Doug Newdick's Blog

Financial Disincentives for Cloud Computing

Doug Newdick — Tue, 14 Feb 2012 09:01:35 +0000

In general I think cloud computing is a great thing. Elsewhere I have talked about the benefits that it can bring to many organisations. Many of the positive financial benefits of cloud computing are well-known: pay only for what you need or use; cost certainty; being able to reduce the cost of ICT as the demand for ICT services reduces; reducing the need for massive upfront investment in infrastructure and so on. One of the benefits that I have been more sceptical about, however, is the way that cloud computing moves the cost of ICT from capital expenditure to operational expenditure. From my point of view money is money. Merely moving it from one line on the budget (capital expenditure or capex) to another line on the budget (operational expenditure or opex) seems to me to be no benefit at all. On investigating the issue further it seems that there are some unusual circumstances where this is a bad thing. These situations really only exist for large enterprises or government agencies rather than smaller users of cloud services. But for these organisations these problems can be significant disincentives to the adoption of cloud services. Understanding these factors can mean the difference between a cloud adoption initiative succeeding or failing.

If your organisation is capital rich and opex poor then the financial model of cloud computing does not work for you. In particular many government departments have capex and opex allocated separately by the central treasury (this is how the New Zealand Government works, and I would be surprised if other governments don’t also use this model). If your organisation has large chunks of funds allocated to capital expenditure and it cannot effectively move it to cover operational expenses then the cloud computing economic model of moving costs from capex to opex is a tricky thing for your organisation to manage. This can be an effective barrier to the adoption of cloud computing services in central government and will be something that treasury departments throughout the world will be looking at as the trend towards governments adopting the cloud continues.

Even if an overall organisation doesn’t work like this individual business units often do and if business units fund IT projects (as is often the case in large organisations) then similar considerations apply. Sometimes organisations pool the capital expenditure at the organisational level, and allocate operational budgets to lower level business units. Anything that increases the operational expenditure of that business unit will probably be viewed negatively. Business unit X is unlikely to go for a project that will be solely funded from its operating budget as opposed to one that is funded from the central pool of capital funds.

In some situations (and in some jurisdictions) capital expenditure may qualify for Research & Development tax credits. If the capital expenditure on ICT is part of a research or development effort to come up with a new product for instance, some governments give tax relief on that expenditure. The same is unlikely to apply to opex spent on cloud services. This can mean that such capex is more effective (i.e. it is worth more) than equivalent money spent on opex. So, this in turn may be a disincentive to use cloud services.

Capital costs are also usually depreciated over time. Depending on the organisation and the asset that might be over three, five or even ten years. Any initiative that moves cost into operational expenditure before the asset it is replacing has been fully depreciated is likely to mean an increase in the financial costs to your organisation (unless the cost savings are so substantial as to outweigh the depreciation amounts). Particular cloud initiatives therefore need to be carefully aligned to the investment and refresh cycles of existing ICT assets.

In short, if you are considering a programme of cloud adoption you need to understand your organisations funding, cost and expense models to ensure that there are no financial or management disincentives to the adoption of these services. It would be a great shame if a fantastic cloud initiative that could deliver costs savings and improvements to business agility and effectiveness foundered on the way that operational budgets and costs were allocated.

Commercial Considerations and Enterprise Architecture

Doug Newdick — Mon, 06 Feb 2012 07:51:56 +0000

This post is dedicated to my colleagues in the Government ICT Supply Management Office within the New Zealand Government. I’ve learnt a lot from working with them over the last few months.

When working in the ICT architecture of an organisation – whether enterprise architecture or solution architecture – your architecture will always be better for a well-informed engagement with the commercial side of ICT. In this post I will describe why it is important to understand the commercial aspects of ICT in order to deliver more successful ICT solutions, and how working with your commercial team can assist in this success.

