June 26, 2015 - Irish Centre for Cloud Computing and Commerce

Cloud Monitoring: Insight and Recommendations for Choosing Efficient Monitoring Tool

Cloud Monitoring: Insight and Recommendations for Choosing Efficient Monitoring Tool - Dr. Vincent Emeakaroha
Irish Centre for Cloud Computing and Commerce IC4, Dept. of Computer Science, University College Cork

In recent times, the topic of cloud computing has received considerable attention from both industry and academia. The continued focus of academic research in the area, couple with an ever increasing range of service offerings from public cloud service providers, such as AWS and Rackspace, serves as proof that enterprises and consumers have recognised the benefits and value in consuming cloud-based services.

Recent Cloud market research indicates that spending on public Cloud services has reached $47.4 billion in 2013 and is expected to be more than $107 billion in 2017. Over the 2013–2017 forecast period, public Cloud services will have a compound annual growth rate (CAGR) of 23.5%, five times that of the industry overall. By 2017, it is expected that public IT Cloud services will drive 17% of the IT product spending and nearly half of all growth across five technology categories: Infrastructure as a Service (IaaS), Platform as a Service (PaaS), Software as a Service (SaaS), Data centres and Basic services. SaaS including applications will remain the largest public Cloud services category, capturing 59.7% of revenues in 2017.

An essential factor enabling the management of Clouds, in the face of its large-scale resource capacity, is monitoring. Powerful and convenient monitoring tools are indispensible for the management and usage of Cloud services. Cloud monitoring plays a central role in different aspects of Cloud service provisioning.

Usage Areas

Cloud monitoring is beneficial to both providers and consumers. The new style of provisioning services in Clouds allows consumers to pay only for the services used and frees them from the management overhead of the underlying infrastructure. This enables low initial set-up cost for business owners. In spite of the pricing advantage, consumers tend to be sceptical about the quality of service offered. They require insight into their service operations. Providers on the other hand have the responsibility of maintaining the underlying infrastructure and provisioning services that meet the terms of the service level agreements (SLAs) they have with their customers. They require visibility to achieve these SLAs and monitoring provides this. In the following areas, we elaborate on the role of monitoring.

Service / Resource Provisioning: This activity involves the optimal allocation of resources to match workload demand, which is essential to achieve elasticity. Cloud computing promises on-demand resource provisioning based on consumer/workload requirements. The ability to measure the overall resource consumption, along with the ability to measure per service consumption (i.e., the amount of resources each individual service consumes), is essential for effective provisioning decisions. Monitoring enables these required capabilities.

Service Level Agreement (SLA) Management: SLA represents a contract signed between a provider and a customer stipulating the terms of a service and the penalties in cases of violations. Demonstrating compliance with customer SLA terms is crucial for a provider in order to build credibility and to attract more customers. To achieve this, they require deep insight into the Cloud resource utilisations and service application behaviours. On the other hand consumers need independent verification of their SLA terms. Monitoring enables these requirements.

Accounting and Billing: The notion of providing computing as a utility service in Clouds relies heavily on the ability to meter consumer usage information for billing. Accurate accounting and billing should reflect the correct amount of Cloud resources consumed by services (e.g. compute hour used, bandwidth used). Monitoring facilitates this ability.

Security Management: The risk of compromising security and privacy is one of the major hindrances against the adoption of Cloud services, especially, in the case of business critical applications with sensitive data. The capability of detecting security breaches or attacks is necessary to secure such application provisioning. Monitoring is necessary to achieve this goal.

There are many other areas where monitoring plays major roles, such as capacity planning, configuration management, etc. Cloud monitoring is a key enabler of Cloud computing success. Without monitoring, Cloud provisioning would be unmanageable.

Quality Features

Currently, there are many monitoring tools in existence. They can be classified as open source, commercial third party and provider owned tools. To choose a monitoring tool has become extremely challenging for users due to their similarity and lack of overview. Based on our recent monitoring research and new developments in Cloud provisioning, the following features are recommended to distinguish a monitoring tool.

