The Cloud Isn't Everything -- You Need a GuideThe Cloud Isn't Everything -- You Need a Guide

DoD best practices can be useful in guiding enterprise cloud decisions.

You may not worry the same way the U.S. Department of Defense does, but many of its cloud concerns are relevant to most, if not all, organizations that are considering or using cloud services. Among the major considerations? Security and availability.

DoD Guide to the Cloud
The Defense Information Systems Agency (DISA) has compiled a 23-page collection of best practices discovered during cloud pilots conducted for the benefit of the DoD community. DISA published the document, "Best Practices Guide for Department of Defense Cloud Mission Owners," in August.

As suggested in the title, this document is meant to be a guide, is not a policy statement. (But security mandates do come in the DoD Cloud Computing Security Requirements Guide.Compliance with the SRG is a DoD requirement for cloud solutions, including both for commercial- and government-provided offerings.) The guide does not compare offerings or promote any particular vendor or provider. It is the result of cloud investigations with an eye toward providing insight into potential problems and sharing recommendations, suggestions, and solutions.

How Much Cloud Do You Want?
You can receive IT services from the cloud via the software-as-a-service (SaaS) model. A variety of cloud communications providers offer unified communications in this model, or UCaaS.You can go in the other direction, too, and use the cloud as an asset of servers and network connections. This is called infrastructure as a service (IaaS). Or, you can go with a hybrid approach, where some of the functionality is in the cloud and the remainder is performed on premises.

The decision on cloud should come down to business objectives and technology. Then which type of cloud your organization adopts, and at what rate, will depend on cost, security, IT staff support, functionality, and availability.

While the graphic below provides a breakdown on XaaS offerings, the guide focuses on IaaS, where the organization can run its own software like a UC package and have direct control of the hardware.

The Cloud Means Shared Responsibility
Shared responsibility is at the heart of cloud implementations. How much work should move into the cloud? What control will be available to you? How reliable is the cloud and the access network? What happens in the event of an operational or security problem? How will the cloud provider resolve these problems, and how quickly?

The shared responsibility is what makes the cloud decision difficult. In most cases the cloud will be less expensive to use. It may offer technology and services that do not exist in the organization. CAPEX becomes OPEX, and often makes the cloud a good financial decision as well.

Cloud Failures
But cloud failures are inevitable. You can estimate the cost of a failure, but you will not know the ramifications until you experience the downtime. IT's responsibility, then, is to decide the level of availability required for each application: high, moderate, or low. Differentiating on the availability level may provide cost benefits, with some cloud providers offering lower prices for lower-level availability requirements. On the other hand, the XaaS may have only one level. The organization should create a mechanism to track needed availability for different users; this can lead to greater satisfaction.

The guide mentions three types of failures to take into account:

Don't accept the cloud provider service-level agreement on availability as a given -- and make sure you read the caveats (disclaimers) in the cloud agreement. Are they acceptable for your organization? What some cloud users may not realize is that the scenarios covering cloud availability may have security vulnerabilities when compared to a single server performing all the work. So check on the security capabilities of each of the failure response methods.

Lessons From the Guide
To wrap up, here are a few lessons learned: