Incorporating Cloud Computing Services Within Maltese Registered Business Organisations

8/12/2019 Incorporating Cloud Computing Services Within Maltese Registered Business Organisations

1/123

Incorporating Cloud Computing Services withinMaltese Registered Business Organisations

Pulis Maria

A dissertation submitted in partial fulfilment of the requirements of

Masters in Business Administration (E-Business) at the Faculty of

Economics, Management and Accountancy University of Malta.

September 2012


2/123

ii

Abstract

Cloud Computing is an emerging business model which could prove as beneficial toorganisations, especially Small to Medium Enterprises (SMEs). This research analyses

how Maltese registered organisations are incorporating Cloud Computing services within

their ICT infrastructure. A thorough look at the available literature is given to identify

different Cloud deployment models (Private, Public and Hybrid Cloud), service models

(SaaS, PaaS and IaaS), common advantages, disadvantages and issues. The findings from

a number of face-to-face interviews were discussed and the perceived benefits and issues

were pointed out. The top benefits outlined were: capital expense savings, the ability to

scale and the fact that the service provider takes care of all the maintenance required. The

most perceived issues related to Cloud Computing are security and vendor lock-ins.

Concerns particularly related to the interviewed companies are data location due to the

nature of the organisations and compliance with regulations. These findings were then

compared and contrasted to a similar study carried out at the European level. In addition,

reference is made to the different Cloud Services available to Maltese business

organisations to date. To be able to get a more complete picture of the local situation,

interviews were also carried out with Maltese Regulators including MFSA and LGA.

Finally, a number of recommendations were given and attention was drawn to a number of

challenging issues. It can be concluded that Cloud Computing is not suitable for every

organisation: choosing a reliable service provider is crucial and having a complete and

extensive SLA could avoid future problems. There is still a low take-up rate of Cloud

services in Malta but with more awareness more Maltese organisation can benefit from

such a service.


3/123


4/123

iv

Table of Contents

Abstract ............................................................................................................................................................ ii

Acknowledgements ....................................................................................... .................................................. iii

Table of Figures ............................................................................................................................................. vii

1 INTRODUCTION .......................................................... ................................................................. ....... 1

1.1 Motivation ............................................................................. .............................................................. 2

1.2 Objective ........................................................... ................................................................. .................. 2

2 CRITICAL LITERATURE REVIEW ................................................................................................. 3

2.1 Definition of Cloud Computing ........................................................ ................................................... 3

2.1.1 Overlapping Definitions .......................................................... ................................................... 5

2.2 Deployment Models ................................................................ ............................................................. 7

2.2.1 Private Cloud .......................................................................... ................................................... 7

2.2.2 Public Cloud .............................................................................................................................. 8

2.2.3 Community Cloud ......................................................... ............................................................. 8

2.2.4 Hybrid Cloud ............................................................................................................................. 9

2.3 Service Models..................................................................................................................................... 9

2.3.1 Infrastructure as a Service (IaaS) ................................................................ ............................. 10

2.3.2 Platform as a Service (PaaS) ............................................................................................... ..... 11

2.3.3 Software as a Service (SaaS) ................................................................................................... 11

2.4 Roles ...................................................... ................................................................. ........................... 13

2.4.1 Cloud Providers ....................................................................................................................... 13

2.4.2 Cloud Resellers or Aggregators .......................................................................................... ..... 13

2.4.3 Cloud Adopters ..................................................................................................... ................... 14

2.4.4 Cloud Consumers .......................................................... ........................................................... 14

2.4.5 Regulators .......................................................... ................................................................. ..... 14

2.5 Perception ............................................................................. ............................................................ 15

2.6 Benefits ............................................................. ................................................................. ................ 15

2.6.1 Capital Expenditure ................................................................................................................. 16

2.6.2 Immediate Delivery ................................................................................................................. 16

2.6.3 Lower Operating Costs ...................................................................... ...................................... 17

2.6.4 Security Benefits ........................................................... ........................................................... 17

2.6.5 Economies of Scale ................................................................. ................................................. 18


5/123

v

2.6.6 Easy Scale-up ................................................................ ........................................................... 19

2.6.7 Other Benefits ....................................................................................................... ................... 19

2.7 Issues ..................................................... ................................................................. ........................... 21

2.7.1 Economic Issues ............................................................ ........................................................... 21 2.7.2 Legal Issues ........................................................ ................................................................. ..... 23

2.7.3 Security Issues ......................................................................................................................... 25

2.8 Cloud Computing for SMEs .............................................................. ................................................. 26

2.9 Cloud Service Provider ..................................................................................................................... 28

3 RESEARCH METHODOLOGY ....................................................... ................................................. 31

3.1 Justification of the Methodological Rationale ........................................................ ........................... 31

3.2 Research Methods ............................................................................ ................................................. 32

3.2.1 Data Collection Methods ......................................................................................................... 32

3.2.2 Criteria for Sample Selection ............................................................. ...................................... 33

3.3 Semi-Structured Interviews Design ................................................................................................... 34

3.3.1 Users Interview ............................................................ ........................................................... 34

3.3.2 Service Providers Interview .............................................................. ...................................... 37

3.3.3 Regulators .......................................................... ................................................................. ..... 37

3.4 Data Analysis Technique ........................................................ ........................................................... 38

3.5 Limitations ........................................................ ................................................................. ................ 38

3.6 Conclusion ........................................................ ................................................................. ................ 39

4 PRESENTATION AND ANALYSIS OF DATA ............................................................... ................ 40

4.1 Descriptive Statistics ................................................................................................................. ........ 40

4.1.1 General Overview ................................................................................................. ................... 42

4.1.2 Current Systems ............................................................ ........................................................... 44

4.1.3 Cloud Computing Understanding ...................................................... ...................................... 45

4.1.4 Benefits, Issues and Concerns ............................................................ ...................................... 47

4.1.5 Looking for in Cloud Service Providers ............................................ ...................................... 62

4.2 Specific Comments not mentioned in the statistics ............................................................................ 66

4.3 Service Provider Point of View ......................................................................................................... 70

4.3.1 BMIT Ltd ........................................................... ................................................................. ..... 70

4.3.2 GFI .......................................................... ................................................................. ................ 77

4.4 Regulatory Point of View ........................................................ ........................................................... 82

4.4.1 Malta Financial Services Authority (MFSA) ........................................................................... 82 4.4.2 Lotteries and Gaming Authority (LGA)............................................. ...................................... 84


6/123


7/123

vii

Table of Figures

Figure 4.1 - Size of the Interviewed Organisations ............................................................. 40

Figure 4.2 - Nature of the Organisations ............................................................................. 41

Figure 4.3 - Current Use of Cloud Computing Services within Interviewed Companies ... 43

Figure 4.4 - Interviewees understandi ng of the term Cloud Computing ............................ 46

Figure 4.5 - Advantages of Cloud Computing ..................................................................... 48

Figure 4.6 - Disadvantages of Cloud Computing ................................................................ 53

Figure 4.7 - Concerns affecting directly Interviewees ......................................................... 58


8/123

1

1 INTRODUCTION

Cloud Services is a term used for a relatively new paradigm that hosts services over theInternet. It allows users to use applications without installation and access their personal

files from any computer with Internet access.

