Cloud Services How Do We Decide? Charley Kneifel Trask Technology 8/13/13

Goal Define when cloud services make sense Or put another – what are the risks of cloud based services compared to the benefits? What is the difference between a cloud service and a hosted or outsourced services How do we decide?

Service Classifications Essential – 24x7, 15 minute recovery – Health/Safety – E911, Paging, … Critical – 24x7 - <2 hour recovery – SAP, , Core University Websites Sensitive – 24x7 / 8-5M-F – 2-4 hour recovery – SISS, Lecture Capture,... Tolerant – 8-5 M-F – 1 Business day recovery – Departmental websites,

System Inter Dependencies Create Risks Real Time – Network – Authentication and Authorization Shibboleth, Active Directory, Kerberos, LDAP – Domain Name Services (DNS) Back End Services and Integrations – Provisioning, PeopleSoft, SAP

Cloud Challenges More reliance than obvious on Duke infrastructure Network Latency/Geography Network Connectivity/Routing Services Shared With Other Customers Required Updates to Current Software Version

Cloud Benefits Geographical Distribution Economies of Scale Expertise or Commodity Speed (Deploy/Update/Fix) – Especially if we don’t customize Features Required Updates to Current Software Version

Lessons Learned So Far Visibility – Openness of Partner Network Connectivity – Can we leverage what we own/control? Internet 2 Specific Peering Relationships/NCREN Multi-Tenancy – Where are we big enough or different? – Where are we small enough or the same?

Lessons Learned (cont.) Integration is a challenge but have same challenge on campus – Shibboleth solves some problems – Consistent AD/LDAP service solves some problems – Uniform services across campus solves some more

$64,000 Question Why would we want to run services outside of Duke? – What do we gain? – What do we give up? – Are we thinking about this in the right way? – Do we run them in the Cloud, at Duke or Hosted

Possible Decision Criteria:

Question 1 Is the service a commodity? – Does Duke need to do it differently? – Does Duke have a different reliance on it than others? – Does Duke add value when we do it ourselves? – Can Duke get to the same economies of scale as the service providers? – Do we gain control of how we make ongoing investments into the service?

Question 2 Is it part of what makes Duke, Duke? – Do we get control to make it do what Duke needs? – Do we get control to keep it running as Duke needs? – Is it core to the Duke campus experience? For Students? For Faculty and Researchers?

Question 3 What is the business value to Duke – Are we the same as other customers? – What makes us different? – What are the impacts of outages on Duke Reputational, Revenue Loss, Liability, … – Does Duke have the talent and can it keep the talent? – Do we want to rapidly introduce change (or force change)?

Question 4 What are the challenges to implementation? – Is it tightly integrated with many Duke systems? – Do we have the expertise and will we need the expertise long term? – Does it have strict networking requirements Latency, bandwidth, jitter – How much customization is needed to meet Duke needs? Can Duke change how it does business or should we customize?

Question 5 What are the security implications – Regulated? FERPA HIPAA Etc.