Small BusinessSecurity GuidesOptimising your business via emerging cloud computing technologies

At work

Simply put, the cloud computing model of IT is the Internet-

based delivery of IT services in the shape of software applications, processing power and storage. These ‘services’ are delivered down the Internet ‘pipe’ in an on-demand fashion, so that companies can simply pay for what they need and nothing more.Cloud computing is a bit like turning on a light switch; you pay for as much light as you need and then you turn it off. You only get charged for what you use and how long you use it for.Cloud computing’s economies of scale hinge around the opportunity for companies to tap into ‘shared computing resources’ owned by the cloud provider. A business buys a

slice of the cloud and uses it just like a server. The cloud provider looks after it for the customer and can manage all the new installations, maintenance and software updates that are needed.The concept here is that the business can use cloud services to operate and trade effectively as it concentrates on its core competencies, whether that be manufacturing washing machines, making cakes or selling legal services -- rather than having to manage IT services across a network of servers i.e tasks beyond the customer’s central area of expertise.

What is cloud computing anyway?Cloud computing has been arguably been over-hyped in recent times, but a simple explanation is not that hard to come by.

Cloud computing is a bit like turning on a light switch; you pay for as much light as you need and then you turn it off.

At work

“

”

The cloud computing model of IT delivery is essentially

hardware and software services delivered over the web. Its uptake among small to medium sized business has been especially rapid.

Ask a cloud computing expert why they think this new model of IT service delivery is going to be a good idea and useful for business and you’ll typically get just three words in reply: flexibility, manageability and cost-efficiency.

Now those are rather over-used terms in the world of IT, so what do they mean and how do they manifest themselves in the real world?

Flexibility foundationsAs we know, cloud computing is the Internet-based delivery of IT services in the shape of software applications, processing power and storage over the Internet.

According to research carried out by the Cloud Industry Forum (CIF), which quizzed 450 senior IT and business decision-makers in SMBs, enterprises and public sector organisations, flexibility was cited as the main reason (at 53 percent) for initially adopting cloud-based services.

Let’s just emphasise that this was the MAIN reason for INITIALLY adopting cloud computing. What is interesting is that the same managers ranked cost saving far lower (at 16 percent) in terms of it being a primary driver for initially adopting cloud services.

Cloud computing directly impacts manageability for some very clear reasons.

Deployment (or installation if you prefer) of software across the entire workforce’s range of desktop and mobile devices effectively becomes outsourced. The IT manager

can now get on with operating the core business IT network and so doesn’t have to spend hours trying to install a new spreadsheet or forms-based application (for employees to input sales data) across the entire staff base. He (or she) instructs the company’s cloud hosting vendor and lets them handle the job.

Manageability mattersSoftware updates, patches, operating system upgrades and – quite crucially we feel – anti virus software updates all become far more controllable, flexible, customisable and (yes we’ll say it again) manageable.

So thirdly, cost-efficiency from the cloud -- as we have said before, cloud computing’s economies of scale hinge around the opportunity for companies to tap into ‘shared computing resources’ owned by the cloud provider.

Buying one flexible chunk of computing power as

and when it is needed is logically going to be more cost effective than buying in a large lump of ‘server and processing power’ and using up its capacity slowly but surely when needed. The business still shoulders the upfront capital expenditure on the cost of the IT, and if the business fails to use it all then this is wasted expenditure that can not be recouped.

Why is the cloud useful for businesses of all types?Customers who opt for cloud services can manage their IT network via a web browser or a dedicated software application. This makes it far easier for them to roll out new software updates (including anti-virus protection) to an entire staff base, as the IT service is managed up in the clouds where it can oversee all the businesses’ desktops and mobile devices.

Cloud basics

At work

What is Software-as-a-Service?

T o use SaaS, a customer’s IT department must be

connected to a network to receive the software down a supply pipe – and of course this ‘pipe’ is typically the Internet.

In the eyes of the user, using web-based SaaS software services is not necessarily any different from using an application that is permanently installed on their machine. But the business feels the (largely) positive effects at the back end inside the IT department - and on the financial bottom line.

Adoption of the SaaS model not only means that the company uses the most up-to-date version of software available at any one time, it also allows the company to use software at a lower cost without weighty technology implementation and deployment costs.