Due to global economic crises, organisations need to keep costs low while focusing on

growth rather than survival. This puts more pressure on IT departments to be more

operational efficient, gain competitive advantage and be more innovative. In certain

circumstances, Cloud Computing could be more affordable than on-premise solutions,

hence the new trend (Robson Communications Inc. 2010).

Cloud Computing is an emerging business model which could prove as beneficial to

organisations, especially Small to Medium Enterprises (SMEs). The use of ICT has found

its roots in almost all industries, each to a different degree, from manufacturing to

professional services. In Malta, this innovative computing paradigm is still gaining

momentum.

In a research carried out by Youseff et al., cited in Koehler et al. (2010), it is claimed that

many researchers agree that the elements of Cloud Computing are not a technical

innovation in themselves. Sharing computer resources in Grid computing, virtualization

and on demand services by Software-as-a-Service (SaaS) has prevailed Cloud Computing.

Weiss, cited also in Koehler et al. (2010) points out that Utility computing has existed

before. He concludes that the real revolution of clouds is the combination of those different

IT aspects into a new business model. Virtualization of data centre infrastructure helped to


9/123

2

increase their utilization by offering storage and computer performance to third parties. On

demand software, offers possibilities to combine different software solutions into one

environment (Koehler et al. 2010). Cloud services are broadly divided into three

categories: Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS) and Software-

as-a-Service (SaaS).

1.1 Motivation

The term Cloud is nowadays alluded in various business aspects, from Marketing to I.T.

The motivation for this study aroused from the hype in the technological world about the

buzzword Cloud. The Cloud is all over, permeating news articles and social

networking services. Accordingly, given my employment background and current studies,

I decided to focus the study towards this new promising technology from a business

perspective based on the local scenario.

1.2 Objective

The objective of this research is to analyse how Maltese registered organisations are

incorporating Cloud Computing within their ICT infrastructure. The study aims to analyse

the different perceptions of key decision makers in the industry. Also, identification of the

perceived benefits and issues should be studied and compared to similar research carried

out across European framework. In addition, consideration will be given to the different

Cloud Services currently available to Maltese business organisations. In order to get a

more complete picture of the local situation, interviews with Maltese Regulators will also

be carried out.


10/123

3

2 CRITICAL LITERATURE REVIEW

According to a survey by Gartner Research (2005) (cited by Marston et al. 2011) about

two-thirds of the average corporate IT staffing budget goes towards routine support and

maintenance activities. This seem anachronistic in an age of globalized and cutthroat

competition as the CEO of a cloud platform provider is quoted commenting in Marston

et al. (2011):

If you woke up this morning and read in The Wall Street Journal that, say,Overstock.com has stopped using UPS and FedEx and the U.S. mail, and had

bought fleets of trucks and started leasing airport hubs and delivering productsthemselves, you would say they were out of their minds. Why is that much moreinsane than a health care company spending $2 billion a year on informationtechnology?

2.1 Definition of Cloud Computing

Cloud computing is vast and incorporates numerous technological aspects. Consequently,

a single hard and fast definition of the term does not exist. Various authors tried to explain

and express understanding of Cloud Computing. The name Cloud Computing was inspired

by the cloud symbol which is often used to represent the Internet in flowcharts and

diagrams (SearchCloudComputing.com 2007).

Foster et al. (2008, pp. 1) defines Cloud Computing as:

A large-scale distributed computing paradigm that is driven by economies ofscale, in which a pool of abstracted, virtualised, dynamically-scalable, managedcomputing power, storage, platforms, and services are delivered on demand toexternal customers over the Internet.

From this definition, one can summarise that Cloud Computing is a specialised distributed

computing paradigm , in the sense that it is massively scalable and highly customisable to

deliver different levels of services (Foster et al. 2008; Mei et al. 2008). In addition, Cloud

Computing is successful as it enjoys a number of economies of scale.


11/123

4

In their paper, Jaeger et al. (2009) refer to Cloud Computing as a model of computing

where machines in large data centres can be dynamically provisioned, configured, and

reconfigured to deliver services in a scalable manner. This would give firms flexibility in

their use of technology especially in services; from scientific research to video sharing to

email. This is beneficial for periods when a firm would require more processing power

than other periods. Cloud Computing is fast accelerating in its widespread of services.

Jaeger et al. (2009) , in citing Horrigans report based on the survey carried out by The Pew

Internet & American Life Project 1 survey (Use of Cloud Computing Applications and

Services); stated that, although many users may not be familiar with the term, the reality is

that most users (69%, according to the Pew study) are already taking advantage of Cloud

Computing through Web based software applications and online data storage services

(Jaeger et al. 2009).

Another definition by Etro (2009), looks at Cloud Computing from the perspective of both

the firm and the consumer. It refers to an Internet-based technology through which

information is stored on servers and is provided as a service and on-demand to clients. On

one side, consumers will be able to access all of their documents and data from any

Internet connectable device, as they already do for email services and document

management (such as Google Apps2

, Ubuntu One3

, Dropbox4

etc). On the other side, firmswill be able to rent computing power (both hardware and software) and storage from a

service provider and pay on demand, similarly as water and electricity consumption, hence

it is commonly known as Utility computing (Etro 2009).

1 http://www.pewinternet.org/ 2 http://www.google.com/apps/intl/en/group/index.html3 https://one.ubuntu.com/

4 https://www.dropbox.com/


12/123

5

A more recent definition, expressed by Bhm et al. (2011), incorporates both the

application and the infrastructure perspective, rather than a technical definition. Bhm et

al. (2011) consider Cloud Computing as an IT deployment model, based on virtualisation,

where resources, in terms of infrastructure applications and data are deployed via the

Internet as a distributed service by one or several service providers. These services are

scalable on demand and can be charged on a pay-per-use basis (Bhm et al. 2011).

2.1.1 Overlapping Definitions

A number of authors in various papers and articles acknowledge the fact that some aspects

of Cloud Computing have been around for some time under different terminologies

(Yfoulis & Anastasios 2009; Foster et al. 2008; Jaeger et al. 2009). Yfoulis & Anastasios

(2009) explain that Cloud Computing builds on top of several other technologies, i.e.

distributed computing, grid computing, utility computing and autonomic computing, and

that it can be envisaged as a natural step forward from the grid-utility model.

Ian Foster et al. (2008) in their paper, comparing Grid Computing with Cloud Computing,

clarify the distinction and similarity in their definitions; these definitions are constantly

changing to reflect newer technology. Jaeger et al. (2009), also refer to the similarity

between Cloud Computing and Utility Computing services.

2.1.1.1 Grid Com putin g

Foster et al. (2008) argue that Cloud Computing not only overlaps with Grid Computing, it

has indeed evolved out of Grid Computing and relies on it as its backbone and

infrastructure support. What is in common between Grid and Cloud computing is their

vision: their aim is to reduce the cost of computing, increase reliability and increase


13/123

6

flexibility by transforming computers from something that we buy and operate ourselves to

something that is operated by a third party (Foster et al. 2008).

Biswas (2011) defines Grid Computing as the use of computer resources from multiple

administrative domains to reach a common goal. Grid computing may be represented as a

super virtual computer composed of a network of loosely coupled computers acting

together to perform humongous tasks. Goyal and Lawande (cited by Stanoevska-Slabeva

& Wozniak 2010) explain the term Grid Computing from the user perspective: Grid

Computing means that the user can simply request information and computations and have

them delivered to him without necessity to care where the data required resides or which

computer is processing his request.

