With more than twenty-thousand employees in over twenty countries, Altran Group has tended towards centralising IT functions — deploying and supporting a reduced number of enterprise applications across all countries. A desire to capitalise on this centralisation is a big part of what got Group CIO Francois Charpe thinking about cloud computing. Through cloud computing, software upgrades would be transparent, high availability would be taken care of be somebody else, and a number of other benefits could be achieved, all without increasing spending.

The first question was: where to start? Since the company specialises in high-tech engineering consulting, and since they have a mobile workforce with a dependency on internal communication, email is one of their most critical systems. So email is what Charpe chose to put on the cloud first.

In 2012 Altran went to the market for cloud-based email, but Charpe was surprised at what he saw. “I found out that the offerings weren’t very mature,” he says. “They were very much standard; I would say they were consumer grade. Enterprise customers need solutions that are tailored to their specific needs.”

After shopping around, Altran decided to go with Google Apps.

Although Google Apps worked fine technically, Charpe ran into trouble making the service fit into Altran’s environment. “For example,” says the CIO, “our users were attached to Outlook, but the combination of Google Apps and Outlook wasn’t satisfactory. We also found integrating Google Apps with BlackBerry to be a long and complicated process.”

Less than a year after taking their first big step towards the cloud, Charpe went back to the drawing board. (Carefully reviewing what they’ve done is not too unusual, as Altran frequently rethinks their information systems.) This time around, among other goals, Charpe was looking to achieve better predictability on costs.

Looking for a lower-level service, Altran put out a request for proposals (RFP) for Infrastructure-as-a-Service (IaaS) offerings; and after evaluating several proposals, they wound up going with Amazon Web Services (AWS).

Charpe says that, to ensure compliance with EU regulation, one key criteria in their selection of cloud providers was that the data be stored in Europe. As AWS operates its services, and stores data, in Ireland, this criteria was easily met.

Beyond the issue of compliance with EU regulation, Altran’s choice of AWS is not surprising. According to research firm Gartner, “[AWS] is the overwhelming market share leader, with more than five times the cloud IaaS compute capacity in use than the aggregate total of the other 14 providers [in their category].”

With IaaS in place, Altran was able to go back to using Exchange email on top of the cloud infrastructure.

In switching vendors, and in reconsidering what kinds of cloud service was best for them, Altran did what a lot of other companies are doing — they shopped around. As Metta Ahorlu, research director at IDC European Services, observes, "Loyalty among customers is going down, we see vendor switch rates increasing."

Not quite plug and play

It’s a buyers market, but buyers need to do their homework — both before subscribing, and after. Regardless of the provider you choose, it would be a mistake to think that after you pay for the cloud service, you can put your feet up on the desk and let somebody else manage your IT.

Charpe says, “When you put applications on the cloud, you have to rethink your infrastructure. Identification and authentication, data back up, and high availability all have to be reconsidered. You also have to make sure you have the right connections between the different infrastructures.”

The first architecture Altran implemented didn’t work so well with their ERP system, so they had to go back to square one. “Thanks to the flexibility of AWS, we were able to redo our configuration without penalising the project,” Charpe says. “The changes took effect immediately, and we didn’t have to pay anything extra. What’s more, even though infrastructure provisioning is typically time consuming, we made our changes with no schedule impact.”

In contrast to Altran, some organisations prefer not to have to do any tinkering themselves. If you fall into this category, be sure to make the difference between cloud offerings from a managed services provider and true cloud offerings. Gartner warns that cloud offerings from managed services providers only have basic IaaS capabilities. The research firm steers companies towards what they consider a better solution: adopting a best-in-class IaaS offering, and then finding a managed services provider to manage it.

Cloud security

According to John Rhoton, author of several books on cloud computing, many companies go overboard and wind up analysing security in a way that does more harm than good. Rhoton says, “Less mature customers who don’t have as good an understanding of cloud computing tend to vastly underestimate the security of cloud service providers; and they greatly overestimate the security they themselves implement.”

Rhoton says there are several strategies to ensure security when putting data in the cloud. The first is to be selective: to not put any data on the cloud that’s too sensitive.

Beyond this basic approach is a second option, which is to encrypt any data you put into the cloud. If you feel the need to encrypt data before having it stored with your provider, you’ll also want to make sure the provider doesn’t have access to any of the keys.

Rhoton says, “That’s a pretty big challenge, because it means you have to manage all the encryption keys. If several people need to access the data, you need a way for them to use the same keys.”

“It also means a lot of the provider functionality won’t be available. Say you were using something like Salesforce, and you have customer data in there. If you encrypt the data before you put it into the cloud, then salesforce won’t be able to run any reports. If you’ve encrypted all the addresses, you can’t ask for a report to get a list of all the accounts in Paris, for example, because Salesforce can’t read the addresses.”

A variation on this second strategy is to anonymise the data, rather than encrypt it. But replacing data with other data that hides identity comes down to the same thing as encryption, because you need to run the information through an algorithm before putting it on the cloud, and when taking it off. The same problems arise: you need to share the algorithm with people who need it, and the service provider can’t run meaningful reports on the data.

The third strategy — the one the more mature customers are adopting, and the approach Rhoton thinks is the wisest — is to do a proper due diligence on the provider and make sure the provider has good controls in place. “Do some research on whether they’ve had incidents where data has escaped and how they’ve handled those cases,” says Rhoton.

“Look at who the customers are,” Rhoton says. “If you look at customers of Salesforce - Amazon, HP, and Symantec, all of whom are specialists in security and cloud computing - you notice that none of them have any problems entrusting Salesforce with sensitive data. That’s because they know that Salesforce is taking all the necessary precautions.”

“Just the fact that the data is in the public cloud doesn’t mean it’s any less secure,” Rhoton points out. “I’d argue that if those customers who are real big, and who are themselves specialists in security and cloud computing, feel that the service is secure, then it probably is.”

Freedom to focus on what’s important and to work anywhere

One organisation that has bought into cloud computing in a variety of ways is the Financial Times. FT CIO Christina Scott says they use a number of cloud services for business applications, such as gmail and Google docs. They have also developed several business applications on the force.com platform, including procurement, vendor management, and holiday booking.

FT uses Salesforce for CRM; and their new Data Warehouse is on Amazon Redshift. According to Scott, “With the Amazon Redshift migration we have seen substantial cost reduction and performance benefits from our old outsourced data warehouse solution.”

Scott sees cloud computing as a way of freeing up technology teams to focus on things that are more important to the business. She also sees cloud computing as a way of freeing people to work remotely. “The experience of working from the office, home, an airport – or wherever – has become standardised,” she says.

Scott believes the future is in cloud computing, and she reckons the paradigm will bring more benefits, such as real time data integration and the ability to really deliver on the big data promises in a cost effective way — and in a way that’s managed by somebody else.”

The CIO of Financial Times is not the only one who sees a big future in cloud computing. Gartner does too. The research firm predicts, “By 2015, 50% of all new application independent software vendors will be pure SaaS providers.”