What is cloud anyway? And why are not all clouds the same? An overview to create clarity.

The topic of the cloud is currently on everyone’s lips again, and decisions are pending in many places. Clarity is essential for assessing the impact on individuals, the economy and society. That’s why we’re starting a small series today that aims to create understanding and clear up misunderstandings.
This text is also available in German 🇩🇪.

Don’t lump everything together

“The cloud is just someone else’s computer,” goes the saying. Just as we don’t lump all our own computers together, but distinguish between mobile or laptop, home or work computer and many others, we shouldn’t lump all clouds together either.

Because these cloud computers can also be equipped very differently with hardware, software and services. On the one hand, this gives them very different properties. On the other hand, different mechanisms are also required when it comes to building or applying a secure, high-performance or reliable cloud from “any cloud”.

Differentiation

What criteria can we use to differentiate the cloud?

From a technical point of view, we can roughly make a three-way division:

• Storage: Is the primary function to store data (i.e., is it essentially a networked hard disk)?
• Compute: Or does it primarily provide computing power (comparable to the computer under the desk)?
• Network: Or is it mainly about moving data around on the Internet?

But we can also look at the level of abstraction, aka the amount of service that comes with the offer:

• Low (close to the hardware): Does the customer (e.g. a company) mainly get a hard disk, a processor or a network card without having to put them in her computer room? Can the customer’s administrators configure every hardware parameter themselves, configure every piece of software and hardware? Do they have full freedom with full responsibility, the dream of all hard-core techies?
• High (the hardware is invisible): Or do customers not even notice that there is any hardware behind it and can just use a ready-made and configured software? Like, for example, an “automatically working” office or accountig package? No update worries, but also fewer setting options (and also less need for them)?

Examples

There are no strict borders between the categories, in fact, the transition is very smooth, making differentiation hard. This is probably why everything is often simply thrown into the “Cloud!” basket, which in turn also simplifies marketing.

To structure the cloud space, we start using to some exemplary products and categories. (Again, these categories are by far not as clearly separated from each other as the graphic suggests; they rather float like clouds themselves).

• File hosting: For many, their first contact with the cloud was probably via cloud storage providers such as Dropbox, iCloud, Google Drive or Microsoft OneDrive. This is where you store your data and retrieve it later or share it with others.
  The service is mainly about file storage and the thousands of computers and hard drives or SSD it consists of is perfectly hidden from the customer, who just sees the software and the service.

• Infrastructure as a Service (IaaS, “vServer”, “Root server”, virtual machine): Here, everything revolves primarily around the computer itself. Instead of selecting and buying servers themselves, the IaaS customers configure a computer online and defines the performance of the processor, amount of main memory, size/speed of the hard disk/SSD and number/speed of network cards from the comfort of their home or office.
  Unlike the hardware order, this virtual cloud computer is available immediately. Within seconds, you can configure the operating system and install the application.

• Content Delivery Network (CDN): This time, we have a network-based service at medium abstraction: It is clear that somewhere there are computers distributed around the world, but they pretty much automatically (from the customer’s point of view) take care of making web requests faster and relieving the load on their own servers behind them.
  When the customer subscribes to the CDN, the CDN starts playing man in the middle: To the users in front of their web browsers, it looks like the CDN is the actual website, even though the CDN forwards certain requests to the web server in the background, which is still operated by the customer herself.
  The CDN thus receives everything that originally went to the customer’s web server: page requests, IP addresses, contents of contact forms, etc. In return, the CDN reduces the number of requests and increases the speed. This also allows the CDN to mitigate some of the attempts when an attacker wants to overload the customer’s original web server (DDoS).

• High-performance computing (HPC/Grid) solutions exist for many scientists, such as particle physics or weather forecasting. The resources required for these large-scale computations are usually jointly supported and administered by many research groups and the public sector.

• Office packages such as Microsoft’s or Adobe’s offerings combine storage, processing and delivery in roughly equal amounts, making users forget that it’s someone else’s computer.

Reasons for cloud applications

Why does someone rely on cloud instead of their own computers? Here are a few possible reasons:

