Security Experts:

Taking Hybrid IT from Accident to Strategy

Most enterprises have an accidental Hybrid IT reality, rather than a strategy. As various groups and geographies within enterprise organizations procure their own cloud services independently of the IT organization, conflict emerges between the use of traditional computing infrastructure and cloud options. As this situation grows, it exposes inefficiencies and risks that demand a more strategic approach.

How did we get here?

The potential for Hybrid IT was created by two flavors of cloud computing – SaaS and IaaS.

While Concur is often cited as the first SaaS offering, Salesforce deserves credit for normalizing the SaaS model in the minds of enterprise buyers whose initial concerns over security and performance were sidelined by business demands for its capabilities. 

IaaS became mainstream when Amazon Web Services launched on March 14, 2006. It armed developers with direct access to infrastructure and an ability to bypass the IT operations provisioning bottleneck. This, combined with Agile development practices, unlocked the potential for DevOps, which emerged in 2009.

Hybrid IT

Web scale companies took full advantage with a cloud-first (or cloud-only) policy, but around 2014, enterprise developers took notice. When enough stories emerged of companies like Netflix out-innovating Blockbuster (leading to the latter’s demise), it tends to draw attention. 

As cloud has crept into the enterprise, it has displaced some, but not all of the traditional computing environment. In many cases, IT organizations cannot abandon legacy investments without introducing unacceptable risk and cost. Thus, we have this uneasy aggregation of cloud and traditional computing, referred to as Hybrid IT by Gartner in a blog post dating back to 2012.

Why the status quo must change

The impact of running cloud and traditional services in parallel in the enterprise is most painfully felt within application development teams and IT operations. As long as cloud and traditional services operate independently, there is a division that increases management complexity and reduces the agility of the organization, impacting the overall competitive posture of the business.

From an application development perspective:

● The deployment pipelines across multiple cloud and legacy services are highly segregated. Where services are redundant, the enterprise misses out on potential volume discounting and efficiency gains.

● Cloud-based services often need access to rigid legacy systems. This dependency creates a flexibility mismatch that reduces the speed and agility benefits of cloud computing.

 

Segregation worked for a while when DevOps initiatives were small-scale experiments using cloud-provided tools. But as DevOps scales out across the enterprise, deployments will slow to a crawl if IT operations cannot abstract the provisioning differences and dependencies between the various computing platforms that make up Hybrid IT.

From the perspective of IT operations and security, there are several challenges:

● Management is divided in silos defined by computing platform, requiring multiple teams and tools. This increases complexity, costs and errors while slowing operations and frustrating users.

● Services delivered on legacy platforms are often unable to elastically respond to peaks or decline in demand, in the same way that cloud services can.

●  IT operations models based on manual management of changes and configurations cannot scale to the pace demanded by the business. As process is bypassed, potential security policy and compliance violations emerge.

IT operations and security teams are experiencing a lack of control introduced by cloud services, which might be fine by the purveyors of “NoOps,” but enterprises have standards for availability and regulations that cannot be ignored without severe consequences. As the use of cloud services accelerates in the enterprise, we can expect these challenges to grow.

Getting to a strategic approach to Hybrid IT

A strategic approach to Hybrid IT means enabling the choice of environment for a workload to be made entirely based on what is best for the business. This is true both for newly developed applications and those that have run faithfully for decades.

This doesn’t automatically mean that public cloud services will always be selected.

For example, there are some services provided by enterprise IT organizations that run in a mainframe or distributed environment that are practically bulletproof. Re-architecting and deploying those services to the public cloud would mean taking on significant cost and risk to availability that may not be in the best interest of the business. So those workloads need to remain where they are for the foreseeable future.

But there are also workloads running in a data center that is at capacity, or for business reasons needs to be shut down. Migrating those workloads to the cloud, or replacing them with SaaS could support the agility needs of the business.

There are serious challenges to enabling true hybrid choice, covering mainframe, distributed, virtual, private and public cloud environments. Managing the complexity and dynamic nature of these very different platforms that were never meant to work well together requires operational and security management that is nimble enough to keep pace, which was difficult enough when all the computing resources ran under the authority of IT operations. With cloud services, operations and security teams will have to evolve their approach.

The focus of this column is to help organizations approach Hybrid IT in a way that enables it to become a strategic differentiator for their business. Stay tuned for future articles that will provide examples, best practices, and analysis of enterprises that are succeeding in evolving their approach to Hybrid IT management.

view counter
Travis Greene, Identity Solutions Strategist at Micro Focus, possesses a blend of IT operations and security experience, process design, organizational leadership and technical skills. After a 10-year career as a US Naval Officer, he started in IT as a Data Center Manager for a hosting company. In early 2002, Travis joined a Managed Service Provider as the leader of the service level and continuous improvement team. Today, Travis conducts research with NetIQ customers, industry analysts, and partners to understand current Identity and Access Management challenges, with a focus on provisioning, governance and user activity monitoring solutions. Travis is Expert Certified in ITIL and holds a BS in Computer Science from the US Naval Academy.