Scalability: With the large-scale nature of Clouds consisting of thousands of nodes. The monitoring of such environment requires monitoring tools that are capable of scaling along side with the resources. This is necessary in order to deliver the monitored information in a timely and flexible manner. A modern monitoring tool should provide this capability.

Non-intrusiveness: Since there are large numbers of resources to be monitored in Clouds, the computational power consumed by a monitoring tool to carry out this activity can impact the performance of the overall system. An efficient monitoring tool should be non-intrusive. That is, it should consume as little resource capacity as possible on the monitored systems.

Interoperability: Cloud environments may include dozens of independent, heterogeneous data centres operating mostly as stand-alone resources. Many business analysts have predicted the need for interoperable federated Clouds to achieve economic advantages by providers and consumers. The management of such federation demands sophisticated monitoring to share information between heterogeneous Cloud Platforms. A good monitoring tool should be capable of supporting this objective. Cloud federation is gaining attention and will definitely contribute enormously to the future of Cloud computing.

Multi-tenancy: Cloud service provisioning includes multi-tenant offers where multiple tenants share the same physical resources and application instances. This strategy tends to increase resource utilisation and drive down cost. However, its management is complex. A good monitoring tool should be capable of concurrently monitoring isolated tenants and presenting their monitored information separately.

Extensibility: As Cloud computing is still evolving; there are continuous changes and extensions to this technology especially in the area of management. Since monitoring techniques are fundamental to Cloud management, a good monitoring tools should be extensible in order to adapt to new demands.

Any Cloud monitoring tool that is not capable of providing these features is not posed to address the requirements of today and future Cloud management.

Business Benefits of Monitoring

Providers/consumers who use the right solution for monitoring Cloud resources and applications are more likely to realise these benefits:

Prevention and resolution of performance issues in a timely manner: Providers who have an insight into Cloud resource utilization are more likely to make informed and timely decisions about resource allocation, and therefore, to prevent performance problems before they impact their business users. The consumers using monitoring gains substantial information about their service, for example, to hold provider responsible in case of poor service performance.
Ability to facilitate changes in business demand. Providers who have end-to-end visibility into the performance of their Cloud services and internal infrastructures are able to make better decisions about adding or subtracting resources to support changes in business demand, This then allows them to ensure a high level of quality of end-user experience at optimal cost.

There are many other benefits of Cloud monitoring besides these two.

Summary

Establishing and maintaining control of Cloud environments has proven beneficial to both service providers and consumers. Providers need real time information about their Cloud environment to make informed management and business decisions. Consumers on the other hand need access to information that verifies the performance of their services. Monitoring plays the central role in providing this information. It is indispensible for the management and usage of Cloud services.

Recently, the number of monitoring tool has increased due to the recognition of its importance in the Cloud market. This increase has consequently made it challenging for users to make particular choice. We propose that the choice of a Cloud monitoring tool must be based on its ability to support the management of current and future Cloud service provisioning strategies.

Software Defined Security: Automated security in the cloud

Software Defined Security: Automated security in the cloud - Dr. Abir Awad

Current generation cloud infrastructure is complex and heterogeneous in nature and its management often requires frequent human intervention. The dynamic scaling nature, rapid virtual machine deployment, and open multi-tenant architectures of the cloud also amplify the associated security issues. This creates an environment, in which local misconfiguration can create subtle security risks for the entire infrastructure and it drives the need for automation and orchestration of cloud security controls. Software-defined security (SDSec) is a new approach to improving security within next-generation cloud environments. It delivers network security enforcement with software instead of traditional physical security controls, inherently simplifying the world of network security. Abstraction, automation and orchestration are not the only benefits of software-defined security, eliminating the dependencies on hardware also means that security can be deployed in tandem with the changing levels of virtualized cloud infrastructure.

