CLOUD COMPUTING – AVAILABILITY ISSUES AND CONTROLS

By: Lisa Cheng

AGENDA

Cloud Outages Amazon

Impact of unavailability on consumers Data Lock-in Vendor Shut-down Linkage to the CA profession Preventative measures

AMAZON CLOUD OUTAGES

Two main types of services EC2 and Amazon Web Services

From 2008-2009 Had 5 instances of cloud outages

From 2010-2011 Had 1 instance of cloud outage

April 21, 2011 outage “Stuck data volume” Lasted 2 days Data were inaccessible, although websites could

still function

Regions

Availability Zones

AMAZON CLOUD STRUCTURE

AMAZON CLOUD STRUCTURE CRITIQUE

“Act of God” Japanese Earthquake Cannot make back-ups within the same Region

Recent April 21, 2011 outage All availability zones within the same region

failed simultaneously Amazon’s competency in building redundancies

is questionable

AMAZON CLIENTS

Quora Brought up new database from the latest back-

up at the company’s level Synchronization issue

Reddit Did nothing

CLOUD OUTAGES ELSEWHERE

Google: 12 outages from 2008-2009 6 outages from 2010 – 2011 (now)

Microsoft: 4 outages from 2008-2009 6 outages from 2010-2011 (now)

Others Playstation Network Intuit Twitter

IMPACT OF UNAVAILABILITY ON CONSUMERS

Companies are still resorting to cloud services to cut down costs

IDC report shown: 17 billion spent on cloud-related technologies in

2009 By 2013, it’ll grow to 45 billion

Harris Interactive: 43% of IT executives are expected to increase

the usage of cloud Why?

DATA LOCK-IN

Vendors with proprietary technologies High conversion costs

SalesForce.com Proprietary programming language named Apex

Microsoft Azure & Amazon Web Services Data are the only portable items

To consumers: Risk of paying high prices for poor services No compatible technology to retrieve data from

cloud Risk of incompliance with standards

VENDOR SHUT-DOWN

Atmos Online Cloud Storage Shut down its business after one month of

operation Offered multiple migration options

Potential impact on consumers Worried about reliance on 3rd party service

providers

LINKAGE TO THE CA PROFESSION

Heated debate over auditing cloud Advantage: opportunities Disadvantage: auditability of cloud

Provide consultancy services over preventative measures vendors/consumers can take to mitigate risks of unavailability

PREVENTATIVE MEASURES: VENDORS

Geographically diversified architecture Reliable internet connection Reliable and redundant hardware/software Effective business continuity plans Make web console and API available to

consumers Establish Service Health Dashboard Regularly monitor CCID – cloud outages

database Regularly monitor the health of virtual

servers

PREVENTATIVE MEASURES: CONSUMERS

Monitor vendors’ service health dashboard Monitor CCID Monitor customer mailing list of recent

changes Monitor RSS feed hosted by the vendor Understand/negotiate Services Level

Agreement Set-up business continuity plans

Hire a second cloud services providers Off-cloud backup Periodical updates to reflect expansion

Self-monitor vendors’ virtual servers

CONCLUSION

Availability Concerns Go for Cloud!

Cloud Outages Cost Reduction

Vendor Lock-in

Vendor Shut-down

THE END