Interview with Stony Grunow - cloud computing for charities

Last week Stony Grunow from Third Sector IT very kindly gave me a bit of his time to talk about cloud computing and how it could benefit voluntary and community organisations.

You can find out more about Stony and his work at http://thirdsectorit.org/.

Summary

• What is cloud computing?
• How could organisation use cloud computing software?
• What concerns do people have about using software on the cloud?
• What are the security issues?
• What are the next steps for organisations thinking of moving over to the cloud?
• What's the ideal kind of organisation for these solutions?

LB: So, what is this thing called 'cloud computing'?

SG: Cloud computing is both a marketing buzzword and a genuine movement that is the natural evolution of computing.

If I can use a few analogies, 20 or 30 years ago, if anybody had a computer in the office, they might very well have bought the parts and assembled the computer themselves, which was a reasonable thing to do - and it was often cheaper than buying it fully assembled. Nowadays most computers in your office are Dell or HP or similar, because it's much cheaper to let another company take care of assembling it together and providing a warranty. It’s so much cheaper that everybody gets their computers from a supplier, and then they install and customise software for their own business needs.

The next step in efficiency, at least for the servers, is to not only to have the servers assembled by another company, but to have the software on those servers installed and run and maintained and updated, so that the software itself is delivered as a service. That’s the meaning of the word 'SaaS' - it stands for ‘Software as a Service'.

If you use any kind of webmail, you've already used SaaS; if you've ever logged into your online bank account and done any transactions you've already used SaaS; all of these areas are good examples of SaaS.

SaaS is a subset of cloud computing and the easiest for small organisations to utilize. While there are a lot more ways to take advantage of cloud computing, most smaller organisations will start with SaaS. They're just going to want something that lets them get their job done faster, easier, cheaper and more reliably, and in that case the cloud computing products they're usually going to be thinking about will be SaaS.

Practically any organisation can use a SaaS solution, there are few organisations that won’t be able to. You can use any kind of computer for these services; you just log on, do your thing, and log off, there is no requirement for specialised hardware or software at your end.

LB: How do you think organisations can use these cloud or Saas tools?

SG: A lot of the things they traditionally use - email, calendaring, document sharing and even donor databases or other business processes - can be delivered as SaaS. In the same way that they log onto their bank account from any computer, all of a sudden they can now handle their email, their internal communications, their interactions with their beneficiaries or donors -- all that can be handled in the cloud.

There are two SaaS options I mainly focus on: Google Apps and Salesforce – although there are a lot out there.

Organisations tend to start off with a small number of free email accounts they get from their web hosting company, as they grow they can move to a Microsoft Exchange Server, which charities can get from CTX for close to free. But even though the software is free, they’ll still need a physical server, it's going to take a consultant to install and configure the software, it may need virus updates, it may need patches, it may need all sorts of things, and that's still your organisation's responsibility, and is most certainly not free. Five years ago, a growing organisation would have few choices besides MS Exchange for their email needs..

Now, another option is Google Apps. Charities can transition from having a server under their desk (with all the associated risk of theft, breakage, viruses, spilt coffee) to either Microsoft's hosted solution or Google's hosted solution. With either of those two options the capital costs / capital requirements are close to zero, the hardware requirements are close to zero, the knowledge of how to install and maintain these systems are close to zero, and the only cost organisations face is a knowledge requirement of how to interact with the service, and a low monthly fee. Their entire purchasing requirements, their entire knowledge requirements, their entire maintenance requirements are dramatically changed.

LB: What kinds of questions do people have when moving to these kinds of solutions?

SG: Their first questions are usually legality, security, and reliability.

People often ask where their data is being held, geographically. There are a lot of legitimate concerns and people wonder how they can utilize cloud computing and comply with the legal requirements of privacy laws and data laws.

One particularly concern is what happens when data is held in the US? A lot of people ask, "Will my data and my private information be exposed to US law enforcement agencies? What about the Patriot Act?" One thing they can and should check for is whether that US cloud provider complies with something called the Safe Harbor, which was worked out between the US government and the EU.

Safe Harbor is an agreement where US companies can comply with the EU Directive on the Protection of Personal Data. EU companies can now keep their data with these US companies, and still comply with both countries' laws. Both Google Apps and Salesforce are Safe Harbor companies, and they follow US/EU practices.

For reliability and security, there are two kinds of data reliability: one is that you have access to your data and always will; and the other one is that no-one outside of your organisation has access to it and never will.

