KPMG's Cloud Architecture framework - censored version

Cloud architecture framework Q1 2013 KPMG in the Netherlands

drs. Mike Chung RE

2 © 2013 KPMG in the Netherlands, registered with the trade register in the Netherlands under number 33263682, is a subsidiary of KPMG Europe LLP and a member firm of the KPMG network of independent member firms affiliated with KPMG International Cooperative (‘KPMG International’), a Swiss entity. All rights reserved. Printed in the Netherlands. The KPMG name, logo and ‘cutting through complexity’ are registered trademarks of KPMG International.

“In theory, theory and practice are the same. In practice, they are not.” Albert Einstein


Content

• Cloud ecosystem

• Cloud service architecture model

• Cloud governance outline

• Cloud governance components

• Cloud layers

• Conceptual frameworks

• Cloud architecture ecosystem

• Cloud architecture delivery approach

• KPMG’s proprietary tools

• Examples and credentials

• Contact information


Cloud ecosystem: key actors and functions

Cloud service provider

Customer organisation

Third party (cloud) provider

Supervising institutes/government

(Public) network

Set out laws, regulations and standards for the

customer organisation as well as (cloud) service

providers

Uses/consumes cloud services

Provides and/or aggregates cloud services

Provides services to cloud service providers

Provides data transport channels


Cloud ecosystem: on-premise, outsourcing, cloud

Local IT



Network

Sourcing service provider


Third party provider


Network





Network

On-premise Outsourcing Cloud

National legislation Legislation of different legal domains

Changing legislation of changing legal domains

Dependency on local IT Dependency on local IT Flexibility in choosing services

Corporate LAN/WAN LAN/WAN, Leased lines (Public) internet

Locally managed, dedicated IT Outsourced, dedicated IT Outsourced, shared IT

(multi-tenancy)

Limited number of third party providers

Dynamic ecosystem of third party providers


Orchestration

Service management

Compliance and

legal control

KPMG’s cloud service architecture model

Service conditions

Service provision

Service request Service consumption

Life cycle and vendor management

Security and IAM

Technology integration

Monitoring & reporting

When are cloud services permitted?

What is the sum of demands for cloud services?

Who are providing the cloud services?

How are the cloud services being offered?

Operations Risk

Finance Technology


Cloud governance outline




(Public) network


Laws and regulations Statements

Control requirements Assurance

Control requirements Assurance

Tech

nolo

gy in

tegr

atio

n

Mon

itorin

g &

repo

rtin

g

Secu

rity

and

IAM

Com

plia

nce

and

lega

l con

trol

Life

cyc

le a

nd v

endo

r man

agem

ent

Serv

ice

man

agem

ent

Orchestration


Cloud governance components

Operations Technology Risk and compliance Finance

Orchestration

Compliance and legal control

Life cycle and vendor management

Service management Technology integration

Security and IAM

Monitoring & reporting

Enterprise demand management and SLAs

Incident management

Service delivery management

Service brokering

Change and configuration management

Protocol definition

Virtualisation management

Network interfacing

Data integration

Compliance control

Legal and judiciary

Service portfolio management

Contract and subcontract

Billing & invoice

Tax management

Procurement

Identity & access management Data protection Threats and vulnerability

intelligence

Business analytics Service continuity and availability Certification and assurance

Technology standards definition Enterprise risk management Service portfolio

management

Financial reporting


On-premises

Cloud layers

Physical facilities

Network

Storage

Hardware

Virtual infrastructure

OS

Middleware

Data(base)

Application development platform

Application

IaaS

Physical facilities

Network

Storage

Hardware


OS

Middleware

Data(base)


Application

PaaS

Physical facilities

Network

Storage

Hardware


OS

Middleware

Data(base)


Application

SaaS

Physical facilities

Network

Storage

Hardware


OS

Middleware

Data(base)


Application

Cloud service Cloud service Cloud service

* In practice, the separation between the customer and the CSP is a contractual/logical/responsibility separation instead of a technical/physical separation.