2.1.1.2 Utili ty Com putin g

Utility computing is another business model which, as described by Biswas (2011),

involves renting computing resources such as hardware, software and network bandwidth

on an as-required, on-demand basis. In 1961, John McCarthy of MIT (cited by Biswas

2011) is quoted saying:

If computers of the kind I have advocated become the computers of the future,then computing may someday be organized as a public utility just as thetelephone system is a public utilityThe computer utility could become the basisof a new and important industry.

Foster et al. (2008), also agree that Utility Computing, is not a new paradigm of

computing infrastructure; on the contrary it is a business model in which computing

resources, such as computation and storage, are packaged as metered services similar to a

physical public utility, such as electricity and public switched telephone network.


14/123

7

Biswas (2011) argues that although both grid computing and utility computing were

precursors to Cloud Computing, nowadays they can be considered as implementations of

the latter. For Cloud Computing does everything grid computing and utility computing do,

and much more. For example, Cloud Computing is not restricted to specific networks, but

it is accessible through the biggest network of them all the Internet. Also, virtualization

of resources and its consequent advantages of scalability and reliability are much more

pronounced in Cloud Computing (Biswas 2011b).

2.2 Deployment Models

Clouds may be divided into:

Private: services built according to Cloud Computing principles, but accessible

only within a private network

Public: available publicly - any organisation may subscribe Community: exclusively used by a specific community with shared concerns

Hybrid: a mix of the above

2.2.1 Private Cloud

This cloud infrastructure is provisioned for exclusive use by a single organisation

comprising multiple consumers (e.g. business units). It may be owned, managed, and

operated by the organisation, a third party, or a combination of both, and it may exist on or

off premises (Mell & Grance 2011). Armbrust et al. (2009) explain the term Private Cloud

as the internal data centre of a business or other organisation, which is not made available

to the general public. Schubert (2010) explains that Private Clouds could be either owned

or leased by the respective enterprise. An example of a Private Cloud is eBay.

A private cloud offers many of the benefits a public cloud computing environment

provides, such as being elastic and service based, but it is managed within an organization


15/123

8

(Marston et al. 2011). Private clouds provide greater control over the cloud infrastructure,

and are often suitable for larger installations. A private cloud can actually be handled by a

third-party provider, e.g. the Government Cloud product from Google5 that will store both

applications and data of government agencies in a completely segregated environment

(Marston et al. 2011).

2.2.2 Public Cloud

Mell & Grance (2011) in The NIST 6 Definition of Cloud Computing explain that the

public cloud infrastructure is provisioned for open use by the general public. It may be

owned, managed, and operated by a business, an academic, or a government organisation

or some combination of them and it exists on the premises of the cloud provider. Marston

et al. (2011) and Schubert (2010) also comment that a public cloud is characterized as

being available from a third party service provider via the Internet, and is a cost-effective

way to deploy IT solutions, especially for small or medium sized businesses. Armbrust etal. (2009) describe that when a Cloud is made available in a pay-as-you-go manner to the

public, it is called a Public Cloud; while the service being sold is Utility Computing.

Examples of Public Utility Computing include Amazon Web Services 7 , Google

AppEngine 8, and Microsoft Azure 9.

2.2.3 Community Cloud

A third cloud infrastructure is the Community Cloud, which is exclusively used by a

specific community of consumers from organisations that have shared concerns (e.g.

mission, security requirements, policy and compliance considerations). The NIST (Mell &

5 http://www.google.com/apps/intl/en/government/trust.html 6 National Institute of Standards and Technology - part of the U.S. Department of Commerce 7 http://aws.amazon.com/8 https://developers.google.com/appengine/

9 http://www.windowsazure.com/en-us/
http://www.google.com/apps/intl/en/government/trust.htmlhttp://www.google.com/apps/intl/en/government/trust.htmlhttp://www.google.com/apps/intl/en/government/trust.htmlhttp://aws.amazon.com/http://aws.amazon.com/https://developers.google.com/appengine/https://developers.google.com/appengine/http://www.windowsazure.com/en-us/http://www.windowsazure.com/en-us/http://www.windowsazure.com/en-us/https://developers.google.com/appengine/http://aws.amazon.com/http://www.google.com/apps/intl/en/government/trust.html


16/123

9

Grance 2011) definition includes that a Community cloud may be owned, managed, and

operated by one or more of the organisations in the community, a third party or some

combination of them, and it may exist on or off premises. In particular, smaller SMEs

could profit from community clouds to which different entities contribute with their

(smaller) infrastructure.

2.2.4 Hybrid Cloud

Another type of cloud infrastructure is the Hybrid Cloud. This is a composition of two or

more distinct cloud infrastructures (private, public or community) which remain unique

entities, but are bound together by standardised or proprietary technology that enables data

and application portability (Mell & Grance 2011).

Hybrid clouds could be useful in situations where an organisation would like to maintain a

degree of control over certain things, for example the storage of sensitive data. Costreduction can be achieved by having a Private Cloud for complete monitoring whilst

outsourcing other less sensitive procedures to the Public Cloud.

2.3 Service Models

Cloud Computing services are broadly divided into three categories: Infrastructure-as-a-

Service (IaaS), Platform-as-a-Service (PaaS) and Software-as-a-Service (SaaS). Nmeek

& Vakov (2012) briefly explain these categories and describe that these encompass all

parts of a company's IT needs.

IaaS This is at the infrastructure level, where the customer is hiring the use of

hardware (usually servers) and the provider will take care of the hardware

maintenance. Users are allowed to install their own virtual servers.


17/123

10

PaaS - This service provides developers with a framework that they can build upon

in order to develop their own applications or customise existing applications. A

provider is not only hiring the platform on which the application is running, but

also complete resources to support whole life cycle of the application creation.

SaaS This is the most common as -a-se rvice variation. The customer will not

buy the software but rather hire it as a service from a provider. The provider offers

the application and the needed infrastructure. The customer pays for the use of the

software as a subscription. Therefore, there is no investment in the application, no

maintenance, just use of the application via Internet. (N meek & Va kov 2012)

2.3.1 Infrastructure as a Service (IaaS)

Qamar et al. (2010) explain that in this model, clients of the cloud service rent entire

computing nodes, such as virtual machines. Mell & Grance (2011) also express that

through this service, the provider supplies the processing, storage, networks and other

fundamental computing resources; and the customer is able to deploy and run arbitrary

software, which can include operating systems and applications. Mell & Grance (2011)

continue that the consumer does not manage or control the underlying cloud infrastructure

but has control over operating systems, storage, and deployed applications; and possibly

limited control of select networking components (e.g. host firewalls). Qamar et al. (2010)

also explain that although particular operating system templates may be available, the

client is responsible for maintaining the operating system and the software that is to run

above it. Examples of this model include Amazons E C210, Rackspace 11 , and Nimbus 12.

Schubert (2010) makes reference to IaaS as Resource Clouds, which provide resources as

services to the user. These resources vary from accessibility to data of potentially dynamic

size, to computational resources. Virtual Machines are the common form of providing

10 http://aws.amazon.com/ec2/11 http://www.rackspace.com/

12 http://www.nimbusproject.org/
http://aws.amazon.com/ec2/http://aws.amazon.com/ec2/http://www.rackspace.com/http://www.rackspace.com/http://www.nimbusproject.org/http://www.nimbusproject.org/http://www.nimbusproject.org/http://www.rackspace.com/http://aws.amazon.com/ec2/


18/123


19/123


20/123

13

Also the migration of user data is a task that should not be underestimated (Bhm et al.