In my experience, most architects couldn’t care less about the procurement of ICT or the commercial aspects of the solutions they architect, design and deliver.It has only been recently that I have had my eyes opened to how important these aspects of enterprise ICT are. If we view one of the key measures of success of an ICT project as being return on investment (ROI) then the cost of the solution is one half of determining the ROI (the other half being the financial benefit accrued). If, as part of the solution, we are procuring software, hardware or services the costs of obtaining them are likely to form a significant part of the overall costs of the solution. It follows from this that the process of negotiating these costs (procurement) is obviously very important. To give an example: if we are implementing a solution to deliver a new product to market it doesn’t matter if the solution is brilliant from a technical point of view if it is so expensive that it costs more than the revenue that the new product brings in.

Beyond the initial purchase costs, if we are to really understand the ROI we need to consider the ongoing costs of the solution. A significant portion of this can be the ongoing support and maintenance fees associated with enterprise software (and hardware). Typically the annual support and maintenance fees run at about 20% of the cost of initial licenses. Many vendors, however, will heavily discount initial purchases and instead rely on annual fees to form the bulk of the revenue. When looking at your solution components you need to understand the scale of annual fees you will be incurring and what you get for them, otherwise you will not be able to understand the likely operating costs of the solution.

Besides the purchase cost of the hardware or software itself, another aspect that we need to consider is the cost of the procurement exercise itself. Heavy-weight procurement exercises such as RFPs can cost a large amount of money to run and take a long time. While this is more of an issue within the public-sector where fairness and open-ness are mandatory, it is still important in the private sector too. It may make sense to implement a less technically preferred solution using already purchased components than it would be to run an expensive procurement process. Or, conversely, we could tailor the procurement process (where possible) to meet the constraints (financial, timeframe or other) that the solution is developed under.

Beyond mere price, you should be asking the question: “Does the commercial construct of this ICT procurement align with the goals and purposes of the architecture?” For instance: does it make sense to buy hardware and software outright when what is required is a temporary solution with a short life-time? In this case a leasing/renting model or Software as a Service would probably be in better alignment with your architecture. If you are making a significant investment in a solution that locks you in to a particular technology then a short-term commercial arrangement where the vendor can raise annual fees whenever they feel like is inappropriate. In that case you are better off locking in support fees for a number of years. For a high transaction volume system is a per transaction licensing model best? (Unlikely.) Per user licensing works best for systems with a lower number of users, rather than for an enterprise system that everyone must use but mostly infrequently. If your ratio of devices to users is high, then licensing on a per user basis is better. However if your enterprise composition is the other way around (with a large number of shared devices) then licensing on a per device basis is better. From these examples you can see that the kind of commercial model can make a big difference to the financial viability of a particular solution. The more options you can give your procurement people, the more information they have to base their negotiations on, the more likely you are to get a licensing and commercial model that maximises the benefits to your organisation.

To summarise the following commercial considerations should always consider the following factors in the architecture of your enterprise and your solutions:

The initial cost of the ICT components (and the leverage you need to get the best price);
The cost and time of a procurement exercise (and what is the most appropriate procurement approach);
The ongoing support and maintenance costs of your solutions (and what that gets you);
The commercial constructs negotiated with vendors.

For large projects or expensive software, work closely with your commercial and procurement teams to ensure that the right technology and vendor are chosen for your architecture, the right contract is negotiated at the right price and that your architecture best utilises the commercial construct that has been arrived at. Doing this will lead to greater overall success of your architecture whether it is project or enterprise in scope.