Software-as-a-Service (SaaS) is a method of using software under license provided by a software vendor, where the application is ‘hosted’ at a site away from the company premises. The software does not take up permanent residence on the customer’s network i.e. it is never fully downloaded or installed.

Analyst firm Forrester says that this approach to placing server storage tasks in the hands of the cloud is the most substantial shift in IT so far this decade.

The SaaS software sits on the vendor’s network ready to be deployed into the outside world. The software applications themselves are written in what is known as a ‘web-native’ format i.e. this simply means that they are built to run over the Internet pipes from the start – and this also means that they are optimised for this type of deployment rather than being traditional desktop (or even mobile) single installation products.

As the Internet has driven more deeply into every company’s operational plans, SaaS web services have become more attuned to real business needs and so have enjoyed increased growth and popularity. The widespread availability of broadband has

underpinned this growth, so that the use of at least ‘some’ SaaS services in modern business framework is becoming the new norm.

SaaS shares a close relationship with cloud computing and is often referred to as being part of what is called the ‘utility model of computing’, the ‘ASP-model’ (or Application Service Provider), or the on-demand computing model. Essentially these jargon-heavy industry terms add up to much the same thing – so newcomers to this subject should not be put off by so-called ‘industry-speak’ if they hear it.

In summary, SaaS provides lower administration costs, automated updates to core software applications as well as patch updates, good compatibility levels (all a company’s users are finally using the same software!) and wider global accessibility for the company’s users as a whole.

At work

“

”

When should businesses consider moving IT to the cloud?It’s a broad question i.e. when should businesses consider moving an element of their IT function to the cloud? To answer this query by merely saying NOW -- would be too broad brush a statement to have any value. But timing is an essential element of any business plan, so we must address this issue.

If a company’s servers are over five-years old, this is approaching the dangerous part of their ‘propensity to fail’ curve.

At work

Acompany company might consider a new cloud

computing component in its IT stack if for example it were to open up a new line of business or product line, or perhaps enter a new market. This ‘new rung on the ladder’ moment in business can be a perfect time to reassess IT input and output channels; a reassessment of the company security layer and a new cloud-driven IT service should be very natural partners

Another key ‘when-factor’ might be related to the business’s hardware or software installation coming to an ‘end of life’ stage. When the hard disks are worn out and the machines need faster processor power, we might also typically find that software and operating systems upgrades just have to be carried out too. So once again, a cloud watershed moment may present itself here.

Cloud computing also provides another more subtle function, which may also have direct relevance to a business’s security layer -- and that is its ability to set up a ‘test’ environment. Because cloud computing comes packaged in a ‘service’ over the Internet, it is there to ‘play with’ in a sense. After all, it’s up in the cloud (it’s actually down on a remote server being ‘hosted’ somewhere else) so you can stress test it and see how well it performs under extreme and/or new conditions.

For want of a random example, if a consumer goods manufacturer wanted to set up a new web-based mail order system to serve an emerging market nation in Eastern Europe, would they want that system ‘hard networked’ in to their existing IT operation? Probably not right? But put any new modular addition to the business in the cloud and

you can test it and bring it in house when the time is right.

Popular thinking today suggests that the business would be happy with this block of business left in the cloud permanently. The crucial factor here is that you recognise the when-factor here as being a time of change in the business.

There are other ‘finger in the air’ gauges that a company might use to consider when it might adopt some element of cloud computing. If a company’s servers are over five-years old, this is approaching the dangerous part of their ‘propensity to fail’ curve. Once again, this is a good time to think about cloud.

Just to come full circle on this topic, let’s also consider when NOT to consider cloud computing. Or at least, when an IT overhaul is not necessarily a good idea.

The end of the tax year, the end of the VAT quarter, Christmas Eve and any other significant annual (or quarterly) milestone when IT downtime which may result from new cloud deployments is not a good idea.

So now you know when this technology is best suited to emerge, you can set your cloud computing stop watch.

“

”

Cloud hosting vendors suggest that they can “spin up” a cloud server in less than a minute for new users...

How does a business sign up for cloud services?So you just sign up for cloud computing and start using the flexible service options as and when you need them right? Well – that’s mostly correct, but did anybody stop and ask HOW exactly a business signs up for the cloud in the first place?

