Five preconditions and tools for gaining greater control over your multi-cloud ecosystem

Report on minor class, 29 March 2022

The need for a faster time-to-market to facilitate a customer-oriented approach requires a strong ‘SaaS-isation’ of the application landscape, which is often spread across several cloud environments: the multi-cloud. The result is a fractured and vast IT environment: a digital ecosystem in which several suppliers must work together. This then involves collaboration models such as DevOps, which entail extra challenges. It requires a great deal of openness and willingness to cooperate on the part of the suppliers, but at the same time responsibilities need to be clearly delineated. How do you orchestrate all of this? How do you determine the responsibilities? How do you safeguard security & compliance? And most of all: how do you maintain control?

These are the questions that were answered during the online minor class ‘Greater control over your multi-cloud ecosystem’ held by the Digital Ecosystems Institute (DEI) in collaboration with managed IT services provider, Solvinity. In an interactive session, business and IT directors, managers and others in positions of responsibility from a range of organisations discussed how to gain greater control over your digital ecosystem with guest speaker Klaas Heek, Solutions Architect at Solvinity.

According to the DEI, the control is in the hands of one of the parties that takes on the role of Orchestrator. As Solvinity defines it, the customer is always in control. To support the customer, Solvinity can act as a Service Integrator and take on responsibility for the management of, and collaboration with, other IT suppliers. To illustrate how to keep a growing multi-cloud under control and get the most out of it, Klaas outlined five preconditions that are required to ensure the success of your multi-cloud ecosystem. The powerful points and examples presented by Klaas led to a lively discussion. He also elaborated on the tools that can play a supporting role.

"Both the customer and the service provider must be willing to be open with one another, even during difficult and uncertain times."

1. Mission-driven collaboration t samenwerken

Though IT service providers may be used to working in a task-driven manner, now they must transition to mission-driven collaboration, in which they focus on the customer’s mission. By adopting this mission, you can provide a better service. A consequence of this is a shift from the more traditional KPI-driven SLAs to collaboration agreements. Solvinity uses the Shared Operating Model (see figure 1) to understand the mission of the customer. By working together to flesh out this model, you gain a strong foundation for mission-driven collaboration with relevant agreements.

2. Transparency

In a collaboration model, soft factors such as trust and transparency, are vital. This new world is appealing but it requires more from service providers than traditional SLAs and KPIs. Soft factors and ‘hard’ requirements coexist. And while the multi-cloud becomes ever more complex, the need for alternative ways to respond to unexpected events is growing. Both the customer and the service provider must be willing to be open with one another, even during difficult and uncertain times. What’s great about an ecosystem is that both parties provide both input and output and therefore share the ultimate responsibility.

"The trick is to strike a balance without resorting to a detailed elaboration of agreements that results in rigid KPIs."

3. Demarcation

This shared responsibility leads us to the next precondition: demarcation. In an increasingly complex IT landscape, there is more confusion as to who is responsible for which services and agreements. Ambiguous agreements can potentially threaten a collaboration between a customer and an IT partner, or between the IT partners themselves. This example of a Shared Responsibility Matrix (see figure 2) shows how the demarcation lines extend across the boundaries of the services of the individual partners.

This model can be incredibly helpful in getting you started. When working with this model, the trick is to strike a balance without resorting to a detailed elaboration of agreements that results in rigid KPIs.

4. Data-driven Security & Operations (SecOps)

The recently discovered Log4j vulnerability is a good example of how exposed you are as an organisation in the current complex and strongly interwoven IT landscape when your data management is not in order. Nobody realised just how many components contained that tiny piece of Log4j code, but all of a sudden that vulnerability was revealed. The response to it also left much to be desired.

If you know where each software is located in your digital ecosystem, you can manage your vulnerabilities more effectively. According to Klaas, the solution to this can be found in data-driven security operations, as when organisations share data, they are able to more quickly respond to similar incidents. To facilitate this, processes must also be data-driven. This requires tools that, for instance, support digital asset management and lifecycle management across different clouds.

"Standardisation is essential to this: it increases the availability in the various clouds and makes compliance simpler."

5. Safeguarding security & compliance

How do you safeguard security and privacy if your data is scattered across a multi-cloud landscape? Standardisation is essential to this: it increases the availability in the various clouds and makes compliance simpler. Third parties are responding to this need by safeguarding compliance on a technical level in their security tools. For example, Microsoft Cloud Defender integrates various technical compliancy controls. In addition, having your own multi-cloud control centre, a kind of landing zone from which you provide security and management services, is beneficial. This allows you to provide the individual service providers with more insight into the service.

Conclusion

In summary, there are five preconditions and corresponding tools for gaining greater control over your multi-cloud ecosystem:

Mission-driven collaboration > Collaboration agreement
Greater transparency > Shared Operating Model
Clear demarcation > Shared Responsibility Matrix
More data-driven SecOps > Digital Asset Management & Lifecycle Management
Multi-cloud Security & Compliance > Multi-Cloud Control Centre

A poll of the participants revealed that Mission-Driven Collaboration is the most important precondition for them, with 55% of the votes. This was followed by Demarcation with 25% of the votes, whereas 15% favoured guaranteeing Security & Compliance. This provides a good indication of where our focus should lie in the future.

Would you like to learn more about this topic or would you like to consult with Klaas Heek about the issues affecting your organisation? If so, please feel free to contact us.