Scary Calendar Effects in Government

Doug Newdick — Fri, 03 Feb 2012 09:18:52 +0000

I am a big fan of the Obsessive Compulsive Data Quality Blog and Podcast as I have mentioned elsewhere. Jim Harris takes a different, even slightly oddball, view on issues around data quality and data management and I find his podcast interesting, thought-provoking and even entertaining. The most recent episode of OCDQ Radio that I have listened to, entitled: Scary Calendar Effects was a very enlightening discussion on the ways that business time periods impact on IT. It also included a hilarious data quality-horror skit (OCDQ meets Friday the 13th). The most obvious example of one of these calendar effects is the quarterly reporting that US publicly listed companies seem trapped in: the need to report earnings on a quarterly basis gives company boards and executives strong incentives to focus on short-term objectives at the expense of long-term ones. This can impact on the ability of IT programmes and projects (often longer term in both execution and payoff) to gain funding or attention. Jim’s examples were all from the private sector. It got me thinking about what other calendar effects are present in the government sector.

The most obvious one is the annual budget cycle of government agencies. Government agencies are funding by yearly appropriations – that is every year government agencies are allocated a certain amount of money out of central funds. (This is the way it works in New Zealand, and I believe that most Western democracies are similar as are many governments with different forms of government.) This fundamental budgeting cycle has several impacts:

It is very hard to win funding for projects that operate over more than one year. The annual budgeting cycle means that multi-year projects need tricky financial measures to have secured funding over multiple years.
At the end of each budgetary year there is often a need to spend any left over money quickly as there is a “use it or lose it” aspect to centrally allocated funds. If the budget in any particular year is not spent, then that money will be taken off the department at the end of the year. Even worse, the departmental budget for the next year could be reduced by the same amount! (It should be noted that similar effects do apply in the private sector, but they usually apply at a business unit level and not to the entire organisation like they do in the public sector.)
“Secured” funding can be lost if it hasn’t been spent by the end of the budget year.

Another way that calendar effects come into play in government is through the electoral cycle. It is a well-known fact that for a period before an election new initiatives become much harder to initiate. This is for a couple of reasons:

Governments don’t want to spend big just before an election as it makes their fiscal position look worse and opens them to criticism by the opposition.
Agencies don’t want to start major initiatives as a change in government can mean that these initiatives will be scrapped and the investment and effort wasted.

And after an election, especially if there has been a change in government, the level of activity is reduced and again major initiatives are hard to get going. New governments want a period of time to understand the current position and decide how to implement their election policies and promises before they will start anything themselves or decide what big initiatives they will support.

The last calendar effect (and this isn’t peculiar to the public sector,though it may be more prevalent) is the cycles of approvals and governance committees. All significant government initiatives (and they don’t have to be very large to count as significant) usually have to go before several committees for approval. There may be financial committees, technology committees, legal reviews, and senior management committees depending on the size and type of initiatives. There will usually be an order that a project has to go through these committees. These committees never meet as frequently as you want, and they will usually have a lead time where documents need to be provided beforehand. If your organisation doesn’t have a well organised process for approval the combination of these factors can mean delays of weeks or even months at crucial stages during your project life-cycle.

These calendar effects might look like they are very far from the “real job” of getting ICT work done, but in fact understanding them can play a vital role in the success or failure of your project. If you are a senior IT leader in a government organisation then you ignore them at your peril. People who have a track record of successful delivery understand them and work with them.

How Does the CloudU Certification Stack Up?

Doug Newdick — Mon, 30 Jan 2012 20:00:37 +0000

I recently obtained my CloudU certification. CloudU is an introductory cloud computing certification provided by Rackspace (a leading IaaS provider) and curated by NZ’s own Ben Kepes. The material and certification are described as “vendor neutral” and it does live up to that label. It is billed as being an introduction to the technical and business aspects of cloud computing and it also lives up to that.

Overall CloudU is a good introduction to cloud computing. It covers the full range of cloud computing (with a focus on IaaS) and looks at issues from both a technical and a business perspective. As you would expect of an introductory course, it doesn’t cover any areas in any depth. This is a good thing: the strength of the CloudU certification is exactly that there aren’t any other certifications that demonstrate that the person has a broad, basic understanding of the subject matter and issues of cloud computing.

