wk 3

1594884 - Pearson Education Limited ©

w domain name will be routed to the affiliated IP address.

Note two important points: First, several (or many) domain names can point to the same IP address. Second, the affiliation of domain names with IP addresses is dynamic. The owner of the domain name can change the affiliated IP addresses at its discretion.

In 2014, the U.S. Department of Commerce announced it was giving up oversight over ICANN. Critics worry that less-free countries will now try to force ICANN to disallow domain names for dissident groups, thereby kicking them off the Internet. At this point, it’s still unclear how ICANN will be governed.

Figure 6-8 GoDaddy Screenshot

Source: © 2015 GoDaddy Operating Company, LLC. All rights reserved.

1594884 - Pearson Education Limited ©

Before we leave addressing, you need to know one more term. A URL (Uniform Resource Locator) is an address on the Internet. Commonly, it consists of a protocol (such as http:// or ftp://) followed by a domain name or public IP address. A URL is actually quite a bit more complicated than this description, but that detailed knowledge is beyond the scope of this text, so we’ll hurry along. The preferred pronunciation of URL is to say the letters U, R, L.

Processing on a Web Server

At this point, you know basic networking terms and have a high-level view of how the Internet works. To understand the value of the cloud, and how it works and how your organization can use it, you need to know a bit about the processing that occurs on a Web server. For this discussion, we will use the example of a Web storefront, which is a server on the Web from which you can buy products.

Suppose you want to buy an item from zulily, a private buyer’s site that sells clothing. To do so, you go to www.zulily.com and navigate to the product(s) you want to buy (see Figure 6-9 ). When you find something you want, you add it to your shopping cart and keep shopping. At some point, you check out by supplying credit card data. But what happens when your order data arrives at the server?

Three-Tier Architecture Almost all Web applications use the three-tier architecture , which is a design of user computers and servers that consists of three categories, or tiers, as shown in Figure 6-10 . The user tier consists of computers, phones, and other mobile devices that have browsers that request and

1594884 - Pearson Education Limited ©

process Web pages. The server tier consists of computers that run Web servers and process application programs. The database tier consists of computers that run a DBMS that processes requests to retrieve and store data. Figure 6-10 shows only one computer at the database tier. Some sites have multicomputer database tiers as well.

Figure 6-9 Sample of Commerce Server Pages; Product Offer Pages

Source: Courtesy of Zuilly Inc. Used by permission.

1594884 - Pearson Education Limited ©

Figure 6-10 Three-Tier Architecture

Notes:

Information is shown exchanged between Web Browsers and Web Server through html via http.

Information is exchanged between Web Server and Commerce Server Application and Other Applications.

Instructions and Data is exchanged between DBMS and Commerce Server Application and Other Applications.

Information is exchanged between DBMS and DB.

When you enter www.zulily.com in your browser, the browser sends a request that travels over the Internet to a computer in the server tier at the zulily site. In response to your request, a server-tier computer sends back a Web page , which is a document coded in, usually, html (and, as discussed in Chapter 4 , probably includes CSS, JavaScript, and other data).

1594884 - Pearson Education Limited ©

Web servers are programs that run on a server-tier computer and manage traffic by sending and receiving Web pages to and from clients. A commerce server is an application program that runs on a server-tier computer. Typical commerce server functions are to obtain product data from a database, manage the items in a shopping cart, and coordinate the checkout process. When a request comes to the server, the Web server examines it and sends it to the proper program for processing. Thus, the Web server passes e-commerce traffic to the commerce server. It passes requests for other applications to those applications. In Figure 6-10 , the server-tier computers are running a Web server program, a commerce server application, and other applications having an unspecified purpose.

Watch the Three Tiers in Action! Suppose the user of the Web page in Figure 6-9 clicks on shoes and then selects a particular shoe, say, the Darkish Gray Dorine Mary Jane shoe. When the user clicks on that shoe, the commerce server requests that shoe’s data from the DBMS, which reads it from the database and then returns the data (including pictures) to the commerce server. That server then formats the Web page with the data and sends the html version of that page to the user’s computer. The result is the page shown in Figure 6- 11 .

Service-Oriented Architecture (SOA)

The cloud would be impossible without a design philosophy called the service-oriented architecture (SOA) . According to this philosophy, all interactions among computing devices are defined as services in a formal, standardized way. This philosophy enables all the pieces of the cloud to fit together, as you will see. However, understanding SOA (pronounced SO-ah)

1594884 - Pearson Education Limited ©

in depth requires you to learn more computer science than you need as a business professional. So, the best way for you to understand SOA is via a business analogy.