2011).

2.4 Roles

In a cloud environment, individual roles can be identified which together make the whole

system work.

2.4.1 Cloud Providers

Cloud Providers, also referred to as Service Providers or IT vendors, develop and operate

services which offer value to the customer. They operate and offer Cloud Computing

services to third parties either via dedicated APIs (PaaS), virtual machines and/or direct

access to the resources (IaaS) (Schubert 2010; Bhm et al. 2011). The providers will

perform the maintenance and the upgrades on the system and will also be responsible for

maintaining the software used on the cloud, along with pricing the cloud services (Marston

et al. 2011).

2.4.2 Cloud Resellers or Aggregators

Aggregate services providers combine existing or parts of services to form new services

and offer them to customers. Therefore, they are both a customer (from the service

providers perspective) and a service provider (from the customers perspective) (Bhm et

al. 2011). Cloud aggregators may expose a single interface to a merged cloud

infrastructure. They match the economic benefits of global cloud infrastructures with the

understanding of local customer needs by providing highly customized, enhanced offerings

to local companies (especially SMEs) (Schubert 2010).


21/123

14

2.4.3 Cloud Adopters

Cloud Adopters, also referred to as Software/Services Vendors by Schubert (2010)

enhance their own services and capabilities by exploiting cloud platforms from cloud

providers or cloud resellers. Marston et al.(2011) introduce the term Enablers to describe

those organizations that will sell products and services that facilitate the delivery, adoption

and use of Cloud Computing. This enables them to, for instance, provide services that

scale to dynamic demands in particular new business entries which cannot as yet estimate

the uptake/demand of their services (Schubert 2010). Enablers will also include specialized

software firms that will provide monitoring software, platform migration software, etc. In

the case of large enterprises, it is also important to implement an organization-wide

consistent IS policy across the different Cloud Computing services (Marston et al. 2011)

2.4.4 Cloud Consumers

Different notions are used for this role including Users, Customers and Subscribers, they

all refer to the end-client who makes direct use of the cloud capabilities in order to either

execute complex computations or to host a flexible data set (Schubert 2010; Marston et al.

2011). The customer buys services through various distribution channels, for example

directly from the service provider, resellers or through a platform provider (Bhm et al.

2011).

Schubert (2010) also makes reference to the Prosumer concept, in which the user

becomes provider and consumer at the same time.

2.4.5 Regulators

All the above-mentioned stakeholders represent different pieces of the Cloud Computing

value -chain. In contrast, the role of the regulator (whether it is a sovereign government


22/123

15

body or an international entity) is one that pervades across the other stakeholders (Marston

et al. 2011). Regulations should be in place to avoid or at least minimise issues which

might arise amongst the different bodies exercising different roles.

Bacon et al. (2010) explain that with the advent of Cloud Computing, protection of the data

entrusted to services has not yet been addressed. Indeed, the owners of the services are

unlikely to be the owners of the systems on which the services run. The question which

arises is if a major leakage of data occurs, who should be held responsible?

2.5 Perception

Some SMEs remain reluctant to avail themselves of broadband services, or consider the

possible advantages of Cloud Computing, due to perceptions (or misconceptions)

regarding possible capital investment, fear of complexity, lack of understanding of the

potential benefits and lack of technical resources. Jayakar et al. (cited by Neves et al.

2011) conclude that others are more willing to test broadband or Cloud applications, but do

not see it as part of a larger strategy. Sultan (cited by Neves et al. 2011) explains that

evidence also suggests even large companies (contrary to conventional wisdom) are

actually embracing Cloud services. Consequently, an increasing number of companies

(small and large) are beginning to see some real value in using the Cloud.

2.6 Benefits

The Cloud constitutes a single point of access for all services which are available anywhere

in the world. This is very beneficial for organisations, especially SMEs, since it allows

certain activities which otherwise are difficult or impossible to achieve. Through Cloud


23/123

16

Computing SMEs can compete directly with larger competitors. Neves et al. (2011) give a

list of how Cloud Computing fits specific SMEs needs, some of which involve:

Their availability off the shelf. They are very user friendly. Their relative low price when compared to the huge initial capital expenditure one

would have to make on start-up.

A number of different options to choose from. Easier customer support and communication. Availability of staff to work with and maintain the system.

2.6.1 Capital Expenditure

The elimination of an up-front commitment by Cloud users, in this manner allows

organisations to start small and add more hardware resources only when there is an

increase in their needs, thus minimising project and financial risks (Armbrust et al. 2009;

Marston et al. 2011; Robson Communications Inc. 2010). Computational exercises

typically involve large amounts of computing power for relatively short amounts of time,

and Cloud Computing makes such dynamic provision of resources possible without

investing into a lot of resources which would be used for a limited time only (Marston et

al. 2011).

2.6.2 Immediate Delivery

This refers to the infinite computing resources available on demand, whilst eliminating the

need for Cloud Computing users to plan far ahead for provisioning (Armbrust et al. 2009).

In order to setup an in-house system one would require a substantial amount of both

financial and physical resources; such as purchasing hardware, building floor space,

adequate power supplies and cooling systems; installing operating systems, software,

provisioning the network and securing back up power. Apart from making this process


24/123


25/123

18

Catteddu & Hogben (2009) state that all kinds of security measures are cheaper when

implemented on a larger scale.

Cloud service providers can help organisations in advanced monitoring, OS provisioning,

application lifecycle management and configuration management, which can otherwise be

highly expensive. As the cloud service provider has the economies of scale required to

develop and maintain the level of network security needed, customers are safeguarded

from attacks such as viruses, spam, phishing and hacking (Robson Communications Inc.

2010).

2.6.5 Economies of Scale

Catteddu & Hogben (2009) express that Cloud service providers are in a better position

than individual organisations because of their larger volume. These are known as

economies of scale14

. These benefits of scale include: Multiple locations: most cloud providers have the economic resources to replicate

content in multiple locations by default. This increases redundancy and

independence from failure and provides a level of disaster recovery out-of-the-box.

Edge networks: storage, processing and delivery closer to the network edge mean

that service reliability and quality are increased overall and local network problems

are less likely to have global side effects.

Improved timeliness of response: especially to incidents response. W ell-runlarger-scale systems can develop more effective and efficient incident response

capabilities due to ability to detect early detection of new malware deployments.

Threat management: cloud providers can also afford to hire specialists in dealing

with specific security threats, while smaller companies can only afford a small

number of generalists. (Catteddu & Hogben 2009).

14 The increase in efficiency of production as the number of goods being produced increases. Typically, a company thatachieves economies of scale lowers the average cost per unit through increased production since fixed costs are sharedover an increased number of goods. http://www.investopedia.com/terms/e/economiesofscale.asp#ixzz1vistsc2Z
http://www.investopedia.com/terms/e/economiesofscale.asp#ixzz1vistsc2Zhttp://www.investopedia.com/terms/e/economiesofscale.asp#ixzz1vistsc2Zhttp://www.investopedia.com/terms/e/economiesofscale.asp#ixzz1vistsc2Z


26/123

19

2.6.6 Easy Scale-up

Cloud Computing makes it easier for enterprises to scale their services which are

increasingly reliant on accurate information according to client demand (Marston et al.

