Gary de Menzes

Businesses are getting to grips with the realities of implementing cloud computing, say the experts.

It is no longer a question of whether companies should be using cloud computing – it is now a matter of what to put into the cloud first. This is according to experts who spoke at the ITWeb Virtualisation and Cloud Computing Summit, in Bryanston, recently.

Cloud has passed the peak of its hype cycle, they said, and enterprises are grappling with the realities of implementing cloud computing strategies.

Thomas Black

Gary de Menzes, regional director at Oracle, noted that some of the top concerns in IT now are consolidation, cloud, virtualisation, operational cost reduction, and risk reduction.

“One of the biggest drivers for cloud today is cost reduction,” he said, because cloud delivers faster time to value. And virtualisation enables the cloud, De Menzes said.

Thomas Black, deputy CTO at Business Connexion, said cloud is a phenomenon that isn’t going anywhere. “But it won’t ever be ‘cloud everywhere’,” he said. “There will still be a need for dedicated architectures. Rather, cloud should be used where it is relevant and viable, not for absolutely everything.” Kim Andersen, principal advisor at CXO Advisor, agreed. “The question is now: ‘what should be cloudified?’”, he said. “Business may be over-complicating matters by trying to move everything into the cloud. You have to look at what is technically possible, and where it makes sense.”

Tammy Bortz

Andersen said a cloud strategy needs to align with the business strategy. “You need a top-down and bottom-up approach,” he said.

Systems have to be appropriately architected with cloud in mind, said Black.

Andersen echoed this. “It requires a structured approach,” he said. Not only should enterprises be assessing what applications they currently have, they should be considering where it is feasible to move them into the cloud, and where this aligns with business strategy and future directions.

Black concluded: “You need to pick the applications appropriate for the cloud, be realistic about what the cloud can provide, and re-architect your systems with this in mind.”

COLLABORATIVE CLOUD

According to Professor Pete Janse van Vuuren, director of Africa CIO Forum and CEO of The Thinking Cap, cloud computing was initially driven by a need to reduce cost. Today, he said, the growth of cloud computing is being driven by a need for flexibility and agility. In the future, he argued, collaboration will be the primary driver.

Janse van Vuuren said, traditionally, IT departments have not had the budget for growth, and have spent the majority of their budgets on running costs. He added that, for this reason, when businesses needed to grow, IT departments needed new ways to add value and drive growth.

According to Janse van Vuuren, this need to cut costs has steered many businesses along the infrastructure journey from basic to a virtualised infrastructure, and finally, to cloud computing.

Today, cloud computing is driven more by a need to be flexible and agile.

Janse van Vuuren said he believes organisations are never going to do business the way they did in the past. He argued that flexibility and speed to market have become crucial for business success, and cloud is the model that enables this.

Janse van Vuuren also stressed that the role of IT departments will be to ensure a seamless experience for end-users. According to him, it should not matter to end-users where data and applications sit, be it in the public cloud, or an enterprise’s cloud.

In the future, cloud computing will be about innovation and collaboration, said Janse van Vuuren. He used the example of teams collaborating on projects while working from three different countries. He said this is enabled by these teams working online, using the cloud. According to him, when cloud computing is used to enable collaboration, it does not matter where people are based, as long as communication is instantaneous.

Janse van Vuuren noted this collaborative future of cloud computing is being driven by social media, and customers’ demands to be able to use any device at any time, from anywhere.

REGULATING THE CLOUD

However, there is currently no legislation, or even a code of conduct, in SA to regulate cloud services and cloud service providers, said Tammy Bortz, director of Werksmans Attorneys. The result is that there are no effective guidelines for how service providers should handle personal information.

According to Bortz, the US is another country that does not have legislation in place to govern cloud services, while the European Union has proposed regulation, in the form of the EU Data Protection Directive.

Bortz pointed out, however, that some countries have legislation in place that regulates the processing of personal information, for example, the UK Data Protection Act.

In Africa, countries that have data protection laws include Angola, Mauritius and Zimbabwe, said Bortz, adding that Namibia, Lesotho, Swaziland and Botswana have ICT policies that recognise the need for regulation of data protection. Bortz also pointed out that, currently, there is an international call for cloud computing to be legislated in order to protect customers, while a number of organisations have proposed guidelines around cloud computing.

In Africa, one such movement is the Harmonisation of ICT Policies in Sub-Saharan Africa (HIPSSA). Bortz explained that this document recognises the need to protect personal data, and also sets out rules for cross-border data transfer within Africa. HIPSSA is not yet in force.

Locally, the Protection of Personal Information (PPI) Bill, which strives to protect the personal information of individuals when this information is in the hands of a third party, is expected to come into effect this year. Once implemented, organisations will be given one year to comply with the legislation.

Bortz stressed the Bill will impact all entities that process personal information. She explained that the definition of processing is broad enough that all businesses will likely be affected – especially cloud providers. According to Bortz, businesses will not only need to comply with the PPI Bill, but the onus will be on businesses to ensure third parties to whom they outsource data processing, such as cloud providers, also comply with the Bill.

Furthermore, says Bortz, the PPI Bill places more obligations on the business, or “responsible party”, than it does on the “operator”, such as the cloud provider. The Bill defines the responsible party as the entity that determines the purpose and means of the data process, while the operator is defined as the entity that processes data for the responsible party, in terms of a contract or mandate.

Bortz concluded that businesses must carry out a thorough assessment of a cloud provider’s policies before entering into a contract. She said this should include a review of providers’ terms and conditions, their security and data privacy policies, service levels, disaster recovery policies and their termination policies.