At work

The simple answer here is that a user (an IT manager

or other individual) really does simply just sign up. Cloud hosting vendors suggest that they can “spin up” a cloud server in less than a minute for new users – and all this means is that your specified “portion” of server space is set aside, made ready and kitted out so that it is ready for use.

The HOW section of cloud computing includes the following:

Choose your cloud plan:There are a few fundamental choices that need to be made in terms of the plan any business signs up to from the cloud. This will mean selecting which hosting resources a company buys into -- and this will be

categorised by parameters including disk space, monthly data transfer, programming support and database features.

Time period: You also need to decide whether you are signing up for 12 months, 24-months or more.

Now proceed to the checkout: Part of the sign up process will of course include the submission of contact information, as well as billing and payment information.

Registration: Creating an account username and password is an essential part of the process.

Ready to go: Based on this simplified explanation of the process, at this point the cloud is ready to go.

Cloud vendors call their part of this whole process “provisioning”. But if you want a more digestible term, you could simply call this action “initiating”, or “preparing” even.

Or if you really want to get down to earth, then we’ll just call this process “turning on”. At this point, you can consider your cloud resource to have been “powered up”.

“

”

Why are some companies concerned about cloud?

Businesses must position staff training at the heart of any cloud migration strategy, if they want to be able to realise tangible business benefits from cloud-based Software-as-a-Service streams.

At work

The proposition presented by cloud computing has

not arrived without some companies voicing their concerns and reservations. It is after all very new -- and with newness comes change, and change is disruptive. But there is positive disruption and negative disruption. So how do we differentiate between the two -- and how do we allay cloud computing worries if they have no real basis for concern?

Some might say…Some say that the problem here is skills; the cloud will change IT provision, but it will fail if we do not change our approach to IT training by a commensurate degree. The argument is simple: businesses must position staff training at the heart of any cloud migration strategy, if they want to be able to realise tangible business benefits from cloud-based Software-as-a-Service streams.

But there are two sides to this argument. On the one hand we should consider that

cloud computing is (arguably) a superb route towards cost savings and the stripping out of unused or underutilised IT resources. On the other hand, the recession itself has driven cost cutting measures that have led to smaller IT departments. So is this Catch-22 for the cloud, or is there a way through the mist?

Catch-22 for the cloud?The answer (mostly) lies in mitigating unnecessary concerns being harboured over outsourcing sensitive data to the cloud.

Terms like “storage bloat” are sometimes used to describe the data loss that can occur when a business blindly saves all its information in one “data dump” to the cloud.

More intelligent use of cloud computing may be to employ services such as email management, which looks after email archiving, retention and management. If there are concerns over how a business should operate within the cloud and be able to

look after its data, this should be a positive area of interest.

An IT survey carried out Vanson Bourne showed that 91% of companies surveyed want a hybrid cloud model for their technology infrastructure, 70% are still “concerned” about the difficulties of managing such an infrastructure over the long term.

The cloud in layersIndustry analysts suggest that the prevalence of these concerns and misgivings may be down to the over usage of the term “cloud computing” itself. When in fact the cloud encompasses an IT Infrastructure (IaaS – Infrastructure-as-a-Service) element, a Platform (PaaS - Platform-as-a-Service) component and then, ultimately a Software (SaaS – Software-as-a-Service) offering.

“

”

Who are the top cloud vendors?Cloud computing is not an open and shut case. The upshot of this is that we should really break any list of cloud vendors down into sub categories.

Five segments of the cloud: platforms, infrastructure, security, storage and cloud software & applications.

At work

Ideally, an analysis of the cloud computing market

place would separate ‘elements’ of the cloud into perhaps five segments: cloud platforms themselves, infrastructure, security, storage and cloud software & applications.

Naming namesBut for the purposes of this overview, let’s stick with what we can define as cloud ‘vendors’ specifically. The below list is merely presented as an hors d’œuvre. Some names you will know well, some names you may know for other reasons and some names may be new to you.

• Akamai• Amazon• Microsoft• Enki• Fortress ITX• Joyent• Google• Rackspace• Salesforce

The ‘service’ selection factorThe important point here is not that these nine companies all hover somewhere around the top ten cloud vendors list on a month-by-month basis at the time of writing. No, the important point is that each company will have a different approach to service – and this is widely argued to be the major defining factor that will help us distinguish one cloud player from another.

