![]()
CHAPTER 1: CLOUD COMPUTING EXPLAINED
The potential of Cloud Computing
In late 2007, executives at The New York Times faced a common commercial dilemma: they identified an attractive business opportunity, but couldn’t pursue it because of the high cost and long lead time for necessary IT resources. Initial estimates for the project were that it would require over $100,000 investment and couldn’t start for several months’ time due to the lengthy timeframe for budget request, hardware ordering and installation/configuration.
It’s no secret that the newspaper business is severely challenged by the growth of the Internet. Any new profitable business offerings capable of increasing subscriber loyalty are eagerly seized by an industry worried about falling revenues and fickle readers.
The project at hand was designed to take advantage of The Times’ historic position as the ‘newspaper of record’ for the United States. Archives of the paper from 1851 to 1922 had been digitised, and The Times wished to make images of the pages available over the Web.
Unfortunately, the existing digital scans were in the TIFF format, which were too large to serve over the Web. The original scans needed to be converted – but large amounts of computing power would be needed, requiring significant capital investment (over $100,000) and time to fund, procure, install and configure (six months or more).
While the organisation chewed over how to proceed, Derek Gottfrid, a Times software engineer, pursued a different course of action. Having heard about Amazon Web Services (AWS) and its Infrastructure-as-a-Service offering, Derek uploaded all four terabytes of the TIFF images to the Amazon Simple Storage Service (S3). He then started 100 virtual machines in the Amazon Elastic Compute Cloud (EC2), on which he installed the popular Hadoop parallel processing software. Over the course of a single weekend, Derek’s program read files from S3, converted the images in one of the 100 EC2 instances, and then wrote the converted images back to S3. When the job was complete, he shut down the virtual machines and released the compute capacity back to AWS. Total cost? $240. And, by the way, The Times continues to use S3 as the storage for the files and serves user requests for the images directly from AWS.
Even the briefest look at this example indicates the tremendous potential for Cloud Computing. Who wouldn’t choose right now over ‘months from now’? Who wouldn’t select $240 rather than $100,000 plus?
But a single swallow does not a summer make, nor does a single example describe the totality of Cloud Computing. In order to understand the promise and peril of Cloud Computing, it’s important to get a full picture of Cloud Computing: in other words, what is Cloud Computing – or, put another way, how may Cloud Computing be defined?
Cloud Computing defined
Sometimes it seems that there are more definitions of Cloud Computing than there are stars in the sky. Certainly there are hundreds of definitions bandied about by vendors, journalists, IT personnel, pundits and public relations representatives. However, one definition stands out as authoritative: that of the National Institute of Standards and Testing (NIST), an agency within the United States Department of Commerce that is charged with developing standards and measures on behalf of the United States Federal Government.
The NIST Cloud Computing definition (available at http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf)has three sections:
1 Essential characteristics. NIST identifies five characteristics that a Cloud Computing environment must embody to implement ‘true’ Cloud Computing.
The five characteristics are:
2 Service models. NIST defines three ways that Cloud Computing may be delivered:
Cloud Software-as-a-Service
Cloud Platform-as-a-Service
Cloud Infrastructure-as-a-Service.
3 Deployment models. NIST describes four different ways that Cloud Computing environments can be deployed:
Much of the discussion about Cloud Computing centres around the deployment models, so it is worthwhile examining how Cloud Computing can be deployed before moving on to the characteristics and delivery models.
Cloud Computing deployment models
Private Cloud is one in which the Cloud infrastructure is operated solely for an organisation. It may be managed by the organisation or a third party and may exist on or off premises.
Essentially, a private Cloud is one dedicated to the use of one organisation; it has full use of all of the Cloud environment’s resources and also bears full responsibility for its costs.
Community Cloud is one in which the Cloud infrastructure is shared by several organisations and supports a specific community that has shared concerns (e.g. mission, security requirements, policy, and compliance considerations). It may be managed by the organisations or a third party and may exist on or off premises.
A community Cloud would commonly be domain-specific (e.g. a Cloud dedicated to use by government health organisations) and operated on behalf of organisations with common objectives and operations.
Public Cloud is a form of Cloud in which the Cloud infrastructure is made available to the general public or a large industry group and is owned by an organisation selling Cloud services.
A public Cloud is available for use by anyone who cares to use it and no commonality of use patterns, application type or user profile is assumed.
Hybrid Cloud describes a deployment situation where the Cloud infrastructure is a composition of two or more Clouds (private, community or public) that remain unique entities but are bound together by standardised or proprietary technology that enables data and application portability (e.g. Cloud bursting for load balancing between Clouds).
It is important to note that hybrid Cloud is the deployment model that is most ambiguous in common use, with the term used to describe very different Cloud topologies and use patterns. For example, the NIST definition implies that a hybrid Cloud is made up of two or more deployment environments, both of which must be Cloud environments.
By contrast, many people use the term ‘hybrid Cloud’ to describe an environment in which applications may be deployed internally in a traditional corporate data centre or to an external private or public Cloud environment – in other words, to these people a hybrid Cloud deployment model does not require multiple Cloud environments.
