TABLE OF CONTENTS

I. II. III. I#. #. #I.

Executive Summary Barriers to cloud computing adoption Customer vendor colla!oration "or success"ul adoption Bene"its$ris%s to !usiness& due to cloud adoption Conclusion 'e"erences

I.

Executive Summary

COMPANIES LARGE AND SMALL are moving quickly to ado t !ome "orm o" cloud com uting tool! and !ervice!# recogni$ing a ne% tec&nology t&at could re!&a e t&eir com etitive land!ca e' In a ne% glo(al !urvey o" nearly )#*++ (u!ine!! and tec&nology leader! conducted (y ,arvard -u!ine!! Revie% Analytic Service!# t&e ma.ority / 0*1 / !aid t&eir organi$ation! %ill (e u!ing cloud tool! moderately to e2ten!ively over t&e ne2t t&ree year!' 3&ey cited t&e cloud4! a(ility to increa!e (u!ine!! ! eed and agility# lo%er co!t!# and ena(le ne% mean! o" gro%t&# innovation# and colla(oration a! t&e driver! "or t&i! "airly aggre!!ive rate o" ado tion' Current and (ro)ected *se o" Cloud Computing +as on ,-../

Clearly# t&e ! eed o" migration %ill (e in"luenced (y circum!tance!' More evidence o" cloud4! (u!ine!! (ene"it! %ould accelerate ado tion / a! %ould (etter5in"ormed management team! / %&ile a &ig&5 ro"ile !ecurity (reac& or ma.or outage re!ulting in lo!! o" (u!ine!! could in&i(it e2 an!ion' A re!earc& a er u(li!&ed in International Journal of Cloud Computing and Services Science (IJ-CLOSER) in A ril 6+)7 &ad "ound t&e "ollo%ing varia(le! 5 Co!t e""ectivene!!# Need "or cloud com uting# Security e""ectivene!!# and relia(ility on cloud com uting in t&i! order a! t&e mo!t !igni"icant "actor! t&at in"luence (u!ine!! organi!ation!4 deci!ion on cloud ado tion' In t&i! ro.ect# %e "urt&er delve dee er into t&i! to ic to under!tand t&e (arrier! to t&e ado tion o" cloud com uting# t&e cu!tomer5vendor colla(oration t&at &a! t&e otential to cataly!e a !ucce!!"ul cloud ado tion and ri!k!5(ene"it! analy!i! "or t&e ado ter!'

II.

Barriers to adoption o" cloud computing

Some o" t&e (arrier! de icted in t&e "igure a(ove are !el"5e2 lanatory' ,o%ever# "e% ot&er (arrier! like data !ecurity# relia(ility# leagal i!!ue! and vendor lock5in need a little in5de t& in!ig&t %&ic& are de!cri(ed (elo%8

0ata Security1 Data rotection to ! t&e li!t o" cloud concern! today' 9endor !ecurity ca a(ility i! key to e!ta(li!&ing !trategic value# re ort! t&e 6+)6 Com uter%orld :Cloud Com uting; !tudy# %&ic& mea!ured cloud com uting trend! among tec&nology deci!ion maker!' <&en it come! to u(lic# rivate# and &y(rid cloud !olution!# t&e o!!i(ility o" com romi!ed in"ormation create! tremendou! ang!t' Organi$ation! e2 ect t&ird5 arty rovider! to manage t&e cloud in"ra!tructure# (ut are o"ten unea!y a(out granting t&em vi!i(ility into !en!itive data' 3&ere are com le2 data !ecurity c&allenge! in t&e cloud8 3&e need to rotect con"idential (u!ine!!# government# or regulatory data Cloud !ervice model! %it& multi le tenant! !&aring t&e !ame in"ra!tructure Data mo(ility and legal i!!ue! relative to !uc& government rule! a! t&e E= Data Privacy Directive Lack o" !tandard! a(out &o% cloud !ervice rovider! !ecurely recycle di!k ! ace and era!e e2i!ting data Auditing# re orting# and com liance concern! Lo!! o" vi!i(ility to key !ecurity and o erational intelligence t&at no longer i! availa(le to "eed enter ri!e I3 !ecurity intelligence and ri!k management

A ne% ty e o" in!ider %&o doe! not even %ork "or your com any# (ut may &ave control and vi!i(ility into your data

Suc& i!!ue! give ri!e to tremendou! an2iety a(out !ecurity ri!k! in t&e cloud' Enter ri!e! %orry %&et&er t&ey can tru!t t&eir em loyee! or need to im lement additional internal control! in t&e rivate cloud# and %&et&er t&ird5 arty rovider! can rovide adequate rotection in multitenant environment! t&at may al!o !tore com etitor data' 3&ere4! al!o ongoing concern a(out t&e !a"ety o" moving data (et%een t&e enter ri!e and t&e cloud# a! %ell a! &o% to en!ure t&at no re!idual data remnant! remain u on moving to anot&er cloud !ervice rovider' =nque!tiona(ly# virtuali$ed environment! and t&e rivate cloud involve ne% c&allenge! in !ecuring data# mi2ed tru!t level!# and t&e otential %eakening o" !e aration o" dutie! and data governance' 3&e u(lic cloud com ound! t&e!e c&allenge! %it& data t&at i! readily orta(le# acce!!i(le to anyone connecting %it& t&e cloud !erver# and re licated "or availa(ility' And %it& t&e &y(rid cloud# t&e c&allenge i! to rotect data a! it move! (ack and "ort& "rom t&e enter ri!e to a u(lic cloud' S eci"ic !ecurity c&allenge! ertain to eac& o" t&e t&ree cloud !ervice model!/So"t%are a! a Service >SaaS?# Plat"orm a! a Service >PaaS?# and In"ra!tructure a! a Service >IaaS?' )' SaaS de loy! t&e rovider4! a lication! running on a cloud in"ra!tructure@ it o""er! any%&ere acce!!# (ut it al!o increa!e! !ecurity ri!k' <it& t&i! !ervice model it4! e!!ential to im lement olicie! "or identity management and acce!! control to a lication!' Aor e2am le# %it& Sale!"orce'com# only certain !ale! eo le may (e aut&ori$ed to acce!! and do%nload con"idential cu!tomer !ale! in"ormation'

6' (aaS i! a !&ared develo ment environment# !uc& a! Micro!o"tB <indo%! A$ure# %&ere t&e con!umer control! de loyed a lication! (ut doe! not manage t&e underlying cloud in"ra!tructure' 3&i! cloud !ervice model require! !trong aut&entication to identi"y u!er!# an audit trail# and t&e a(ility to !u ort com liance regulation! and rivacy mandate!' 7' IaaS let! t&e con!umer rovi!ion roce!!ing# !torage# net%ork!# and ot&er "undamental com uting re!ource! and control! o erating !y!tem!# !torage# and de loyed a lication!' A! %it& Ama$on Ela!tic Com ute Cloud >EC6?# t&e con!umer doe! not manage or control t&e underlying cloud in"ra!tructure' Data !ecurity i! ty ically a !&ared re! on!i(ility (et%een t&e cloud !ervice rovider and t&e cloud con!umer' Data encry tion %it&out t&e need to modi"y a lication! i! a key requirement in t&i! environment to remove t&e cu!todial ri!k o" IaaS in"ra!tructure er!onnel acce!!ing !en!itive data'

'elia!ility Anyone %&o &a! ever urc&a!ed a cloud5(a!ed !o"t%are !y!tem i! "amiliar %it& t&e Service Level Agreement >SLA?' In t&e SLA# t&e rovider commit! to a ercentage o"

u 5time# or amount o" time t&e !y!tem can (e e2 ected to run %it&out interru tion' Ideally t&i! %ould (e )++1# (ut a! %it& mo!t tec&nology# &iccu ! in !ervice delivery are inevita(le'

<&en creating t&e SLA# vendor! take into account regularly !c&eduled maintenance# a! %ell a! un lanned outage! or do%ntime' A"ter making t&o!e con!ideration!# mo!t cloud com anie! can !till quote a(out CC'C1 u 5time' 3&at look! retty im re!!ive and !eem! to (e in line %it& t&e kind o" er"ormance %e &ave come to e2 ect "rom SaaS vendor!' =n"ortunately# nay!ayer! !till like to &ar on t&at ')1'

Even t&oug& cloud !y!tem! are recogni$ed a! t&e ca!&5"lo%5"riendly alternative to on5 remi!e !y!tem!# %e !till &ave t&e traditionali!t! t&at re"u!e to em(race t&e cloud' Many re"er to in!tead d%ell on t&e :%&at i"!'; <&at i" t&e &o!t4! !erver! go do%nD <&at i" mi!!ion5critical data i! lo!tD <&ile t&e!e are clearly valid que!tion!# "or many on5!ite uri!t!# %&at it really come! do%n to i! control' =!er! "eel more !ecure %&en t&ey are in control o" t&e !y!tem'

Legal Issues Organi$ation! mu!t ro erly negotiate and dra"t t&e legal contract (et%een t&e organi$ation and t&e cloud !ervice rovider' I3 manager! may not &ave t&e aut&ority to agree to t&e term! o" t&e contract or acce t t&e ri!k!' Organi$ation! !ometime! "ind t&at cloud rovider!# in articular t&e lo%5co!t online !ervice rovider!# re!ent :take it or leave it; contract! t&at are non5negotia(le' 3&e ri!k! o" doing (u!ine!! %it& t&e!e cloud !ervice rovider! and acce ting t&eir (oiler late contract! are t&at many o" t&em8

lack critical enter ri!e5 rotective term!# do not adequately rotect t&e cu!tomerE! data# do not contain any guarantee a! to quality o" !ervice# and allo% "or more li(eral u!age o" er!onal in"ormation# %&ic& %ould not (e !u""icient "or an organi$ation to meet it! rivacy and ot&er legal o(ligation!'

