. Les grandes entreprises externalisent une gamme de services plus diverse que les PME. Le 4 pages des statistiques industrielles. Ministère de l'Économie, des Finances et de l'Emploi, 2008, 242. Download the report at http://www.industrie.gouv.fr/sessi/4pages/242/index.html.

Kaplan, Robert S and Norton, Dave P. 1996. Balanced Scorecard: Translating Strategy into Action. s.l. : Harvard Business School Press, 1996.

Kaplan, Robert S. and Norton, David. P. 2001. The Strategy-focused Organization: How Balanced Scorecard Companies thrive in the new business environment. s.l. : Harvard Business School Press, 2001. ISBN 978-1591391340.

Krawczyk, Stéphane. 2009. Le Baromètre Entreprises France - Indicateurs - Suivre les Intentions d’Achats. IDC. [Online] 2009. [Cited: October 16, 2009.] http://www.idc.com/france/downloads/research/toc/baro_entre_1_pres.pdf.

Markess International. 2009. Référentiel de Pratiques - Atouts & Bénéfices du modèle SaaS. s.l. : Markess International, 2009.

—. 2009. Référentiel de Pratiques Hébergement, Virtualisation, Cloud Computing - Edition 2009. s.l. : Markess International, 2009.

Page 145: Cloud Computing In France

145

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Bibliography Skills

Mell, Peter and Grance, Tim. 2009. Effectively and Securely Using the Cloud Computing Paradigm. [Powerpoint] s.l. : National Institute of Standards and Technology, 2009.

—. 2009. The NIST Definition of Cloud Computing. s.l. : National Institute of Standards and Technology, Information Technology Laboratory, 2009. Version 15.

Nassah, Franck. 2006. L’INFORMATIQUE DANS LES PME FRANCAISES. s.l. : IDC, 2006.

Pacale, Richard, et al. 1981. The Art of japanese management. s.l. : Simon & Schuster, 1981. 978-0671225391.

Perry, Randy, et al. 2009. Force.com Cloud Platform Drives Huge Time to Market and Cost Savings. s.l. : IDC, 2009. p. 19, White Paper. Sponsored by: Salesforce.com.

Plummer, Daryl C., Cearley, David W. and Smith, David Mitchell. 2008. Cloud Computing confusion leads to opportunity. s.l. : Gartner, 2008.

Plummer, Daryl C., et al. 2008. Cloud Computing : Defining and Describing an Emerging Phenomenon. s.l. : Gartner, 2008.

Plummer, Daryl C., et al. 2009. Five refining attributes of Public and Private Cloud Computing. s.l. : Gartner, 2009.

Porter, Michael. 1980. Competitive Strategy: Techniques for Analysing Industries and Competitors. New York : Free Press, 1980.

Pring, Ben, et al. 2009 . Forecast: Sizing the Cloud; Understanding the Opportunities in Cloud Services. s.l. : Gartner, 2009 .

Ried, Stefan, Matzke, Pascal and Lisserman, Miroslaw. 2009. Clouds Appearing In The Sky Of Outsourcing. s.l. : Forrester, 2009. p. 12.

Ried, Stefan, Mendel, Thomas and Lisserman, Miroslaw. 2009. yet Another Cloud. s.l. : Forrester, 2009. p. 7. Forrester’s First Proposal Of A Cloud Taxonomy.

Rogers, Everett M. 1962. Diffusion of Innovations. s.l. : Free Press, 1962.

Schadler, Ted. 2008. Talking To Your CFO About Cloud Computing. s.l. : Forrester, 2008.

Shimizu, Koichi. 2009. Advertising Theory and Strategies 16th edition. s.l. : Souseisha Book Company, 2009. Professor from Josai University Graduate School of Business Administration.

—. 2003. Symbiotic Marketing Strategy 4th edition. s.l. : Souseisha Book Company, 2003. Professor from Josai University Graduate School of Business Administration.

Staten, James. 2009. Best Practices: Infrastructure-As-A-Service. s.l. : Forrester, 2009.

—. 2009. Which Cloud Computing Platform is right for you? s.l. : Forrester, 2009.

Staten, James, Yates, Simon and Echols, Ben. 2009. TechRadar™ For Infrastructure & Operations Professionals: Cloud Computing, Q3 2009. s.l. : Forrester, 2009.

Venkatraman and Henderson. 1993. Strategic Alignement: Leveraging Information Technology for Transforming organizations. IBM Systems Journal. IBM Systems Journal, 1993, Vol. 32, 1.

Wang, Chenxi, Penn, Jonathan and Herald, Allison. 2009. How secure is your cloud? s.l. : Forrester, 2009.