In a traditional world, before cloud computing, your data might be on a laptop, and if that laptop was lost or stolen, all of a sudden you'd be in a situation where you no longer have your data, and the thieves or whoever found your laptop had access to it, which is the worst of all possible worlds. With cloud computing - presuming the data is kept on the cloud - that risk is suddenly reversed. If I lose my laptop, I have only lost the hardware, but as soon as I change my password the thieves no longer have access to my data, and I have never lost access to my data.

So you don't necessarily increase or reduce security, but you do completely change the security model - it's a little bit like the difference between flying and driving. Flying is statistically safer, but the pilot is in control instead of us, possibly producing anxiety. Driving is statistically less safe, but few people have high levels of anxiety behind the wheel of their own car because they are in control. Cloud computing security models are far more robust but, like flying, we have to relinquish control, and that produces understandable concern. 

LB: I guess some of the concerns that people have around security will be that, because it is accessible on the web, that other people could, without you knowing, be trying to get into that - is that a relevant concern?

SG: The security consideration, in terms of people trying to access your data, isn't much different whether you're using cloud computing or traditional computing. Even if you are utilizing traditional computing you're usually going to have some sort of risk, for instance, if people can work from home, then you have to make sure that connection is secure. If you're a group working with Chinese dissidents, your security concerns are going to be huge because the Chinese government may go after you; in that case everything is at risk, regardless of whether you use cloud or traditional computing. Whereas if you're in a fairly non-political charity it's very doubtful that there's going to be an orchestrated effort to get your data, but you should always be concerned about random hackers. Being a bit paranoid never hurts!

Again, you change security model: so in the traditional security model, there's a server, the server's usually under your desk, it's accessible by anybody who has keys to your office, which then includes all of your staff, your former staff if they ever made a copy of the key, your landlord, your cleaner, and anybody who used to be a tenant of that building before you moved in. So a lot of people have the ability to go into your office after hours. Even if your server's locked up it's not hard to kick in the door and literally copy over your entire hard drive, or just pick up the server and run with it. That risk exists in traditional computing, and much of the garden variety risk will simply be someone breaking into your office, and they will take your server because it's valuable and not because of the data on it.

With cloud computing you have no risk of anybody being able to break in; you instead have different online risk access. So I always suggest people change their question. Don't ask if cloud computing is secure, at least no more than you would ask if a car you're going to buy is secure. On a certain level no car, no computer model is going to be 100% secure; the question is, is the security you're going to get from this different car or different computer system going to be equal or better to what you already have, and is it going to be the best, or one of the best, options that you could afford? We'd all love a safer car and we'd all love a safer computer system, but nothing is perfectly safe, and perhaps *the* safest option isn't within our budget anyway. From where I stand, the question is not, "Is it secure or not?", the question is, "Is it more secure than what I have now? And is this the most secure option that will suit my needs and my budget?"

And in my experience cloud computing is usually far more secure. To give you can example, with Salesforce.com you can restrict the IP address and the time from which someone can access your data. You can secure your database so that people can't access it any time other than 9 to 5, Monday to Friday, and only from the IP address of your office. So even if someone breaks into your office, if it’s not during office hours they can't get your data. So you have a completely different security model. You’ll have to decide if its better or worse, but it's clearly different. Personally, I think it's far better, but all organisations should examine this and be satisfied themselves.

LB: So whether your information is based on the cloud or in your office, it’s vital you know how to create and protect secure passwords.

SG: In terms of the car analogy, let's say someone buys a very safe BMW, and someone [else] buys a very unsafe MG convertible, and then the owner of the BMW starts drinking & driving - it doesn't matter how much safer the BMW is, their chance of death is much greater than the MG. The same thing with businesses - even if you have a very secure system, if everyone is going to put their passwords on Post-It notes and leave them attached to their monitor in the office, then guess what?

Regardless of whether you are cloud or not, you are at greater risk from a disgruntled employee or other ‘mundane’ risks - the exotic risks are exciting, but not the most likely risk.

LB: If an organisation is thinking of moving some of their technology over to the cloud, what are the kind of discussions that need to happen within the management team?

SG: I think the biggest challenges that come from moving to the cloud are the same as if you move to any new IT platform; you're going to have so many of the same challenges.

If you don't have the management team on board with a clear vision of where they want to go, if you don't have the employees desiring a better system and willing to learn, you're going to have a disaster whether you're trying a cloud- or a non-cloud-based system. Many of questions apply across the board.

So I think the questions people should start with are, "Do we have a need? Can we improve things? Do we want to improve things? And if we do want to improve things what's the best solution?"  I think cloud-based solutions should be on the shortlist, but they won't always be the right answer.

