The Cloud Environment
Moving to a cloud solution for communications is the next big thing for CIOs to consider. Think of this hosted solution as Communications as a Service (CaaS), communications in the cloud. The cloud solution can offer rapid expansion capability, flexibility, cost control and expense reduction.
How do you define CaaS for communications? SaaS, Software as a Service is the umbrella term. CaaS is a subset. Both can be called cloud or hosted offerings. SaaS and CaaS are forms of outsourcing. There are about two dozen competing definitions for SaaS. There are multiple definitions for CaaS as well.
There are cloud based voice services, IP Telephony (IP PBX), Unified Messaging (UM), call center and Unified Communications (UC) services. The cloud/hosted service can also support backup and recovery for remote offices and can deliver business continuity at a lower cost. Acquisition and support costs can be reduced. Service levels may even be improved. All of these advantages lead CIOs to at least consider and analyze cloud based communications services.
An attraction of CaaS or cloud communications service is that the enterprise accesses the services through the Internet or IP managed network service to gain access to managed technology services. The enterprise does not buy hardware (though the enterprise generally does need endpoints and some internal network to access the services) or software. The use of a pool of servers in the cloud, either dedicated or shared, is a form of virtualization.
The communications services are delivered as a common set of features and functions. The enterprise subscribes to the features and functions desired. The financial arrangements for access can be by the seat, phone, feature, usage, or unlimited usage with flat fee. Pricing models are still evolving, which makes it somewhat difficult to compare cloud service charges. Overall, however, the promise of lower cost to the enterprise is the major attraction of considering cloud communications services.
Why Look at a Cloud Solution
Reducing costs is almost always the primary driver for considering a cloud solution. A major benefit is a reduced, controlled and predictable cost. Because the cloud site is shared with many other subscribers, the overall hardware, software and operations costs can be prorated over the subscribing organizations. The enterprise benefits from the service provider's economy of scale, which should translate into lower cost service.
However, there are other advantages that can accrue to the subscriber to cloud communications services:
* Flexible sizing--The cloud solution can expand or reduce the number of seats/phones/endpoints very quickly. This is especially useful when the number of active seats varies by season or for special events or situations.
* Business continuity/reliability--The cost of high availability (99.999%) may be beyond most budgets. Ensuring continued operation or rapid recovery when a disaster occurs can prove more affordable with a cloud solution than if the enterprise tried to deliver the same level of business continuity itself.
* Staffing--The enterprise ICT staff responsibilities are significantly less with a cloud solution. The ICT staff can be smaller and will not require expensive certification training. The ICT function is mostly administration of the service.
* Software--The enterprise does not have to deal with software subscription fees and licensing costs. These are included in the service subscription fee.
* Management--The enterprise should not have to allocate significant time to managing a cloud solution. Management will deal primarily with a contract that has specific deliverables and SLAs.
* Features and functions--The enterprise can gain access to features and functions that are not available on their existing system/service or that are too expensive to implement. Features and functions can be tailored to individual users, thereby avoiding a one-size-fits-all solution.
Cloud Implementation Models
There are six possible business models for the cloud communications providers. Different business models may complicate some and maybe all of the issues that may arise when subscribing to a cloud service. Here are the business models now in place:
* A total cloud service where the provider owns the hardware, software, and network, and has the staff that implements and maintains the service.
* The cloud service (private or public) can be located on dedicated or shared servers that run customer owned software. Amazon's EC2 platform is a cloud based business service that already exists. Amazon Elastic Compute Cloud (Amazon EC2) is a web service that provides resizable compute capacity in the cloud. Here, the Service Level Agreement (SLA) covers the platforms and network but not the features and functions offered.
* Another model is a communications software vendor (e.g. call center software) operating on another provider's hardware and network. The Amazon EC2 service is a candidate to support this model as well.
* A third party installs licensed communications software in the cloud (like EC2) and sells the service directly.
* A reseller that owns nothing, but resells cloud services from one or more wholesale providers.
* The provider locates the system/solution on the enterprise premises, charges by the seat but manages the system remotely through the cloud. The enterprise becomes responsible for some of the business continuity capabilities as well as power and cooling costs. Some providers call this a managed service and not a cloud service.