Yuhanna, Noel. 2007. Database Archiving Remains An Important Part Of Enterprise DBMS Strategy. s.l. : Forrester, 2007. p. 20.

Page 146: Cloud Computing In France

146

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Bibliography Skills

Journalistic and official sources

Babcock, Charles. 2009. Why 'Private Cloud' COmputing is Real - and worth considering. Information Week. April 13, 2009.

Carr, Nicholas G. 2008. The Big Switch. s.l. : WW Norton & Co, 2008. 0393062287.

—. 2005. The End of Corporate Computing. MIT Sloan Management Review. 2005, Vol. 46, 3.

—. 2008. The new economics of computing. Rough Type. [Online] November 05, 2008. [Cited: October 24, 2009.] http://www.roughtype.com/archives/2008/11/the_new_economi.php.

Cloud Security Alliance. 2009. Security Guidance for Critical Areas of Focus in Cloud Computing. s.l. : Cloud Security Alliance, 2009.

ENISA. 2009. Cloud Computing - Benefits, risks and recommendations for information security. s.l. : ENISA, 2009. p. 123. Download this document at: http://www.enisa.europa.eu/act/rm/files/deliverables/cloud-computing-risk-assessment.

Financial Times. 2009. 6 Mars 2009, s.l. : Financial Times, 2009.

Fleck, Chris. 2008. Cloud Economics 101 - Part 1. Citrix Community - the Citrix Blog. [Online] September 27, 2008. [Cited: October 3, 2009.] He is Vice President of Community and Solutions Development at Citrix Systems and speaker of various Cloud Computing conferences.. http://community.citrix.com/display/ocb/2008/09/27/Cloud+Economics+101+-+Part+1.

Frascaria, Kareen. 2009. Le PRA as a service, tendance forte de la rentrée. ZDNET. [Online] ZDNET, July 21, 2009. [Cited: November 5, 2009.] http://www.zdnet.fr/blogs/cloud-news/le-pra-as-a-service-tendance-forte-de-la-rentree-39702547.htm.

From Shafts to Wires: Historical Perspective on Electrification. Devine Jr, Warren D. 1983. 2, s.l. : The Journal of Economic History, 1983, Vol. 43. S0022050700029673.

Golden, Bernard. 2009. The Case Against Cloud Computing, Part One. CIO. [Online] January 22, 2009. [Cited: November 15, 2009.] http://www.cio.com/article/477473/The_Case_Against_Cloud_Computing_Part_One. CEO of Navica Inc., a systems integration firm specializing in open source software.

—. 2009. The Case Against Cloud Computing, Part Three. ITWorld. [Online] CIO.com, February 9, 2009. [Cited: November 25, 2009.] http://www.itworld.com/saas/62255/case-against-cloud-computing-part-three?page=0%2C0.

Hoff, Christopher. 2009. Domain 1 - Cloud Computing Architectural Framework. Security Guidance for Critical Areas of Focus in Cloud Computing. s.l. : Cloud Security Alliance, 2009.

Hogben, Giles. 2009. Privacy, Security and Identity in the Cloud. s.l. : ENISA, 2009.

Krigsman, Michael. 2008. MediaMax / The Linkup: When the cloud fails. ZDNet blogs. [Online] ZDNet, August 27, 2008. [Cited: November 24, 2009.] http://blogs.zdnet.com/projectfailures/?p=999.

Lemos, Robert. 2009. Inside one firm's private cloud journey. Network World. [Online] Network World, October 28, 2009. [Cited: November 2, 2009.] www.networkworld.com/news/2009/102809-inside-one-firms-private-cloud.html?hpg1=bn.

Linthicum, David. 2009. 4 things that are driving cloud computing. [Online] October 7, 2009. [Cited: October 12, 2009.] Author of the book "Cloud Computing and SOA Convergence in Your Enterprise: A Step-by-Step Guide". http://www.infoworld.com/d/cloud-computing/4-things-are-driving-cloud-computing-598?page=0,1.

—. 2009. The Value of Application Service Governance for Cloud Computing. s.l. : Layer 7 Technologies, 2009. p. 10. Founder of a consulting organization dedicated to excellence in SOA implementation, corporate SOA strategy, and leveraging cloud computing. He was an associate professor of computer science, and continues to lecture at major colleges and universities..

Loi n° 78-17. 1978. Loi Informatique et libertés - Loi n° 78-17 du 6 janvier 1978. January 6, 1978. Loi relative à l'informatique, aux fichiers et aux libertés.

McAfee, Andrew. 2009. The Cloudy Future of Corporate IT. The Business Impact of IT. [Online] August 21, 2009. [Cited: October 22, 2009.] McAfee is currently a principal research scientist at the Center for Digital Business in the MIT Sloan School of Management, and a fellow at the Harvard’s Berkman Center for Internet and Society.. http://andrewmcafee.org/2009/08/the-cloudy-future-of-corporate-it/.