The challenges of moving to any new system are going to be similar: there's going to be retraining, there's going to be a brief loss of functionality as everyone has to relearn everything, and there's going to be some time and effort and financial cost involved. Your goal is that after the (hopefully short) transition period, you reach the point where you say, “Ah! Now we can accomplish much more than with the old system!” If you don't get that gain, or you don't think you'll get that gain, it's not always wise to make the change; but the decision process isn’t that much of a difference between cloud and non-cloud.

With a cloud-computing system you are slightly more dependent on the internet, but not by much - if the internet goes down in a traditional office there's still mayhem.

One thing everybody should be aware of is that there are ways to reduce the risk of losing connection to the Internet in your office. It's getting more affordable to have two internet providers and have them connect through the same router (called a Dual-WAN router). If one internet connection goes down you won’t be affected. Regardless of whether you are cloud or not, I recommend two internet lines to any businesses that rely on a connection to the internet.

LB: If you move your whole office solutions to the cloud does it have much effect on the bandwidth? Do organisations need to think about how much they're getting and whether that needs increasing?

SG: The bandwidth requirements for SaaS is no different than your staff browsing an online newspaper or checking the latest sports scores - the use is minimal. Some people find their bandwidth demands are even less with SaaS. That said, you will appreciate web pages loading quickly, so if it currently takes forever for a web page to come up, upgrading your connection won’t hurt.

LB: How easy is it for different SaaS products to talk to each other?

SG: You have the same limitations that you do with most IT products talking to each other. It works to an extent but it's rarely perfect.

If you have, say, Salesforce and Google Apps it's incredibly easy to send emails from within Salesforce through your Google account, so in that regard the interoperability is great. However, both products have a calendar, and because they record different things different ways the synchronisation isn’t seamless.

So whenever you go for different systems you always have that question mark, but there's no difference than, say, using two traditional systems, you're still going to have the same issue. On the plus side, syncing with cloud computing is sometimes easier because the data is already out of your office, as there's no location issues anymore. But if it always worked perfectly than IT staff wouldn't have jobs!

LB: What about brand? Can you move to cloud-based email and keep your email addresses? Would anyone from the outside know that anything has changed?

In the old days of your free Hotmail account you always had the little advertisement at the bottom - "Please use Hotmail!"  That’s not the case with modern business SaaS solutions. When moving to Google Apps your email is presented as presented and delivered as it ever was, with the same email address and domain name that you already have, and in fact you have some additional advantages: you can have those very long, boring legal disclaimers on the bottom of emails, automatically inserted and standardised across your organisation; you can have attractive footers in your email with your organisation’s logo; and you can use internal branding so your employees see your logo in the SaaS application rather than the provider’s.

LB: What is the ideal kind of organisation to use Saas?

The ideal candidate is an organisation that has fairly minimal or lightweight IT solutions already. If you're a smallish organisation that has email accounts from your web host and your donor management system is a bunch of spreadsheets, then moving to the cloud is a powerful proposition because the gains are immediate, the up front cost is minimal and the improvement will be clear.

Another particularly good candidate is organisations with multiple offices or staff working from home where the staff out of the office have a reduced functionality in what they can do. If you need people to be working from home, if you need volunteers from all over the country or the world to be effective, if you have two different offices, or if you have staff in the field then you may particularly benefit from a cloud-based solution.

If your IT staff have all their time consumed by managing your IT systems, or even worse your regular staff are spending all their time dealing with IT issues, moving to cloud computing can provide a massive and immediate benefit.

These are a few examples of the organisations particularly suited to SaaS.

I think larger organisations can also gain tremendously, but because of their size and existing systems and platforms, they need to take more time evaluating.

Furthermore, when you consider these solutions I usually don't recommend a complete abandonment of your existing software solutions.

With Google Apps many of your colleagues will prefer Gmail's web interface to access their email. If you have a staff member who's less comfortable with new technology, or prefers Outlook, it's no problem, they can continue to access email via Outlook while the rest of the staff uses the web interface.

If you're using Google Docs it's going to have different functionality to MS Office, so if you find something is missing than keep on using Microsoft Word or Microsoft Excel for certain things, and then use Google's document collaboration suite for other tasks.

Rarely do organisations completely abandon non-cloud systems. It's usually an act of adding on new functionality, it's like going from just a car to a car and a Barclay's bike (for those of you in London). The gains from cloud computing are powerful, but in areas where they don’t meet your needs you can still keep using traditional computing solutions.

I personally use Apple's Keynote for presentations, I use Microsoft Word occasionally, and I use Google Docs, all on the same computer, for different aspects of my business. So even though I’m a complete cloud enthusiast I'm very comfortable using whatever meets my needs and whatever I think will give me the most functionality.