Key capabilities for mastering the cloud

Transcription

1 Key capabilities for mastering the cloud HP white paper According to IDC, 85 percent of net-new enterprise applications will be specifically designed to be accessed in the cloud by The reasons are clear agility and cost savings. However, traditional systems are not going away. This means that IT will need to efficiently and effectively manage hybrid services comprised of cloud and non-cloud infrastructure, middleware, and applications for the foreseeable future. This white paper is targeted at IT leaders who are looking to master the cloud as part of a hybrid management strategy for cloud, virtualized, and physical business services. It focuses on the five key capabilities that IT executives need to govern, deliver, automate, assure, and secure hybrid environments and the pitfalls that one should avoid when approaching the cloud.

2 The hybrid world The cloud is here to stay but so are traditional business processes. The world of tomorrow will be a hybrid mixture of public cloud, private cloud, and legacy in-house services. Every major business process, within the next 24 months, will rely on one or more cloud applications integrated with traditional systems. And this will put you, as an IT leader, in an interesting situation. Consider the example of a prospect-to-quote business process in the hybrid world. The process is composed of other processes, both structured and unstructured. The CRM system is provided as a service by a software-as-a-service provider. The scoring engine is on a cloud platform from another vendor. The lead management system runs in an on-premises private cloud. Your sales people connect to the system via mobile devices from wherever they are. And relevant data resides in production and inventory systems at the company s plants and outlets. As the business process executes, sometimes it is under your direct control, and sometimes it is not. It passes through your managed systems and out again and then back. And if it slows down, knowing where and why is very, very difficult. But deciding who is responsible is not you are. is a more complex world. Modern composite applications will drive the reality of the hybrid IT environment applications that deliver rich user experiences that win business and build revenue. And those applications will be harder to manage and maintain. They ll introduce new challenges for testing and monitoring. Because users will demand multiple access options, perimeter security will no longer be sufficient to protect data and business processes. Wider variety in infrastructure and middleware across the stack will create complex heterogeneous environments that will cause chaos if they are poorly managed. This hybrid world represents a fundamental shift in the way IT manages both the cloud and its traditional environment. From now on, every enterprise will have to rethink its entire IT value-delivery chain. IT leaders will have to consider fundamental changes like portfolio investment planning, designing applications for cloud enablement, putting tools and processes in place to manage hybrid mixtures of cloud-based and traditional services, elevating the priority of data privacy and compliance, and implementing end-toend security that covers both cloud and non-cloud applications. And perhaps most important, business changes will have to be synchronized with IT changes, from development to delivery, so that the business can take advantage of the benefits cloud delivery offers. Approaches that don t span planning, software development lifecycles, and application lifecycles or that apply outdated security and compliance techniques are destined to fail in delivering the value that the business requires. Most IT leaders are aware of this, but they are also aware that in order to become cloud ready, IT organizations have specific cloud challenges to consider. 2

3 As a result of these concerns, many IT executives are uncomfortable with the way their business counterparts who are eager to speed up innovation, accelerate business processes, and reduce time to revenue are pressuring them to adopt cloud services. In many cases, business users are bypassing IT and signing up for public cloud services on their own. IDC asserts that: In a corporate world where innovation is the key to success, seven out of ten respondents are in agreement that the cloud is either very or somewhat important as an enabler of business innovation at their organizations (69 percent) and the majority feels cloud technology investments are actually shaping overall business strategy (54 percent). 2 The role of the CIO is changing. CIOs may not be entirely comfortable with the way cloud-service delivery is changing their world but they re going to have to get comfortable, quickly. According to CIO Magazine: The promise of the cloud has been generating significant interest for organizations in recent years. From offering the ability to scale instantaneously to meet changing demands, to purchasing computing resources on-demand thus avoiding costly up-front infrastructure expenditures, to moving information out of end-point silos to a central location, accessible anywhere and anytime. As the various cloud computing models and offerings have matured, benefits have become more tangible and adoption has begun to spike. 3 In responding to the demands of the hybrid world, CIOs will have to go beyond changing technology and processes to changing the very role they play within the business. They will find themselves extending their traditional role as managers of systems and builders of in-house services to become brokers of externally acquired services as well. They will have to apply their knowledge and expertise to assessing and selecting off-premises services such as software, infrastructure, and platform as a service. And they will have to integrate those services into the enterprise IT service catalog and manage them to protect and prioritize the investments the company makes in them, the business outcomes they support, and the company and customer data that resides on them. This expanded role will be complex and challenging. IT leaders will be charged with transforming legacy infrastructure, applications, and processes with precious little room for error. And at the same time they ll have to manage and secure across both legacy applications and cloud assets. They ll also be in the cloud-building business, planning and developing on-premises private clouds for more efficient and agile delivery of services developed in house. And the core competency of this new role will be the ability to align business needs with the optimal mix of internally and externally available services, seamlessly blend them into a reliable, secure, compliant end-toend system, and manage that system consistently and cost-effectively with a single set of tools and processes. Caution: potholes ahead Here are some of the pitfalls awaiting IT organizations not prepared to manage the cloud: Higher costs than expected Difficulty monitoring for performance and availability using current tools Lack of internal IT expertise Difficulty in embedding security requirements and architecture during development Difficulty adapting existing skills and processes to cloud Difficulty in securing composite applications across hybrid environments Limited ability to move resources to maximize usage Inability to automate composite application provisioning Inability to automate the customization of applications after provisioning Problems in managing business services that span traditional IT and cloud environments Limited ability to determine accountability in hybrid and public clouds Trouble with service-level measurement in complex, dynamic hybrid cloud environments 3