2011). The list of cloud resources which can be rapidly scaled on demand includes

storage, CPU time, memory, web service requests and virtual machine instances. As such,

scalability can be quantified by the amount of usage of extra resources which are

automatically commissioned with the increase in demand and charged on a pay-per-

consumption basis. However, the actual importance of scalability lies in the fact that

resources are made available in minutes, which otherwise would have taken weeks or even

months (Misra & Mondal 2010). A cloud provider has the potential to dynamically

reallocate resources for filtering, traffic shaping, encryption, etc. in order to increase

support for defensive measures (e.g. against DDoS 15 attacks) when an attack is likely to

take place or is taking place. The ability to dynamically scale defensive resources on

demand has obvious advantages for resilience (Catteddu & Hogben 2009).

2.6.7 Other Benefits

Another great advantage of Cloud Computing is ubiquitous access or mobility, which

allows employees to be productive from wherever they are rather than confining them to

their desks at the company (Misra & Mondal 2010). The ability to access any Cloud

system through any device with Internet access is very valuable.

Disaster recovery is a very important aspect of enterprise computing. As devices, systems,

and networks get increasingly complex, there are more room for other different things to

15 A distributed denial-of-service (DDoS) attack is one in which a multitude of compromised systems attack a single

target, thereby causing denial of service for users of the targeted system. The flood of incoming messages to the targetsystem essentially forces it to shut down, thereby denying service to the system to legitimate users.http://searchsecurity.techtarget.com/definition/distributed -denial -of -service -attack
http://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attackhttp://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attack


27/123

20

go wrong. Disaster may occur due to several causes including natural and man-induced

ones. Disaster recovery and business continuity planning are becoming increasingly

important for every business organization. Disaster recovery planning16

is done by

replicating resources in a number of places. This fear is very much reduced in the cloud as

data is replicated thrice and stored in servers which are geographically scattered (Misra &

Mondal 2010).

Koehler et al. (2010) conducted a study on the Consumer Perceptions on Cloud Services,

they also compared results with Hostings (2009) and IDCs (2009) studies. Hostings

survey (cited by Koehler et al. 2010) reveals that the three most important factors, which

drive the consumers to invest in Cloud Computing are: Cost Savings as the number one

factor (34% of the respondents); High availability (17%), Performance (12%) and

Consumption Based Pricing (12%). The IDC study (cited by Koehler et al. 2010) comes up

with similar issues. Most of their respondents (83%) rate competitive pricing as the most

important attribute.

However, Koehler et al.s (2010) survey shows that financial factors, that is, less initial

costs and less on- going costs, only ranked 5th and 6th in consumers consideration in order

of importance. Instead, respondents seemed to appreciate more the flexibility, especiallythe possibility of accessing applications from anywhere and anytime, as well as the ability

of scaling the application usage on demand (Koehler et al. 2010).

A possible explanation for the lower rank of financial aspects could be because of the

different approach of the survey. Although companies may take the cloud solution into

16 A plan for business continuity in the event of a disaster that destroys part or all of a business's resources, including ITequipment, data records and the physical space of an organization. http://www.webopedia.com/TERM/D/DRP.html
http://www.webopedia.com/TERM/D/DRP.htmlhttp://www.webopedia.com/TERM/D/DRP.htmlhttp://www.webopedia.com/TERM/D/DRP.html


28/123

21

consideration because of their financial benefits; when they are choosing a specific cloud

provider, other service attributes play a more crucial role in the decision process (Koehler

et al. 2010).

2.7 Issues

2.7.1 Economic Issues

Armbrust et al. (2009) explain that although the economic appeal of Cloud Computing is

often described as converting capital expenses to operating expenses (CapEx to OpEx),

they believe the phrase pay as you go captures more directly the economic benefit for the

buyer. Schubert (2010) similarly refers to the Pay per use concept, which is the

capability to build up costs according to the actual consumption of resources. Hours

purchased via Cloud Computing can be distributed non-uniformly in time (e.g. use 100

server-hours today and no server-hours tomorrow, and still pay only for what you use). In

addition, the absence of up-front capital expense allows capital to be redirected to core

business investment (Armbrust et al. 2009; Schubert 2010) .

A term which is very popular in economics is Opportunity Cost 17: this can be applied to a

decision to either retain on-premise IT or move to the Cloud. Kepes (2011) found that

roughly 80% of IT time and expenditure is wasted on processes which do not create any

value for the organization (beyond maintaining the status quo). The opportunity cost of not

choosing the Cloud is therefore the benefit that can accrue to the organisation through

optimal utilization of that 80%. Simply put, a move to the Cloud can make the difference

between an organization being 20% efficient, to one being 80% efficient (Kepes 2011).

17 The cost of an alternative that must be forgone in order to pursue a certain action. The benefits you could havereceived by taking an alternative action. http://www.investopedia.com/terms/o/opportunitycost.asp#ixzz1wdW1eprZ
http://www.investopedia.com/terms/o/opportunitycost.asp#ixzz1wdW1eprZhttp://www.investopedia.com/terms/o/opportunitycost.asp#ixzz1wdW1eprZ


29/123

22

Even though pay-as-you-go pricing could be more expensive than buying and depreciating

a comparable server over the same period, the cost is outweighed by the extremely

important Cloud Computing economic benefits of elasticity and transference of risk,

especially the risks of over-provisioning (underutilisation) and under-provisioning

(saturation) (Armbrust et al. 2009).

Another common term in economics is Elasticity 18 , the key observation is that Cloud

Computing gives the ability to add or remove resources at a fine grain (one server at a time

with EC2) and with a lead-time of minutes rather than weeks, allowing matching resources

to workload much more closely. Armbrust et al. (2009)explain that this underestimates the

benefits of elasticity, because in addition to simple diurnal patterns, most nontrivial

services also experience seasonal or other periodic demand variations (e.g. e-commerce

peaks in December and photo sharing sites peak after holidays) as well as some unexpected

demand bursts due to external events (e.g. news events). Since it can take weeks to acquire

and rack new equipment, the only way to handle such spikes is to provision for them in

advance (Armbrust et al. 2009).

Being a more environmental conscious society, the Going Green issue is nowadays more

important. This is also relevant in Cloud Computing, not only to reduce additional costs ofenergy consumption, but also to reduce the carbon footprint. Whilst carbon emission by

individual machines can be quite well estimated, this information is actually taken little

into consideration when scaling systems up. Clouds principally allow reducing the

consumption of unused resources (down-scaling). In addition, up-scaling should be

carefully balanced not only with cost, but also with carbon emission issues (Schubert

18 The degree to which a demand or supply curve reacts to a change in pricehttp://www.investopedia.com/university/economics/economics4.asp#ixzz1wepO6Ug9
http://www.investopedia.com/university/economics/economics4.asp#ixzz1wepO6Ug9http://www.investopedia.com/university/economics/economics4.asp#ixzz1wepO6Ug9


30/123

23

2010). In a paper published by Robson Communications Inc. (2010) reference is also

made to Green IT policies which companies are looking to adopt. Cloud service providers

are uniquely positioned to deliver a compelling alternative to an on-premise technology

upgrade, helping contribute to a company s efforts to reduce its carbon footprint (Robson

Communications Inc. 2010).

