Upload
whitmeyertuffin
View
515
Download
0
Tags:
Embed Size (px)
DESCRIPTION
Citation preview
EXECUTIVE BRIEFING:
STRATEGIC ISSUES SURROUNDING CLOUD
SERVICES
April 11, 2013
EXECUTIVE BRIEFING: STRATEGIC ISSUES
SURROUNDING CLOUD SERVICES
BRIEF INTRODUCTION TO CLOUD COMPUTING
April 11, 2013
3
CLOUD DEFINITION
Public Private Hybrid CommunityCloud Types
Service TypesSoftware as a Service (SaaS)
Platform as a Service (PaaS)
Infrastructure as a Service (IaaS)
Key Characteristics On-Demand
Self ServiceGlobal Secure
AccessUtility Billing
Elastic ScaleAutomation Orchestration
Thanks to Geoff Sinn and Dimension Data for certain slides. NIST = The National Institute of Standards and Technology
4
TRADITIONAL VS. CLOUD COMPUTING
5
BASIC DEFINITIONS: CLOUD TYPESPrivate Cloud
Public Cloud
Hosted Private Cloud
Virtual Private Cloud
Hybrid Cloud
Community Cloud
• A Cloud architecture that is deployed for the sole use of a single enterprise – and resides on the enterprise premise (i.e. on-premise)
• A Cloud architecture that is deployed for the sole use of a single enterprise – but hosted by a cloud services provider (i.e. off-premise)
• A Cloud architecture that is deployed for the provision of public cloud services – a cloud architecture that serve multiple enterprises – hence sharing of underlying infrastructure elements occur (to varying degrees, based on the actual service type).• A dedicated partition within a Public Cloud architecture that is allocated to a single enterprise – hence certain elements of the architecture are shared, while others are dedicated to a single enterprise (related to the service type).
• A Cloud architecture that is made up of a combination of previous Cloud Types – most often a combination of Private and Public Cloud Architectures (once again related to the service types).
• A Public Cloud Architecture for the provision of cloud services to a specific or limited community or segment or vertical.
6
BREAKDOWN OF PRIVATE CLOUD
Source: Gartner 2011
7
BREAKDOWN OF PUBLIC CLOUD
Source: Forrester Research Inc.
Finished Application that you rent and customize
Developer Platform that abstracts the infrastructure, OS and middleware to drive developer productivity
Deployment platform that abstracts the infrastructure
•
•
•
8
THE ABC’S OF CLOUD – “XAAS”
AaaS – Architecture BaaS – Backend CaaS – Call Center DaaS – Data EaaS – Email FaaS – Frameworks GaaS – Governance HaaS – Hardware IaaS – Infrastructure JaaS – Java Authentication Kaas – Knowledge LaaS – Lending
MaaS – Monitoring NaaS – Networks OaaS – Office PaaS – Platform QaaS – Data Quality RaaS – Recovery SaaS – Software TaaS – Telephony Uaas – Unification Vaas – Value-Added-Services XaaS – Anything Yaas – Yield Optimization ZaaS – Zebra
Credit: Updata Partners
BUSINESS DRIVERS OF CLOUD COMPUTING
• Business continuity
• Technology independence
• Operational complexity
• Specialized skills
Risk Optimization
• Time-to-market
• Innovation
• New business models
• Resource leverage
Strategic Agility
• No capex, less assets
• Pay-as-you-use
• On-demand capacity
• Elasticity
• Economies of scale
• Time-to-value
Cost Optimization
9
10
ECONOMICS OF CLOUD COMPUTING/SAAS
Recommend resources from VC firm Updata Partners (Carter Griffin) web site: http://www.updatapartners.com/resources/12/SEVC-Cloud-Presentation/
SE Venture Conference 2013 Presentation on Cloud Computing Growth in Cloud market from $14B in 2010 to
$60B in 2016 SMB’s are early adopters
Cloud Computing: GMPP, rCAC and the Importance of Component Level Analysis -- Key metrics for measuring and managing a SaaS business
Cloud Computing: A Closer Look at Churn -- a deeper analysis of churn and its impact on SaaS businesses
11
EXECUTIVE BRIEFING: STRATEGIC ISSUES
SURROUNDING CLOUD SERVICES
MANAGING LEGAL RISK IN THE CLOUD
April 11, 2013
12
Main areas of legal risk: Keeping data “secure” to:
Manage personal information in compliance with growing number of laws and regulations, and
Maintain trade secrets/other IP Avoiding contract risk and the customer-
supplier “gap”
CLOUD COMPUTING AND SECURITY
Data Dispersal
Data Fragmentation
Secure Data Centers
Multiple Customer Demands
Easier Patching and Updates
Lack of Transparency
Lack of Responsiveness
“Trading Market” of Subcontractors
Vendor Lock-In
Advantages Disadvantages
13
14
UPDATES IN PRIVACY AND SECURITY LAW
HIPAA Updates This month – 10 year anniversary for HIPAA 2009 Hi-Tech imposed obligations on vendors (“Business Associates”) New Omnibus Rule effective March 26, 2013; compliance required generally by
September 23, 2013. Enhanced obligations on Business Associates and increased penalties.