4 Five critical capabilities for hybrid delivery Based on extensive experience in delivering cloud services and in helping our customers manage hybrid environments, HP has identified five critical capabilities your IT organization needs to effectively deliver business services across a combined public cloud/private cloud/traditional IT infrastructure. These five capabilities for mastering the cloud, shown in Figure 1, include the ability to: Figure 1 1. Govern 2. Deliver 3. Automate 4. Assure 5. Secure Five critical capabilities for hybrid delivery Govern and manage your published catalog of hybrid services. Deliver modernized, cloud-ready, hybrid applications quickly and securely. Automate the optimized deployment of hybrid services from infrastructure to applications. Assure the availability and performance of dynamic, hybrid services. Secure and control cloud-enabled business processes. Keeping both the capabilities of cloud delivery and the reservations CIOs have about it in mind, HP offers solutions focused on delivering the level of control required to capitalize on cloud technology and to support the innovation necessary to remain competitive. Govern and manage your published catalog of hybrid services. The first critical requirement is governance creating an overall strategy for investment decisions with portfolio management. Enterprises need to be able to prioritize investments in public, private, and hybrid applications to make sure they are investing in the most important things. Once the business priority for the investment has been identified, it is critical to be able to publish and manage a catalog of hybrid services. The primary purpose of the catalog is to help the CIO make informed sourcing decisions, and that in turn requires a clear understanding of what both in-house and external services cost. It is extremely important to be able to accurately track the cost and value of internal services, because business users know the asking price of public cloud services and the vendor claims regarding their value, and expect to be able to compare in-house equivalents. It is equally important to efficiently manage the on-boarding of a public-cloud service into the catalog from vendor management to integration to delivery, bringing services supplied by third parties into the catalog while making sure that governance, management, and security are under control. The HP answer to the need for solid portfolio planning and governance is HP Project and Portfolio Management (PPM) software. This solution set allows organizations to prioritize key investments and then execute against that investment plan in a way that provides resources are available, costs and budgets are monitored, and issues can be resolved at any point throughout delivery of the services. 4

5 Our solution for helping IT monitor its in-house costs against those of external service providers is HP IT Financial Management software. By combining it with HP Service Management and Project and Portfolio Management software, IT departments can govern complete costs of on- and off-premises services and integrate them with support processes and tools such as the help desk. Deliver modernized, cloud-ready, hybrid applications quickly and securely. Once the catalog is in place to guide build-versus-buy decisions, the next step is to accelerate the delivery of modern, cloud-ready applications. As stated previously, the vast majority of net-new enterprise applications will be specifically designed to be accessed in the cloud by Cloud introduces new demands on the development, delivery, and deployment of applications, and designing applications to be accessed in the cloud requires a new approach to validation and optimization. In particular, new technologies such as AJAX, Flex, and HTML5 that make applications friendlier and easier to use also make them substantially harder to test. (Most cloud applications aren t really applications at all, but collections of applications integrated to form an end-to-end business process.) Security and performance are also much more difficult to manage. The HP answer to these challenges is composed of HP Application Lifecycle Management software and HP Fortify Application Security Center software. This combined solution supports application readiness with performance validation and optimization; comprehensive, patent-pending testing; and architectural governance for building elastic and resilient applications. It also makes it possible to test and verify servicebased cloud architectures, accelerate delivery with service virtualization, and analyze cloud security and vulnerability. It reduces time to market by enabling cooperation between applications teams from development to release. And because 80 percent of hacker attacks strike at the application level, HP Fortify detects more than 600 security vulnerabilities before applications go into production. It also makes it possible to deliver findable information on demand across hybrid environments. Because information volumes and complexity have exploded across virtual, physical, cloud, and hybrid infrastructures, enterprises must be able to deliver the right information to the right person at the right time not only to compete, but to avoid legal or regulatory disasters. The HP Information Management Framework of software, solutions, 5

