Course : BCA Sem : 5

Subject : CLOUD
COMPUTING
(DSE2)

By : Asst. Prof. Abhishek

Kumar Vishwakarma
 This Video is an Intellectual
Property of
Yogoda Satsanga Mahavidyalaya,
Dhurwa, Ranchi, Jharkhand
Case study of NIST architecture
NIST (National Institute of Standards and Technology) has developed
guidelines and drafted them into a formal publication available specifically
for cloud adopters. These include a roadmap for organizations in depicting
the ideal methods by which an organization can transform their current
enterprise IT to the cloud.
The guidelines published by NIST under this program includes, cloud
computing reference architecture, a standards roadmap and other
government and businesses related informational guides. The roadmap
prepared for US Government is divided into three distinct volumes
consisting of high priority requirements in cloud for government agencies,
useful information for cloud adopters and technical considerations of cloud
for these agencies.

[email protected]
NIST Cloud Computing Program Mean?
• The NIST cloud computing program is a set of best procedures, practices
and standards for developing, deploying and maintaining cloud
computing architecture.
• The NIST cloud computing program designs security assessments,
procedures, and technical guidance documents on building cloud
architecture and services and in supporting the federal government for
all upcoming cloud initiatives.

[email protected]
The Conceptual Reference Model of NIST
The NIST cloud computing reference architecture defines five major
actors:
1. cloud consumer,
2. cloud provider,
3. cloud carrier,
4. cloud auditor, and
5. cloud broker

[email protected]
The Conceptual Reference Model of NIST
Each actor is an entity (a person or an organization) that participates
in a transaction or process and/or performs tasks in cloud computing.

[email protected]
The interactions among the actors
Case 1: A cloud consumer may request cloud services from a cloud
provider directly or via a cloud broker. A cloud auditor conducts
independent audits and may contact the others to collect necessary
information.

[email protected]
The interactions among the actors
Case 2: A cloud consumer may request service from a cloud broker
instead of contacting a cloud provider directly. The cloud broker may
create a new service by combining multiple services or by enhancing
an existing service. In this scenario, the actual cloud providers are
invisible to the cloud consumer and the cloud consumer interacts
directly with the cloud broker.

[email protected]
The interactions among the actors
Case 3: Cloud carriers provide the connectivity and transport of cloud services from cloud
providers to cloud consumers. As illustrated in Figure, a cloud provider participates in and
arranges for two unique service level agreements (SLAs),
1. with a cloud carrier (e.g. SLA2) and
2. with a cloud consumer (e.g. SLA1).
A cloud provider arranges service level agreements (SLAs) with a cloud carrier and may
request dedicated and encrypted connections to ensure the cloud services are consumed
at a consistent level according to the contractual obligations with the cloud consumers. In
this case, the provider may specify its requirements on capability, flexibility and
functionality in SLA2 in order to provide essential requirements in SLA1.

[email protected]
The interactions among the actors
Case 4: For a cloud service, a cloud auditor conducts independent assessments of the
operation and security of the cloud service implementation. The audit may involve
interactions with both the Cloud Consumer and the Cloud Provider.

[email protected]
Cloud Consumer
A cloud consumer is the end-user who browses or utilizes the services provided by Cloud
Service Providers (CSP), sets up service contracts with the cloud provider. The cloud
consumer pays peruse of the service provisioned. Measured services utilized by the
consumer.
Cloud consumers use Service-Level Agreement (SLAs) to specify the technical
performance requirements to be fulfilled by a cloud provider. SLAs can cover terms
concerning the quality of service, security, and remedies for performance failures. A cloud
provider may also list in the SLAs a set of limitations or boundaries, and obligations that
cloud consumers must accept.
In a mature market environment, a cloud consumer can freely pick a cloud provider with
better pricing and more favourable terms. Typically, a cloud provider’s public pricing policy
and SLAs are non-negotiable, although a cloud consumer who assumes to have
substantial usage might be able to negotiate for better contracts.

[email protected]
Cloud Consumer

[email protected]
Cloud Provider
A cloud provider is a person, an organization; it is the entity responsible for making a
service available to interested parties. A Cloud Provider acquires and manages the
computing infrastructure required for providing the services, runs the cloud software that
provides the services, and makes arrangement to deliver the cloud services to the Cloud
Consumers through network access.
A Cloud Provider's activities can be described in five major areas, as shown in Figure, a
cloud provider conducts its activities in the areas of service deployment, service
orchestration, cloud service management, security, and privacy.

[email protected]
Cloud Auditor
An entity that can conduct independent assessment of cloud services, security,
performance, and information system operations of the cloud implementations. The
services that are provided by Cloud Service Providers (CSP) can be evaluated by service
auditors in terms of privacy impact, security control, and performance, etc.
Cloud Auditor can make an assessment of the security controls in the information system
to determine the extent to which the controls are implemented correctly, operating as
planned and constructing the desired outcome with respect to meeting the security
necessities for the system.
There are three major roles of Cloud Auditor which are mentioned below:
• Security Audit.
• Privacy Impact Audit.
• Performance Audit.