A SOA Analogy Figure 6-12 shows an arrangement of departments at a hypothetical online bicycle part retailer named Best Bikes. The Sales Department receives order requests and follows a process to have them approved for shipping. On request, the Credit Department verifies customer credit as needed to approve orders, and the Inventory Department verifies the availability of the inventory needed to fulfill an order.

Figure 6-11 Product Page

1594884 - Pearson Education Limited ©

Source: Courtesy of Zuilly Inc. Used by permission

In an informal, non-SOA-type organization, one salesperson would contact someone he or she knows in Credit and ask something like, “Can you approve an allocation of $10,000 of credit to the ABC Bicycle Company?” In response, the credit person might say, “Sure,” and the salesperson might note the name of the person who approved the amount. Some days, he or she might remember to record the date; other days, not so. Another salesperson might do something else, say, contact a different person in Credit and ask something like, “I need $5,000 in credit for Order 12345,” and that other person in Credit might say, “I don’t know, send the order over,

1594884 - Pearson Education Limited ©

and if I can, I’ll write ‘Approved’ on it.” Other irregular, but similar, interactions could occur between the Sales and the Inventory departments.

Figure 6-12 Approval Request Interactions Among Three Departments

Such operations are definitely not service-oriented. People are asking for credit verification in different ways and receiving responses in different ways. The process for approving an order varies from salesperson to salesperson, and possibly from day to day with the same salesperson. The records of approvals are inconsistent. Such an organization will have varying levels of process quality and inconsistent results, and should the company decide to open a facility in another city, these operations cannot be readily duplicated, nor should they be.

Using SOA principles, each department would formally define the services it provides. Examples are:

1594884 - Pearson Education Limited ©

For the Credit Department:

CheckCustomerCredit ApproveCustomerCredit

For the Inventory Department

VerifyInventoryAmount AllocateInventory ReleaseAllocatedInventory

Further, for each service, each department would formally state the data it expects to receive with the request and the data it promises to return in response. Every interaction is done exactly the same way. There is no personal contact between certain people in the departments; no salesperson need know who works in Credit or Inventory. Instead, requests are emailed to a generic email address in Credit or Inventory, and those departments decide who will process the request and how it will be processed. No department has or need have any knowledge of who works in another department nor how the department accomplishes its work. Each department is free to change personnel task assignments and to change the way it performs its services, and no other department needs to know that a change occurred. In SOA terms, we would say the work of the department is encapsulated in the department.

With this organization, if Best Bikes wants to add another Inventory Department in another city, it can do so and no salesperson need change the way he or she sets up, submits, or receives responses to requests. Sales continues to send a VerifyInventoryAmount service request, formatted in the standard way, to the same email address.

1594884 - Pearson Education Limited ©

With multiple sites, the Inventory function would change the way it implements service requests to first identify which of the several Inventory Departments should process the request. Sales would not know, nor need to know, this happened. Best Bikes could dynamically create 1,000 Inventory Departments and the Sales Department need not change anything it does. Later, it could reduce those 1,000 Inventory Departments to three, and, again, sales need not make any change.

SOA for Three-Tier Architecture From this discussion, you can see how SOA is used to enable cloud processing. The description and advantages and disadvantages of this analogy for SOA are the same for the cloud. Consider Figure 6-13 , which shows the three-tier architecture with SOA drawn in. In this case, the commerce server application formally defines services that browsers can request, the data they must provide with the request, and the data that each will receive in response to the request. Sample services are:

ObtainPartData ObtainPartImages ObtainPartQuantityOnHand OrderPart

And so forth. Again, each service also documents the data it expects and the data it will return.

Now, JavaScript (or another code language) is written to invoke these services correctly. That JavaScript is included as part of the Web pages the server sends to the browsers, and when users employ the browsers to purchase, the JavaScript behind the Web page invokes the services in the correct way.

1594884 - Pearson Education Limited ©

Figure 6-13 SOA Principles Applied to Three-Tier Architecture

The server tier can consist of three servers at 3 AM, 3,000 servers at 11 AM, 6,000 servers at 6 PM, and 100 servers at 10 PM. Furthermore, those servers can move around the world; at one time of day, they can be all located in the United States, and at another time of day, they can all be located in Europe, and so on. Nothing, absolutely nothing, in the browsers need change as these servers are adjusted.

To take advantage of the multiple Web servers, a load-balancing program receives requests and sends them to an available server. The load- balancing program keeps data about the speed and health of all its assigned Web servers and allocates work to maximize throughput.

In addition, on the back end, SOA services are defined between the Web server and the database server. Accordingly, the database server need do nothing as the number and location of Web servers is adjusted. And that’s a

1594884 - Pearson Education Limited ©

two-way street. Nothing in the Web servers need be changed if the number and location of database servers is adjusted. However, load balancing for database servers is considerably more complicated.

Do not infer from this discussion that SOA services and the cloud are only used for three-tier processing. Such services and the cloud are used for multitudes of applications across the Internet. This three-tier application is just an example.

From this discussion, you can understand how cloud elasticity is possible. However, for many organizations to use the cloud and to be able to mix and match Web services, they need to agree on standard ways of formatting and processing service requests and data. That leads us to cloud standards and protocols. Again, we discuss these at a very high level.

Protocols Supporting Web Services

A protocol is a set of rules and data structures for organizing communication. Because the cloud’s Web services use the Internet, the protocols that run the Internet also support cloud processing. We will start with them.

TCP/IP Protocol Architecture The basic plumbing of the Internet is governed by protocols that are defined according to an arrangement called the TCP/IP protocol architecture . This architecture has five layers; one or more protocols are defined at each layer. Data communications and software vendors write computer programs that implement the rules of a particular protocol. (For

1594884 - Pearson Education Limited ©

protocols at the bottom layer, the physical layer, they build hardware devices that implement the protocol.)

Figure 6-14 Protocols That Support Web Services

Internet Protocols: http, https, smtp, and ftp The only Internet protocols that you as a business professional are likely to encounter are those at the top, or the application layer of the TCP/IP architecture, shown in Figure 6-14 . Hypertext Transfer Protocol (http) is the protocol used between browsers and Web servers. When you use a browser such as Microsoft Edge, Safari, or Chrome, you are using a program that implements the http protocol. At the other end, at the New Zealand hotel mentioned earlier, for example, there is a server that also processes http. Even though your browser and the server at the hotel have never “met” before, they can communicate with one another because they both follow the rules of http. Similarly, in Figure 6-13 , the browsers send and receive service requests to and from the commerce server using http.

1594884 - Pearson Education Limited ©

As you will learn in Chapter 10 , there is a secure version of http called https . Whenever you see https in your browser’s address bar, you have a secure transmission and you can safely send sensitive data like credit card numbers. When you are on the Internet, if you do not see https, then you should assume that all of your communication is open and could be published on the front page of your campus newspaper tomorrow morning. Hence, when you are using http, email, text messaging, chat, videoconferencing, or anything other than https, know that whatever you are typing or saying could be known by anyone else.

Two additional TCP/IP application-layer protocols are common. smtp, or Simple Mail Transfer Protocol , is used for email transmissions (along with other protocols). ftp, or File Transfer Protocol , is used to move files over the Internet. Google Drive and Microsoft OneDrive use ftp behind the scenes to transmit files to and from their cloud servers to your computer.

WSDL, SOAP, XML, and JSON To wrap up the discussion, we will briefly consider four standards used extensively for Web services and the cloud. Those standards and their purpose are as follows:

WSDL (Web Services Description Language)

A standard for describing the services, inputs and outputs, and other data supported by a Web service. Documents coded according to this standard are machine readable and can be used by developer tools for creating programs to access the service.

SOAP (no longer an acronym)

A protocol for requesting Web services and for sending responses to Web service requests.

1594884 - Pearson Education Limited ©

XML (eXtensible Markup Language)

A markup language used for transmitting documents. Contains much metadata that can be used to validate the format and completeness of the document, but includes considerable overhead (see Figure 6-15a ).

JSON (JavaScript Object Notation)

A markup language used for transmitting documents. Contains little metadata and is preferred for transmitting volumes of data between servers and browsers. While the notation is the format of JavaScript objects, JSON documents can be processed by any language (see Figure 6-15b ).