SDSec is a similar technology of Software Defined Network (SDN) insofar that the security control plane is separated from the security processing and forwarding planes. This concept has attracted the attention of many organisations and several solutions have been recently proposed for security automation in both commercial and academic domains. The following are examples of commercially available products:

CheckPoint solution: is software defined protection that partitions the security infrastructure into three interconnected layers; enforcement, control and management layers. These work together to deal with threat prevention, access control and data protection.

Intel security controller: enables automated and dynamic security provisioning policy synchronisation protection and remediation for software defined infrastructure built on VMware NSX. It has virtual antivirus, IPS, sandboxing, firewall, web filtering and data loss prevention.

CloudPassage Halo: allows host intrusion detection (file integrity monitoring, configuration security monitoring and log-based intrusion detection), network authentication and management for firewall configurations.

Catbird: is a software-defined security system for virtual infrastructure. It allows protection of private clouds and virtual Data Centers, and is available for both VMware and OpenStack.

Many researchers also consider SDSec as a promising solution and this has been the subject of some European-funded projects (e.g. https://www.secured-fp7.eu/ which is studying the architecture of a security gateway). Other researchers have developed an open-source SDN Controller (SE-Floodlight) which is an implementation of an SDN security policy enforcing mediation service in an OpenFlow stack. A working group called “Software Defined Perimeter Working Group” has also been launched by the Cloud Security Alliance (CSA) in December 2013 to create a security model to stop all forms of network attacks including DDoS, Man-in-the-Middle, etc. using the same idea of separating control plane and data plane.

This is achieved by an approach deploying perimeters preserving the invisibility and inaccessibility to “outsiders,” and combining device authentication, identity-based access and dynamically provisioned connectivity.As one can guess, when applied to the cloud, this calls for automated deployment as well as analysis mechanisms, which in turn requires a cloud assurance policy language to express security goals for such environments. Where possible, configuration changes should be statically checked against the policy prior to implementation on the infrastructure. While many policy-driven security management systems exist, not many, however, tackle the requirements of a virtualized infrastructure. This is an open research opportunity since virtualization technology is becoming increasingly common in datacentres.

Software-Defined Security is one of the most promising approaches for the development of a cloud security solution, which can run without the traditional physical security middle-boxes. It can identify malicious traffic, infected hosts or network intruders and it isolates them through quarantine or redirection to a honeypot. The security abstraction, together with the unification of the security and policy definitions as well as their enforcement (even in dynamic and virtualised environments), independently from the underlying hardware and communication platform, are the main advantages of Software-Defined Security.SDSec is also a part of the Software-defined datacentre (SDDC), which is an extension of the virtualization concepts of abstracting, pooling, and automating all of the datacentre’s resources and services. Here, all the elements of the infrastructure i.e. networking, storage, security etc., are virtualised and delivered as a service. Software Defined security is, however, still a marketing term and is at an early stage of development.

Despite much current investment to automate the different security controls in the cloud, an intelligent, security solution, that automatically protects and mitigates the threats is still only an aspiration. Such a solution is a goal worth striving for, bearing in mind that the worldwide SDN market and all related applications for the enterprise and cloud service providers is expected to grow from $960 million in 2014 to over $8 billion by 2018 ( here ).

Container Technology and its Relevance for the PaaS Cloud

Container Technology and its Relevance for the PaaS Cloud - Dr. Claus Pahl

Abstract— Containerisation is widely discussed as a lightweight virtualisation solution. Apart from exhibiting benefits over traditional virtual machines in the cloud, containers are especially relevant for Platform-as-a-Service (PaaS) clouds to manage and orchestrate applications through containers as an application packaging mechanism. We discuss the requirements that arise from having to facilitate applications through distributed multi-cloud platforms.