O"ten# cloud !ervice contract! "ail to deal %it& ro er tran!itioning o" t&e data and !ervice! to anot&er cloud rovider >or (ack to t&e cu!tomer organi$ation? %&en t&e contract or t&e relation!&i come! to an end# leaving t&e organi$ation vulnera(le to lo!! o"# or inacce!!i(le# data and interru tion o" critical !ervice!' 3&i! i! %&y engagement o" e2 erienced I3 coun!el can (e invalua(le' Generally ! eaking# more indu!try5! eci"ic cloud o""ering! are availa(le# (ut at co!t! %&ic& are &ig&er t&an con!umer5(a!ed or generic !ervice! t&at are more !uita(le to non5enter ri!e or non5regulated (u!ine!!e!'

A !ucce!!"ul rocurement o" cloud !ervice! take! time and require! t&e involvement o" in"ormed and e2 erienced legal coun!el %&o can ! ot t&e i!!ue! and advi!e on %&et&er t&e cloud !ervice! contract term! are adequate' I" t&e contract term! are not acce ta(le and cannot (e amended# t&e (u!ine!! leader! !&ould con!ider "inding a di""erent cloud !ervice rovider# or maintain certain !ervice! in5&ou!e and re!trict t&e ty e o" data or !ervice t&at %ill (e migrated to t&e cloud'

3erm! %&ic& need to (e t&oroug&ly covered in a cloud !ervice contract include8 o%ner!&i o" data# termination rig&t! and termination a!!i!tance# u time# !ervice availa(ility# er"ormance level!# !ecurity %arrantie!# allocation o" lia(ility ri!k# rivacy# data !ecurity and (reac& noti"ication requirement!# com liance %it& la%! and regulation!# re re!entation! a(out .uri!dictional e2 o!ure o" in"ormation and o eration!# and remedie! "or (reac& o" t&e contract'

Cloud !ervice contract! !&ould al!o include ro er term! dealing %it&8 c&ange# ro(lem re!olution# !u(contracting# u!e o" o en !ource !o"t%are# a lication re5develo ment#

o%ner!&i o" any intellectual ro erty# trade5!ecret rotection#

con"identiality# te!ting# data integrity# otential !econdary u!e! o" data# a!!urance o" data !egregation and i!olation# encry tion in tran!it and in !torage# (acku and data recovery# %&at &a en! to t&e data and t&e in"ra!tructure u on termination o" t&e agreement or in t&e event o" a "ailure or in!olvency o" one o" t&e artie!# &o% maintenance or !ervice interru tion %ill (e &andled# %&at geogra &ical limitation! mu!t (e im o!ed# t&e rig&t to audit t&e entitie! and t&e tec&nology# etc'

#endor Loc%$in1 Going %it& a cloud !olution mean! to t&e organi!ation! like entering contract "or t&e ! eci"ic rotocol!# !tandard! and tool! o" t&e cloud vendor# making "uture migration co!tly and di""icult' <&en com anie! calculate t&e co!t o" u!ing cloud com uting !ervice!# t&ey "ail to "actor in t&e co!t! o" migrating o"" t&e !y!tem F e2 en!e! %&ic& could (e ro&i(itive and une2 ected' A Cloud a lication %ould mo!t ro(a(ly (e !tandard!5com liant "or certain intero era(ility "unction!' -ut t&e actual &o!ting o" t&e a lication# t&e actual requirement! "or t&at a lication to e2i!t in a cloud environment# to connect to t&e virtuali$ed re!ource! and t&e admini!tration tool! t&e cloud rovider! may rovide to con"igure and maintain t&e a lication# %ill (e# "or t&e mo!t art# controlled (y t&e cloud rovider it!el"' 3&i! ne% degree o" cloud vendor lock5in i! a !te (ack%ard! "rom all t&e %ork t&at &a! (een done %it& a roac&e! !uc& a! !ervice oriented arc&itecture' SOA "ree! client! "rom t&e tec& vendor lock5in model# in term! o" motivating t&e tran!ition to%ard! intero era(ility level !tandard!'

III. I#. #. #I.

Customer vendor colla!oration "or success"ul adoption Bene"its$ris%s to !usiness& due to cloud adoption Conclusion 'e"erences )' Factors In"luencing Organi2ation Adoption 0ecision On Cloud Computing # Ailar Ra&imli# International Gournal o" Cloud Com uting and Service! Science >IG5 CLOSER? 9ol'6# No'6# A ril 6+)7# ' )H+I)HJ 6' 3o4 t5e Cloud Loo%s "rom t5e Top1 Ac5ieving Competitive Advantage In t5e Age o" Cloud Computing# A re ort (y ,AR9ARD -=SINESS RE9IE< ANALK3IC SER9ICES 7' A %&ite a er on L0ata Security in t5e Cloud 4# (y 9ormetric F Data Security Sim li"ied and CSO F Cu!tom Solution! Grou H' T5e 0o4ntime 0ilemma1 'elia!ility in t5e Cloud # article (y Carl!on L'# on !o"t%areadvice'com *' T5e Legal Issues o" Cloud$!ased Computing Services# A r 6+)7# u(li!&ed (y -ennett Gone! M A!!ociate! J' Cloud Computing6s #endor Loc%$In (ro!lem1 75y t5e Industry is Ta%ing a Step Bac%4ard# Nov 6+))# (y McNendrick G'# article in AOR-ES maga$ine