*


Conceptual framework for Infrastructure-as-a-Service

Cloud service provider(s)


Physical facilities

Network

Storage

Hardware


APIs

On-premises IT

Customer data platform and applications

Serv

ice

man

agem

ent

Demand control

Ope

ratio

nal d

eliv

ery

man

agem

ent

Res

ourc

e/ca

paci

ty m

anag

emen

t

Com

plia

nce

Perf

orm

ance

man

agem

ent

Mon

itorin

g &

repo

rtin

g

Secu

rity

and

IAM

Network control

Open APIs Proprietary APIs

Virtualisation Emulation

Server resources Computing resources

Data storage Backup & archiving

NaaS Network security

Single Distributed

OS

Integration between on-premise and cloud

infrastructure

The

rate

of m

ulti-

tena

ncy


Conceptual framework for Platform-as-a-Service



Infrastructure layer

Database layer

Application layer

Integration layer

Business process layer

User interface layer

On-premises IT

Customer data and applications

Serv

ice

man

agem

ent

Demand control

Ope

ratio

nal d

eliv

ery

man

agem

ent

Res

ourc

e/ca

paci

ty m

anag

emen

t

Com

plia

nce

Perf

orm

ance

man

agem

ent

Mon

itorin

g &

repo

rtin

g

Secu

rity

and

IAM

Network control

Configuration Toolkits

Workflow Process mining

Service Bus EAI

Development Hosting

Performance tuning Analysis

CSP owned Outsourced

Integration between on-premise and cloud

applications


Conceptual framework for Software-as-a-Service



Infrastructure layer

Platform layer

Application code

Database

Configuration

Access

On-premises IT

Customer data

Serv

ice

man

agem

ent

Demand control

Ope

ratio

nal d

eliv

ery

man

agem

ent

Res

ourc

e/ca

paci

ty m

anag

emen

t

Com

plia

nce

Perf

orm

ance

man

agem

ent

Mon

itorin

g &

repo

rtin

g

Secu

rity

and

IAM

Network control

CSP’s directory Federation

Custom rules Custom reports

Master data services Admin data services

Closed Open source

Proprietary PaaS-based

CSP owned Outsourced

Transition/migration and integration of IAM

Appl

icat

ion

wor

kflo

w m

anag

emen

t


Cloud architecture ecosystem: KPMG’s methodologies and frameworks

KPMG’s corporate advisory principles

KPMG’s IT strategy advisory methodology

KPMG’s enterprise architecture framework

KPMG’s cloud architecture framework

Architecture templates and practices:

• Conceptual architecture (what) • Logical architecture (how) • Cloud roadmap (when) • Solution architecture (detailed/physical)

KPMG’s international good practices based on cloud architecture and solution implementation projects

KPMG’s involvement in leading cloud standards

and regulatory organisations

KPMG’s cloud and mobile computing market

forecasts and trends information

KPMG’s cyber intelligence


Cloud architecture ecosystem: hierarchy

Corporate strategy

IT strategy

Enterprise reference architecture

Cloud reference architecture

Cloud architecture Cloud roadmap

Service solution architectures

Rules and regulations

IT vision and principles

Requirements and controls

Current IT environment

Technology trends and forecasts

Risk appetite

Budget


Cloud architecture ecosystem: content of cloud reference architecture

Conceptual cloud architecture (What?)

Logical cloud architecture (How?)

• Scope of conceptual architecture

• Applicable legal and regulatory limitations

• Corporate’s vision and principles on cloud

• Requirements and standards • Orchestration

• Compliance and legal

• Life cycle and vendor

• Service management

• Technology (integration)

• Monitoring and reporting

• Security

• Extent of cloud services

• (Optional) longlist of CSPs, technologies

and integrators/aggregators

• References


Cloud roadmap (When)


• Scope and depth of logical architecture

• Cloud selection/exclusion decision flows

• Corporate cloud orchestration dashboard,

organisation and processes

• Exit strategy

• Service management organisation and

processes

• Cloud deployment steps

• Technology integration steps

• Cloud and mobile security controls

including IAM

• High-level data flow architecture

• Cloud monitoring and reporting steps

• Use-cases and market’s leading practices

• References

• Scope and depth of cloud roadmap

• Current state IT services landscape

• Current state issues, challenges and points

for improvement

• Interim state overview

• Target state overview

• Desired level of maturity

• Rationale (Business Case)