The cloud relies on virtualisation techniques to achieve elasticity of large-scale shared resources. Virtual machines (VMs) have been the backbone at the infrastructure layer providing virtualised operating systems. Containers are a similar, more lightweight virtualisation concept, i.e., less resource and time consuming. They have been suggested as a solution for more interoperable application packaging in the cloud. VMs and containers are both virtualisation techniques, but solve different problems. The difference is that containers are tools for delivering software – i.e., there is a PaaS (Platform-as-a-Service) focus – in a portable way aiming at more interoperability [1] while still utilising operating systems (OS) virtualisation principles.VMs on the other hand are about hardware allocation and management (machines that can be turned on/off and be provisioned) – i.e., there is an IaaS (Infrastructure-as-a-Service) focus on hardware virtualisation. Containers as a replacement for VMs are only a specific use case where the allocation of hardware resources is done through containers by componentising workloads in-between clouds. For portable, interoperable applications in the cloud, we need a lightweight distribution of packaged applications for deployment and management [2]. A solution is containerisation.The basic ideas of containerisation are
- a lightweight portable runtime,
- the capability to develop, test and deploy applications to a large number of servers and
- the capability to interconnect containers.
Bernstein [3] already proposes containers to address concerns
at the cloud PaaS level. They also relate to the IaaS level through sharing and isolation aspects.This article reviews the virtualisation principles behind containers, in particular in comparison with virtual machines. The relevance of the new container technology for PaaS cloud shall be specifically investigated.

As applications are distributed today, the resulting requirements for application packaging and interoperable orchestration over clusters of containers are also discussed. We aim to clarify how containers can change the PaaS cloud as a virtualisation technique, specifically PaaS as a platform technology. We go beyond [3], addressing what is needed to evolve PaaS significantly further as a distributed cloud softwareplatform resulting in a discussion of achievements and limitations of the state-of-the-art. To illustrate concepts, some sample technologies will be discussed if they exemplify technology trends well.

Member Musings: Cloud Adoption for Organizations with traditional IT

Cloud Adoption for Organizations with traditional IT. Is there a good starting point?
John Power
Founder & C.E.O. of Ostia Solutions

Organizations such as Amazon and SalesForce were ‘born in the Cloud’ and do not have the same concerns as organizations with traditional, on premise IT systems. Having grown around the Cloud they do not have the issues that confront traditional IT when dealing with the Cloud. While many traditional organizations are dabbling with the Cloud by using it for applications like Email and CRM, there are few who have managed to use Cloud to augment their core business IT processing and there are no public examples of where they have migrated their on premise systems to the Cloud. This article explores why this is the case by paring it down to the fundamental issue and proposes how traditional IT can start to gain the real benefits available in the Cloud.

What is different about Cloud?
There are many views of what is different about the Cloud, however, Cloud is in reality an evolution of what has been there before. There are also some myths which we will try to dispel here:

Massive virtualization of hardware capability: large organizations have been doing this on IBM Mainframe systems since the early 1980s.
Unlimited scalability of systems: this certainly has evolved; however, earlier systems had the capacity to be massively scalable, but this came at a cost.
The ability to stand up environments very quickly: this capability has also been available for some time but again, at a cost.

So what is different?

Cost and charging models: Pay as you use (OpEx) compared with large up-front payments (CapEx).
Self Service: non-technical people can manage the creation of Cloud instances.
Practically unlimited scalability: a cost effective ability to handle unpredictable loads as demanded by today’s mobile and internet driven world.

From the differences above, it would seem to be a ‘no brainer’; everyone should be racing to the Cloud, right? Well there is one further difference which is the key to Cloud adoption by traditional IT environments: location of and access to their data.

Location of the Infrastructure
So why is this a major issue? Consider that organizations have spent the last 50 years and literally billions of dollars burying their data in silos behind firewalls so that only internally authorised employees could see the data. This was done for good reason to protect the data from unauthorised access and, more a phenomenon of today than the past, to avoid massive data leakage. There is growing regulations mandating what organizations can do with this data leading to massive fines if organizations are in breach of these regulations.

