Clouds: Whats new is old is new

1
Clouds Whats new is old is new

• Joseph Alhadeff, VP Global Public Policy CPO,
  Oracle

2
Cloud Computing, Hard to Define
3
NIST Definition v15
Cloud computing is a model for enabling
convenient, on-demand network access to a shared
pool of configurable computing resources (e.g.,
networks, servers, storage, applications, and
services) that can be rapidly provisioned and
released with minimal management effort or
service provider interaction. This cloud model
promotes availability and is composed of five
essential characteristics, three service models,
and four deployment models.
4
Characteristics/Deployment models (NIST)

• On-demand self-service
• Broad network access
• Resource pooling
• Rapid elasticity
• Measured Service

• Private cloud. The cloud infrastructure is
  operated solely for an organization. It may be
  managed by the organization or a third party and
  may exist on premise or off premise.
• Community cloud. The cloud infrastructure is
  shared by several organizations and supports a
  specific community that has shared concerns
  (e.g., mission, security requirements, policy,
  and compliance considerations). It may be managed
  by the organizations or a third party and may
  exist on premise or off premise.
• Public cloud. The cloud infrastructure is made
  available to the general public or a large
  industry group and is owned by an organization
  selling cloud services.
• Hybrid cloud. The cloud infrastructure is a
  composition of two or more clouds (private,
  community, or public) that remain unique entities
  but are bound together by standardized or
  proprietary technology that enables data and
  application portability (e.g., cloud bursting for
  load-balancing between clouds).

5
Service Models (NIST)

• Cloud Software as a Service (SaaS). The
  capability provided to the consumer is to use the
  providers applications running on a cloud
  infrastructure. The applications are accessible
  from various client devices through a thin client
  interface such as a web browser (e.g., web-based
  email). The consumer does not manage or control
  the underlying cloud infrastructure including
  network, servers, operating systems, storage, or
  even individual application capabilities, with
  the possible exception of limited user-specific
  application configuration settings.
• Cloud Platform as a Service (PaaS). The
  capability provided to the consumer is to deploy
  onto the cloud infrastructure consumer-created or
  acquired applications created using programming
  languages and tools supported by the provider.
  The consumer does not manage or control the
  underlying cloud infrastructure including
  network, servers, operating systems, or storage,
  but has control over the deployed applications
  and possibly application hosting environment
  configurations.
• Cloud Infrastructure as a Service (IaaS). The
  capability provided to the consumer is to
  provision processing, storage, networks, and
  other fundamental computing resources where the
  consumer is able to deploy and run arbitrary
  software, which can include operating systems and
  applications. The consumer does not manage or
  control the underlying cloud infrastructure but
  has control over operating systems, storage,
  deployed applications, and possibly limited
  control of select networking components (e.g.,
  host firewalls).

6
(No Transcript)
7
Evolution Over The Years
Adoption
Time
8
New?

• Cloud computing is an amalgam of mostly existing
  technologies and services
• Some use models, coupled with scope of
  availability and ease of use are part of whats
  new
• The access and availability of computing, storage
  and applications enables individual users to be
  content creators, publishers and application
  developers.
• Further developments and roles are expanding in
  new and innovative ways.
• Are existing regulatory paradigms relevant or
  applicable?

9
Virtualization
Virtualization is separating the computing
workload from the hardware. Once computers have
become more or less disembodied, all sorts of
possibilities open up. Virtual machines can be
moved around while running, perhaps to
concentrate them on one server to save energy.
They can have an identical twin which takes over
should the original fail. And they can be sold
prepackaged as virtual applianceseventually to
turn a data centreor even several of theminto a
single pool of computing, storage and networking
resources that can be allocated as needed.
The Economist Special Report Where the Cloud
Meets the Ground Oct 23, 2008 Quoting Paul
Maritz of VMware
10
Cloud Computing Architecture
Web Services
Virtual Machines
Dynamic Application Provisioning
CRM
Database
BI
Virtualization Layer
Email
Commodity Hardware
11
Cloud Computing Benefits

• Reduce capital expenditures
• Low barrier to entry
• Scalable infrastructure
• Cost-effective Pay for what you use
• Acquire resources on demand
• Release resources when not needed
• Virtually infinite compute and storage resources
• Turn Organizations fixed cost into variable cost
• May improve security
• Patch management/professionally managed services

12
Cloud Computing Vs. Traditional Hosting Key
Differences
13
Familiar Questions

• Cloud?
• Abstraction Layer
• Where is my information?
• Who controls it?
• Who has access?
• How is being used?
• Who is it being shared with?
• Who is looking out for my interests?

14
Cloud computing operational concerns the back
end

• Performance/availability/Service Level
• Support
• Interoperability
• Audits/Oversight
• Termination/Lock-in
• Less by design and more by inertia
• Role of open standards
• Portability

15
Cloud computing legal concerns

• Privacy
• International data transfers
• Consistent treatment
• Lawful access issues
• Export control
• Data breach notification laws
• Data retention laws
• E-discovery
• Government regulation
• Jurisdiction/Conflict of Laws

16
Cloud computing contractual concerns

• All of the operational/legal issues plus -
• Data ownership
• IP
• Limitation of liability issues
• SLAs
• Indemnities
• Subcontracting
• Dispute resolution
• Audits
• Notice/ consent for transfer, where applicable

17
Desirable characteristics

• Extended corporate controls
• Good security/privacy policies, practices and
  controls
• Up-to-date patched
• 24x7x356 service
• Mapping to legal requirements
• Tools
• PIA, Audit reports, Gap Analysis to 27001
• Privacy/Security by Design
• Ecosystem Accountability

18