Serverless computing: What Middle Eastern CIOs need to consider

With hyperscale and regional providers rushing to meet demand for cloud services in the Middle East, serverless computing is a key technology that every CIO in the region should have on their roadmap.

A key question that Middle Eastern CIOs need to ask themselves is what they want to achieve by moving to the cloud. Does cloud adoption simply mean moving your infrastructure from one data centre to the other and saving some money, or is the goal a complete revamp of your IT ecosystem by moving to a software-based, pay-as-you go model? If the answer was the latter, then you should be looking into serverless computing. There has never been a better time to consider this new technology in the Middle East.

Data centres from major players including Microsoft, Amazon Web Services (AWS), Oracle, and IBM have cropped up across the Middle East over the past few years. Recently, AWS announced the planned arrival of its new UAE region in 2022, which will surely accelerate cloud adoption even further in the Middle East .

What is serverless computing?

The term serverless computing may be a bit misleading, as there is always a server somewhere in a data centre, but serverless nevertheless does exactly what its name entails for the enterprise. Just as cloud computing virtualized your data centre, serverless is a game-changer that removes the hassle of worrying about the underlying infrastructure of an application. Instead, developers can just focus on writing code (usually referred to as a function in serverless) and pay for the computing power that is used in running it, thus removing the hassle of provisioning and maintaining an infrastructure, even a cloud-based one!

Unlike virtual machines, which can remain idle for periods of time, serverless functions operate on an event-driven model and spin up to respond to certain requests and spin down once the task is complete.

Given that most providers charge for serverless based on the number of requests and their duration, this makes it a very cost-effective proposition for cloud adopters. Serverless thus can be seen as the next logical evolution of the software model and is essentially “functions as a service (Faas)”, which continues the monolithic-to- microservices journey that many organizations have been on in the last decade or so.

Serverless computing moves to mainstream

Gartner has predicted that serverless computing will move to the mainstream in the over the next year or two as more and more organizations embark on their digital transformation journeys and tap into the power of the cloud to drive down costs and increase business value.

The promise of serverless, in which developers can just work on an application without thinking about server requirements, security, storage, etc., has proven to be very tempting with technology leaders in companies of all sizes looking into its potential for their digital journeys.

It’s not surprising then that all the major cloud providers already provide serverless in one form or another. A recent study done by Datadog estimates that one in every five organisations is already using FaaS in one form or another.

The big cloud providers that have established data centres in the Middle East are paying attention to this trend. For example, in addition to opening new data centres, AWS has also made its serverless repository available in its current Middle East region from Bahrain, allowing customers to share serverless applications among themselves and save time on development by giving access to a huge library of pre-built applications .

Tapping the power of serverless in the Middle East

For Middle East CIOs to tap into the potential of serverless it is essential to cultivate a culture in which the technology can thrive by focusing on a few key points, out of which technology can surprisingly be the least important. Serverless requires a fundamental re-think of how applications function and a learning curve which has to be taken into account. Unless the relevant skill gaps are identified and filled in early, a serverless adoption strategy will fail.

In addition, since serverless is driven almost purely by developers with zero infrastructure to maintain, a greater synergy of operations and development teams is required. Infrastructure teams need not fret about being sidelined however, as their role may evolve to take on new responsibilities such as monitoring and optimizing the input/output overhead of serverless functions and their touchpoints to existing infrastructure.

Serverless computing has security implications

At the end of the day, serverless is code and insecure code continues to be one of the major ways in which an organization can get compromised. The fact that OWASP (the Open Web Application Security Project)  has released a detailed guidance on its famous top 10 application risks just for serverless shows the level of importance that securing FaaS has now reached. To accommodate this, security teams also need to undergo a shift in mindset as they realize they don’t have an OS/virtual machine to secure, and traditional security products do not translate to a serverless model. Instead, the focus shifts on the security and integrity of serverless source code and looking at each function in the cloud as a perimeter to secure.

In such a model, while a lot of the security burden shifts to the cloud provider, developers have an increased responsibility to write secure source code and application configurations and security teams need to workhand-in-hand with them to make it happen. Cross-functional teams with strong collaboration are key in making serverless a security success story.

Serverless requires software re-engineering

Lastly, serverless is not a one-size-fits-all solution and for it to be successfully adopted, CIOs need to re-engineer their software stack and look at where it can benefit and deliver the most business value to the enterprise. Large, mission-critical, monolithic applications with resource-intensive operations are generally not suitable for a migration to serverless architecture as they lack the detailed debugging and performance metrics IT teams will require and latency might increase in such an architecture as serverless functions spin down when not in use. The ugly specter of vendor lock-in also raises its head, as the serverless ecosystem is usually closely tied to a particular cloud environment and vendor

All that being said, the promise of serverless computing, in which a developer can deploy and run code without any physical or virtual OS to worry about in terms of performance or scalability, is simply too large a benefit to ignore. While we are far away from a fully serverless world in which IT teams can just focus on delivering business value instead of worrying about server maintenance, serverless computing is very much here to stay and needs to part of any CIO’s cloud migration strategy in the Middle East. IT teams on a budget and with an appetite to innovate might find serverless the perfect playground to experiment in for their new digital products.

(Taimur Ijlal is an information security and data protection professional with more than 18 years of experience in cybersecurity, enterprise risk assessment and cloud technology.)