Massachusetts Data Security Act Effective March 2010; contract requirements effective March 2012 Requires contract terms with vendors; written security policy; and that certain
personal information to be encrypted
New COPPA Regulations Published December 2012; compliance required July 1, 2013 Now covers third-party plugins, ad networks Expands what constitutes personal information (e.g. IP Addresses)
15
UPDATES IN PRIVACY AND SECURITY LAW
EU Data Protection Proposed Regulations In January 2012, detailed revisions proposed to make the law more
uniform across the EU, and increases protections and possible penalties
US companies seeking to transfer personal information from EU to US must follow a safe harbor certification/filing approach or other rules to comply with EU regulations
FTC: Concerns have increased from use and sale of personal information, to
use of IP addresses, device identifiers, and other information not normally considered as personally identifiable
Breach Notification Laws: NC Identity Theft Protection Act of 2005 Virtually all states have adopted similar statutes
16
SECURITY POLICY
Legal Requirement to have a Written Information Security Policy:
NC law: All companies must have written procedures relating to the destruction of personal records as official policy
Mass. Data Security Act: organizations that handle information about Mass. residents must have a comprehensive written information security program
HIPAA/Hi-Tech: Also requires a written information security program Federal Trade Commission: Failure to protect personal information by using
reasonable security can be an unfair and deceptive trade practice Other Good Reasons for a “WISP”
Complying with breach notification laws Assuring compliance with required privacy notices (e.g. California requirement) Protecting intellectual property Satisfying officer and director fiduciary obligations Complying with contracts Increasing value of company to buyers Dealing with subpoenas and related requests for electronic information in
discovery
Typically service agreements, not licenses Often offered via “click and accept”
agreements Sometimes incorporate by reference other
terms of use and policies Sometimes purport to be changeable without
notice by the vendor
17
CONTRACTING IN THE CLOUD
CONTRACT TERMS: SECURITY AND PRIVACY
Confidentiality Obligation to maintain reasonable and effective
physical, technical and administrative security measures
Compliance with all applicable data privacy and security laws
Right to review security/disaster recovery policies Right to audit and test security
18
Notification in the case of breach Indemnification for breaches/payment of
costs of required notices to customers Require use of encryption Restrictions on use of subcontractors and
downstream sharing of information Restrictions on where data can be stored
19
CONTRACT TERMS: SECURITY AND PRIVACY
Ownership and Use of Data Disposition of Data on Termination Location of Data Legal / Government Request to Access Data
20
CONTRACT TERMS: DATA ISSUES
Uptime
Performance & Response Time
Error Correction Time
Infrastructure / Security
Performance Credits
Use of Measurement Technology
Notice/Reporting Obligations
21
CONTRACT TERMS: SLA’S
Monthly service fees
Per user or provider, or based on transactions?
When does it start?
Implementation fees
Commitment to start date?
Add-on pricing
Payment terms
Caps on increase in fees
22
CONTRACT TERMS: PRICING
Length Termination Rights Termination Penalties Data Rights upon Termination Vendor Termination or Suspension Automatic Renewal
23
CONTRACT TERMS: TERM & TERMINATION
24
KEY TAKEAWAYS
Companies (vendors and users) should: review the laws applicable to their situation,
and update security practices, policies and procedures as needed
perform appropriate due diligence and contract negotiations for important cloud contracts
review insurance policies and possibility for additional insurance