2.7.2 Legal Issues

A number of authors make direct reference to a various legal issues an organisation should

look at before committing to a cloud service provider (Catteddu & Hogben 2009; Marston

et al. 2011; Qamar et al. 2010; Bacon et al. 2010). The parties to a contract should pay

particular attention to their rights and obligations related to notifications of breaches in

security, data transfers, creation of derivative works, change of control, and access to data

by law enforcement entities. Because the cloud can be used to outsource critical internal

infrastructure, and the interruption of that infrastructure may have wide ranging effects, the parties should carefully consider whether standard limitations on liability adequately

represent allocations of liability, given the parties use of the cloud, or responsibilities for

infrastructure (Catteddu & Hogben 2009).

Subpoena and E-Discovery

Where there is the need of the confiscation of physical hardware as a result of subpoena 19

by law-enforcement agencies or civil suits, the centralisation of storage as well as shared

tenancy of physical hardware means that many more clients are at risk of the disclosure of

their data to unwanted parties (Catteddu & Hogben 2009). However Marston et al. (2011)

and Catteddu & Hogben (2009) maintain that it may become impossible for an agency to

19 A writ commanding a person designated in it to appear in court under a penalty for failure http://www.merriam-webster.com/dictionary/subpoena
http://www.merriam-webster.com/dictionary/subpoenahttp://www.merriam-webster.com/dictionary/subpoenahttp://www.merriam-webster.com/dictionary/subpoenahttp://www.merriam-webster.com/dictionary/subpoena


31/123

24

confiscate a cloud because all servers and desktop are virtualized, being brought up and

shut down as needed.

Risk from Changes of Jurisdiction

Customer data may be held in multiple jurisdictions, some of which may be high risk.

Usually the customer will not know exactly where his data resides, hence would not know

under which jurisdiction it is. If data centres are located in high-risk countries, (e.g. those

lacking the necessary legislation, having an unreliable legal framework and enforcement,

states that do not respect international agreements, etc.), sites could be raided by local

authorities and data or systems will be subject to enforced disclosure or seizure (Catteddu

& Hogben 2009).

Data Protection Risks

Any company transferring its computing activities to the cloud risks running afoul of

different countries' laws governing data protection, most notably in the EU, which possibly

has the most stringent data protection laws (Marston et al. 2011). Cloud Computing poses

several data protection risks for cloud customers and providers. In some cases, it may be

difficult for the cloud customer (in its role as data controller) to effectively check the data

handling practices of the cloud provider therefore making sure that the data is handled in a

lawful way (Catteddu & Hogben 2009).

Licensing Risks

Catteddu & Hogben (2009) also make reference to licensing conditions, such as per-seat

agreements, and online licensing checks may become unworkable in a cloud environment.

For example, if software is charged on a per instance basis every time a new machine is

instantiated then the cloud customers licensing costs may increase exponentially even

though they are using the same number of machine instances for the same duration. When


32/123

25

creating original work in the cloud (new applications, software etc.), there might be the

risk that the original work will not be protected by the appropriate contractual clauses

(Catteddu & Hogben 2009).

2.7.3 Security Issues

Bryan Gardiner (cited by Qamar et al. 2010) expresses that companies are mostly

concerned about lost or stolen data. In a survey conducted by a research firm IDC (cited by

Qamar et al. 2010), almost 75 % of IT executives reported that security was their primary

concern. Security in the cloud must be included from the start. This demands a new

approach to end-to-end security that supports strong isolation of data, even when business

processes are outsourced into the cloud. Cloud processing needs isolation among users of

shared services, as well as isolation among services (Bacon et al. 2010). In using cloud

infrastructures, the client necessarily cedes control to the Cloud Provider on a number of

issues which may affect security.

Data Lock-In

Due to lack of procedures, standard data formats or services interfaces that could guarantee

data, application and service portability (Catteddu & Hogben 2009; Armbrust et al. 2009),

it can be difficult for the customer to migrate from one provider to another or migrate data

and services back to an in-house IT environment. This might create a problem, as the user

would be dependent on that particular provider for service provisioning.

Isolation Failure

Since Cloud Computing is based on multi-tenancy and shared resources, there might be the

risk of failure of mechanisms which separate storage, memory, routing and even reputation

between different tenants (e.g. guest hopping attacks) (Catteddu & Hogben 2009).


33/123


34/123


35/123

28

attractive for small and medium-sized enterprises because smaller companies do not have

the possibility of setting up a giant data centre (Qamar et al. 2010).

2.9 Cloud Service Provider

Cloud service providers face the challenge of balancing the need to provide a high level of

service availability and quality of services (QoS) to meet its customers needs with the

business need to operate profitably. With QoS controls available, cloud providers offer a

range of services and price points which provide more choice to customers and back these

services with service level agreements (SLAs). The result for enterprises is lower-cost IT

infrastructure, applicable to a greater range of application types, obtained by combining

shared platform economics with high levels of performance assurance (Lamba & G. Singh

2011).

An organisation should ask and clarify a number of issues with the cloud provider to be

assured that they are sufficiently protecting the information entrusted to them. Some of

these issues are listed below:

Division of Liabilities - Although in many jurisdictions cloud providers can be held

liable for the illegal data they might be hosting, the eCommerce Directive

(2000/31/EC) introduced special liability protection for hosting providers (Eecke

2012; Catteddu & Hogben 2009). In security incidents, ranging from data leakageto the use of an account to launch an attack, both parties would be held responsible

for the due diligence of what is under their control (Catteddu & Hogben 2009). A

distinction is made in EU Directive 95/46/EC and other rules between the Data

Controller and the Data Processor. The distinction is crucial, as it will determine

the respective responsibilities. The Data Controll er is liable towards the data

subjects (Eecke 2012; Catteddu & Hogben 2009).


36/123

29

Division of Responsibilities - With reference to security incidents, there needs to be

a clear definition and understanding between the customer and the provider of

security-relevant roles and responsibilities. Some of the typical liabilities of service

providers (cited by Catteddu & Hogben (2009)) are:

o Physical support infrastructure (facilities, rack space, power, cooling,

cabling, etc.)

o Physical infrastructure security and availability (servers, storage, network

bandwidth, etc.)

o OS patch management and hardening procedures (check also any conflict

between customer hardening procedure and provider security policy)

o Security platform configuration (Firewall rules, IDS/IPS tuning, etc.)o Systems monitoring

o Security platform maintenance (Firewall, Host IDS/IPS, antivirus, packet

filtering)

o Log collection and security monitoring

In the case of standard terms of service (i.e. no negotiation possible), cloud customers

should verify what lies within their responsibility (Catteddu & Hogben 2009).

The real challenge for a cloud service provider is defining which technology improvements

will deliver a significant performance gain in a cost-effective manner. Prior to selecting

which technology improvement to pursue, a cloud service provider should first investigate

how its infrastructure relates to its business model. Identifying the drivers of total

ownership costs is the key to finding the right mix of technology and processes that will

optimize a cloud service providers quality of service (Sahlin et al. 2012).

In order to arrive to the final Cost Calculation, Service Providers would take a number of

costs into consideration; these would then be spread amongst the whole pool of cloud

users. The following list (cited by X. Li et al. 2009) gives a brief overview of some of

these costs:


37/123

30

Server Cost : In Cloud, servers are mounted in the racks and constructed into a

resource pool.

