Thoughts on prepping for the migration to the cloud
As I was thinking about my week and the conversations I had with clients and colleagues, a few things struck me and I thought I would put them out there to see how a larger community would react to them.
First, most moves that I’ve seen from enterprises to the clouds have been « lift and shift » in nature.
Application transformation takes time and efforts and often enough the business decision to move to the cloud establishes a schedule that does not allow the necessary time to do it. Thus the « lift and shift » approach.
To make things « simpler » or for lack of expertise, time and / or resources, the move is often done « as is », ie the current environment is ported with little to no changes to the nomenclature / tagging necessary for any form of efficient automation (which is a foundational block of any cloud environment), no or little analysis of the existing security requirements and how they would translate in the cloud provider, little thoughts on how the support would work once the application is ported and how lacking infrastructure telemetry will affect their ability to resolve a problem or even provide an appropriate audit trail.
The list could go on but I hope you see my point.
Second, the move to the cloud implies an iterative learning process in order to bring our resources up to speed but also to adapt policies and procedures, responsibilities and teams to the new reality the business will have to deal with. There is a strong tendency to « hold on » to current structures and methods and hope they will be good enough for once our applications will live in the cloud
To compound the problem, while formal training is a good start, there is nothing like experience to identify where each team, organisation, procedures, budget allocation, response time, etc will or will not be adequate once the transition will be accomplished.
So the problem is the following: we know of our target to the cloud but because we lack a general understanding of the impacts, we have a hard time preparing for the new reality at hand and end up doing a poor job at migrating our applications and supporting them afterword.
So how can we fill that gap ? How can we provide our staff and organizations in general the opportunity, training and tools to make the transition to the cloud a more successful one ?
Here is an idea that we developed with 2 of my clients which I think provides a path toward answering this: invest some hard cash, depending on the organization this could be substantial, in order to build a « cloud stack » on-prem as a intermediary step to your migration.
Before throwing me stones, hear me out :). I know I work for VMware and this sounds like a cheesy sales pitch, but for those who know me, you know my intentions are pure (haha) ;)
If an organization would hire external consultants, business transformation analysts, send staff to training and conventions, etc. all with the idea of building their expertise and supporting their transition to the cloud, they would consider the significant amount of money allocated to these activities as an investment with no expectations to see how courses, travel expenses, consulting fees, etc could be offset in an upcoming contract or service in the cloud.
No this would be consider plain and simply an investment, with whatever amount of money never coming back into the budget.
Now what if you would take that money and build yourself an on-prem stack that behaves like a cloud ? What if you selected a few individuals to support it while the rest of your staff would only have access to it as if it was a cloud provider, and have them go thru the journey of migrating a few applications , some simples and complex ones, and support them.
I’m not talking about some development applications or something that is non impactful to the business. No the real thing, including common services like AD configured to be a DC, your HR system, your company web site, etc.
Yes this will require an upfront investment to put together the stack but put that investment in the same column you would the training and conferences in your budget because this has WAY more potential to benefit your organisation in identifying the gaps, provide significant data points to address procedures and workflows, hands on experience on developing nomenclatures that will be useful for the automation and telemetry, etc.
A year or two later or in parallel you start pushing stuff to the cloud.
I ask you: how much more confident would you be about your organization’s ability to do this right with minimal impact to the business at this point rather than have external staff and a bunch of certificates hanging off cubicle walls as your only measure to mitigate the risk ?
This idea has legs and as I said, at least 2 of my customers have decided to go down that path.
If you are a VMware shop, we have Validated Designs (VVD) and a vCloud Foundation (VCF) offering you should consider to achieve this. Especially in the case of VCF, the operation of the stack is minimal and automated so it does not require many people to maintain it and can be accessed via constructs that looks and behaves as VPCs or VNETs.
As an analogy, you can read all the books you want and watch as many videos your time permits to prep for a backpacking trip. Not until you have the weight on your back and got lost a few time on the trail or weathered a storm do you know you will be able to do the full journey.
Let me know what you think.
Cloud Security Strategist | Security Solutions Architect | Mentor
4yGreat post. This is a classic Day 0 / Day N problem. Most organisations don't properly define where they are (day 0) and what the desired end-state will be (day N) and all the steps (days) in between to get there. The definition is across the entire organisation since this is not just a technology problem. People and process are fundamental to this. Building an "on-prem cloud-stack" may be part of what you do on Day 1, people being trained and processes being changed as they move in a structured and focussed manner towards Day N. Organisations are reluctant to employ (read trust) experienced third-parties consultant company (like me) to help with this journey and think that they can do it all themselves. More often than not, they fail on multiple counts and never really get to where they want to be in the timeframe they want to be in, get very frustrated and make wrong/compromised decisions. Ideally, organisations should follow the CI/CD model and continue around the ∞ and learn on every loop around; Adapt, Adopt or Die. ...and remember security is job zero.
Data Center/Cloud/Edge/Network/Security/K8s - Technology Evangelist & Enterprise/Solution/Consultant Architect
4yGreat post Bruno Germain
Exploring new horizons
4yI agree with at least the last paragraph :-)