• Key themes

• (Optional) choices for CSPs, technologies

and integrators/aggregators

• Achievements

• Next steps

• Timelines

• High-level planning

• References


Cloud architecture ecosystem: input and framework



Conceptual architecture

Logical architecture


Frameworks

• TOGAF • Zachman • ITIL • COSO • Prince2

Corporate principles

• Business and technology requirements • Corporate methodologies and practices

Methodology

• KPMG’s Architecture Delivery methodology • KPMG’s cloud framework

Controls

• CSA • ENISA • ISACA • Cobit • ISO • ISAE


Cloud architecture delivery approach (extensive)

Plan Assess Design Implement Monitor Stage

Steps

Stage objectives

• Preparation • Goals alignment • Expectation

management

• Strategy articulation • Cloud service

identification • Current capabilities,

processes and technology inventory

Tools

= Management checkpoint C

• KPMG’s project planning & budget templates

• KPMG’s roles & responsibilities matrix

• KPMG’s RA project charter

• RA glossary and term disambiguation

Engagement initiation

• Scope definition • Blueprints definition • RA and roadmap • Implementation plan • CSP comparisons • Feedback and

stakeholder approval

• RA implementation

• Evaluation • Monitoring methods

implementation • Architectural

iterations initiation

Architecture vision and principles

Reference architecture design Transition planning Architecture change

management setup

Project governance setup Architecture readiness Roadmap design Governance setup Continuous improvement

Project kick-off Process assessment Process and governance architecture design Process implementation

Methods setup and communication Technology assessment Impact analysis Technology implementation

C

C

C C C C

C C

C

• KPMG’s cloud assessment tool

• KPMG’s content framework technique

• KPMG’s process and technology inventory templates

• KPMG’s cloud solution tool

• TOGAF templates • Zachman framework

tools • ArchiMate modelling

tools • KPMG’s strategic,

segment and capability architectures technique

• Example transition plans

• KPMG’s EA implementation technique

• Example evaluation papers


Cloud architecture delivery approach (practical)

Stage 1: Define Stage 2: Assess Stage 3: Deliver Stages

Input

Activities

Output

• KPMG’s cloud project templates

• KPMG’s practices on cloud architecture approach

• Customer organisation’s practices on architecture

KPMG’s cloud assessment tool

KPMG’s templates for inventory, requirements and impact analysis

Customer organisation’s data on current architecture

KPMG’s cloud market and solution tool

KPMG’s example architectures based on previous projects

Customer’s practices on cloud and sourcing

• Defining scope and depth

• Defining desired situation (SOLL)

• Defining the project approach and planning

Assessing technology and (business) processes (IST)

Identifying the delta (gap between SOLL and IST)

Defining requirements

Delivering cloud reference architecture

Delivering logical cloud architectures

Delivering cloud roadmap

• Cloud architecture scope

• Cloud architecture objectives

• Project approach and plan

Architecture inventory

Architecture requirements

Impact analysis


Logical cloud architectures

Cloud roadmap


KPMG’s proprietary tools

Cloud Assessment tool Cloud market and solution tool

Cloud solution architecture templates Cloud roadmap templates


Cloud conceptual architecture (IAM) Cloud logical architecture (Federation technology)

Cloud solution architecture (PaaS) Cloud risk and compliance architecture

Example deliverables I


Example deliverables II

Solution architecture (IaaS)

Conceptual architecture (PaaS)

