They Call It Stormy Monday

Transcription

1 ANALYST BRIEF They Call It Stormy Monday MOVE TO THE CLOUD REQUIRES FULL LIFE CYCLE MANAGEMENT Author Rob Ayoub Overview The revelation on September 17, 2013 that the cloud storage company Nirvanix would shut down within two weeks brought into the spotlight the potential pitfalls of cloud- based services. While the long- term effects of the closure have yet to be determined, immediate focus has been on backup and transition strategies for cloud services. Unfortunately, this is just one component of the product life cycle that has been disregarded as organizations shift customer relationship management systems, content, and other applications to the cloud. The reality of the cloud services market is that companies will fail, services will change, and innovation will occur that could undermine an entire organization s cloud strategy. Organizations must plan beyond the initial move to the cloud and must develop roadmaps and contingency planning that not only evaluate worst- case disaster scenarios, but also consider the implications of switching cloud providers in the event that a superior service emerges.

2 NSS Labs Findings Cloud storage prices continue to decline, and this is intensifying competition between large and small providers. Large public cloud providers such as Amazon, Google, and Microsoft have the resources to use storage and other cloud components as loss leaders in order to drive new business, leaving smaller cloud vendors in a difficult predicament. Up to this point, many organizations have evaluated the move to the cloud on the basis of cost savings but have ignored the costs surrounding switching vendors or disaster recovery. The hidden costs of moving functions to the cloud are significantly greater than simply storing data in the cloud. Customers increasingly are more reliant on the cloud provider s user interface and business logic for their operations, which makes planning for disaster recovery more difficult. Many other cloud vendors are using the failure of Nirvanix to promote their own services, promoting backup and additional features. NSS Labs Recommendations Critically assess the health of the provider, the risk to the business, and the disaster recovery options for each function to be outsourced to the cloud. Incorporate contingency planning for cloud- based services into disaster recovery plans. Evaluate risk to the organization s business as if service level agreements (SLAs) do not exist, since they will have little to no relevance should the service provider go out of business. Investigate alternate service providers and set up pilot programs to evaluate new technologies. 2

3 Table of Contents Overview... 1 NSS Labs Findings... 2 NSS Labs Recommendations... 2 Analysis... 4 The Cloud Is A Bullet, Just Not A Silver One... 4 Outsourcing Will Fail... 4 Innovation Will Occur... 5 Business Requirements Will Change... 5 Competition Will Drive Price And Technology Improvements... 5 Additional Total Cost of Ownership (TCO) Considerations... 6 Reading List... 7 Contact Information

4 Analysis The abrupt shutdown of Nirvanix left customers scrambling to secure their data and select an alternate provider. That an outsourced provider has failed is not news; if anything, the failure of Nirvanix illustrates that cloud providers are just as likely to fail as any other business. Media focus has been on the lack of options customers face as well as on the surprise that a company with large customers could fail both IBM and Dell had agreements with Nirvanix. The idea that any business is immune from failure is a fallacy, but sensible risk and disaster planning could have mitigated the damages. The Nirvanix closure draws attention to the failure of most organizations to carefully consider service alternatives when relying on the cloud for data storage and the hosting of applications. The Cloud Is A Bullet, Just Not A Silver One Public cloud infrastructure is a burgeoning market; industry sources indicate that the public cloud market is growing at an annual rate of well over 30 percent. Total market size is in excess of USD $6 billion for infrastructure as a service (IaaS), platform as a service (PaaS), and hosted software components alone, excluding services that have exponentially greater revenue potential. The advantages of using the public cloud are well documented, but many organizations have brushed aside the proper risk management that is essential to consider when moving services to the cloud. The general market attitude appears to be that large vendors, such as Amazon and Microsoft, can not go out of business; however, as the Nirvanix closure shows, even companies of moderate financial strength can quickly and unexpectedly shut their doors (Nirvanix received USD $70 million in funding with USD $25 million coming in May 2012). In addition to the risk factors associated with using a single cloud provider, there are several other compelling reasons why organizations should consider multiple providers for any outsourced service. In a world where business agility is crucial and where lack of innovation has caused the decline or demise of many companies (for example, Blackberry) it is critical that organizations considering cloud- based services continually monitor the overall market for new technologies and services that will propel their businesses forward. Outsourcing Will Fail Although outsourcing failures usually are not publicized, primarily because of the fear of negative publicity, they nevertheless do occur. Where large outsourcing failures are part of the public record, their damaging effects are evident. In 2004, for example, Electronic Data Systems (EDS) wrote down USD $559 million after delays and problems associated with a contract with the US Navy. 1 More recently, companies such as Netflix, 2 Reddit, and others 3 have suffered outages affecting their entire businesses for hours at a time, in spite of their reliance on the Amazon platform. Ultimately, an organization must be responsible for its own brand and no outsourced provider amazon- outage- shows- any- company- can- fail/ /amazon- cloud- outage- impacts- reddit- airbnb- flipboard/ 4

