AfricanCloud

When looking at cloud economics for enterprises, it is important to determine whether the cloud spend within the organisation is optimal today and will continue to be so tomorrow. According to Jon Tullett, Associate Research Director, IT Services & Cloud, at IDC sub-Saharan Africa, this is something that is often overlooked when determining whether the cloud solutions a company is using are providing optimal value.

Speaking at the International Data Corporation (IDC) Cloud and Datacentre Roadshow in South Africa, he said there are a lot of misconceptions about moving to the cloud, such as it is cheaper, costs would be more sustainable and it would be easier to manage, but it is not that simple. “The reality is that it’s harder than a lot of people think.   Many organisations end up with duplicate spending because they have some stuff in the cloud and others are not, or they are using two or more clouds. So, it is important to get a better handle on that to rationalise the spend.”

He says while he recommends that organisations actively and aggressively look for the best places to run their applications, this can be a difficult task. “People often focus only on the monthly cost or consumption cost, but what they’re overlooking are the hidden costs such as the cost of additional services and technologies to conduct a migration or to integrate a new environment into the existing infrastructure, the cost of retraining skills, switching both professional services and technology providers, or the egress costs of getting your data out of where it is, which often surprises people,” says Tullett.

Then there is also the potential cost around the risk that must be considered, such as the costs in the event of a failure, recovery costs and opportunity cost delays to roll out to the market. “So, there are a lot of hidden costs that need to be understood, over and above just the cost of the cloud solution you are considering. That said, organisations should continuously be looking at what the best environment for their applications  is. They must just not make the decision based purely on what it’s going to cost them at the moment,” he advises. “What many people don’t realise is that the marginal cost of running cloud services is relatively consistent from one to another. So, if somebody is massively underselling the competition, they are cutting costs somewhere else and eventually those costs will be recovered one way or another.”

While sustainability is a key priority globally, Tullett believes that there are more pressing issues facing organisations in South Africa and the rest of the African continent.. “Right now, it’s all about power. In South Africa, our biggest concerns are around reducing power consumption and cost, while also reducing exposure to risk when the lights go out. Yes, you can manage that risk by moving stuff out of your data centre, which is very power-hungry and where managing risk is difficult and put it into a third-party data centre and just hope they will take care of the risk, but they have energy supply issues of their own. And the network has energy supply issues. So, in this country, the focus is on power availability and continuity,” he says. “That is what’s driving a lot of conversations and we’re seeing data centre operators investing in renewable energies just to support their operations, which is a good thing. In that respect, the data centre and cloud industry are leading some of the renewable energy conversations here, but it’s still a big concern.”

Tullett says the entire delivery chain of applications needs greater scrutiny. “You can offset a lot of risk by moving stuff out of on-premise into the cloud or a third-party data centre, but if you forget about the network component, that will fail eventually and then you have just lost access to this very expensive cloud application. That’s one thing. The other thing is modernization,” he concludes. “Don’t just lift and shift your old technology architecture into a new environment and expect miracles, because all you have done then is picked up your technical debt and moved it somewhere else and added some more. While it’s an important step, it can’t be your last step. You need to take the next step and the next step is to start modernizing and re-architecting those applications.”

Jon Tullett is the Research Manager, IT Services, IDC South Africa

As CIOs turn to the cloud to help streamline performance across key areas of operations, knowing exactly how to conquer the biggest cloud adoption challenges is more important than ever before says,  Marilyn Moodley, Country Leader for South Africa and WECA (West, East, Central Africa) at SoftwareOne. 

One of the first hurdles organisations encounter centres on what it expects cloud adoption to achieve. “Executives and technology teams may have slightly different views on this. While board members might believe the business needs to keep up with cloud trends, IT might focus on the challenges and complexities of cloud migration. Each view has its merits as cloud brings fundamental changes to how an organisation operates – and how it manages critical workloads,” notes Moodley.

With an understanding of what cloud adoption can do for an organisation, the next step is clearly articulating the primary reason for moving to the cloud. “Is it to reduce costs? Provide greater scalability? Or a requirement to grow and expand into new markets? It’s important to clarify key business goals before you can connect these to the capabilities that cloud can deliver,” she says.

A cloud adoption roadmap

Often the sheer magnitude of what organisations face on their cloud journey leads to a state of ‘analysis paralysis’ in which the research phase takes much longer than anticipated. “This can be a precarious juncture for an organisation as there is a temptation to then leap into the cloud wholesale without fully considering whether some workloads are appropriate,” says Moodley.

She adds that organisations can alleviate some of this pressure by focusing on applications rather than on technologies and architectures. “The key is to decide what’s needed for each application. Is it feasible to move the application to the cloud? Does it need to be modernised first? Or would a simple lift and shift work? Knowing this helps to prioritise and break down a migration program into more manageable chunks.”

Moodley says a comprehensive licensing assessment provides important guidance on which software needs must be met and the most cost-effective method of ensuring an organisation remains one step ahead of software audits and can proactively solve IT compliance issues before they happen.

A practical migration plan

After a business has clarified its goals and assessed its licensing and application needs, it can then prioritise which applications should be moved to the cloud first and start building a practical and achievable migration plan. 