Let’s not forget, cloud computing started out as a highly disruptive technology development (albeit mainly positive), with no previous customer references, very few SLAs (service level agreements), spiralling security concerns and no tangible guarantee of ROI (return on investment).

Many would argue that cloud computing still sits in this mire of uncertainty and that security is still a massive concern. But things are better than that; building on the cloud is not like laying down foundations on quicksand, there are answers to most of the questions we will need answered.

The question is, how well can each cloud vendor attend to a customer’s concerns, questions and uncertainties? Once again, it will come down to service.

“

”

Where are the cloud’s data centres?Surely one of the great issues with cloud computing is the IT industry’s apparent willingness to fuel the ‘ethereal’ image of the cloud’s data banks. “It’s just out there,” they say...

There are latency effects experienced by certain software applications (if they are particularly high volume transaction apps) depending on the cloud’s location.

At work

The cloud delivers data and application processing

power as and when you need it, they say. “Don’t concern yourself with building an IT infrastructure, just outsource it to our hosted service,” they (the cloud providers) say and say and say.

But hang on, that’s not really what we want to hear, is it? All this ‘up in the sky’ flexibility is all very well, but businesses today large and small want to know not only which side their bread is buttered on, they also want to know where the butter dairy is. Come to think of it, they also want to know if the cows are happy this week.

Cold hard factsSo to come down to earth with some hard facts, let’s look at where the cloud really is.

The cloud – or to put it more accurately, the server racks in the data centres that hold the software for cloud-based applications to work over the Internet – does have an actual street address.

Both McAfee and Rackspace (to name just two) have built cloud data centres in London, UK – in addition to their US bases of course. According to Data Centre Knowledge dot.com, Amazon holds its data banks right around the globe in Amsterdam, Dublin, Frankfurt, London, Hong Kong, Singapore, Tokyo and at eight locations across America.

Physical realitiesSo let’s not use the rest of this section to simply list companies and data centre office locations. Let us take it as read that Google, Microsoft, Salesforce.com and every other cloud vendor out there does indeed have a physical building ready to deliver cloud services as an when needed.

The point to embrace here is… why do these companies build so many different sites around the globe? If the cloud as truly global as the Internet itself, then why doesn’t Google (or whoever) find the cheapest ground rent available and just

build one huge lump of cloud data?

The answer is a multi-layered one. There are latency effects experienced by certain software applications (if they are particularly high volume transaction apps) depending on the cloud’s location.

Compliance complicityPlus there’s also the geographical factor to consider i.e. regulatory and compliance rulings governing data in Europe are different from those in the US and the Far East, so this is a consideration too. But a deeper analysis of this topic is another story for another day.

“

”

How should we view cloud Service Level Agreements?A business signs up for cloud computing services and

should expect to get everything that it has paid for within the scope of the signed agreement right? Given this cornerstone of consumer purchasing advice, is attempting to transfer this maxim to the world of technology and cloud computing services too much to ask?

Unfortunately the Service Level Agreement (SLA) that governs most cloud contracts is more of an “expectations-management” mechanism in many senses.

SLA basicsWhile cloud SLAs may set out to lay down a blueprint for how a cloud service should operate, firms may find them more constructive tools if they are viewed as a remit for communications between vendor and customer i.e. almost a conflict prevention tool if you like.

Building your cloud computing SLA should be a two-way street, with your own company’s representatives inputting to the SLA itself – otherwise it’s just a document, not an “agreement” between two parties.

Companies will need to go through a process of auditing, analysing, documenting and ratifying every element of their cloud SLA to make sure that it provides appropriate levels of:

• Performance and processing power

• Data storage and data throughput

• Security, anti-malware provisioning and all-round ‘robustness’ or service

• Flexibility, controllability and manageability

• Clarity of charges and costs

• Refundable options in the event of service outages

NB: The above list is intended to be dynamic, rather than exhaustive and definitive. It is however a very good foundation and starting point.

Dynamic dataWe have used the word ‘dynamic’ just there and this is the main issue at hand; cloud computing is still-nascent, rapidly changing and ultra-dynamic.

Entering into any new agreement with a cloud supplier is almost like buying a new car straight off the production line i.e. it should all work fine, but the road may be bumpy ahead and unpredictable.

Once again, a little of the ‘buyer-beware’ attitude here should go a long way.

