Cloud computing offers business potentially huge cost savings and productivity gains, but security concerns are preventing many organisations tapping in to these benefits.
However, an international London-based communications agency, Imagination, has found a way to avoid the pitfalls, save money, boost productivity and even improve information security.
The firm has begun a roll-out of web-based collaboration tools under the leadership of Matt Ballantine, head of IT at Imagination.
He estimates that the project has saved £420,000 in software licensing and additional staff costs over three years.
The firm has also saved £12,000 in air-conditioning replacement costs for a server room that is being de-commissioned at its London offices.
Productivity boost
But the biggest gains, says Ballantine, have been in terms of increased productivity because of better collaboration between staff and clients across 14 locations in nine countries.
Just two months into the roll-out, with Google Apps software-as-a-service for e-mail, calendar, contacts, tasks and groups deployed, 60% of about one-third of the staff who have been polled so far say it is easier to work with colleagues and clients, particularly those in other parts of the world.
The business is leading the project, which is crucial, says Ballantine. "IT's role is as facilitator, rather than setting the direction and objectives of the project," he said.
A team was drawn from across the business at the start of the project nine months ago and was involved in the selection process.
"Security was a central part of that evaluation process, and for that reason we choose the Google platform as it's ahead of its competitors on that score," said Ballantine.
Cost control
All Google's hosting infrastructure is delivered under SAS 70 accreditation, which is something Imagination could not have afforded to do on its own, he said.
It was vital for the business to provide staff and clients as a way of collaborating that could be accessed from anywhere, but that ensured control over information.
"If organisations do not provide the tools people need to do their work, they will simply go to the internet and find their own ways of doing things outside an approved, controlled environment," said Ballantine.
"This is the risk of not having cloud-based services within an organisation," he said, "because information is becoming like water - it will find a way out, so it is best to provide routes that are managed rather than trying to block all the leaks."
Google Apps was also an easy choice because, unlike many other businesses, Imagination does not deal with sensitive personal information. "For us, personal data protection regulations were not an issue," said Ballantine.
But the company does handle information on behalf of some clients, such as new product information, that is commercially sensitive. In these situations, Imagination has had to provide more secure communication channels.
This is handled on a case-by-case basis, usually driven by the clients, who typically do not want information sent using e-mail, cloud-based or otherwise, as these channels are inherently insecure, said Ballantine.
To reduce the likelihood of anyone exposing the company to risk in this regard, however, Imagination has a rigorous set of security policies and procedures.
Developing clear guidelines on how to identify and handle sensitive information was an important element of the Google project from the start, Ballantine said. "It is important that all staff know exactly what is expected of them legally and contractually, and have all the support they need to make sensible decisions."
The involvement of people across the business was important because by helping to define problems they own the process rather than it being something imposed on them by the legal or IT department, said Ballantine.
Although more expensive, the more secure channels using VPN technologies are necessary only in a limited number of cases.
For the bulk of communication and collaboration, Google Apps is ideal, said Ballantine, and provides a fast, resilient, ubiquitous service that would be impossible for Imagination to provide with in-house resources. "Google provides a stable and secure infrastructure that is being managed and hosted by people who know what they are doing," he said.
User involvement
From a user point of view, business involvement was essential, said Ballantine, to ensure everyone understands what the tools within Google Apps offer and how the tools can enable them to work more effectively.
Now that the collaboration applications have had time to bed in, Imagination is pilotingGoogle Docs and Google Sites with four groups in the business.
Ballantine believes a phased approach to introducing cloud-based services to an organisation is best. Past experience in other organisations, he said, has shown that where new tools are simply given to the business and the business is left to get on with it, chaos results.
"We are looking at a business change approach by helping teams in the business to set down a clear plan of action for how they are going to use the tools according to best practice and company policy," he said.
Ballantine also plans to put in specific guidelines for granting permissions for accessing documents and controls to ensure Imagination has a route for audit and to ensure it has control over the information being generated.
"With SAS 70 we know there are solid processes around the management of the hosting environment, but it is up to us to implement best practice and policy around the management of the information so people understand how best to share that information," he said.
The idea of documents living only within the cloud, from a security point of view, said Ballantine, is more compelling than the old way of doing things because it enables complete control over who has access to documents and the ability to change them.
Managing the project
Imagination has shown that cloud computing does indeed enable cost savings and improved productivity, and can even improve security rather than increasing risk, but it is not something that can simply be switched on overnight, replace every system or meet every need within the business.
Experience dictates that this should be approached as a business change project that is led by the business and backed up with the policies, procedures and training end-users require to understand what the tools can do and how best to use them.
First published on www.computerweekly.com on 30/06/2010