The business model will have a great influence on the SLAs and Acceptable Use Policies (AUP) that an enterprise will encounter. The stability of the service may be in jeopardy if the service provider's business model is not successful. What if the cloud provider goes out of business? This has already occurred with some wholesale as well as retail providers. What if the provider decides to terminate some function and features? The enterprise should have a backup plan (possibly an alternative cloud provider) in place in case any of these situations occur.
Cloud Provider vs. On Premise Solution
It is now common that enterprises look at the features and functions offered by a purchased/leased system vs. what is offered by a cloud solution. The technical requirements are usually the initial concern. This is important, but the business issues will have longer lasting impact on the solution’s acceptability. The table below summarizes the business concerns that must be considered when comparing the hosted and internal system solutions.
Business Comparison of the Cloud and On Premise System Solutions
Cloud Service Descriptions
There are a number of cloud services available with over 170 providers covering the U.S. and Canada. Each provider has its own definition of cloud communications. Almost all of the services are accessed via the Internet. Here are the types of cloud services available today:
* Voice Service: Traditional voice services are offered mostly for SMBs.
* IP Telephony: This may also be called hosted PBX or virtual PBX service. The common features and functions found on a legacy PBX and newer IP PBXs are offered.
* Unified Messaging: A messaging service that includes a single service that combines voice, e-mail, and fax messages and storage.
* Presence: A system for collecting and managing an individual's status, ability to communicate, and preferences for mode of communication.
* Call Center Support: This would include individual or combined functions such as:
--Automatic Call Distribution (ACD)
--Interactive Voice Response (IVR)
--Auto/predictive dialing
--Agent reporting
* Unified Communications: A communications service that includes several if not all of the following elements; voice calls, unified messaging, audio/video conferencing, mobility, web/data collaboration, and presence.
The more of the unique functions and features that an enterprise needs, the more likely it is that all of these requirements will not be found on a single cloud service unless that service targets the enterprise's vertical market. However, there will always be functions that are common to most enterprises, and these are the candidates for cloud services.
Enterprises want flexibility in their traffic volumes. Many providers support the traffic changes well. Flexibility also includes changing the balance of cloud vs. enterprise operations, hardware and software usage. Some providers sell flexibility as part of their service, but contract language hinders and may eliminate the flexibility that's actually achievable.
Security and Privacy Issues
Security and privacy issues can hinder the cloud solution implementation. Security in the cloud is a common subject in blogs, articles and white papers. It usually is one of the major concerns that make enterprises hesitate moving to cloud-based services of any type.
How much responsibility will the provider accept? What happens when the requirements are not met? Is the enterprise left holding the bag? I think that the language in the contracts covering these issues can become very complex, with the provider trying to absolve themselves of as many liabilities as possible. This may make the enterprise reluctant to move their communications functions to a cloud solution.
The security issue is being pursued by the Cloud Security Alliance (CSA). The mission statement for the CSA is:
To promote the use of best practices for providing security assurance within Cloud Computing, and provide education on the uses of Cloud Computing to help secure all other forms of computing.
The CSA website states that:
The issues and opportunities of cloud computing gained considerable notice in 2008 within the information security community. It was at a security practitioners' conference, the ISSA CISO Forum in Las Vegas, November 20, 2008, where the concept of the Cloud Security Alliance was born. Following a presentation of emerging trends by Jim Reavis that included a call for action for securing cloud computing, Reavis and Nils Puhlmann outlined the initial mission and strategy of the Cloud Security Alliance. A series of organizational meetings [was held] in early December 2008.
In December 2009, the CSA published a 76-page "Security Guidance for Cloud Areas of Focus in Cloud Computing V2.1". For those new to the cloud services, the CSA guidance document has an excellent introduction in section I, "Cloud Architecture". The 17 pages of introduction cover the entire set of cloud service considerations and how they operate.
Performance Considerations
A service that offers what is required but does not perform well can be worse than no service at all. The performance delivered by the provider cannot be assumed to be adequate, but must be measured and must meet specific performance levels. Performance goals may sound good, but goals are not contractually binding. Here are factors that should be included in the provider performance measurements:
* Reliability/Availability--The enterprise would like to have no downtime at all. An availability of 99.999% is great but it is likely that this cannot be delivered; 99.9% is more likely. Question what is and is not included in the availability measurement. You may be surprised as to what is not included. What is the maximum uptime that the provider will guarantee? Look at the last two years of actual service delivery experience.