At work

Building your cloud computing SLA should be a two-way street, with your own company’srepresentativesinputting to the SLA itself.

“

”

Ask a cloud computing expert to solve the

following riddle: when is a cloud not a cloud? The most likely answer you will get is: when that cloud is a private cloud. This is because in some senses a private cloud is not true cloud computing; rather, it is an emulation of some of the virtualisation functions of the public cloud, but done on an individual level inside a single company in an ‘on-premise’ server.

An ‘instance’ of cloud powerAs stated, the private cloud will still offer the ability to virtualise – and when we say this we mean that component blocks of storage and processing power can be set aside and ‘described as an instance’ in their own right, such that they represent a so-called ‘virtual machine’. This means that they can still be scaled up or down inside the realm of the total private cloud, and in most cases, can also share from one of the key benefits of utility computing i.e shared hardware costs.

Private benefitsBut private clouds can not benefit from the higher level economies of scale experienced in the public cloud. That being said, they do have a place and are typically used for housing elements of a firm’s critical infrastructure that the company would not be happy to release externally. This is not to say that the public cloud is insecure (far from it in fact), it is merely down to a) a bit of common sense b) a bit of human nature and c) a bit of pressure from management.

Going PublicThe public cloud on the other hand is a more thoroughbred beast, with all the appendages and ancillary functions that this new model of IT delivery has to offer. What is more, the public cloud is built at scale – and therefore it stands to offer the greatest opportunity to benefit from economies of scale that can possibly exist. The public cloud then is dynamically provisioned IT

services delivered over an Internet connection.

Which apps, which cloudSo which applications should we put in the private cloud versus the public cloud? Ah well, that of course is the $64,000 question. But it’s not too hard to work it out. Each application will have its own characteristics in terms of mission criticality, workload, data throughput and security. What tends to matter most is the ‘accountability’ of the data that the application itself has to handle i.e the true business value of the data in hand.

In practice, a combination of public, private and hybrid cloud environments is already proving to the most workable methodology for

Private clouds vs. public clouds what’s the difference?

The public cloud is thoroughbred beast, with all the appendages and ancillary functions that this new model of IT delivery has to offer. What is more, the public cloud is built at scale.

At work

“

”

What type of applications do not work best in the cloud?

There’s a simple way to answer the question

of what type of application works well in the cloud; as you might be able to guess, the best gauge is to look at what does not work well in the cloud.

1 – Sensitive DataAny software application that is inherently built around the need to collate and manage sensitive data is, in simple terms, not best suited to the cloud computing model of IT delivery. Sure the cloud is safe; there are security controls and firewalls aplenty from all the biggest cloud hosters/providers. But if you have an application that relies on mission critical data and you can keep it on-premise, then do so. Only put these applications in the cloud as a secondary option.

2 – Heavy Input/Output ApplicationsAny software application that makes a high degree of physical input/output demands on a company’s physical server is not best suited to the cloud. Applications that work well in the cloud can be sent to the cloud server that houses and powers them -- and then made to work “out there” in the cloud doing what they do. If that application has to constantly ask for connections to and from the customer’s terrestrial IT network (i.e. not in the cloud), then things start to look like hard work. Examples would be data analysis applications and software that relies on CEP (or complex event processing) to work.

3 – Solid & Consistent Workload AppsIf your application is a solid, unchanging, accurately definable entity – then why are you looking to put it in the cloud? The cloud computing model of IT offers massively expandable flexibility; but if you know what your application needs to handle every day, every week and every month – then you know what your IT requirements are, so you can buy the appropriate amount of on-premise server hardware to fit the bill. Using the cloud in this instance is not a problem, but it is really not prudent, profitable or efficient. If you know you need a car 7 days a week, you don’t hire one every morning do you? It’s the same concept.

At work

4 – Audit Unfriendly AppsIt’s a simple straightforward truth, some companies will be working under data regulation and compliance rulings that specify against the use of cloud computing. It may be worded differently along these lines: the physical location of each server unit that the company uses for data storing and processing must be able to be specifically identified and geographically located. As cloud hosters/providers typically do not tell customers which cloud server their work is carried out on at any one time, the possibility of cloud computing for companies under such regulations is ruled out.