Figure 6-15a Example XML Document

Figure 6-15b Example JSON Document

1594884 - Pearson Education Limited ©

Service authors (computer programmers) create WSDL documents to describe the services they provide and the inputs and outputs required. These WSDL documents are seldom read by humans. Instead, developer tools like Microsoft Visual Studio read the WSDL to configure the

1594884 - Pearson Education Limited ©

programming environment for programmers who write code to access that service.

As shown in Figure 6-14 , SOAP, which is not an acronym though it looks like one, is a protocol that sits on top of http and the lower-level Internet protocols. Sits on top of means that it uses http to send and receive SOAP messages. (SOAP can also use smtp.) Programs that use Web services issue SOAP messages to request services; the Web service uses SOAP messages to return responses to service requests.

Finally, XML and JSON are ways of marking up documents so that both the service requestor and the service provider know what data they’re processing.Figure 6-15 shows a simple example of both. As you can see, XML documents contain as much metadata as they do application data. These metadata are used to ensure that the document is complete and properly formatted. XML is used when relatively few messages are being transmitted and when ensuring a complete and correct document is crucial. Both WSDLs and SOAP messages are coded in XML.

As its name indicates, JSON uses the notation for JavaScript objects to format data. It has much less metadata and is preferred for the transmission of voluminous application data. Web servers use JSON as their primary way of sending application data to browsers.

With this technical background, you should no longer be skeptical that the benefits of the cloud are real. They are. However, this fact does not mean that every organization uses the cloud well. In the remainder of this chapter, we will describe generic ways that organizations can use the cloud, discuss how Falcon Security in particular can use the cloud, and, finally, discuss an exceedingly important topic: cloud security.

1594884 - Pearson Education Limited ©

1594884 - Pearson Education Limited ©

Q6-4 How Do Organizations Use the Cloud? Organizations can use the cloud in several different ways. The first, and by far most popular, is to obtain cloud services from cloud service vendors.

Cloud Services from Cloud Vendors

In general, cloud-based service offerings can be organized into the three categories shown in Figure 6-16 . An organization that provides software as a service (SaaS) provides not only hardware infrastructure, but an operating system and application programs as well. For example, Salesforce.com provides hardware and programs for customer and sales tracking as a service. Similarly, Google provides Google Drive and Microsoft provides OneDrive as a service. With Office 365, Exchange, Skype for Business, and SharePoint applications are provided as a service “in the cloud.”

You’ve probably heard of, or used, Apple’s iCloud. It’s a cloud service that Apple uses to sync all of its customers’ iOS devices. As of 2015, Apple provides 10 free applications in the iCloud. Calendar is a good example. When a customer enters an appointment in her iPhone, Apple automatically pushes that appointment into the calendars on all of that customer’s iOS

1594884 - Pearson Education Limited ©

devices. Further, customers can share calendars with others that will be synchronized as well. Mail, pictures, applications, and other resources are also synched via iCloud.

An organization can move to SaaS simply by signing up and learning how to use it. In Apple’s case, there’s nothing to learn. To quote the late Steve Jobs, “It just works.”

The second category of cloud hosting is platform as a service (PaaS) , whereby vendors provide hosted computers, an operating system, and possibly a DBMS. Microsoft Windows Azure, for example, provides servers installed with Windows Server. Customers of Windows Azure then add their own applications on top of the hosted platform. Microsoft SQL Azure provides a host with Windows Server and SQL Server. Oracle On Demand provides a hosted server with Oracle Database. Again, for PaaS, organizations add their own applications to the host. Amazon EC2 provides servers with Windows Server or Linux installed.

The most basic cloud offering is infrastructure as a service (IaaS) , which is the cloud hosting of a bare server computer or data storage. Rackspace provides hardware for customers to load whatever operating system they want, and Amazon.com licenses S3 (Simple Storage Service), which provides unlimited, reliable data storage in the cloud.

Figure 6-16 Three Fundamental Cloud Types

1594884 - Pearson Education Limited ©

Figure 6-17 Benefits of Content Delivery Networks

Content Delivery Networks

1594884 - Pearson Education Limited ©

A second major use of the cloud is to deliver content from servers placed around the world. A content delivery network (CDN) is a system of hardware and software that stores user data in many different geographical locations and makes those data available on demand. A CDN provides a specialized type of PaaS but is usually considered in its own category, as it is here.