The other certifications that exist are either:

Specialised (such as the Cloud Security Alliance‘s certification on cloud security)
Vendor and/or product specific (such as Microsoft’s Virtual Academy)
or, proprietary and expensive (such as those offered by specialised IT training vendors).

So, in this respect, the CloudU certification does stand out positively, in being general, vendor neutral and free.

In general the material is solid, though I do have some specific quibbles about some of it. The security material is the weakest. In particular the advice is not broad enough (it only looks at a narrow range of security issues and controls) and somewhat out-of-date (the password advice is horribly antiquated). Another area that seemed weak was the discussion of standards. The role that standards may play, and the kinds of standards that are out there was generally not discussed. Another minor point was that a few of the discussions have a somewhat idiosyncratic flavour and would perhaps have benefitted from being informed by comparison with wider industry terminology and approaches. None of these points detract from the value of the certification.

Overall, the certification is worthwhile one to have and a valuable contribution to the industry. Just don’t expect that anyone who has it is a cloud computing expert. I’m looking forward to watching its evolution.

Disappointing Advice from the NHS on Securing Tablets

Doug Newdick — Sun, 22 Jan 2012 04:47:20 +0000

In this weeks news from the Guardian Government Computing Network (a UK based news site) there was an article about some disappointing – from my point of view – guidance from the National Health Service (NHS) on tablet (specifically iPad) security. Unfortunately it appears that the actual guidance document itself is not freely available, so I’m having to rely on newspaper reporting. In an article entitled “NHS warns staff over tablet security risks” the guidance is reported as saying that tablets are:

“inherently less secure than more traditional technology”
“a high profile target for malware”

Which is an exaggeration of the facts. There is nothing inherently less secure about this technology. There are some significant issues with android devices and malware, but they are only as bad as the issues with malware for PCs. Indeed the lack of security comes from a lack of information, mechanisms and tools from enterprise IT to support and encourage secure use.

The document then goes on to issue the following guidance:

“[staff are warned] not to use tablet devices to store sensitive patient data”
“staff must have strong encryption and passwords if using tablets”
“devices must be configured to allow for remote wiping, or wiping after a number of failed password attempts”
“[the guidance] warns against the use of cloud services with tablets”
“Users should remove or disable unnecessary services”
“the ability to transfer data from the devices should be restricted to a list of permitted destinations”
“tablets should not be deployed ‘out of the box’, but should be configured with a standardised OS and firmware version together with current security updates before use”

(The points above are all direct quotes from the article) If this is an accurate summary of the guidance then this is truly disappointing as if implemented, this guidance would (a) significantly reduce the benefits from using these device; (b) be unlikely to succeed. The amount of resistance from users to these measures would likely be very high. People with tablets are more likely to ignore, avoid or subvert these measures than they are to follow them. The guidance ignores the whole point of the tablet, and the challenge it offers to IT by treating in the same way that legacy desktops and devices have been treated.

It recapitulates a depressing tendency from centralised IT functions and government security to ignore the different uses that tablets are put to and to try and reinstate an inappropriate traditional “one size fits all” approach to managing devices.

The NHS has missed an opportunity here. Instead of taking such a conservative approach they could have:

recognised the different uses that people have for tablets,
understood the different security risks and controls appropriate for those different uses

and, based on this, recommended appropriate tools and measures for these different uses to deliver the maximum benefit while enabling secure and responsible use of tablets. This would have increased the chance of different agencies within the UK health sector taking them seriously and increased the chance that their guidance would be effective in actually securing devices in the sector.

Links to Some Cloud Computing Resources

Doug Newdick — Wed, 11 Jan 2012 09:35:14 +0000

I’d just like to highlight several links to key cloud computing resources on the net. These either contain things I’ve found useful or interesting or are from major players (and thus should be taken into account).

The first item is my own whitepaper on negotiating privacy, data residency and security in the cloud for New Zealand organisations. If you are looking at cloud computing for private or public sector organisations in New Zealand then this isn’t a bad place to start (if I do say so myself) though my thinking has moved on a little since then.