Oestreich, Ken. 2008. ITIL, ITSM, and the Cloud. Fountainhead. [Online] Insights into the enterprise data center & green technology space, November 10, 2008. [Cited: November 29, 2009.] Vice president of product marketing at Egenera. Speaker in various conferences on Cloud Computing (SYS-CON Cloud Computing Conference & Expo 2009, etc.). http://fountnhead.blogspot.com/2008/11/itil-itsm-and-cloud.html.

Page 147: Cloud Computing In France

147

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Bibliography Skills

Open Cloud Manifesto. 2009. Cloud Computing Use Cases White Paper. s.l. : Cloud Computing Use Case Discussion Group, 2009. p. 37. Can be found on: http://opencloudmanifesto.org/resources.htm. Version 1.0.

—. 2009. Open Cloud Manifesto. Open Cloud Manifesto. [Online] Spring 2009. [Cited: November 15, 2009.] http://www.opencloudmanifesto.org/Open%20Cloud%20Manifesto.pdf.

Petri, Gregor. 2009. Cloud Computing and the New Role of the IT manager, Will ITIL and COBIT Help or Hinder? Conclusion. CA Community. [Online] CA, October 23, 2009. [Cited: November 28, 2009.] http://community.ca.com/blogs/itil/archive/2009/10/23/cloud-computing-and-the-new-role-of-the-it-manager-will-itil-and-cobit-help-or-hinder-conclusion.aspx.

—. 2009. Part 2: Cloud Computing and the New Role of the IT manager: Will ITIL and COBIT help or hinder? IaaS. CA Community. [Online] CA, October 20, 2009. [Cited: November 28, 2009.] http://community.ca.com/blogs/itil/archive/2009/10/20/part-2-cloud-computing-and-the-new-role-of-the-it-manager-will-itil-and-cobit-help-or-hinder.aspx.

SLA@SOI. 2008. Press Release #1: European research project SLA@SOI, led by SAP, has commenced. SLA@SOI. [Online] 2008. [Cited: November 15, 2009.] http://sla-at-soi.eu/wp-content/uploads/2009/01/press_release1.pdf.

Page 148: Cloud Computing In France

148

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Bibliography Skills

Providers and Consulting firms documentation

Amazon Web Services. 2009. 37Signals Case Study : Amazon Web Services. Amazon Web Services. [Online] Amazon Web Services, 2009. [Cited: October 24, 2009.] http://aws.amazon.com/solutions/case-studies/37signals/.

—. 2009. Amazon EC2 SLA. Amazon. [Online] October 23, 2009. [Cited: October 24, 2009.] http://aws.amazon.com/ec2-sla/.

—. 2009. Amazon Web Services Customer Agreement. Amazon Web Services. [Online] October 30, 2009. [Cited: November 12, 2009.] http://aws.amazon.com/agreement/.

—. 2009. Amazon Web Services: Overview of Security Processes. Amazon Web Services. [Online] September 2009. [Cited: November 11, 2009.] http://s3.amazonaws.com/aws_blog/AWS_Security_Whitepaper_2008_09.pdf.

—. 2009. The Server Labs Case Study: Amazon Web Services. Amazon Web Services. [Online] June 2009, 2009. [Cited: October 26, 2009.] http://aws.amazon.com/solutions/case-studies/the-server-labs/.

Atos Origin. 2008. Du mainframe au cloud. Enterprise 2.0. [Online] Ocotober 9, 2008. [Cited: October 12, 2009.] http://entreprise2.wordpress.com/2008/10/09/du-mainframe-au-cloud/.

Behnia, Kia and Wrobel, Erik. 2008. Seven Requirements for Balancing Control. s.l. : BMC Software, 2008. p. 11. Kia Behnia, Chief Corporate Architect, CTO Office, BMC Software; Erik Wrobel, Director of Product Management, VMware. Download at http://documents.bmc.com/products/documents/62/88/96288/96288.pdf.

BIT Group. 2008. Business & Information Technology Group. Dîner – Conférence DSI 2010. Les tendances pour les DSI 2008 - 2012. s.l. : BIT Group, 2008.

CA. 2009. Make Your IT Organization More Effective. s.l. : Computer Associates (CA), 2009. Written by William F. Clark (PUBLIC SECTOR CTO) and Ray Wright (INDUSTRY SOLUTIONS).

Capgemini. 2008. Capgemini et Amazon Web Services signent un accord pour offrir des solutions de cloud computing aux grandes entreprises. Capgemini. [Online] November 18, 2008. [Cited: November 2009, 2009.] http://www.fr.capgemini.com/m/fr/n/pdf_Capgemini_et_Amazon_Web_Services_signent_un_accord_pour_offrir_des_solutions_de_cloud_computing__aux_grandes_entreprises.pdf.