Consider CDN applications: A news organization could use a CDN to store copies of its news articles. The CDN vendor replicates articles on servers, possibly worldwide, so as to speed response time. When a news reader accesses an article, the request is transmitted to a routing server that determines which CDN server is likely to deliver the article to the user the fastest. Because traffic changes rapidly, especially for popular sites, such calculations are made in real time. A request for content at one moment in time could be served by a computer in, say, San Diego, and a few moments later, that same request from that same user might be served by a computer in Salt Lake City.

In addition to news articles, CDNs are often used to store and deliver content that seldom changes. For example, the company banner on an organization’s Web page might be stored on many CDN servers. Various pieces of the Web page could be obtained from different servers on the CDN; all such decisions are made in real time to provide the fastest content delivery possible.

Figure 6-17 summarizes CDN benefits. The first two are self-explanatory. Reliability is increased because data are stored on many servers. If one server fails, any of a potentially large number of other servers can deliver the content. You will learn about denial-of-service (DOS) attacks in Chapter 10 . For now, just understand that such security threats send so much data to a given server that the server’s performance for legitimate traffic

1594884 - Pearson Education Limited ©

becomes unacceptable. By having multiple servers, CDNs help to protect against such attacks.

In some cases, CDNs reduce access costs for mobile users (those who do have a limited data account). By delivering the data faster, site connection charges can be reduced. Finally, many (but not all) CDN services are offered on a flexible, pay-as-you-go basis. Customers need not contract for fixed services and payments; they pay only for what they use, when they use it. Figure 6-18 shows an example of how CDN servers might be distributed. A number of vendors offer CDN.

Figure 6-18 Servers Used in a Typical CDN Service

Figure 6-19 Web Services Principles Applied to Inventory Applications

1594884 - Pearson Education Limited ©

Using Web Services Internally

The third way that organizations can use cloud technology is to build internal information systems using Web services. Strictly speaking, this is not using the cloud because it does not provide elasticity nor the advantages of pooled resources. It does advantageously use cloud standards, however, so we include it here.

Figure 6-19 shows a Web services inventory application at a hypothetical online bicycle part retailer named Best Bikes. In this example, Best Bikes is running its own servers on its own infrastructure. To do so, Best Bikes sets up a private internet within the company, an internet that is generally not reachable from outside the company. Best Bikes writes the applications for processing inventory using Web services standards; applications publish a WSDL; the Web services are accessed by other applications within the company using SOAP; and data are delivered using

1594884 - Pearson Education Limited ©

JSON. Application users access the inventory Web services using JavaScript that is sent down to the users’ browsers.

Users of the inventory Web services include Sales, Shipping, Customer Service, Accounting, and other departments. Internal applications can use the inventory Web services like building blocks. They can use the services that they need—and no more. Because the Web services are encapsulated, the inventory system can be altered without affecting other applications. In this way, systems development is more flexible, and it will be faster and hence less costly.

As stated, however, this is not a cloud. In this example, Best Bikes has a fixed number of servers; no attempt is made to make them elastic. Also, the servers are dedicated to inventory. During idle periods, they are not dynamically reused for other purposes. Some organizations remove this limit by creating a private cloud, as discussed in Q6-6.

1594884 - Pearson Education Limited ©

Q6-5 How Can Falcon Security Use the Cloud? Falcon Security is an innovative startup company with a small IT department. As such, it is unlikely to have the resources necessary to develop a large server infrastructure. Instead, it is far more likely to take advantage of cloud services provided by cloud vendors.

SaaS Services at Falcon Security

Software as a service requires little investment in the hardware and software system components. The SaaS vendor administers and manages the cloud servers and makes the software available, usually as a thin-client. Falcon will, however, need to transfer existing data, create new data, develop procedures, and train users.

Some of the SaaS products that Falcon could use are:

Google Mail Google Drive Office 365 Salesforce.com Microsoft CRM OnLine

1594884 - Pearson Education Limited ©

And many others …

You already know what the first three SaaS offerings are. Salesforce.com and Microsoft’s CRM OnLine are customer relationship management systems, which you will learn about in Chapter 7 .

PaaS Services at Falcon Security

With PaaS, Falcon leases hardware and operating systems in the cloud from the cloud vendor. For example, it can lease EC2 (Elastic Cloud 2, a PaaS product offered by Amazon.com), and Amazon.com will preinstall either Linux or Windows Server on the cloud hardware. Given that basic capability, Falcon would then install its own software. For example, it could install its own, in-house developed applications, or it could install other applications licensed from a software vendor. It could also license a DBMS, say, SQL Server from Microsoft, and place it on an EC2 Windows Server instance. In the case of software licensed from others, Falcon must purchase licenses that permit replication because Amazon.com will replicate it when it increases servers.