“SoftwareOne understands how to guide organisations through this process, helping with considerations such as how to time the migration of certain applications to ensure that key business processes aren’t disrupted. For instance, if an organisation has workloads with specific seasonal usage, it might want to migrate the applications used for that process well outside of those busy periods. Having an application-centric approach allows a business to plan its migration more simply than using a more traditional server-centric approach,” Moodley explains.

An effective migration plan should provide a clear view of the costs involved. However, Moodley cautions that while a move to the cloud can reduce some expenses, it is not always the case early on. “An organisation will save on data centre operating costs once migration is 100% complete, but this process takes time. Aspects such as electricity, cooling and even building rent will not necessarily decrease in cost in a granular way if they are still required for the applications that remain. Enlisting the help of a partner who understands the migration funding programs available through all of the hyperscale cloud services providers – Amazon Web Services, Google Cloud and Microsoft Azure –can ease transitional costs considerably,” she says.

Moodley notes that in the complexities of moving to the cloud, many organisations can lose sight of common pitfalls which can be avoided by identifying key cloud drivers in a documented strategy.

Marilyn Moodley is the South African Country Leader for SoftwareONE.

At least 95% of cloud security failures in the next three years will be the customer’s fault, according to Gartner. Unsurprisingly, the biggest threat to security is people. Misconfiguration mistakes escalated from 15% of exploitable errors in 2018 to more than 40% in 2021 and human error is now the third most common cause of security breaches, ahead of malware and right up there with social engineering and hacking. Complacency about cloud security is a major contributing factor, but this needs to change. Most cloud services operate under a shared responsibility model in which providers secure the infrastructure, while customers are required to lock down the software stack and applications. In other words, responsibility for patching vulnerabilities and controlling access to cloud accounts still lies with the user.

What does this mean? Organisations need to remain vigilant, ensuring that they take the necessary steps and precautions to secure their data and identities if they’re to avoid becoming an unfortunate statistic with no one to blame but themselves.

Identify, verify, control

No matter the deployment model, sufficient controls are required to govern access and usage. With such a variety of effective Identity and Access Control service providers available today, there is little excuse for businesses not to have these measures in place. Authentication and access control requires users to verify their identity, and secures their access to resources across cloud, SaaS, on-prem and APIs, while increasing speed, agility, and efficiency.

Such IAM solutions make it straightforward to provide the means for customers, employees and partners to all have secure access to the necessary resources. By using identity verification and access control services located in the cloud, the limitations and costs associated with on-premises IAM can be replaced by a more flexible, scalable solution. Cloud IAM is key to ensuring security outside of network perimeters and capabilities include authentication, access management, identity verification, consent collection, risk management and API security.

Access control to the cloud should be regulated through the creation of centralised rules and policies to streamline processes. The use of Multi-Factor Authentication (MFA) is critical to ensure the correct identification of individuals trying to access networked resources, while Privileged Access Management (PAM) tools enforce control over sensitive components and applications in the environment.  These tools form part of a larger cloud security picture that includes details such as a zero trust framework, bolstered with cybersecurity mesh, and reinforced with Secure Access Service Edge (SASE).

Zero trust: never trust, always verify

Zero trust is a framework for securing organisations in cloud and mobile spaces by insisting that no user or application be trusted by default. It enables least-privileged access, establishes trust based on context which is informed by user identity and location, endpoint security posture as well as the app or service being requested, while performing necessary policy checks at each step. A well-tuned zero trust architecture leads to simpler network infrastructure, a better user experience, and improved cyber threat defense.

SASE: borderless security

Secure access service edge (SASE) is a framework for network architecture that brings cloud native security technologies together with wide area network (WAN) capabilities to securely connect users, systems, and endpoints to applications and services anywhere. This ensures that data and traffic is secured, no matter where it travels.

Cybersecurity MESH: closing the gaps

Gartner describes cybersecurity mesh as “a flexible, composable architecture that integrates widely distributed and disparate security services”. Concerned with strengthening digital security while bringing tools closer to the assets they’re designed to defend, a cybersecurity mesh architecture (CSMA) encourages organisations to deploy solutions that fit their specific needs by working within their integrated ecosystems. This enables businesses to share cybersecurity intelligence, automate and coordinate responses to threats, and simplify their security operations. CSMA offers a distributed identity fabric that helps establish trusted access across all applications, customers, partners, and workforces.

Achieving visibility and developing security skill sets

Visibility in cloud security means eliminating blind spots that can result in overspending, performance inefficiencies and security complications. This is done through service-centric or role-centric tools, rather than host-centric tools to manage networks. If it is not possible to hire the necessary competencies, organisations will have to develop them. Many vendors offer online resources to help technologists learn the skills they need to become cloud security engineers. In addition to an increase in the need to cultivate the necessary skills, there will be an increase in demand for technologists that have the DevOps skills necessary to align business workloads with the cloud.  Upskilling will also be critical to bridging the skills gap which includes training business teams on how to use cloud tools.

Owning security responsibility

Accordingly, it’s important for businesses to remember that even when they’re purchasing infrastructure, software or functionality as a service, they’re not outsourcing total responsibility for security. This will continue to be a shared responsibility, because it is unlikely that service providers would willingly take on the possibility of being liable for human action or error beyond their control. As such, organisations will need to prioritise the acquisition of or the development of necessary security-minded skills in order to protect their digital assets from cyber harm.

Marilyn Moodley is the South African Country Leader for SoftwareONE.