5.4  Deep Dive: Portability Standards

5.4.1  Purpose, Expectations and Challenges

The standards around portability are expected to enable smooth switch of cloud providers with minimal impact to cost and service quality. The purpose is thus to set guidelines for the cloud providers to build relevant layers of abstraction in their environments to help portability. Looking across the delivery models, the following are some of the challenges to address portability:

•SaaS – the content, data and metadata (application configurations) should be portable to a new environment for a smooth switch

•PaaS – the code base, application frameworks, data and metadata would be some things to port

•IaaS – the software runtime environments (configurations and APIs) would need to be ported. Typically, this would be the VM.

5.4.2  Initiatives – Focus, Sponsors and Status

Tables 5.5 and 5.6 show some of the key initiatives by industry bodies as well as by vendors towards portability standards.

5.4.3  Market Adoption

The current status shows that the portability using virtualisation (OVF standard) is the one in place. IBM has built an OVF toolkit and Citrix has Project Kensho OVF tool as a part of their Xenserver Virtualisation technology. Sun, Eucalyptus and few other vendors, however, are claiming portability by using open source-based platforms.

Table 5.5  Portability – group initiatives

5.4.4  Gaps/Areas of Improvement

OVF standard addresses portability through movement of VMs, which is the typical technology basis for the cloud. This addresses the IaaS level portability. Standards/ guidelines for portability of other models (SaaS, PaaS) as discussed earlier need to be addressed.

5.5  Deep Dive: Governance, Risk Management

and Compliance Standards

Having placed several core and non-core systems on the cloud, Nimbus has a key dependency on the provider to ensure that these systems do not fail and impact its business. Several assessments and discussions with the provider were done and a contract signed up. Now, how does Nimbus ensure the contractual terms are being met on an on-going basis by the provider? What if there is a breach? How can this risk be managed? Nimbus has signed up for several regulatory measures. How far are these adhered to by the provider? What if there is a breach? These are some concerns handled by GRC function.

5.5.1  Purpose, Expectations and Challenges

GRC in cloud computing can be considered as an extension of the traditional model, but has to address several new challenges as this is applied to an environment external to the organisation. The governance requirements can be classified as:

1.Design-time governance covering

(a)Service definition (e.g. design, build management, source code management, and QA)

(b)Service deployment

2.Runtime governance covering

(a)Service policy management (e.g. security, performance, reliability, etc.)

(b)Service retirement

3.Change management for services, policies, processes, data and infrastructure

The governance spans across all the cloud service types, viz. software (SaaS), platform (PaaS) or infrastructure services (IaaS).

Risk management in a cloud will be relevant to managing all types of IT and business risks that ensue due to managing services in an external environment, such as operational risk (e.g. outages), security risks (both data and process), financial risk and legal risk (due to non-compliance of regulatory needs).

Lastly, compliance of cloud to various regulatory needs brings in typical requirements, such as:

1.Records management (ensuring records for all activities)

2.Auditing (audit of all transactions)

3.Legal and eDiscovery needs (support for any forensic investigation)

4.Data privacy (meeting privacy laws as per region)

5.Geography (restrictions on geography imposed by organisations/governments)

The expectation from the standards is to enable the cloud meet all the above-listed requirements.

5.5.2  Initiatives – Focus, Sponsors and Status

There are very few guidelines focused on GRC. The Cloud Security Alliance [19] discussed in Security standards also covers the aspects of GRC and is the only industry initiative. Table 5.7 shows the vendor initiatives only.

Table 5.7  Governance, risk and compliance – vendor initiatives