Some cloud vendors include DBMS products in their PaaS services. Thus, Falcon could obtain Windows Servers with SQL Server already installed from the Microsoft Azure cloud offerings. That option is likely what Toshio was considering when he mentioned the $10 per TB per month.

DBMS are also included in other vendors’ cloud offerings. As of May 2015 Amazon.com offers the following DBMS products with EC2:

Amazon Relational Database Service (RDS)

A relational database service supporting MySQL, Oracle, SQL Server, or PostgreSQL

1594884 - Pearson Education Limited ©

Amazon DynamoDB A fast and scalable NoSQL database service

MongoDB A NoSQL DBMS product that stores objects in JSON format

Amazon ElastiCache An very fast in-memory cache database service

Amazon Redshift A petabyte-scale data warehouse

Finally, Falcon might use a CDN to distribute its content worldwide and to respond to leads generated from advertising as described in Q6-1.

IaaS Services at Falcon Security

As stated, IaaS provides basic hardware in the cloud. Some companies acquire servers this way and then load operating systems onto them. Doing so requires considerable technical expertise and management, and hence a company like Falcon is unlikely to do so.

Falcon might, however, obtain data storage services in the cloud. Amazon.com, for example, offers data storage with its S3 product. Using it, organizations can place data in the cloud and even have that data be made elastically available. Again, however, an organization like Falcon would more likely use SaaS and PaaS because of the added value they provide.

1594884 - Pearson Education Limited ©

Q6-6 How Can Organizations Use Cloud Services Securely? The Internet and cloud services based on Internet infrastructure provide powerful processing and storage services at a fraction of the cost of private data centers. However, the Internet is a jungle of threats to data and computing infrastructure, as discussed in Chapter 10 . How can organizations realize the benefits of cloud technology without succumbing to those threats?

The answer involves a combination of technologies that we will address, at a very high level, in this question. As you read, realize that no security story is ever over; attackers constantly strive to find ways around security safeguards, and occasionally they succeed. Thus, you can expect that cloud security will evolve beyond that described here throughout your career. We begin with a discussion of VPNs, a technology used to provide secure communication over the Internet.

Virtual Private Networks (VPNs)

A virtual private network (VPN) uses the Internet to create the appearance of private, secure connections. In the IT world, the term virtual means something that appears to exist but in fact does not. Here, a VPN

1594884 - Pearson Education Limited ©

uses the public Internet to create the appearance of a private connection on a secure network.

A Typical VPN Figure 6-20 shows one way to create a VPN to connect a remote computer, perhaps an employee working at a hotel in Miami, to a LAN at a Chicago site. The remote user is the VPN client. That client first establishes a public connection to the Internet. The connection can be obtained by accessing a local ISP, as shown in Figure 6-20 , or, in some cases, the hotel itself provides a direct Internet connection.

In either case, once the Internet connection is made, VPN software on the remote user’s computer establishes a connection with the VPN server in Chicago. The VPN client and VPN server then have a secure connection. That connection, called a tunnel , is a virtual, private pathway over a public or shared network from the VPN client to the VPN server. Figure 6- 21 illustrates the connection as it appears to the remote user.

Figure 6-20 Remote Access Using VPN; Actual Connections

To secure VPN communications over the public Internet, the VPN client software encrypts, or codes (see Chapter 10 , page 383), messages so

1594884 - Pearson Education Limited ©

their contents are protected from snooping. Then the VPN client appends the Internet address of the VPN server to the message and sends that package over the Internet to the VPN server. When the VPN server receives the message, it strips its address off the front of the message, decrypts the coded message, and sends the plain text message to the original address inside the LAN. In this way, secure private messages are delivered over the public Internet.

Figure 6-21 Remote Access Using VPN; Apparent Connection

Using a Private Cloud

A private cloud is a cloud owned and operated by an organization for its own benefit. To create a private cloud, the organization creates a private internet and designs applications using Web services standards just as shown in Figure 6-19 (page 227). The organization then creates a farm of servers and manages those servers with elastic load balancing just as the cloud service vendors do. Because of the complexity of managing multiple database servers, most organizations choose not to replicate database servers. Figure 6-22 illustrates this possibility.