[email protected]
Cloud Broker
As cloud computing evolves, the integration of cloud services can be too complex for
cloud consumers to manage. A cloud consumer may request cloud services from a cloud
broker, instead of contacting a cloud provider directly. A cloud broker is an entity that
manages the use, performance and delivery of cloud services and negotiates
relationships between cloud providers and cloud consumers.
In general, a cloud broker can provide services in three categories:
• Service Intermediation: A cloud broker enhances a given service by improving some
specific capability and providing value-added services to cloud consumers. The
improvement can be managing access to cloud services, identity management,
performance reporting, enhanced security, etc.
• Service Aggregation: A cloud broker combines and integrates multiple services into
one or more new services. The broker provides data integration and ensures the
secure data movement between the cloud consumer and multiple cloud providers.
• Service Arbitrage: Service arbitrage is similar to service aggregation except that the
services being aggregated are not fixed. Service arbitrage means a broker has the
flexibility to choose services from multiple agencies.

[email protected]
Cloud Carrier
The mediator who provides offers connectivity and transport of cloud services within cloud
service providers and cloud consumers. It allows access to the services of the cloud
through Internet networks, telecommunication, and other access devices. Network and
telecom carriers or a transport agent can provide distribution.
A consistent level of services is provided when cloud providers set up Service Level
Agreements (SLA) with a cloud carrier. In general, Carrier may be required to offer
dedicated and encrypted connections.

[email protected]
Cloud SLA (cloud service-level agreement)
A cloud SLA (cloud service-level agreement) is an agreement between a cloud service provider and a
customer that ensures a minimum level of service is maintained. It guarantees levels of reliability,
availability and responsiveness to systems and applications; specifies who governs when there is a
service interruption; and describes penalties if service levels are not met.
A cloud infrastructure can span geographies, networks and systems that are both physical and virtual.
While the exact metrics of a cloud SLA can vary by service provider, the areas covered are uniform:
• Volume and quality of work (including precision and accuracy);
• Speed;
• Responsiveness; and
• Efficiency.
The SLA document aims to establish a mutual understanding of the services, prioritized areas,
responsibilities, guarantees and warranties provided by the service provider. It clearly outlines metrics
and responsibilities among the parties involved in cloud configurations, such as the specific amount of
response time to report or address system failures.

[email protected]
Why we need an SLA?
SLAs are an integral part of an IT vendor contract. An SLA pulls together
information on all of the contracted services and their agreed-upon expected
reliability into a single document. They clearly state metrics, responsibilities
and expectations so that, in the event of issues with the service, neither party
can plead ignorance. It ensures both sides have the same understanding of
requirements.
Any significant contract without an associated SLA (reviewed by legal counsel)
is open to deliberate or inadvertent misinterpretation. The SLA protects both
parties in the agreement.
Ideally, SLAs should be aligned to the technology or business objectives of the
engagement. Misalignment can have a negative impact on deal pricing, quality
of service delivery, and customer experience.

[email protected]
What's in an SLA?
The SLA should include not only a description of the services
to be provided and their expected service levels, but also
metrics by which the services are measured, the duties and
responsibilities of each party, the remedies or penalties for
breach, and a protocol for adding and removing metrics.
Metrics should be designed so bad behavior by either party is
not rewarded.
For example, if a service level is breached because the client
did not provide information in a timely manner, the supplier
should not be penalized.

[email protected]
SLAs features :
• Specific details and scope of provided services, including priorities,
responsibilities and guarantees
• Specific, expected and measurable services at minimum or target levels
• Informal or legally binding
• Descriptive tracking and reporting guidelines
• Detailed problem management procedures
• Detailed fees and expenses
• Customer duties and responsibilities
• Disaster recovery procedures
• Agreement termination clauses

[email protected]
Metrics should be monitored
The types of SLA metrics required will depend on the services being provided.
Many items can be monitored as part of an SLA, but the scheme should be
kept as simple as possible to avoid confusion and excessive cost on either
side.
Depending on the service, the types of metric to monitor may include:
• Service availability: the amount of time the service is available for use.
This may be measured by time slot, with, for example, 99.5 percent
availability required between the hours of 8 a.m. and 6 p.m., and more or
less availability specified during other times. E-commerce operations
typically have extremely aggressive SLAs at all times; 99.999 percent
uptime is a not uncommon requirement for a site that generates millions of
dollars an hour.