Software Cost : Mainly this includes licenses e.g. Operating Systems software, VM

software and management software.

Network Cost : Cost related to networking is caused by switches, NIC and cables

which are used to attach physical servers to the network.

Support and Maintenance Cost : This metrics item also belongs to soft cost, but

includes some important work, such as software distribution and upgrading, asset

management, troubleshooting, traffic management, servers configuration, virus

protection, disk management and performance maintenance

Power Cost : Power consumption in Cloud is primarily caused by Computing

Infrastructure (IT loads) including Server servers, network switches and Network

Critical non-IT

Physical Infrastructure: Transformers, uninterruptible power supplies, power

wiring, fans, air conditioners, pumps, humidifiers and lighting.

Cooling Cost : As a first-order approximation, the power consumed in the data

centre is completely converted to heat.

Real-Estate Cost : Due to the special infrastructure required like cooling and

power, space needed by a Cloud is often significantly more expensive to build than

standard commercial properties.

Several Cloud Computing (and conventional computing) data centres are being built in

seemingly surprising locations, such as Washington (Google, Microsoft, Yahoo! and

others) and San Antonio, Texas (Microsoft, US National Security Agency and others). The

motivation behind choosing these locales is that the costs for electricity, cooling, labour,

property purchase costs and taxes are geographically variable, and of these costs,

electricity and cooling alone can account for a third of the costs of the data centre

(Armbrust et al. 2009).


38/123

31

3 RESEARCH METHODOLOGY

3.1 Justification of the Methodological Rationale

The aim of this study is to find out the extent of use or non-use of Cloud Computing within

Maltese Business Organisations. When using the term Maltese Business Organisations,

one understands all registered Maltese organisations. The researcher will seek findings

from the views of practitioners in managerial positions and decision makers within Maltese

organisations within the Private Sector. Their opinions, founded by their experience and

knowledge, will provide an insight on whether the use of Cloud Computing is beneficial to

their organisations. Their conceptions give a general overview of potential benefits and

issues their company would enjoy or face when committing to such investment. In

addition, the study will investigate the Regulators role in Malta together with Cloud

Service Providers to get a better picture of the whole scenario.

Thus, this research merits a phenomenological approach since the researcher will seek to

evaluate knowledge from the experiences, thoughts and opinions of the respondents. The

goal of qualitative phenomenological research is to describe a "lived experience" of a

phenomenon (Waters 2007). From the phenomenological paradigm, one can see that one

of the basic beliefs of the named paradigm is that the world is socially constructed and is

subjective. The observer is part of what is being researched, thus care should be taken in

distancing oneself from the research in order to be able to make objective observations.

From its very nature the research in question, which studies the incorporation of Cloud

Computing into different businesses, is focusing on the meaning of Cloud Computing and

its benefits to the individual organisations, it is very much based on different situations.

Since it is a more qualitative methodology rather than a quantitative methodology, methods


39/123

32

to analyze its data must be quite different from more traditional or quantitative methods of

research in order to be able to investigate small samples in more depth.

The assumption for this study is that people who are informed or have experienced Cloud

Computing would be more familiar with the advantages and disadvantages and therefore

would be more able to form an opinion about its likelihood for their organisation. Their

opinion is also important since they are most likely to be the decision makers in such

scenarios, to choose whether to invest in Cloud Computing or not.

Qualitative research will also be applied since Cloud Computing is a relatively new

approach to Maltese Organisations. Neill (2007) pointed out that qualitative research is

used when the researcher may only know roughly in advance what he/she is looking for.

Thus, qualitative research is the most appropriate technique with which to ask Why and

How questions to discover new insights.

3.2 Research Methods

3.2.1 Data Collection Methods

The information was collected through a number of face-to-face interviews which were

carried out during June 2012. The interviews were all audio-recorded in order to be able to

analyse each opinion more deeply.

Primary data was collected from the semi-structured face-to-face interviews carried out

with top management personnel and with employees who are more technical. Semi-

structured interviews were chosen over questionnaires and other research tools as they are


40/123

33

the most convenient tool to analyse personal opinions. Secondary data was not used since

no such information was collected before. The semi-structured interviews consisted of

open-ended questions which were prepared in advance; leaving the respondents free to

give their opinion and not narrowed down to specific answers only.

The purposeful sample consisted of Directors, CIOs, CTOs, and Head of Departments

from different types of Maltese organisations, from different Industries: such as the

Gaming industry, IT services, and from Professional Services sector which include legal

advice, accounting services, auditing and tax advisory.

Semi-structured interviews were carried out with two Cloud Computing Service Providers;

namely BMIT and GFi. Similar questions were asked, in this case from the s uppliers

point of view. In order to be able to get an overview of the regulations pertaining to

Maltese business organisations, semi-structured interviews were also carried out with

Regulators, namely MFSA (Malta Financial Services Authority) and the LGA (Lotteries

and Gaming Authority in Malta).

3.2.2 Criteria for Sample Selection

The target population included a range of companies from various industries. These were

limited to those industries which make use of ICT in their day-to-day business processes.

Convenience sampling was used to select the companies from within the population to

conduct the interviews. This non-probability sampling technique is commonly used in

academic qualitative research, where time, workforce and money bound the researcher.

Samples are in fact selected because they are accessible to the researcher. The


41/123

34

disadvantage of convenience sampling is that the method is not a product of a randomized

selection process and thus the results cannot be inferred to the whole population.

Initially interviewees were informally contacted via acquaintances, LinkedIn and their

website. Subsequently interviewees were contacted via email to set an appointment to go

through the semi-structured interview together. I also informed all the interviewees that all

data gathered was to be used only for academic purposes, I forwarded them a

Confidentiality form signed by both my tutor and myself (found in Appendix A, page 103) .

Unfortunately it was somewhat difficult to set-up meetings for the interview given that

everyone is nowadays struggling with busy schedules and have less time to spare on

something which will not be of benefit to their organisation. However, I managed to

gather enough information for the purpose of this dissertation.

3.3 Semi-Structured Interviews Design

In general, the questions were structured to capture the respondents opinion about

characteristics of Cloud Computing that were found during the literature review.

3.3.1 Users Interview

General Information

First, I wanted to gather some general information about the interviewees.

Some questions that were asked to get an overview of the interviewee and the company

he/she was representing were similar to:

Describe the nature of your organisation In which sectors/industries do you operate? What is your title/position in the organisation?


42/123

35

What is the size of your company?

Cloud Computing Perception

I also wanted to investigate the interviewees general understanding of Cloud Computing.

In the cases where the interviewee was knowledgeable about the concept, I asked for an

overview with regards to advantages and disadvantages Cloud Computing could offer. I

will compare the different perceptions which were brought up during the interview to the

potential benefits and issues which were found out during the literature review. The

questions asked were on the lines of:

What do you understand with the term Cloud Computing? Can you mention some advantages and disadvantages of Cloud Computing?

On the other hand, in the cases where the user was not knowledgeable about the term

Cloud Computing, I explain what the concept implies. There were cases where the

interviewee was aware of some services which fall under Cloud Computing but was not

fully aware of the whole concept of Cloud Computing. In such cases, he/she were still able

to identify some perceived advantages and disadvantages.