The Microsoft Virtual Academy is a set of great learning materials (including self-assessments) for Microsoft’s range of cloud products. While vendor and product specific it is still a great free resource, and Microsoft do have the greatest breadth of public cloud offerings in the marketplace at the moment.

Rackspace’s CloudU is a vendor neutral set of courses (including self-assessments and a completion certificate) on cloud computing curated by NZ’s Ben Kepes.

The Cloud Security Alliance is a not-for-profit that promotes security within cloud computing. Its membership is made up of most of the major players in cloud computing including Google, Microsoft, SalesForce etc. Regardless of that, they have produced a particularly useful questionnaire for assessing the security of your cloud service provider, the Cloud Assessments Initiative Questionnaire and some good Security Guidance.

The Cloud Standards Customer Council is a cloud end user advocacy group (its membership is made up of organisations who use cloud computing rather than provide it like the CSA), it has published a Practical Guide to Cloud Computing and a set of Cloud Computing Use Cases.

NIST (the USA National Institute of Standards and Technology) have come up with one of the most widely used definitions of cloud computing, and the US work on government cloud computing is probably the most advanced internationally. If you are interested in cloud computing in the public sector context this is probably the first place you should look. They have a number of useful documents including the US government’s Cloud Computing Technology Roadmap.

OASIS is a standards body that focuses on open standards for the global information society. There are a number of OASIS committees that are relevant to cloud computing, but the one most concerned with it is the Identity in the Cloud Technical Committee which is interested in developing standards for identity management in cloud computing. Currently they have a range of use cases concerned with identity management in the cloud, which will be useful if this is an area you are working on.

If you have any other useful resources for cloud let me know!

End User Computing: It’s No Longer One Size Fits All

Doug Newdick — Fri, 06 Jan 2012 01:48:58 +0000

After looking at end user computing and desktops quite seriously for nearly a year now, I have come to a number of conclusions, but the single most important one is that one thing we can say for sure is that end user computing is no longer a case of one size fits all.

There are two aspects to this:

A pull from the demand side – people are demanding different devices and experiences. They will no longer settle for the locked down standard operating environment for a desktop, or the single make and model of mobile phone; and if centralised IT won’t provide what they want, they will get it from elsewhere.
A push from the supply side – we are seeing the technology that can deliver in a manageable fashion different models of end user devices and computing. In many cases this is the vendor and IT communities reacting to the demand side of the equation, but this reaction is reaching a level of maturity and sophistication that we can now meet that demand.

In short: the different members of an enterprise want different kinds of end user computing experiences, ones that suit their personalities and their role: they want tablets, they want individualised applications, personalisable desktops and the choice of their favourite smartphone. And IT now has the ability to deliver this in a manageable and secure fashion.

2011 in review

Doug Newdick — Wed, 04 Jan 2012 04:31:50 +0000

The WordPress.com stats helper monkeys prepared a 2011 annual report for this blog.

Here’s an excerpt:

A New York City subway train holds 1,200 people. This blog was viewed about 4,300 times in 2011. If it were a NYC subway train, it would take about 4 trips to carry that many people.

Click here to see the complete report.

Understanding The Desktop Application Landscape

Doug Newdick — Tue, 13 Dec 2011 10:00:24 +0000

When we discuss end user computing and the desktop we mustn’t lose sight of the fact that the whole point of these things is to provide end users with access to applications and data. So, in order to deliver a truly effective end user computing experience we need to pay close attention to the application landscape of our enterprise. It is important to understand the overall application landscape, so that we can make the best decisions about what end user technologies to deploy and how best to deploy them.

The worst thing that you can do is to assume that IT know what applications users need. IT folk have a bad habit of thinking that what is important to them – what looms large in their life of IT support – is what is important to the wider business. They therefore tend to think of desktop applications in terms of office productivity tools and big line-of-business applications. They don’t really know what applications are important to the business, and will therefore give a very partial and limited view of the application landscape.