Today these organizations host their data in their own data centres or in facilities managed on their behalf by other large organizations. In all cases, there are key characteristics to this arrangement; the organization…

knows where their data is ‘at rest’ at all times and can sign off any audit confident of this fact.
knows that they have backup and disaster recovery procedures in place that have been developed and matured over many years. Again, this is a fact that can be confidently signed off in any audit.
knows that their data is protected from external networks by multiple layers of security, in many cases including physical disconnect of these systems from the Internet thus ensuring complete confidence that a data breach cannot happen at least via the public Internet.

So consider the alternative of putting this data on a public Cloud:
Despite efforts by a large number of companies, it is still not always clear where the data will reside. This is changing fast with many companies offering to guarantee location of data but there is still a fundamental distrust. How does one sign off on an audit in this case?
The Cloud offers massive potential for disaster recovery and speedy reinstatement of systems, however, these services still need to be developed to the maturity levels that are available to on premise installations.

Finally the public Cloud is just that, it’s connected to the Internet and opens up massive potential for a data breach. Looking at this logically, the data centres that host these Cloud environments offer some of the most secure installations in the world. Coupled to that they have the most up to date security and monitoring processes installed which are likely to be light years ahead of what any on premise installation offers. However, the perception of a threat is still there and will only dissipate with time and as organizations get to understand the real benefits of Cloud offerings.

So how can traditional organizations make use of the Cloud for their traditional core IT without risk of compromising their core principles? The answer is around the testing of their applications.

Application Testing and Service/API Virtualization
Organizations are producing more and more applications to support the increasing numbers of market channels. These applications still in some way connect to back office systems and thus are putting massive pressure on the organization to make back office test systems available which accurately mirror the behaviour of production systems. This is costly in terms of hardware, software licenses and management. Offshore testing presents another problem, as connectivity cannot always be provided to the usual test systems due to data regulations. The solution is often expensive masking projects to enable offshore testing access. Then when systems are finally delivered, a huge amount of time is wasted on-shore to ensure the systems work together.

The key to all of this is to ensure the back office systems are accessed using well define IT Services or APIs. These APIs offer access to newer, external, customer facing applications reusing existing capabilities of the core IT systems that have been built up over time and are reliable. These APIs are stable as they are linked to the core IT systems which change infrequently and the key that offers a solution to this problem.
Using a technique called Service or API Virtualization; it is possible to mimic the behaviour of these Services or APIs, such that newer applications can call the mimicked versions of these APIs which can run on commodity hardware and software boxes. To all intents and purposes the application under test believes and acts as if it is talking to the real Service so full testing of the application under test can take place in isolation of the real systems.

The second part to this puzzle is that not only can the API be virtualized, but the data supporting the API can be synthetic. What this means is that it is valid data is returned by the API but that data has been generated based on the signature of the Service and thus bears no relationship to the real data residing on the on premise systems.

Service and data virtualization offers the following features:

Creates exact copies of back office, on premise Services/APIs.
No connectivity required to back office systems.
Uses valid but synthetic data for Services/APIs.
No data from on premise systems is used.
In that that no connectivity is needed to the back office systems and that no data is used from those systems, we have removed the blocks to an ideal use of the Cloud by traditional IT organizations.
Service/API Virtualization in the Cloud
Service/API and Data Virtualization in the Cloud offers the following benefits:
Enables test environments to be stood up in minutes.
Use of as many test environments as required.
Avoid interference between testing groups.
Improves the performance of agile projects by enabling the creation of test Services/APIs that have not yet been developed or completed.
Avoids all data governance issues.
Perfect for offshore or offsite development or testing.
Avoids load on expensive back office or external systems.
Creates a fixed and controllable cost of testing.
Organizations can benefit in many ways through the use of service virtualization to reduce risk and improve the efficiency and effectiveness of the development and testing process. This is achieved by an ability to stand up multiple testing environments in minutes while reducing the load on back office systems.

Service Virtualisation is a proven technology that provides significant benefits for organizations that adopt, implement and use it. This adoption is fast becoming main stream and is approaching critical mass. There are a number of suppliers of this type of technology including Ostia, CA, IBM, HP and Parasoft.

Daily Archives: June 26, 2015