1. Chapter 5 Overview of Cloud Standards Anand Govindarajan and Lakshmanan

2. Abstract Cloud computing is slowly transforming itself from a hype ( 模糊 ) to reality. However, its maturity and further adoption depends on its ability to address concerns such as security, interoperability, portability and governance ( 支配 ) at the earliest opportunity. This can be accelerated by compliance to guidelines and standards defined in consensus by the cloud providers. Without addressing these concerns, users would be wary ( 警惕的 ) to tread ( 步行 ) this path in spite of its powerful economic model for business computing. This chapter will explore the readiness of various standards of interoperability, security, portability and governance for the cloud computing model. The market adoption of these standards will also be explored and gaps or opportunities for improvement will be discussed. Abstract

3. An IDC Survey [1] of senior Information Technology (IT) executives/CIOs shows that limited or lack of security, reliability, interoperability, portability and compliance ( 承諾 ) in the cloud are some of the top concerns for its mainstream adoption. The impact of these challenges and solution responsibility are not limited to the cloud providers, but span across all the players in the cloud ecosystem such as the service consumers, service providers and governing bodies. Hence, a solution or an approach to address these concerns should be built with consensus from all the players. Cloud Standardisation (Standardization) is the means to such solutions. 5.1 Overview – Cloud Standards – What and Why?

4. Standardisation provides predictability for providers and consumers alike. It enables innovation, promotes vendor independence, interoperability, encourages repeatable processes and increases resources/skills availability. IT has a fair share of standards that has lead to its maturity and faster adoption. Cloud computing can look at re-use/extension of the IT standards, restricting the creation of fresh ones to address unique scenarios and challenges of this model. For example, Amazon, a public cloud provider, could utilise the existing security standards for data centres like physical security, network security, etc., to protect its cloud environments. However, interoperability of a service between two public cloud environments would need fresh standards. 5.1 Overview – Cloud Standards – What and Why?

5. There needs to be cautious balance between the levels of standardisation so that it does not stifle ( 阻止 ) innovation and enables early industry adoption. Hence, what will be some of the important standards that typical Enterprises look for before adoption? These are (restricting the definitions to IT): 5.1 Overview – Cloud Standards – What and Why?

6. Interoperability/integration – interoperability enables products/software components to work with or integrate with each other seamlessly ( 無縫地 ), in order to achieve a desired results. Thus, it provides flexibility and choice to use multiple products to achieve our need. This is enabled by either integrating through standard interfaces or by means of a broker that converts one product interface to another. 5.1 Overview – Cloud Standards – What and Why?

7. Security – security involves the protection of information assets through various policies, procedures and technologies, which need to adhere to standards and best practices in order to achieve the desired level of security. For example, Payment Card Industry (PCI) data security standards from PCI SSC [2] define ways to ensure credit card data to avoid fraud. This is applicable to all organizations that hold, process or pass credit cardholder information.

8. Portability – as per Wikipedia [3], a software is said to be portable when the cost of porting the same from an existing platform for which it was originally developed, to a new platform, is less than the cost of re-writing it for the new platform. Software with good portability thus avoids vendor lock-in. This is typically achieved by adhering ( 遵守 ) to standard interfaces defined between the software component and vendor platforms. For example, Java programs are set to be portable across operating systems (OS) that adhere to standard interfaces defined between the Java runtime environment and the OS. 5.1 Overview – Cloud Standards – What and Why?

9. Governance, Risk Management and Compliance (GRC) – governance focuses on ensuring that the enterprise adheres to defined policies and processes. Risk management puts in controls to manage and mitigate risks as defined by the enterprise. Compliance ensures that the enterprise adheres to various legal/legislative as well as internal policies. Standards have been defined for IT systems to adhere to certain industry as well as legal standards such as Sarbanes-Oxley (SOX) [4], Health Insurance Portability and Accountability Act (HIPAA) [5], etc.

10. Having discussed the need for standards, the subsequent sections will present the various initiatives in this section. To understand the need for standards from the cloud perspective and the status of various initiatives better, a hypothetical company called Nimbus Corp is considered. Nimbus is actively moving its IT systems to various cloud options. It started journey into clouds with an IBM CloudBurst® private cloud for its marketing applications. Having been successful in its pilot, Nimbus started to move some of its data-processing-intensive applications to Amazon Web Services (public cloud) in time for handling Christmas volumes. 5.1 Overview – Cloud Standards – What and Why?

11. It moved a couple of custom-built applications to Amazon EC2 and the Marketing data mart to Amazon’s Oracle instance. The SaaS-based BI vendors, Birst or PivotLink, are being looked at for replacing its current marketing dashboard, having moved the data mart to the cloud. Nimbus is also considering using Force.com or Google App Engine (GAE) PaaS environments to build additional marketing applications. The standards are reviewed with this company in mind. 5.1 Overview – Cloud Standards – What and Why?

12. 5.2 Deep Dive: Interoperability Standards In using the new cloud setup for its applications, Nimbus faces the following interoperability challenges: The SaaS-based marketing dashboard on one vendor cloud has to fetch the data from the Marketing data mart sitting on Amazon’s infrastructure (IaaS) The marketing applications built on Force.com or GAE (PaaS) needs to interact with the other applications running on Amazon EC2 Similarly, there could be many such scenarios between public and private cloud deployments as well as across various delivery models such as SaaS, PaaS and IaaS. What are the expectations from standards to address these challenges?

13. Interoperability is typically achieved through APIs or brokers between the two interacting parties where the control and the data originating from the requestor is converted into a common format and then moved to the provider and vice versa. The purpose of the standards is thus to set guidelines for vendors, cloud providers and developers of these APIs/brokers to enable interoperability across various cloud resources and hence avoid vendor lock-in. There are, however, additional challenges posed for interoperability in the cloud scenario when compared with that of the traditional IT environments, such as: 5.2.1 Purpose, Expectations and Challenges

14. In additional to the interoperability of application control and data, other supporting aspects of policy management, security management and deployment/provisioning are also to be managed across all the interfacing environments. In the infrastructure layer, cloud computing is supported by the concept of virtualisation. Interoperability heavily depends on the compatibility of these virtual machines (VM). How do some of the current standardisation initiatives fare? 5.2.1 Purpose, Expectations and Challenges

15. Tables 5.1 and 5.2 show some of the key initiatives by industry bodies as well as by vendors towards interoperability standards. 5.2.2 Initiatives – Focus, Sponsors and Status

18. 5.2.3 Market Adoption From Tables 5.1 and 5.2, except for industry initiatives like OVF, the standards are in very early stages of development. In addition, there emerging cloud brokering/management vendors (such as RightScale, CloudKik and CloudSwitch) whose tools interoperate across cloud environments to provide management capabilities through a single interface. They eventually, as predicted by Gartner [18], could provide lot of additional services by building an abstraction layer across the clouds. Some of them are a part of the standard bodies driving these standards.

19. The mature initiatives are focused towards the infrastructure layer. The scenarios discussed earlier, such as: 1.Interoperability/integration between cloud delivery models (SaaS, PaaS and IaaS) is not addressed. Except for Unified Cloud Interface and Cloudware Arch, the rest primarily focus in the Infrastructure layer (IaaS). 2.Standards for interaction between private and public clouds are also not addressed. One such scenario is the usage of hybrid cloud. Various vendors such as Amazon and other cloud brokers seem to have required technology, but have to contribute by participating in the standardisation initiatives. 5.2.4 Gaps/Areas of Improvement