Cavalliere, Lionel. 2009. Construire une infrastructure IT optimisée pour le Cloud Computing avec la virtualisation. IDC - Infrastructure IT et Cloud Computing. Paris : VMWare, September 24, 2009. p. 19.

Gruau, François. 2009. Comment faire évoluer votre infrastructure IT dans le contexte économique actuel ? Paris : ATOS ORIGIN, 2009. Vice President Innovation & Business Development. Presented at "Cloud Computing and Infrastructure - IDC Conference".

Hartman, Tyson and Beck, Larry. 2009. Defining the Business Value of Cloud Computing. s.l. : Avanade, 2009.

Hurley, William. 2009. A Down-to-Earth look at Cloud Computing. [interv.] Tom Parish. BMC Podcasts. s.l. : BMC, April 29, 2009. Chief Architect, Open Source Strategy at BMC Software.

IDATE. 2008. Comportement d'achat des PME. IDATE Consulting and research. [Online] IDATE, July 15, 2008. [Cited: December 21, 2009.] http://www.idate.fr/fr/Research-store/Comportement-d-achat-des-PME_316.html.

Mauger, Regis. 2009. Cloud Computing. Paris : BMC Software, 2009.

Morrison, Scott. 2009. Steer Safely into the Clouds - Why you must have Cloud Governance before you move your apps. s.l. : Layer 7 Technologies, 2009. p. 12. Vice President Engineering and Chief Architect.

Open Crowd. 2009. Cloud Taxonomy, Landscape, Evolution. www.opencrowd.com. [Online] May 4, 2009. [Cited: July 29, 2009.] www.opencrowd.com/assets/images/views/views_cloud-tax-lrg.png.

Portio Research. 2009. COLT CIO survey. s.l. : COLT, 2009. Internal survey.

Rollet, Béatrice. 2009. Cloud Computing for dummies. Malakoff : COLT, 2009. Conference.

Sorofman, Jake. 2008. The Cloud Computing Adoption Model: Eating the Elephant One Bite at a Time. rPath. [Online] rPath, October 23, 2008. [Cited: November 30, 2009.] Vice President of Marketing. http://blogs.rpath.com/wpmu/closing-the-gap/2008/10/23/the-cloud-computing-adoption-model-eating-the-elephant-one-bite-at-a-time/.

Page 149: Cloud Computing In France

149

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Bibliography Skills

VMWare. 2009. Open Virtualization Format. VMWare. [Online] 2009. [Cited: November 15, 2009.] http://www.vmware.com/appliances/getting-started/learn/ovf.html.

Winter, Richard. 2008. Why Are Data Warehouses Growing So Fast? B eye Network. [Online] April 10, 2008. [Cited: October 24, 2009.] An Update on the Drivers of Data Warehouse Growth. http://www.b-eye-network.com/view/7188.

Zhu, Jinzy. 2009. Cloud Computing Technology and Practice. IBM. [Online] August 20, 2009. [Cited: December 6, 2009.] http://www-07.ibm.com/events/nz/ibmforum/presentations/downloads/IBMCloudLabsKeynote_JinzyZhu.pdf.

Online encyclopedia

Gartner. 2009. Gartner Glossary. Gartner. [Online] 2009. [Cited: December 13, 2009.] http://www.gartner.com/6_help/glossary/GlossaryI.jsp.

Wikipedia. 2009. Information Technology Infrastructure Library. Wikipedia. [Online] Wikipedia, November 27, 2009. [Cited: November 28, 2009.] http://en.wikipedia.org/wiki/Information_Technology_Infrastructure_Library.

—. 2009. Mainframe computer. Wikipedia. [Online] September 14, 2009. [Cited: October 12, 2009.] http://en.wikipedia.org/wiki/Mainframe_computer.

—. 2009. Network-centric organization. Wikipedia. [Online] Wikipedia, May 28, 2009. [Cited: December 20, 2009.] http://en.wikipedia.org/wiki/Network-centric_organization.

—. 2009. Records Management. Wikipedia. [Online] Wikipedia, November 9, 2009. [Cited: November 11, 2009.] http://en.wikipedia.org/wiki/Records_management.

—. 2009. Strategy map. Wikipedia. [Online] Wikipedia, December 6, 2009. [Cited: December 6, 2009.] http://en.wikipedia.org/wiki/Strategy_map.