1594884 - Pearson Education Limited ©

Figure 6-22 Private Cloud for Inventory and Other Applications

Private clouds provide security within the organizational infrastructure but do not provide secure access from outside that infrastructure. To provide such access, organizations set up a VPN and users employ it to securely access the private cloud as shown in Figure 6-23 .

Private clouds provide the advantages of elasticity, but to questionable benefit. What can organizations do with their idle servers? They could realize some cost savings by shutting down the idle servers. But unlike the cloud vendors, they cannot repurpose them for use by other companies. Possibly a large conglomerate or major international company could balance processing loads across subsidiary business units and across different geographical regions. 3M, for example, might balance processing for its different product groups and on different continents, but it is difficult

1594884 - Pearson Education Limited ©

to imagine that, in doing so, it would save money or time. A company like Falcon Security is very unlikely to develop a private cloud.

Figure 6-23 Accessing Private Cloud over a Virtual Private Network

Microsoft, Amazon.com, Oracle, IBM, and other major cloud service vendors employ thousands of highly trained, very highly skilled personnel to create, manage, administer, and improve their cloud services. It is unimaginable that any noncloud company, even large ones like 3M, could build and operate a cloud service facility that competes. The only situation in which this might make sense is if the organization is required by law or business custom to maintain physical control over its stored data. Even in that case, however, the organization is unlikely to be required to maintain physical control over all data, so it might keep critically sensitive data on- premises and place the rest of the data and related applications into the facilities of a public cloud vendor. It might also use a virtual private cloud, which we consider next.

1594884 - Pearson Education Limited ©

Using a Virtual Private Cloud

A virtual private cloud (VPC) is a subset of a public cloud that has highly restricted, secure access. An organization can build its own VPC on top of public cloud infrastructure like AWS or that provided by other cloud vendors. The means by which this is done are beyond the scope of this text, but think of it as VPN tunneling on steroids.

Using a VPC, an organization can store its most sensitive data on its own infrastructure and store the less sensitive data on the VPC. In this way, organizations that are required to have physical control over some of their data can place that data on their own servers and locate the rest of their data on the VPC as shown in Figure 6-24 . By doing so, the organization gains the advantages of cloud storage and possibly cloud processing for that portion of its data that it need not physically control.

In some cases, organizations have obtained permission from regulating bodies to store even their very sensitive data on a VPC. For example, Case Study 6 (pages 243–244) discusses FinQloud, a VPC set up and managed by NASDAQ OMX, the owner of the NASDAQ and other financial exchanges.

Figure 6-24 Using a Virtual Private Cloud (VPC)

1594884 - Pearson Education Limited ©

1594884 - Pearson Education Limited ©

1594884 - Pearson Education Limited ©

Q6-7 2026? So where does the cloud go in the next 10 years? Absent some unknown factor such as a federal tax on Internet traffic, cloud services will become faster, more secure, easier to use, and cheaper. Fewer and fewer organizations will set up their own computing infrastructure; instead, they will benefit from the pooling of servers across organizations and from the economies of scale produced by cloud vendors.

But, looking a bit deeper, the cloud brings both good and bad news. The good news is that organizations can readily obtain elastic resources at very low cost. This trend will benefit everyone from individuals on the iCloud or Google Drive, to small groups using Office 365, to companies like Falcon Security using PaaS, to huge organizations like NASDAQ OMX (Case Study 6 ) using IaaS.

The overall size of the cloud is getting bigger too. For example, Google’s Project Loon looks to seed the atmosphere with high-altitude balloons capable of providing Internet access to previously unreachable parts of the planet. And Google isn’t stopping there. It’s also making the cloud faster. Google Fiber aims to offer users 1 Gbps connections to the Internet. That’s 100 times faster than the average broadband connection. Comcast responded to Google’s plans by announcing its own gigabit-per-second service.

1594884 - Pearson Education Limited ©

So what’s the bad news? Remember that 500,000-square-foot Apple Web farm in Figure 6-2 ? Note the size of the parking lot. That tiny lot accommodates the entire operations staff. According to Computerworld, that building employs an operations staff of 50 people, which, spread over three shifts, 24/7, means that not many more than eight people will be running that center at any one time. Seems impossible, but is it? Again, look at the size of the parking lot.

And it’s not just large companies like