Defining cloud computing: A taxonomy

Those of you who still think the best answer when deploying any new application is to buy a server and rack it in your datacentre, you are woefully behind the times and may just be making the most expensive and slowest decision possible. Myriad deployment options exist today, from colocation to virtual machine hosting, and this collection of options has been blown out even wider thanks to the advent of cloud computing, which Forrester defines as: A standardised IT capability (services, software, or infrastructure) delivered via internet technologies in a pay-per-use, self-service way. Cloud computing differs from other hosting options because of the latter two characteristics and because of how vendors (and end users) deliver them. For example, pay-per-use generally means no long-term contract for the service and nearly all track consumption and factor this into their pricing. Also, self service typically means services are provisioned with no human intervention, sales calls, service tickets, or lengthy procurement processes and thus empowers the buyer to provision the service and start consuming. This implies that procurement of the service is fully automated, and to deliver cloud services cost effectively, this is essential. Another common characteristic of cloud computing is multitenancy, or the ability to service multiple customers from the same resources. In software this can mean that multiple customers interact with a single instance of the application or service being delivered. For infrastructure, this typically means that customers share the same physical hardware but are separated from each other via virtualization technologies. Cloud computing services deliver IT empowerment that can’t easily be matched by other outsourcing or hosting solutions because of their time-to-market advantages, the flexibility they offer, and the economics of the service, when leveraged correctly. But it should be noted that cloud computing isn’t one service, but a collection of services that meet this definition. And not all cloud computing services are designed for the same users inside the business. Most aren’t designed for ready consumption by infrastructure and operations professionals, but by developers, for example. So it’s imperative to understand the categorization of cloud computing services, who they’re for, what makes them different, and how mature each category is so that you know where to add them to your strategic road map.

Several organisations have attempted to define and organise cloud computing solutions, including the National Institute of Standards and Technologies (NIST). NIST and other organizations have broken cloud computing services into three categories, commonly referred to as the “SPI model” ( see Figure 1, click to see in full screen): • Software-as-a-service (SaaS) offerings are finished applications. You can’t modify the application or service provided, but it may be possible to do some lightweight customisations to the look and feel and to workflows. The consumer of these services can be anyone inside a business from human resources, sales management, remote workers, or I&O, depending on what value the SaaS solution provides.

• Platform-as-a-service (PaaS) is a build-deploy-manage environment. These cloud services provide a framework and a software system for application developers to create new services and rapidly deploy them on the Internet. It’s becoming common to see PaaS offerings designed specifically for the enhanced use of a SaaS service. For example, Force.com is primarily used to create new applications that directly leverage the Salesforce.com CRM service. • Infrastructure-as-a-service (IaaS) is an on-demand virtual hosting environment. These services let more sophisticated developers procure virtual machines in minutes, fill them with whatever they want, and deploy. The VMs are metered for actual resource consumption (CPU hours, bandwidth, and storage consumed), which constitutes the bill for the service. Use a little, pay a little. Use a lot, pay a lot. While this categorisation is relatively easy to understand, it doesn’t tell the whole story. There are some services within application middleware and infrastructure segments that are not full platforms but discrete services that can be consumed standalone. Thus, Forrester offers a more complete view of cloud computing (see Figure 2): • Cloud application services are Internet-resident middleware services. These are cloud services that provide a discrete middleware function but are not complete, standalone applications. A non-developer couldn’t derive very much value by procuring these services. Examples include cloud databases like Microsoft SQL Azure, billing systems like Amazon DevPay, and integration services like Boomi. • Cloud infrastructure services are discrete infrastructure or IT operations functions. These are either IT infrastructure components in the cloud, such as storage-as-a-service, or IT functions such as disaster recovery delivered as an on-demand cloud service. Clouds aren’t citizens of the Internet Finally, beyond understanding what is cloud computing, European customers must also understand where clouds live. While the popular science assumption is that cloud services “live in the cloud” and thus are free from the boundaries the rest of us face, this simply isn’t true. Cloud services, like all other IT services originate from datacentres located in specific geographies. And this means that both the service and you as the consumer are still bound to the laws and regulations of your respective jurisdictions when conducting business. For European customers that means understanding your obligations under the EU Privacy Directive and the implication of using a US-based cloud service subject to the US Patriot Act. Want to know more?

The issues highlighted in this column, along with further examples of how enterprises are getting the most from cloud computing, will be addressed by James Staten in his keynote presentation entitled “Where Is The EMEA Cloud?” at the co-located Forrester events “Security Forum EMEA 2010” and “Infrastructure & Operations Forum EMEA 2010” taking place in London on March 11 -12, 2010, at the Guoman Tower Hotel, St Katherine’s Dock.