The next worst thing you can do is to ask managers what applications their staff need. Mangers (as much as IT staff) tend to over simplify the desktop environment, though for different reasons. They will focus on what applications cost them the most, and which require the most management attention. In general this will also lead to them mainly focussing on office productivity and expensive line-of-business applications. They will ignore the multitude of small desktop apps that their staff see as essential and often don’t understand what their staff do on a day-to-day basis. If you rely on managers you will find a multitude of business critical applications have been overlooked.

The best way to understand what applications people need is to look at the applications they currently have. If you have a well-ordered software asset management system (and corresponding processes) then this will be a piece of cake. You will have this information at your fingertips. If, like most organisations, however, you don’t have good software asset management then you will need to perform some sort of discovery process.

Once you have figured out what applications are installed (or used) then you can go through the exercise of analysing what the applications do and what they are used for (not the same thing!) and, most importantly, who uses them.

All of this then forms the application landscape which will in turn inform and constrain the overall design of your end user computing environment. It can do this in several ways:

If any business critical applications are windows based, then you will need to deploy Windows as part of your environment.

If applications are browser-based they may require certain internet browsers (older applications requiring IE6 is a common issue faced by desktop modernisation programmes).

If most business applications are browser-based then this may weaken any dependencies on particular operating systems.

If applications can be virtualised then this increases your options around types of desktop deployments.

Conversely, if some applications cannot be virtualised then this will constrain your desktop deployment.

Some applications will require more powerful end user resources, perhaps more memory, faster processors or specialised hardware.

All of these factors will need to be taken into account before you can design the full end user computing solution set. If you can marry your application landscape analysis with an analysis of your end user use cases (such as I have outlined previously) then you will be well on your way to developing a comprehensive end user computing architecture.

The iPad Is the Only Game in Town…So Far

Doug Newdick — Tue, 29 Nov 2011 09:28:25 +0000

One of the drivers for looking at end user computing at the moment, above and beyond just looking at the desktop, is the rise of the tablet. We have more options(and challenges) now than just the traditional Windows desktop PC. Everybody working in enterprise IT (architecture, operations, security and management) is trying to figure out how to deal with the huge demand for tablets. Or are they? My experience is that the issues that enterprise IT is facing from the post-PC era, from the consumerisation of IT is mostly demand driven. And that demand is only for iPads, not tablets in general. Smartphones are a different story, in that space there is not just one game in town, but while smartphones are an important part of the corporate IT landscape they aren’t the game changer that tablets – iPads – are. Yes there are Android tablets out there, but , aside from apple-haters and technicians working in our IT department I don’t have anyone asking for one. I’ve taken a look at android tablets and my feeling is that in general they are six months to a year from being serious competition to the iPad. So, in six months I expect to start seeing the demand for android tablets to make an impact on me.

What about Windows tablets? Well, I don’t seriously expect to see competitive Windows Phone 7 tablets. By the time someone gets around to having a decent Windows tablet, I expect Windows 8 to be out. As Windows 8 is expressly for the tablet form factor, while Windows Phone 7 is designed for the phone form factor I believe that we are unlikely to see serious Windows based tablets before Windows 8 is released some time late next year.

The one non-apple tablet on the market, that I think I may need to take into consideration is the Kindle Fire – Amazon’s new android tablet. It seems to me that three factors mean that this could be a serious competitor for the iPad: (1) the price point; (2) amazon’s expertise in user experience; and, (3) the amazon ecosystem (already shown to great effect with the kindle). And, it seems that I’m not the only one who thinks so. So until the demand for the Kindle fire picks up, or some other android competitor is launched, I’ll be looking for a general tablet solution, but I really only have an iPad problem. Looking into the future my architectures for end user computing need to consider a multiplicity of platforms (even if that number is only realistically two), but my burning issue is just dealing with one.