6 and services breaks down silos; brings all key stakeholders to the table; and enables customers to increase business efficiency and flexibility and reduce risk. Automate hybrid service deployment, from infrastructure to applications. The ability to rapidly and consistently provision applications and the underlying middleware and infrastructure that support them is a central element of hybrid-delivery cloud strategies, and the IDC survey indicates that 70 percent of the respondents believe automated application and infrastructure provisioning is important to the success of their overall cloud strategy. Automation is also needed to ensure optimal use of resources and to make sure that unused resources are reclaimed and reused as soon as possible. Automating standard implementations helps to reduce errors and deployment time and makes it easier to maintain versions and patches. It also makes it easier to implement a self-service portal to allow end users the ability to request and provision the application themselves. And finally and maybe most important automation is the key to innovating the process of delivering services, reproducing the efficient processes public cloud providers use, and applying those processes across the entire service catalog to free funds from the maintenance budget and divert them to business innovation that gives the company a competitive edge. HP Cloud Service Automation software is an extensible cloud management solution offering application provisioning. The solution provides a service catalog and role-based portals for designing, building, and consuming private cloud, public cloud, and hybrid IT services. The solution features advanced database, middleware, and application deployment, seamless bursting to public cloud services, and advanced policy-based resource management. For service providers, it includes software-as-a-service aggregation capabilities. Assure the availability and performance of dynamic, hybrid services. The goal is to move to the cloud without your customers even noticing. Once the service is deployed, whether private or public, physical or virtualized, availability and performance management are critical. This means that IT has to proactively manage service-level agreement violations by monitoring cloud-enabled business processes from end to end, which in turn requires a 6

7 single, unified view across traditional, private-cloud, and public-cloud services. And since many services will be made up of Web and Internet components, monitoring will be even more difficult. Among the survey participants, less than half think that their existing application performance and availability management processes and tools will be effective in addressing their organizations requirements for monitoring and managing applications across public and private cloud environments on a consistent and seamless basis. Service-level agreement guarantees were a concern for 75 percent. Networks, in particular, represent a top concern. Since cloud applications rely on the network more than ever, network management information has to be correlated with application, middleware, and server diagnostic data. And with such a large number of clouds dependent on virtualized infrastructure, a more dynamic approach than traditional CMDB technology is required to keep track of the fast-changing relationships between virtual networks, servers, storage, and applications. Furthermore, in an era when business processes span private and public cloud environments, it is important to measure how changes will affect end-user performance. And increasingly complex IT infrastructures characterized by the additional abstraction layers of virtualization or cloud-based services make it increasingly difficult to report on how infrastructure performance affects businessservice performance. Leveraging patented production monitoring capabilities, HP Business Service Management makes it possible to monitor cloud-enabled business processes from end to end and proactively manage service-level agreement violations. It provides a single, unified view across traditional, private cloud, and public cloud services and makes it possible to analyze integrated network traffic and latency. And the unique HP Run-time Service Model, designed for highly virtualized environments, gives access to near realtime visibility into business processes. Secure and control cloud-enabled business processes. Cloud-enabled applications and business processes also require a new approach to ensuring protection and compliance. Traditional security that focuses on denying access to data is no longer enough. Cloud security has to combine controlled access with monitoring and protection of the application as well as the infrastructure, in development as well as in production. Seventy percent of IT leaders in the largest cloud survey to date cited security as their key concern. 4 For this critical function, we deliver HP Fortify 360 and HP ArcSight Enterprise Threat and Risk Management software for dynamic, application-level monitoring and vulnerability protection. HP Fortify consolidates security monitoring capabilities from the infrastructure level to the network level to the application level, and HP ArcSight brings together operations metrics and security metrics to expose risk at the business-process level. It also offers privatecloud infrastructure monitoring, compliance and forensic transparency, and integrated and correlated monitoring of users across traditional, private cloud, and public cloud services. 7

8 Add to these capabilities virtual infrastructure protection contributed by HP TippingPoint vcontroller, and the combined solution makes it possible to build in security when the application is developed, track behavioral anomalies and identify trouble before damage is done, produce complete activity reports spanning internal and cloud systems, and conduct audits quickly, easily, and cost-effectively. ArcSight offers an array of additional advantages, including private-cloud infrastructure monitoring, compliance and forensic transparency, and integrated and correlated monitoring of users across premises-based, private-cloud, and public-cloud services. Focus on the future to maximize cloud performance. At HP we continue to evolve our offerings to support the dynamic changes and needs of the cloud market. We enable enterprises to master the cloud to innovate with confidence and deliver value to the business by accelerating time to market, lowering cost of service, improving service quality, and providing compliance and security. Whether you are developing your cloud strategy or already moving to the cloud, HP and HP Preferred Partners can help you maximize how you govern, deliver, automate, assure, and secure your hybrid environments. To learn more about managing and securing hybrid environments and to assess your cloud readiness, visit Get connected Get the insider view on tech trends, alerts, and HP solutions for better business outcomes Share with colleagues 1. IDC, Worldwide Software as a Service Forecast: Software Will Never Be the Same, #223628, June IDC White Paper Sponsored by HP, Five Steps to Successful Integrated Cloud Management, May CIO Cloud Computing Survey, November 2010, p1. 4. Goldman Sachs Equity Research, January Copyright 2011 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. 4AA3-4693ENW, May 2011