5 – The Software License Brick WallThis one should not take too much explaining; some software licenses have simply not got to grips with cloud computing. These licenses either never envisioned a time when cloud computing would take off as a viable computing environment, or they have simply shut the door to cloud deployment as they feel (for example) that the number of user license controls is too hard to pin down. Good examples here would be ERP (or enterprise resource planning) software, which suffers particularly from this shortfall.

A mashup is a term used to describe a web-based application that combines information from two or more sources to present a new service.

In order to answer the question, what is a cloud

mash up -- we should first answer the question, what is a mashup? For those new to the term, a mashup is a term used to describe a web-based application that combines information from two or more sources to present a new service.

For an example, think about a news website that pulls in weather updates from Weather dot com (or other), or stocks and shares info, currency rates or even additional news items from Reuters. The resulting end product is a mashup of its component parts.

Mashups use an API (Application Programming Interface) to combine and coalesce different website elements. So just one more definition - an API is basically a set of software-to-software programming instructions that work on the web. APIs allow one piece of web-based software to talk to another in a process controlled by the API itself.

So we know what mashups are and we know how they interconnect. A cloud mashup then is quite simply a web-based instance of a mashup, but the application content itself resides in the cloud. So why is that good?

If your cloud mashup is by its very nature hosted in the cloud then it will be sat next to some useful software building tools if you subscribe to a cloud mashup centre service, such as the one provided by IBM for example. A good enterprise mashup platform features reusable application building blocks (commonly referred to as ‘widgets’ and ‘feeds’) that can be built into new applications or incorporated into existing applications.

in this scenario we’re using software building blocks way up in the cloud to construct applications that will handle our data in an off premise location alongside other cloud “tenants” (or customers if you prefer). Surely this is a data security nightmare waiting to happen right?

Well, it’s true -- you don’t want to put your core mission critical data in this environment, but it has great potential for experimental testing of new services before they are taken to more fully blown levels of research and development.

Plus anyway, companies using this level of technology should at least be thinking about enterprise level (and yes we do mean SMB enterprise level) anti virus and malware protection with a firewalls and a formal security policy.

Cloud-based application mashups are arguably the technology of the future, but they are already here today. Although they might not have enjoyed widespread adoption as yet, any SMB IT manager should have at least around this much (see above) passing knowledge of them we feel.

What is a cloud mashup?Cloud computing has a variety of custom-tuned deployment scenarios in real-world computing environments, one of these is the cloud mash-up.

At work

“

”

At work

AVG Technologies CZ, s.r.o.Lidická 31, 602 00 BrnoCzech Republicwww.avg.cz

AVG Technologies USA, Inc.1 Executive Drive, 3rd FloorChelmsford, MA 01824USAwww.avg.com/us-en/homepage

AVG Technologies UK, Ltd.Glenholm Park, Brunel DriveNewark, Nottinghamshire,NG24 2EGUnited Kingdomwww.avg.co.uk

AVG Technologies GER GmbHBernhard-Wicki-Str. 780636 MünchenDeutschlandwww.avg.de

AVG Technologies CY Ltd.Arch. Makariou III.2-4 Capital Centre1505, Nicosia, CyprusFax: +357 224 100 33www.avg.com

AVG SMB group at:� bit.ly/AVGSMB

Read our blogs at:� blogs.avg.com

Become an AVG affiliate at:� avg.com/gb-en/affiliate

Become an AVG Fan at:� facebook.com/avgfree

Follow us at:� twitter.com/officialAVGnews

Watch our Channel at:� youtube.com/user/officialAVG

IDENTITY STANDARDS

14

MASTER LOGO

For a company that constantly innovates its product lineup to provide the best security possible, we felt it necessary to revise our identity to reflect that: quicker, brighter,and full of personality. Both symbol and logotype have been redesigned. AVG’s new logotype has been specially drawn and must never be recreated or typeset in an alternative font. The symbol has been simplifiedfrom previous designs for crisper edges, and to refine the identity of a company that is dedicated to protecting the identity of others. The colors are more vibrant and mirror the alert, energetic and bold new direction that AVG is headed. The shape of the symbol itself has been softened and updated to resemble interlocking hands, as a nod to the community that defines us and our loyal customers.

© 2011 AVG Technologies CZ, s.r.o. All Rights Reserved. AVG is a registered trademark of AVG Technologies CZ, s.r.o. All other trademarks are the property of their respective owners.