The IT environment continues to broaden. Both intentionally, as part of an actual business-plan- driven IT strategy, and unintentionally, as part of “shadow IT” activity, enterprises continue to add more SaaS, PaaS, and IaaS solutions to their portfolios. This increases the difficulty of maintaining a sufficient level of cloud observability. Each new environment IT knows about adds another place or set of places IT has to look to get the information it needs, and presents its own challenges in getting visibility into what is happening within and among clouds. Each new environment IT does not know about is a potential source of business, operational, and cybersecurity risk.
To ensure the business can actually do business, realize the full value of cloud-focused digital transformation efforts, protect company data assets properly, and manage the overall IT service portfolio, IT needs to understand what SaaS and other cloud platforms are actually in use. It needs additional visibility into cloud use both for sanctioned and unsanctioned cloud activity.
To manage company resources properly, IT also needs to address the increasing number of places and ways in which the organization can overspend or mis-spend money on all these cloud services.
In an ideal world, IT operations teams are the counteragent to the organization’s blind spots and to over-spending or mis-spending on cloud services. In the real world, for most organizations, those teams are stretched thin, over-worked, and under-equipped for this type of work. Their time and attention are, necessarily, focused first on ensuring the availability and performance of critical services; and second, on supporting new business initiatives and associated IT services and infrastructure. There is little time or attention to spare for backwards-looking audit and optimization of the use of existing solutions (as long as they are delivering the services they are intended for).
Whether we are talking about managing the service portfolio functionally, to make sure the business has what it needs to compete, or about managing that portfolio with an eye to reducing wasteful spending, it takes human time and attention to accomplish the goal. Without more humans, or indeed with fewer if your IT department was in line for cuts recently, the amount of human time and attention needed must be minimized.
Complicating the situation, upper management often believe they have all the information they need to understand and optimize cloud use…even when the operations folks tasked with collecting that information feel otherwise.
Moreover, 46% of organizations have yet to update their operational processes to deal with cloud use in delivering production services. Processes developed solely for on- premises resources are just stretched to cover cloud deployments, but it is not a good fit. Processes for on-premises resources often presume (and depend on) levels of access to infrastructure that are simply not available for cloud solutions, or assume integrations with infrastructure systems (such as an on- premises directory) that are not in place. It is easy for gaps in visibility and the poor fit between process and cloud use to turn into benign neglect — “if it ain’t broke, don’t fix it” — and a gradual, ever-increasing accumulation of solutions, accounts, account privileges, cybersecurity risks, and costs.
With or without adequate operations staffing, IT needs tools that will let them see what cloud systems are actually in use. The need is clearly more acute where operations teams are oversubscribed, but even where they are not, the organization needs some means of seeing clearly which cloud solutions and cloud service providers are part of the overall service portfolio.
This goes for sanctioned as well as unsanctioned services and applications. Certainly, the need to capture information about shadow solutions is urgent and important. But, given how many years companies have been engaging cloud now, and the breadth of functions engaged, it is also important to have help keeping track of sanctioned solutions and their current status: are they still in use, growing in importance, fading into disuse, or abandoned?
Seeing all of this is the first step toward weeding out the unused and unneeded, pruning back what is overgrown, and prudently investing in what is needed and used. That is, this visibility is the main prerequisite to cloud cost management and optimization.
One technology business recently implemented cloud visibility and optimization tools on its environment. It found not the expected 70 cloud services known to IT, but 250 applications in use. “The level of blindness was shocking!” according to the CIO. Another business, after moving one of its core applications to IaaS, discovered astonishing waste. For example, one virtual machine was used for only a few minutes a day but was running 24×7 and just “counting its cycles” between late-night bursts of work as part of a daily extract-transform-load process.
Of course, seeing that a cloud is being used is not enough: in order to assess issues like right-sizing the numbers and types of subscriptions, or establishing that data are being handled correctly, or understanding where all the key steps in crucial process are taking place, IT also needs to be able to see who is using each cloud service, and for what.
Before IT can level-up its approach to cloud and implement good governance and process, it needs to clean up the skeletons in the closet—and to do that, it needs to shine a light in there first.
The appropriate place for such functionality is in the cloud. A cloud-based Cloud Cost Management (CCM) solution provides visibility into which cloud platforms and services are in use, how much is being spent in each, and on what. They can provide comparisons across platforms and advice on how to reduce costs, reallocate resources, and get better value for each dollar spent. CCM is not primarily a security tool (though it has a role to play in securing the enterprise, certainly) but part of its function is to find shadow cloud deployments. Consequently, it will need to see which services are in use via which Identities, which it can accomplish in several ways: by being “in line” between users and cloud destinations; by integrating with such a system (presumably a CASB), or by integrating with an identity provider (such as Okta or Ping); by having an agent on user desktop browsers; or some combination of these. It can then gather usage information directly, if in-line or using an agent, or indirectly, via APIs into other cloud providers.