• Acquisition (asset) costs: The computers do not have to be purchased by the customer. So there are no initial costs, but there are ongoing costs. In fast-moving business, this can be a decisive advantage.
• Effort and automation: The customer does not have to take care of setting up the server or the software herself; the cloud provider takes care of that. This argument counts above all for small and technically less affine SMEs. For larger companies, the cantons or the federal government with relatively high IT requirements, a certain uniformity and standardization, this often weighs less heavily, especially for core processes.
• Know-how: At first glance, less in-house know-how is required. (But this can also turn out to be a boomerang, if at any point you no longer even have the know-how to make sensible IT decisions, even if it’s just the choice of products to buy, developments to commission, or services to subscribe to).
• Sharing costs: By sharing the infrastructure between many users, synergies are created. When it is not needed at the moment, it can be used for others. As long as not all users have a lot of demand at the same time, the total infrastructure can be less than the sum of the infrastructure needed for each individual.
• Scaling: A popular argument used by providers: As a customer, you only pay for as much as you use. And if you ever need more, we’re there to help you. Again, this is especially true for SMEs. For big orders from large customers, the leeway is often limited to a few percentage points up or down, because even the cloud provider itself can not have an unlimited amount of reserves. If the contracts with large customers do allow significant peaks, their incremental costs are often prohibitively high.
• There is no other way: The manufacturer offers its software only as a cloud solution. (For example, this very easily allows subscription solutions that lead to continuous, predictable revenue). This lock-in can sometimes also be expensive.

Conclusions

Not everything sold under “cloud” should be lumped together, but decision makers should know the characteristics of the services they subscribe to, including the associated risks and side effects. Only then can you ask the right questions and make sound decisions: For yourself, for the company, or for our entire society.

Cloud decisions always depend on where the cloud fits into one’s own processes, but also on how much IT know-how already exists within the organization. Depending on this, it is also possible to achieve a large part of the advantages of the cloud in-house with standardized tools (open source or commercial) and then retain one’s sovereignty and benefits, both within and outside of IT.

Anyone making decisions about cloud should, of course, first and foremost know their needs or requirements. But this actually applies to all decisions, even if this is most easily forgotten in the IT sector.

Appendix

Further reading

• The NIST Definition of Cloud Computing: NIST SP 800-145, September 2011.
  A brief definition of the Cloud on just two content pages: The Essential Characteristics (On-demand self-service, broad network access, resource pooling, rapid elasticity, measured service), the Service Models (SaaS, PaaS, IaaS), and the Deployment Models (private/community/public/hybrid cloud).
• Cloud Computing: Wikipedia, [online, retrieved 2022-11-03].
• Trevor Jones: A cloud services cheat sheet for AWS, Azure and Google Cloud: Techtarget, 29. Juni 2021 [online, retrieved 2022-11-03].
  A tabular comparison listing the names of similar services provided by the “Big Three”. Of course, many other, smaller providers have similar products, generally with less lock-in. (A lot of what either provider offers is in fact implemented using commercial or open source products which anyone can install on their own servers as well.)
• Paul Kerrigan: Pizza as a Service 2.0, 20. Juli 2017 [online, retrieved 2022-11-03].
  Funny, illustrative and illustrated overview over the different levels of abstraction, ranging from homemade (low level) over takeaway to party (hight level).

Tabular overview

Level of abstraction	Storage	Computing	Network
low: „bare metal“, the customer can see and control many aspects of the hardware, but has to deal with them as well.	Block Storage etc.: iSCSI, Amazon S3, …	IaaS/virtual machine: Almost like your own computer, but it is located at your provider’s and can be grown and shrunk on demand.	Proxy/VPN: Your data packats will be forwarded more or less directly.
medium	Cloud data base: The DB server’s machine itself does not have to be administered. However, if you make a mistake, such as not setting a DB password, anyone around the world is able to access your data.	PaaS: Some things come pre-setup by your provider, intended for a specific use case. The customer still has to configure a few things.	CDN/Content Delivery Network: Your entire web traffic will be processed intelligently and optimized.
high: „full service“, the provider tries to provide an all-inclusive offer. The customer does not see the underlying hardware and has no possibility to chang or optimize it or configure it for specific applications.	File Hosting: Users can save entire files, view them in the web browser, and share them with other users.	SaaS: The provider has already set up things for the customer, such as a Web CMS. The customer can start adding content immediately.	„Serverless“ Computing (still runs on servers, despite the misleading marketing name): User-defined functions will process the network requests; includes aspects of computing, and therefore reaches far into the computing sector in the illustration.
Cloud applications	„Office“ applications: Storage, compute and networking are provided as a fused service.

Additional services and duties

If you use a cloud, you will need additional administrative services. These services themselves are often part of the cloud service offering, but lie outside of the table:

• User, rights, and role management (often as single sign on)
• Security and its management or monitoring, including data safety or security concepts)
• Resource planing, cost control
• Life Cycle Management
• maybe license management
• …

Even if everything seems to happen automatically, some duties (most notably the overall responsibility) always remains in the hands of the customer.

Image source

The title image is a remix based on two images by Simon Eugster: Left, Leuchtende Stratuswolke (CC BY-SA 3.0), right Cirrus Uncinus With Plane (CC BY-SA 2.0-de)