Cloud computing: differences in approach between large organizations that use cloud computing and

providers of cloud services in the Netherlands.

6th Mediterranean Conference on Information Systems

Theo Thiadens Phdprofessor IT governance

Fontys university of applied Sciencesthe Netherlands.

1. Public cloud computing is the delivery of standard services on a standard contract. Suppliers call this the real cloud computing and a new delivery model.

2. Cloud computing needs more regulation. Suppliers place their hope on above national organizations as f.e. the EU.

3. Large organizations put value on flexibility, less on the financial aspects.

4. In governance and organization supplier are a little further advanced than the demand side. External influence varies, but is minor in public cloud computing.

Core:

1. Theory

1.1. Definitions 1.2. Legal aspects 1.3. Business and implementation 1.4. Governance and organization

2. Research set up.

3. Results

3.1. Differences regarding the definition 3.2. Differences regarding the legal aspects 3.3. Differences regarding the business case 3.4. Opinions on governance and organization.

Table of contents.

1. Theory: definitions.

Different definitions. Definitions focussing on objective, definitions focussing on components and definitions focussing on both.

The definition of the NIST is used, that mixes both:

CC = a model for enabling convenient on demand network access to a shared pool of configurable computing resources, that can be rapidly provisioned and released with minimal management effort or service supplier interaction. This model promotes availability and is composed of:

- five essential characteristics, - three service models and - four deployment models.

Remind:

a. Private law deals with contracts: - liability and quantities - scalability, price and services - termination (migration & lock in)

b. Public law: - privacy and confidentiality (f.e. moving information of customers) - duty bound by authorities f.e. tax and health data - protection against hackers - taxes : where in the country that provides the services or where the service is demanded? (profits, value added tax, advance levies)

Public cloud computing uses standard contracts Private cloud computing uses tailor made contracts.

1.1. Legal aspects.

Donkers (2011) :

• Advantages: lower cost no initial investment scalability

• Disadvantages: reliability accessibility performance scale up and down quick restore no physical governance privacy security

1.3. Business and implementation.

Donkers (2011)

Reasons predominantly of a financial nature.

Processes at customer (user side) dependent upon used cloud service:

a. SaaS : processes in the field of security, monitoring, service desk and incident management.

b. PaaS/IaaS more extensive and more integration with the existing service management processes. In the integrated organization more attention to availability, capacity, financial and supplier management.

Supplier: private clouds governance and reporting described in contract. public clouds: - standard reports - audit reports - partner council, customer councils

1.4. Governance and organization.

10 In-depth interviews by groups of students.

Large organizations on user side

Five suppliers: Ms, Google, IBM, Accenture, AFAS

Five users: InHolland, UvA, Politie, DAF, NXP

Research questions: - definition for cloud computing - main legal aspects - business case - governance and organization.

2. Research set up.

1

3.1. Differences regarding the definition.

Who? Microsoft Google IBM Accenture AFAS

Subject:

Definition: Cloud computing is a A cloud service is a Public cloud makes Cloud computing is AFAS online is anew delivery model hosted application or seen as replacement windows applicationwhich sells is provided via a of the current that can be calledservices at platform built in that are somewhere on the applications. Everyone can via a terminal. It subscription fees. All a shared infra- internet and where use the services is a Public SaaSservices can be structure and delive- one pays per service. and there are many provision.purchased per user red via the web. applications. per month.

Distinction between Microsoft provides all Google provides services Clouds are the resour- It makes a correctcloud services: services worldwide from a public IBM provides complete ces and cloud services distinction between

from computer centers cloud and does not solutions for orga- are provided in conformity resources and in Europe, Asia and Ame- provide anything tailor- nizations. These are public, with an SLA to a customer. services.rica. Not every service made. private or hybrid solu-is provided tions.everywhere.

Who? InHolland University of Police, region DAF NXPAmsterdam Midden-Nederland

Subject:Not knowing where

Definition: Cloud computing is Cloud computing is the data and Cloud computing is The definition is the onea sequel to an extension of the applications outsourcing of by Gartner: "Style ofvirtualisation. It involves outsourcing. One does are. Approach the exploitation of ICT, computing, in which ICTan organization asking itself sacrifice some to ICT facilities not knowing where application is providedwhich tasks flexibility. via the internet. one's data is as scalable and flexi-it really wants to kept. ble service via theperform in-house internet." At the Police force

Use of Live@edu, Microsoft The University everyone still knows One has a hybrid Private cloud iscloud services: mail, absence regis- currently checks out where data and applica- cloud. DAF has its own computer center hosting.

stration (all public cloud student email. tions are: that is not a sharepoint servers. In addition, NXP usesapplications) Researchers have cloud. In the long The business systems public cloud freedom and use run towards a hybrid use the services, particularly cloud services cloud. ATOS computer centres. IaaS and PaaS.

use of services

Supplier:

Geared towardsRevolution:

standaard services

public CC.

User:

Geared towardsevolution.

Start if used:

student mail

3.2. Differences regarding the legal aspects.

Suppliers: when settlement in USA.:

- Patriot act forces us to provide the data required by USA government- Aim at regulation of CC at supra national level: * federal government in USA * EU regulation in EuropeUsers: when Dutch government and universities:

- Aim to comply to Dutch laws- Methods for example: give stu- dents the choice either use own e- mail or universities G-mail

1.

3.3. Differences regarding the business case.

Supplier:

*2007-2008 start* flexibility* latest version* pay as you go

User:

*NXP, DAF every service evaluated on cost, risk & functionality*police&universities: functionality and future

Less financial!

3.4. Opinions on governance and organization.

Suppliers:

private cloud: contract gives reporting plus coordinationpublic cloud: little influence- Google: dashboard +accountmgnmt- MS: partner-+ customercouncil- AFAS: participation sessionsIn some cases: insight in external auditsUsers:

Processes : monitoring security management service desk& incident mngmnt not always set up.