Censored – security vulnerability information


Example deliverables III

High level case for Cloud

Cloud strategy framework

Cloud Architectures


Example outline cloud roadmap

2014

Clo

ud R

A So

lutio

n ar

chite

ctur

es

Clo

ud

gove

rnan

ce

IaaS

Cloud architecture vision and principles

Cloud architecture assessment results

2015

Cloud RA

2013

Actualised cloud RA

IaaS solution concept

SaaS solution concept

PaaS solution concept

Solution architectures

Integration solution implementation

Cloud governance principles

Process architecture

Orchestration architecture

Cloud RA implementation

Cloud governance implementation

PaaS SaaS

Current status inventory

Data classification

IaaS enablement preparation

Storage, backup and archiving

Impact analysis

Test server capacities

Production server capacities

Impact analysis

PaaS enablement preparation

Impact analysis

SaaS enablement preparation

Software testing

Software development

Mobile apps development

Apps hosting

E-mail Basic portal services

CRM Office

Identity registration

ERP

Collaboration

Directory services


KPMG’s experience and expertise

We have done this before

KPMG continues to win many awards for excellence across its

different businesses and locations. Recently named ‘Sustainable Firm

of the Year’ by International Accounting Bulletin, ‘Global Firm of the Year’ in the British Accountancy Awards and won two awards in the 2012 Management Consultancies

Association Awards for ‘Technology Project’ and ‘Operational

Performance’

To name a few: • Cloud strategy, reference architectures,

solution architectures and risk model for a global oil company (2012 – ongoing)

• Cloud and data centre architecture for a Fortune 500 manufacturing company

• Cloud and virtualisation solution architecture for a German telecommunication organisation

We lead and guide the cloud industry

• We are involved as architecture specialists in cloud technology and services development for Microsoft

• We are active members of CSA, OpenGroup, Kantara Initiative and ISACA cloud group

• We are involved in many national and international institutions as trusted advisors on cloud computing such as EU, various national banks and governments

We offer solutions

• In addition to architecture advisory services, KPMG leads and implements cloud computing solutions with technology vendors such as Oracle and IBM

• To automate and to support our cloud services, KPMG liaises with vendors such as Quest (Dell), Aveksa and Varonis

• KPMG leads and implements cloud-based IAM solutions

We follow a collaborative approach

• We bring a robust and collaborative approach based on our expertise of our client’s needs to ensure that the focus is aligned with our client’s strategic direction and expectations

• We have a deep understanding of business services, compliancy, finance and technology. With this knowledge we will work with you


KPMG’s recent cloud computing projects

Global oil company

Ongoing

KPMG is currently providing cloud strategy and architecture services for

a global oil company. The project involves all organisational and

technical aspects of cloud and mobile computing for various layers of

architecture (conceptual, logical, solution)

International publishing company

Q4 2012

KPMG assessed the cloud strategy and architecture for an international publishing company. Its emphasis was on financial, legal and security

aspects. KPMG will be involved again for the implementation phase

as QA.

Dutch insurance company

Ongoing

KPMG currently performs a risk assessment on cloud services

(Google Apps and Office 365) for a Dutch insurance company. The

objective of the project is to get formal approval from the National Banking

Authorities to use public cloud computing services.

Global oil company

Ongoing

KPMG’s international team of specialists is conducting a large-scale Proof-of-Concept for the use of cloud

services and mobile devices. The outcome of this project will be the basis for the client’s IT strategy.

International telecom provider

KPMG’s joint team of Belgian and Dutch strategy and financial

consultants is devising the cloud strategy/architecture. The client chose

KPMG for its broad knowledge on various fields such as revenue assurance, market trends and

technical architecture.

Ongoing

International publishing company

Q1 2012

KPMG assessed different cloud platform solutions (PaaS) and advised

on the feasibility of implementing PaaS. KPMG also performed a

comparison analysis with on-premises alternatives.

Various Cloud Service Providers

Ongoing

KPMG certified various well-known cloud service providers on ISAE3402/SAS70 and ISO

standards. Companies such as Google (Postini), Terremark,

Salesforce, NetSuite and Symantec cloud services have been certified

by KPMG .

Global Oil Company

01 - 2011

KPMG devised the risk and security control framework concerning the use

of cloud computing. The client was very contended with KPMG and

asked KPMG to provide advice on the organization on the cloud strategy as

well.


Contact

drs. Mike Chung RE Senior Manager IT Advisory KPMG in the Netherlands [email protected] +31 (0)6 1455 9916