* Response Time--Since the service is in the cloud, there will be some delay when features or functions are accessed. What do your enterprise users now experience? Can this experience be matched or improved with the cloud service? What is and is not included in the response time measurements?
* Voice Quality--Many cloud services pass the voice call through their site. The voice call is then delivered through the Internet or an MPLS service. A Mean Opinion Score (MOS) of 4.5 or better should be the requirement. This is equivalent to PSTN call quality. The enterprise may have to accept a slightly lower (MOS) but it should not be below 4.2. If the voice calls do not pass through the provider’s site and network, but are terminated at the enterprise site, then MOS performance is not the responsibility of the cloud provider.
* User Satisfaction--User satisfaction should cover how well the service operates and supports user productivity. The features offered should require little training and be intuitive in their operation. The more difficult to learn and use the service, the less productive the user.
* Measuring Provider Performance--The performance response time and voice quality should be reported in 15-minute increments. Measuring over a longer period obscures the peaks and valleys. Availability should be reported on a monthly schedule with any outages detailed as to the length of outage, what caused the outage and how it was resolved.
Service Level Agreements (SLAs)
The Service Level Agreement (SLA) may be measured over a long period of time, possibly weeks. The SLA is most important when the traffic busy hour occurs. Experience with the SLAs of MPLS services is an example of the biased arrangements that clearly need to be renegotiated to satisfy the enterprise's busy hour performance.
The demarcation point (demarc), where the SLAs start and end for accessing the service, may be much further away than the enterprise expects. The distant demarc means that the provider is not responsible to meet the SLA at or near the customer premises or desktop.
Analyze the reports produced by the provider. Do they offer real insight into the performance? Are the reports demonstrating how to tailor the offering to meet the enterprise’s performance requirements? As more features and functions are introduced, the enterprise should be able to evaluate who uses what and how well so that only the features and functions of value continue.
Regulatory/Legal/Compliance Considerations (HIPAA, PCI...)
Cloud based services have regulatory/legal/compliance implications as well. Cloud service planning should include the enterprise's legal department. Should all users have access to all features and functions? I have one client that decided to limit UC availability for some users to satisfy the compliance regulations. My opinion is that if it is communications in any electronic form, E-Discovery as well as other requirements will be applied to the cloud service. Plan for them and avoid the surprises.
When you contract for a cloud service that needs to be secure and meet compliance and/or regulatory requirements, read the fine print. You should have enterprise lawyers be very critical and precise in their review of the provider's responsibilities and liabilities and the liabilities not accepted by the provider.
Another issue is the ownership of the information resident at the cloud site, for example the voice mail messages. Presence information could be useful to third party organizations such as advertisers.
Most enterprises would automatically expect that the information passing through the cloud site belongs to the enterprise and is not owned by the provider. What about the information on the individual users? How about the traffic information that is sent and received? If presence is involved, can that presence information be sold to others? Will the provider use their access to the enterprise's users to send out information created by third parties for the sale of products or services? Would the provider be able to sell profile information of the enterprise's users?
The provider will set the Acceptable Use Policies (AUP). The AUP will favor the provider's business model and revenue. Read your AUP for your present ISP service to get an idea of the probably unbalanced arrangement that favors the providers.
Conclusions
Cloud-based services have prompted much discussion and press coverage. The enterprise cannot ignore the cloud service alternative.
The expanding role of multimedia technologies and expanded communications methods available to enterprise employees and their customers opens new opportunities for enterprises to offer service to users. Limited human resources forces enterprises to look for advanced communications features which cloud services can offer.
Enterprises view the communications function as an integral part of their business processes. The enterprise should include their departments that would use the cloud communications services in the discovery, specification and requirements definition for the service. Moving to a cloud based communications service is as much a business decision as a technical decision.
Some of the business questions that need to be addressed are:
* This is outsourcing; have you outsourced before? What issues arose? What can you do better?
* Will you be locked into a single provider?
* What is the cloud provider's track record?
* Is the provider financially viable?
* How much of the communications environment would you turn over to a cloud provider? Some, or all (in phases)?
The success of migration to cloud services will depend on executive management participation as well as participation of the ICT staff. Some impact on the enterprise operations will have to occur. Look at the values and challenges and make an informed decision. Cloud based communications services are not for everyone.