Page 150: Cloud Computing In France

150

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Skills

VI. Annexes

Page 151: Cloud Computing In France

151

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes A growing interest for Cloud Computing – Google Trends

I. A growing interest for Cloud Computing – Google Trends

Google Trends is a Google tool that allows to measure the popular interest for a subject on Internet. Below, 3 expressions are compared: SOA (Service Oriented Architecture), offshoring and Cloud Computing.

Search Volume Index : how many searches have been done for the terms entered, relative to the total number of searches done on Google over time.

News Reference Volume : number of times the topic appeared in Google News stories (only English-language headlines are displayed).

Figure 53 - Google Trends (http://www.google.fr/trends?q=cloud+computing%2C+soa%2C+offshoring –2009 December 20)

We can see that this subject is growing in interest for the last year and a half, and it could become the subject of IT attracting the highest degree of interest in a few years from now.

Page 152: Cloud Computing In France

152

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Layers of Cloud Computing services

II. Layers of Cloud Computing services

To understand better the technologies behind the terms SaaS, PaaS et IaaS, we present below the different layers shown by the Cloud Security Alliance (Hoff, 2009).

Infrastructure services contain the Data Center itself and the physical machines in it. Infrastructure-as-a-Service also adds hardware-abstraction layer and, if needed, core connectivity and delivery to these resources. The API layer allows the consumer to manage this infrastructure.

Platform-as-a-Service is on top of IaaS and adds an integration layer that allows the consumer to use providers’ development frameworks in order to develop specific applications.

Software-as-a-Service is built on top of PaaS and offer the consumer a complete environment: content, application and presentation.

We can understand that SaaS providers could be clients of PaaS and IaaS providers, and conversely PaaS providers could be clients of IaaS providers.

Ex: A company that sells SaaS to consumers may develop its application on top of a PaaS solution, for example Salesforce.com. Salesforce.com could be built on top of Amazon Web Service offering, who is a IaaS provider.

Figure 54 - "Cloud Reference Model" - Cloud Security Alliance (Hoff, 2009)

Page 153: Cloud Computing In France

153

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Taxonomy of Cloud Computing

III. Taxonomy of Cloud Computing

Here is the classification (Open Crowd, 2009), from the consulting firm OpenCrowd, that presents all type of existing offers of Cloud Computing services and some providers’ solutions.

Figure 55 - Cloud offerings

Page 154: Cloud Computing In France

154

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Nicholas G. Carr’s electricity metaphor

IV. Nicholas G. Carr’s electricity metaphor

Nicholas G. Carr published in 2005, in the MIT Sloan Management Review, an article entitled The End of Corporate Computing (Carr, 2005) which was developing the idea that the fragmented model of IT, where all organizations have their own IT infrastructure, will disappear.

He compared this transformation to what happened years ago with electricity. Organizations that used to rely on their own private factory for satisfying their needs for electricity now get their electricity from providers whose role is to distribute electricity. Thus the organizations no longer need a dedicated factory for this task but rather they simply have to pay for the electricity they consume. This is no more a function done by organizations but a service they use. Similarly, Information technologies like software or hardware will not be seen as assets but will be bought as a utility service, a commodity, that they get from an IT provider. Here is what Nicholas Carr said:

“Manufacturers began to shut down and dismantle their waterwheels, steam engines and electric generators. They no longer had to run their own dynamos; they could simply buy the electricity they needed, as they required it, from new utility suppliers. Power generation was being transformed from a corporate function into a utility. Now, almost exactly a century later, history is repeating itself. Information technology is undergoing the same transformation.”

But this process took nearly 50 years to complete and the real impact of the technology was not visible at first because electric motors were initially used as simple replacements for steam power, and factory layouts remained unchanged (McAfee, 2009). Electrification of industry in the United States began around 1883 and, as late as in 1930, nearly 20% of factory power was still supplied by steam engines and that situation persisted in some old factories until the 1960s. Andrew McAfee, a professor at MIT, recalls that there were detractors and skeptics about the new technology throughout the transition period, and he quotes a statement from Warren D. Devine Jr’s paper in the Journal of Economic History (From Shafts to Wires: Historical Perspective on Electrification, 1983):

“… the merits of driving machines in groups or driving them individually were discussed in the technical literature throughout the first quarter of the twentieth century. Between 1895 and 1904, this subject was vigorously debated in meetings of technical societies; neither technique could be said to be best in all cases… And, over 20 years later, group drive was still being strongly recommended for many applications… Two textbooks printed in 1928… make it clear that there were many situations in which group drive was justified.”

This metaphor is not accepted by everyone, suggesting that IT is much more complicated than electricity.

The idea of entering into a transformation where no organization will have in-house IT infrastructures has raised numerous reactions. H. A Marquis published, one year later, a response to N. Carr’s article, where he invalidates the possibility of a total transformation (Finishing off IT, 2006). Marquis emphasizes the vital importance that may have a resource in an organization and the risk its absence would entail. He argues that organizations are already insourcing functions in their IT department. These are not isolated actions and some laws may complicate further the idea of a total

Page 155: Cloud Computing In France

155

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Nicholas G. Carr’s electricity metaphor

transformation (Gromm-Leach Bliley and Sarbanes-Oxley in USA). More importantly, he says that some tasks that make the strength of a company should not be outsourced: only simple tasks that do not add value should be.

We can also cite Thomas Bittman from Gartner who says that the electricity utility metaphor doesn’t work (Bittman, 2009) and shows two reasons:

• “Computing is a rapidly evolving technology”,

• “Service requirements vary widely for computing”. IT evolves everyday very quickly whereas electricity production and distribution hasn’t evolved much since the invention of air conditioning that made distance distribution possible. This electricity metaphor, which may not be the best one, simply shows that there is always an evolution possible in the manner in which services or products are delivered, an evolution that takes some time to come but that, eventually, is nearly total like for the distribution of electricity, water or even music.

Page 156: Cloud Computing In France

156

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes ITIL - Information Technology Infrastructure Library

V. ITIL - Information Technology Infrastructure Library

ITIL provides a framework of Best Practice guidance for IT Service Management (Wikipedia, 2009).

ITIL gives detailed descriptions of a number of important IT practices and provides comprehensive checklists, tasks and procedures that any IT organization can tailor to its needs. ITIL is published in a series of books, each of which covers an IT management topic. The names ITIL and IT Infrastructure Library are registered trademarks of the United Kingdom's Office of Government Commerce (OGC).

Figure 56 - ITIL, a high level view of the service model (ITSMF - The IT Service Management Forum,

2007)

For more information, visit the ITIL website at www.itil.org.

Page 157: Cloud Computing In France

157

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Some Cloud Computing Providers and Consulting Firms

VI. Some Cloud Computing Providers and Consulting Firms

Here is a list of Cloud Computing actors that may interest French early adopters.

Infrastructure-as-a-Service providers

Provider Type of relations Services Location of the Data

Centers

AMAZON WEB SERVICES

“No-relation” model

Online Servers: Elastic Compute Cloud, Virtual Private Cloud. Database: Simple Storage Service, SimpleDB, Relational Database Service Other: Cloud Front, Simple Queue Service

All over the world and in Europe (not in France). Possibility to choose the location.

CLARANET “Custom contract” In the future: “No-relation” model

Private Cloud off-premises. In the future: online servers with ClaraCloud.

France. Possibility to choose the location.

COLT TELECOM

“Custom contract” In the future: “No-relation” model

Private Cloud off-premises. Virtual server on-demand (no online self-provisioning): COLT Dynamic Infrastructure Services. In the future: online servers.

Europe and France. Possibility to choose the location.

GANDI.NET “No-relation” model In the future: “No-relation” model

Online servers. In the future: online servers.

France.

GOGRID “Custom contract” “No-relation” model

Online servers. Cloud storage. Private Cloud off-premises.

United States of America. Soon in Europe.

IBM “Custom contract” In the future: “No-relation model”

Private Cloud off-premises. All over the world and in France.

LINKBYNET “Custom contract” Private Cloud off-premises. Virtual server on-demand (no online self-provisioning): @GILE.

France.

ORANGE BUSINESS SERVICES

“Custom contract” Private Cloud off-premises. Virtual server on-demand (no online self-provisioning): ORANGE Flexible Computing.

France.

RACKSPACE “Custom contract” “No-relation” model

Private Cloud off-premises. Online servers: Rackspace Cloud.

USA and Europe. Not in France.

Page 158: Cloud Computing In France

158

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Some Cloud Computing Providers and Consulting Firms

Platform-as-a-Service providers

Provider Type of relations

Services Location of the Data Centers

COLT TELECOM

? In the future: Develop, test and deploy applications in the Cloud.

Europe and France.

GOOGLE “No-relation” model

Develop, test and deploy applications in the Cloud: Google App Engine.

All over the world (not in France). Impossible to choose the location.

IBM “No-relation” model

Develop and test in the Cloud: IBM Smart Business Development & Test

All over the world and France. Impossible to choose the location.

MICROSOFT “No-relation” model

Develop, test and deploy applications in the Cloud: MICROSOFT Azure.

All over the world and France. Impossible to choose the location.

SALESFORCE “No-relation” model

Develop, test and deploy applications in the Cloud: FORCE.COM.

All over the world (not in Europe). Impossible to choose the location.

Private Cloud Constructors and software firms

Constructor Services

CITRIX Virtualization Software: XEN.

IBM Private cloud: Cloud Burst (that integrated VMWARE).