[email protected]
Metrics should be monitored
• Defect rates: Counts or percentages of errors in major deliverables.
Production failures such as incomplete backups and restores, coding
errors/rework, and missed deadlines may be included in this category.
• Technical quality: in outsourced application development, measurement
of technical quality by commercial analysis tools that examine factors such
as program size and coding defects.
• Security: In these hyper-regulated times, application and network security
breaches can be costly. Measuring controllable security measures such as
anti-virus updates and patching is key in proving all reasonable preventive
measures were taken, in the event of an incident.
• Business results: Increasingly, IT customers would like to incorporate
business process metrics into their SLAs. Using existing key performance
indicators is typically the best approach as long as the vendor’s
contribution to those KPIs (Key Performance Indicator) can be calculated.

[email protected]
Cloud Computing Vs. Traditional Computing
1. Cloud Computing : Cloud Computing, as name suggests, is collective
combination of configurable system resources and advanced service that can
be delivered quickly using internet. It simply provides lower power expenses,
no capital costs, no redundancy, lower employee costs, increased
collaboration, etc. It makes us more efficient, more secure, and provide greater
flexibility.
2. Traditional Computing : Traditional Computing, as name suggests, is a
possess of using physical data centers for storing digital assets and running
complete networking system for daily operations. In this, access to data, or
software, or storage by users is limited to device or official network they are
connected with. In this computing, user can have access to data only on
system in which data is stored.

[email protected]
 Cloud Computing Vs. Traditional Computing
Cloud Computing Traditional Computing
It refers to delivery of different services such as
It refers to delivery of different services on local
1 data and programs through internet on different
server.
servers.
It takes place on third-party servers that is hosted It takes place on physical hard drives and website
2
by third-party hosting companies. severs.
It is ability to access data anywhere at any time by User can access data only on system in which data
3
user. is stored.

It is more cost effective as compared to traditional

It is less cost effective as compared to cloud
computing as operation and maintenance of
4 computing because one has to buy expensive
server is shared among several parties that in turn
equipment’s to operate and maintain server.
reduce cost of public services.

It is less user-friendly as compared to cloud

It is more user-friendly as compared to traditional computing because data cannot be accessed
5 computing because user can have access to data anywhere and if user has to access data in another
anytime anywhere using internet. system, then he need to save it in external storage
medium.

[email protected]
 Cloud Computing Vs. Traditional Computing
Cloud Computing Traditional Computing
It requires fast, reliable and stable internet
It does not require any internet connection to access
6 connection to access information anywhere at any
data or information.
time.
It provides more storage space and servers as
It provides less storage as compared to cloud
7 well as more computing power so that applications
computing.
and software run must faster and effectively.
It also provides scalability and elasticity i.e., one
8 can increase or decrease storage capacity, server It does not provide any scalability and elasticity.
resources, etc., according to business needs.

Cloud service is served by provider’s support It requires own team to maintain and monitor system
9
team. that will need a lot of time and efforts.

Software is offered as an on-demand service

Software in purchased individually for every user
10 (SaaS) that can be accessed through subscription
and requires to be updated periodically
service.

[email protected]
Cloud Economics
Cloud economics is the study of cloud computing’s costs and benefits and
the economic principles. As a discipline, it explores key questions for
businesses:
1. What is the return on investment (ROI) of migrating to the cloud or
switching current cloud providers? And
2. What is the total cost of ownership (TCO) of a cloud solution versus a
traditional on-premises solution?
When individual businesses understand the economics of cloud computing,
they can optimize their investments and obtain the greatest value for their
organization.

[email protected]
Cloud Economics
Cloud economics involves two primary principles:
1. Economies of scale and
2. Global reach.
Through economies of scale, cloud providers save organizations money
because they purchase computing resources in massive quantities at lower
costs. When companies utilize these shared resources, they avoid the
substantial up-front CAPEX (Capital expenditures) costs of purchasing their
own expensive infrastructure. And with a pay-as-you-go pricing model,
companies pay only for the resources they actively use, scaling up or down as
needed.

[email protected]
Cloud Economics
When exploring cloud economics of a company, IT and finance managers can follow a basic
process to determine cloud computing ROI (Return on investment) and TCO (Total Cost of
Ownership), and use those estimates to help make their case to executives.
process should include these three elements:
• Benchmarking: Calculate the cost of operating your current data center, including
capital costs over the equipment lifespan, labor costs and any other maintenance and
operational costs, from licenses and software to spare parts.
• Cloud costs: Estimate the costs of the cloud infrastructure you’re considering (public
cloud, private, hybrid cloud). You’ll need a quote from your vendor, but look beyond this
basic pricing structure to consider ongoing fees, labor and training costs, ongoing
integration and testing of apps, as well as security and compliance.
• Migration costs: Determine the cost to migrate IT operations to the cloud or to switch
cloud providers. These costs should include labor and expenses to integrate and test
apps.
With hard numbers in hand, IT managers can compare the TCO of different cloud
architectures and scenarios. This way they can make a stronger case for the business
value of cloud adoption to the decision-makers in their organization.
[email protected]