When discussing or reading about hybrid Cloud, one must be extremely careful to understand the assumptions another party has about what qualifies as a hybrid Cloud, as the implications of the different versions of hybrid are quite different.
Another important aspect of deployment model to keep in mind is the difference between private and public Cloud Computing environments. Specifically, with regard to security and compliance, many people assume that public Cloud environments present significant risk, while private Cloud environments are immune to risk from these factors.
While it is true that private and public Cloud environments differ and present different risk profiles, it is not the case that risk is entirely associated with public Cloud deployment environments, while private Cloud environments are immune to risk.
This book will discuss the risks associated with Cloud Computing in general, and the specific risks associated with the public and private deployment models; but make no mistake, risk is present in any form of computing and Cloud Computing is no exception, no matter which deployment model is implemented.
Cloud Computing service models
The NIST definition identifies three Cloud Computing service models: Infrastructure-as-a-Service, Platform-as-a-Service and Software-as-a-Service. The so-called ‘IPS’ taxonomy to define Cloud Computing service models is typical throughout the IT industry, and definitely provides a convenient method to understand how a given Cloud offering fits into the larger Cloud Computing picture.
It’s worthwhile to review the NIST definition of each service model before delving into what each service model implies.
Cloud Software-as-a-Service (SaaS) The capability provided to the consumer is to use the provider’s applications running on a Cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g. web-based e-mail). The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, storage or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.
Cloud Platform-as-a-Service (PaaS) The capability provided to the consumer is to deploy onto the Cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems or storage, but has control over the deployed applications and possibly application hosting environment configurations.
Cloud Infrastructure-as-a-Service (IaaS) The capability provided to the consumer is to provision processing, storage, networks and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying Cloud infrastructure but has control over operating systems, storage, deployed applications and possibly limited control of selected networking components (e.g. host firewalls).
Discussion of each service model
While the NIST definition goes through a progression of SaaS, PaaS and IaaS, we will describe the service models in a different order: IaaS, SaaS and PaaS. We do this for clarity, as the description of each of the models can best be understood when addressed in this order.
Infrastructure-as-a-Service The best way to think about IaaS is that it offers the ability to use fundamental computing resources like virtual machines or network capacity on an as-needed basis. The using organisation does not own the capital assets (i.e. the physical servers or network switches, which are owned by the service provider), but merely uses the computing capacity offered by those assets.
The most common way of paying for these resources is on a ‘pay-as-you-go’ model; that is, a rental model in which payment is made for a granular use of the service. For example, IaaS virtual machines are commonly offered for a per-hour fee, with the fee tied to the capacity of the virtual machine. A small machine might be, say, $0.10 per hour, while one with four times the capacity might be $0.40 per hour.
The benefit of IaaS is that it breaks the previous necessity of owning computing assets in order to perform computing processes. While ownership of an asset is often the best way to get the greatest possible benefit from it, in other use cases, ownership is uneconomic. That is why we rent cars at vacation destinations rather than purchasing a new car every time we visit a new holiday spot.
The problem with many computing tasks in organisations is that they are poorly suited for the asset ownership model. Owning a large amount of computing infrastructure to manage the once-a-month accounting reconciliation is an example where owning computing assets is poorly matched to the use profile; the remainder of the month, where no reconciliation is going on, represents a waste of capital as those assets sit idle. Likewise, occasional analytic processing represents another poor computer utilisation situation. IaaS offers the opportunity to rent computing resources for short periods of time to manage occasional or peak workloads.
In addition to the obvious use cases associated with temporary computing resource use, some organisations have moved to use IaaS for use cases associated with ongoing computing. For example, Netflix uses Amazon Web Services to host its main website and much of its order processing and digital media management. Even though Netflix is certainly capable of managing its own technology infrastructure, it prefers to rely on Amazon to build and operate data centres and computing infrastructure, since Amazon specialises in this. Offloading this aspect of its online service allows Netflix to concentrate in areas it sees as its core differentiator: media delivery, recommendation engine and supply chain management.
There is also some evidence that IaaS providers can deliver their compute services less expensively than IT organisations can with their own assets. For those IT organisations, it’s less expensive to use an external provider than attempt to own and operate their own computing infrastructure. Significant controversy about whether internal assets or external Clouds are less expensive exists, and no universally accepted answer is available. However, there is a trend by many companies to move a sizable portion of their computing to external Cloud service providers. Naturally, one of the concerns raised about putting important compute workloads in an external provider is security, which will be addressed at length in the remainder of this book.
Software-as-a-Service The best way to think of the SaaS service model is as an application delivered over the Internet, with the using organisation taking on no responsibility for application deployment or operation. The SaaS provider retains control and, ultimately, obligation for all aspects of application delivery – availability, performance and, of course, security.
By contrast, the using organisation bears no responsibility for the application’s service characteristics – users merely interact with the application.
One other aspect of SaaS is quite critical, though not overtly described in the service model definition. SaaS applications are typically not dedicated to a single user organisation, the way an on-premises application usually is. The sharing of a single application by many different user organisations is commonly referred to as multi-tenancy. The fact that many different organisations – indeed, even competitors – share a single application, raises the im...