MICROSOFT Virtualization Software: HYPER-V.

UBUNTU Software: Ubuntu Enterprise Cloud. Integration possible with Public Clouds.

VMWARE Virtualization Software: VSphere 4. Integration possible with Public Clouds.

Page 159: Cloud Computing In France

159

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Some Cloud Computing Providers and Consulting Firms

Consulting Services

Constructor Services

AVS CONSULTING

Expertise center for Cloud Computing solutions: Salesforce’s Force.com.

CAP GEMINI Expertise center for Cloud Computing solutions: Amazon Web Services.

COLT TELECOM

Cloud Audit.

IBM Cloud Computing consulting: audit, resilient cloud validation, etc.

OCTO TECHNOLOGY

Expertise center for Cloud Computing solutions: Amazon Web Service, Google App Engine, Salesforce’s Force.com

REVEVOL Expertise center for Cloud Computing solutions

Page 160: Cloud Computing In France

160

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Cloud Software

VII. Cloud Software

Some examples of the existing tools available for an organization are:

• Manage resources when they are in the “No-relationship model”;

Figure 57 - Orchestration tool from BMC Software

• Provide a unique interface to manipulate on-premises and off-premises resources from multiple providers;

Figure 58 - A VMWare interface to manage on-premises and off-premises resources (on Terremark, Hosting.com servers, etc.) with VCloud

• Integrate ITIL best practices in a software created for all Cloud (and virtualized environments);

Page 161: Cloud Computing In France

161

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Cloud Software

Figure 59 - Enable automation with CA software, based on ITIL principles (CA, 2009)

• Data governance (organize data between those that should be hosted in-house and those that can be in the cloud); or

Figure 60 - Data governance with Guardiam, a data governance software company recently acquired by IBM

• Apply policy enforcement for all Cloud Services.

Page 162: Cloud Computing In France

162

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Cloud Software

Figure 61 - Policy Enforcement on Cloud Computing services from 7 Layer Technologies (Morrison, 2009)

These are only example of the possibilities offered by some Software Companies that are creating everyday new features for their software to be compliant with Cloud Computing services and to answer to some issues that I have underlined.

Page 163: Cloud Computing In France

163

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Cloud Software

Figures

Figure 1 - Actors of the Cloud Computing market ................................................................................................ 11 Figure 2 - Cloud Computing layers (SaaS / PaaS / IaaS) ........................................................................................ 13 Figure 3 - Public Cloud (Open Cloud Manifesto, 2009) ......................................................................................... 14 Figure 4 - Private Cloud (Open Cloud Manifesto, 2009) ....................................................................................... 15 Figure 5 - Hybrid Cloud (Open Cloud Manifesto, 2009) ........................................................................................ 15 Figure 6 - Community Cloud (Open Cloud Manifesto, 2009) ................................................................................ 16 Figure 7 - Forrester's TechRadar for Cloud Computing (Staten, et al., 2009) ....................................................... 17 Figure 8 - Motivations for IT investment (Nassah, 2006) ...................................................................................... 20 Figure 9 - 7Cs compass model ............................................................................................................................... 22 Figure 10 - 7S of McKinsey (Pacale, et al., 1981) .................................................................................................. 23 Figure 11 - IT investment in the years (Gillett, 2008) ............................................................................................ 27 Figure 12 - Customers pay for a service (Rollet, 2009) ......................................................................................... 31 Figure 13 - The infrastructure follows the actual demand .................................................................................... 32 Figure 14 - Economies of scale and skill drive cloud computing (Schadler, 2008) ................................................ 34 Figure 15 - Costs: New Project vs Existing Application; PaaS vs IaaS vs Internal IT .............................................. 39 Figure 16 - 3 major benefits for the organization on an operational level ........................................................... 40 Figure 17 - Linking a Private Cloud to a Public Cloud could be easy with the right technology (Cavalliere, 2009)49 Figure 18 - A better understanding of the services ............................................................................................... 50 Figure 19 - Navigation in the Cloud (Ried, et al., 2009) ........................................................................................ 51 Figure 20 - Classification of the issues regarding Security and Privacy ................................................................. 55 Figure 21 - Classification of the issues regarding Compliance .............................................................................. 57 Figure 22 - Classification of Legal and Contractual issues .................................................................................... 60 Figure 23 - CapEx to OpEx cost savings versus Cost of Risk for cloud computing (Linthicum, 2009) .................... 66 Figure 24 - Business services based on ITIL that have a role in managing a Cloud Computing environment (Mauger, 2009) ..................................................................................................................................................... 69 Figure 25 – Innovation Adoption Curve (Rogers, 1962) ........................................................................................ 72 Figure 26 - Balanced Scorecard of Cloud Computing, Adapted from the Balance Scorecard by Kaplan and Norton (Kaplan, et al., 1996) ............................................................................................................................................. 74 Figure 27 - Gartner’s IS-Lite model ....................................................................................................................... 75 Figure 28 - Control vs Agility (Behnia, et al., 2008) ............................................................................................... 77 Figure 29 - Three emerging patterns for IaaS services (Staten, 2009) ................................................................. 78 Figure 30 – Example of priority outsourcing matrix .............................................................................................. 79 Figure 31 - Cloud Computing applications funnel ................................................................................................. 81 Figure 32 - Result of an eligibility matrix (Hartman, et al., 2009) ......................................................................... 82 Figure 33 - A possible IT roadmap (Zhu, 2009) ..................................................................................................... 83 Figure 34 - Server Virtualization Is A Top Priority For Most Enterprises In 2010, But Cloud Is Not (Gillett, et al., 2009) ..................................................................................................................................................................... 84 Figure 35 - 5-step Cloud Computing Adoption Model (Sorofman, 2008) ............................................................. 85 Figure 36 - Cloud Computing providers, France 2009 (Markess International, 2009) .......................................... 87 Figure 37 - Different relationships with a provider ............................................................................................... 89 Figure 38 - 3 generic models of providers ............................................................................................................. 93 Figure 39 - Porter's Generic Strategies (Porter, 1980) .......................................................................................... 94 Figure 40 - PaaS providers (Portio Research, 2009) .............................................................................................. 96 Figure 41 - IaaS providers (Portio Research, 2009) ............................................................................................... 96 Figure 42 - Factors driving change (Behnia, et al., 2008) .................................................................................... 100 Figure 43 - Strategy map of an IT department .................................................................................................... 105