5 should be expected to protect that brand more than the organization itself. When outsourcing fails, be it a corporate function, or be it cloud- based infrastructure, the organization will suffer the consequences. Innovation Will Occur Another important consideration when outsourcing services is to predict the likelihood of a new technology or hosted service emerging that might significantly improve the service offering. Organizations should have proper methodology in place to evaluate new services along with a plan to transfer data should it become necessary to detach from a service provider. Consistent evaluation and benchmarking of new services against the current service will allow organizations to better understand the hosted service and can show any signs of trouble early. Business Requirements Will Change It is important to evaluate the current service, not only to stay abreast of competitors, but also because business requirements will change over time. Consider, for example, the evolution of web content hosting: an organization that relies on a third- party provider may begin by hosting exclusively with static storage, but as the business expands, its web site may require a more dynamic platform, for which assorted specialized vendors exist. Throughout its evolution, the organization should consider not only current provider options but also the options of insourcing or of changing providers. Competition Will Drive Price And Technology Improvements Just as end user business will evolve, so will the service providers. For example, within the current market, storage appears to be the loss leader for the largest cloud providers. Amazon and Microsoft both offer storage for pennies per gigabyte. Many smaller cloud providers have difficulties competing against such offers; thus, in order to stay competitive, smaller providers will have to specialize by, for example, tailoring their service offerings to specific verticals. Organizations should continually consider multiple options based on their current needs. 5

6 Additional Total Cost of Ownership (TCO) Considerations Organizations that currently have cloud- based services or that are considering outsourcing any component of their IT infrastructure must consider the additional costs associated with making appropriate preparations for potential failures. Figure 1 catalogs the factors that add to the TCO of any cloud component (be it infrastructure or a hosted service) and that therefore must be considered during evaluation of such services. Of themselves, these may not be time- consuming, but together they can significantly increase the cost of the cloud deployment. In the case of Nirvanix, organizations with a secondary provider in place would have been much more prepared for the shutdown, but also would already have been aware of the additional costs. For many organizations, there will be information technology (IT) components that can be outsourced for cost savings or improvements in efficiency. Ultimately, however, there are mission critical components that simply should remain in house. Task Frequency Additional Costs Audit existing outsourced services and assign criticality Quarterly to semi- annually Medium Benchmark current outsourced providers Quarterly Medium Develop risk scoring for outsourced providers Meet with business leaders to keep abreast of changing needs Monitor for independent cloud deployments within the organization Quarterly Quarterly Weekly Medium Low Low Pilot new/backup services Monthly quarterly Medium to high Plan for a total data and service transition Test annually, reviewed quarterly Medium to high Train business leaders on available services and options for expansion Quarterly to annually Low Figure 1 Additional Tasks That Increase Total Cost of Ownership 6

7 Reading List The Enterprise Security Landscape Is Changing. NSS Labs security- landscape- changing Is Cloud Security Best Fit For Your Organization? NSS Labs security- best- fit- your- organization 7

8 Contact Information NSS Labs, Inc. 206 Wild Basin Rd Building A, Suite 200 Austin, TX USA +1 (512) This analyst brief was produced as part of NSS Labs independent testing information services. Leading products were tested at no cost to the vendor, and NSS Labs received no vendor funding to produce this analyst brief NSS Labs, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the authors. Please note that access to or use of this report is conditioned on the following: 1. The information in this report is subject to change by NSS Labs without notice. 2. The information in this report is believed by NSS Labs to be accurate and reliable at the time of publication, but is not guaranteed. All use of and reliance on this report are at the reader s sole risk. NSS Labs is not liable or responsible for any damages, losses, or expenses arising from any error or omission in this report. 3. NO WARRANTIES, EXPRESS OR IMPLIED ARE GIVEN BY NSS LABS. ALL IMPLIED WARRANTIES, INCLUDING IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON- INFRINGEMENT ARE DISCLAIMED AND EXCLUDED BY NSS LABS. IN NO EVENT SHALL NSS LABS BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL OR INDIRECT DAMAGES, OR FOR ANY LOSS OF PROFIT, REVENUE, DATA, COMPUTER PROGRAMS, OR OTHER ASSETS, EVEN IF ADVISED OF THE POSSIBILITY THEREOF. 4. This report does not constitute an endorsement, recommendation, or guarantee of any of the products (hardware or software) tested or the hardware and software used in testing the products. The testing does not guarantee that there are no errors or defects in the products or that the products will meet the reader s expectations, requirements, needs, or specifications, or that they will operate without interruption. 5. This report does not imply any endorsement, sponsorship, affiliation, or verification by or with any organizations mentioned in this report. 6. All trademarks, service marks, and trade names used in this report are the trademarks, service marks, and trade names of their respective owners. 8