Page 164: Cloud Computing In France

164

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Cloud Software

Figure 44 - Strategy map of an eBusiness web site or an ISV ............................................................................. 106 Figure 45 - Path of progress for the Information System (CapGemini, 2008) ..................................................... 108 Figure 46 - Control the process, overview of the ITIL schema (ITSMF - The IT Service Management Forum, 2007) ............................................................................................................................................................................ 113 Figure 47 - Application lifecycle, adapted from the project (Hugon, et al., 2009) and operational lifecycles ... 115 Figure 48 - Application lifecycle with Infrastructure-as-a-Service ...................................................................... 117 Figure 49 - Application lifecycle with Platform-as-a-Service ............................................................................... 120 Figure 50 - Alignment of the functions (CIGREF, 2002) ....................................................................................... 131 Figure 51 - Evolution of the organization (BIT Group, 2008) .............................................................................. 132 Figure 52 - Impact of the network organization on the IT department (BIT Group, 2008) ................................. 133 Figure 53 - Google Trends (http://www.google.fr/trends?q=cloud+computing%2C+soa%2C+offshoring –2009 December 20) ...................................................................................................................................................... 151 Figure 55 - Cloud offerings .................................................................................................................................. 153 Figure 56 - ITIL, a high level view of the service model (ITSMF - The IT Service Management Forum, 2007) .... 156 Figure 57 - Orchestration tool from BMC Software ............................................................................................ 160 Figure 58 - A VMWare interface to manage on-premises and off-premises resources (on Terremark, Hosting.com servers, etc.) with VCloud .............................................................................................................. 160 Figure 59 - Enable automation with CA software, based on ITIL principles (CA, 2009) ...................................... 161 Figure 60 - Data governance with Guardiam, a data governance software company recently acquired by IBM161 Figure 61 - Policy Enforcement on Cloud Computing services from 7 Layer Technologies (Morrison, 2009) .... 162 Figure 54 - "Cloud Reference Model" - Cloud Security Alliance (Hoff, 2009) ..................................................... 152

Endnotes

(i) GDP: Gross Domestic Product is equal to the sum of the income generated by production in the country in the period.

(ii) CAGR: The Compound Annual Growth Rate is a geometric mean growth rate on an annualized basis.

(iii) Tier one: Tier one storage solutions means that it is stored on expensive and high-quality media. It is usually for critical data.

(iv) The Open Cloud Manifesto is a manifesto containing a "public declaration of principles and intentions" for cloud computing providers and vendors, annotated as "a call to action for the worldwide cloud community" and "dedicated belief that the cloud should be open".

(v) ENISA is the European Network and Information Security Agency. The objective of ENISA is to improve network and information security in the European Union.

(vi) Conference organized by Octo Technology – “Les enjeux du Cloud Computing” (Stakes of Cloud Computing) – 10 December 2009

Page 165: Cloud Computing In France

165

Cédric Mora December 2009

Cloud Computing in France – A model that will transform companies Annexes Cloud Software