Cloud Computing Usage

The last set of questions was the investigation of how Cloud Computing is being used/

unused within Maltese Organisations. I asked the interviewees about the relevance of such

services within their organisation. The first question was whether they actually make use

of any Cloud Service. This eventually led to a different set of questions: whether they are

current users, potential users or whether they think Cloud Services are not suitable for such

organisation. In each situation, I asked for reasons why such a decision was made.

All Users:

Are you aware of the different Cloud Computing Services currently in the market,

both locally and internationally? As a Maltese organisation, which solution do you see as the most suitable?


43/123


44/123

37

3.3.2 Service Providers Interview

In order to be able to evaluate well the use of Cloud Computing within Maltese

organisations, I also discussed some issues with the Service Providers in Malta. They have

hands-on experience of the perception of Maltese organisations vis--vis their services. In

addition, I wanted to extract some issues which are specific to Malta.

Some sample questions asked were:

Which sectors/ industries are the most popular within your Cloud Computing users

pool?

Average size of companies which are investing in Cloud Computing? SMEs or

larger organisations?

What do you think is the perception of Maltese organisations decision makers? Which cloud services do you offer? Which ones are the most popular? Any common issues which you face? How do you ensure security to your clients? Where there any legal requirements which kept you back from offering additional

services? Or had an impact on the services you are offering?

What would you say are the main benefits of Cloud Computing for Maltese

organisations?

Which markets do you see the most profitable in the near future?

3.3.3 Regulators

Another relevant party to this study comprises the regulators in Malta. These include the

institutions and governmental entities which supervise the authenticity of the Service

Providers while offering guarantees to the users. The following few questions were asked

to the regulators since the scope of these questions is only to offer an overview of the

regulations in Malta:


45/123

38

What are the legal issues which organisations should look at before investing into

Cloud Computing services?

Are there any regulations pertaining to Maltese Organisations related to Cloud

Computing?

Are there any compliance requirements or certifications that the providers need to

adhere to?

3.4 Data Analysis Technique

All interviews were audio recorded to be able to examine the interviewees opinions better.

These were later evaluated by transcribing them into different codes and sections for easier

interpretation, contrasting and comparison of the answers given. The coded transcripts and

audio-records are available in Appendix B (found on page 105) .

Once all data was captured, transcribed and evaluated into different sections and coding,

Data Analysis was carried out by extracting graphs from the data. Where this extraction

was not possible, evaluation of each different answer was made and recorded.

3.5 Limitations

Since Cloud Computing is a fairly new concept in Malta, the stakeholders lack own

experience about the subject, although some turned out to be very knowledgeable. Most of

the interviewees are still deciding whether to opt for Cloud Computing or are in the

selection process, so most of the opinions were based on research they made and not

through experiences.


46/123

39

3.6 Conclusion

The ultimate aim of qualitative research is to offer a perspective of a situation and not to

provide a final conclusion regarding a subject. Myers (2000) understands that the mission

of qualitative research is to discover meaning and understanding, rather than to verify truth

or predict outcomes.

The way arguments are presented in the next discussions consists of a set of findings, given

the limitations of the study.


47/123

40

4 PRESENTATION AND ANALYSIS OF DATA

4.1 Descriptive Statistics

In total, thirteen (13) individuals from different Maltese Registered companies were

interviewed. The size of the companies they represented ranges from start-ups of two full-

time employees to multi-national companies with one hundred forty full-timers in their

Maltese offices. Four companies have between one and nine employees (1-9), three

companies have between ten and fifty employees (10-50), while another six companies

have between fifty and one hundred fifty full time employees (50-150). All companies

interviewed are Maltese registered companies; however, six of the named companies have

several other offices around the world.

Figure 4.1 - Size of the Interviewed Organisations

1-9 Employees10-50 Employees

50-150 Employees

0

1

2

3

4

5

6

4

3

6

Size of the Organisation


48/123

41

The respondents come from different industries and sectors ranging from IT services

including web design and development, card payment industry, online marketing,

Professional Services offering legal advice, tax consultation, auditing services, traditional

accounting etc; to the Gaming Industry offering complete online gaming solutions and

betting.

Figure 4.2 - Nature of the Organisations

Figure 4.2 above shows where each organisation falls within the named sectors. The roles

of the interviewed personnel consist of Foundation Partners, Directors, Chief Technical

Officer (CTO), Deputy Chief Information Officer (CIO), Head of IS Architecture, Head of

IT Department and Head of Software Development. All the interviewed parties have an

important role in the acquisition and management of their IT system; hence, they were all

relevant respondents to fulfil the aim of the study.

0

0.5

1

1.5

2

2.5

33

1

2

1

2

3

1

Nature of the Organisation


49/123


50/123

43

The other international company which makes intensive use of Cloud Computing is a

Gaming company. The head of IS Architecture, explained how they utilise SaaS for their

financial systems, PaaS for their mobile applications and for telepresence systems, while

IaaS since they host both Private and Public Cloud Hosting. Unfortunately not much more

information could be gathered about the current use of Cloud Services from this company

since the interview was carried out via email (found at Appendix B) as the Head of IS

Architecture does not reside in Malta.

Figure 4.3 - Current Use of Cloud Computing Services within Interviewed Companies

During the time when the interviews were being carried out, three companies were

implementing Cloud Computing Services. That is, they were during the finalisation of the

requirements discussions with their respective selected Service Providers. Two of these

companies decided to opt for a local Service Provider while the third company was after a

well- established foreign Service Provider. The comments of these three companies

representatives were based on the thorough research they went through during their

analysis stage.

15%

62%

23%

Currently Using Cloud Services

Yes

No

Currently Implementing


51/123


52/123

45

in its own data centre. In addition, it uses its own data centre for application hosting and

then uses Citrix software for virtualisation and thin provisioning. Thin provisioning is the

act of using virtualization technology to give the appearance of more physical resource

than is actually available.

4.1.3 Cloud Computing Understanding

As we saw in previous chapters, there is no general definition of the term Cloud

Computing; this is also reflected in the answers obtained during the interviews. The

general idea to which most definitions refer, is that Cloud Computing consists of Remote

Services running on multiple remote Servers which can be accessed from any Internet

point usually through a portal (see Figure 4.4) . Other comments referred to the storing and

hosting of your own data on third parties servers. Also, related to data hosting, reference

was made to a pool of resources (both software and hardware infrastructure) shared

between multiple users. This takes us to a point, which a CTO of a company madereference to, that Cloud Computing services could be the outsourcing of any layer of your

infrastructure from lower to higher level, including the people. That is, you can use the

Service Providers service for maintenance, support and technical issues, instead of having

your own IT Administrator. This all depends on the requirements of the specific

organisation, as there might be companies which do not have the expertise, time or

resources to manage their own servers hence they outsource this requirement.


53/123

46

Figure 4.4 - Interviewees understanding of the term Cloud Computing

Other respondents articulated the possibility to scale within minutes through Cloud

Computing which otherwise would not be possible or would be expensive to do. The CTO

of a particular IT Company also made reference to the different cloud setups which exist,

mainly the Private or Public Cloud and continued that if an organisations opts for services

through a Service Providers public cloud, it would be eliminating the CapEx (Capital

Expenditure) costs but most probably increasing the OpEx (Operating Expenditure) costs

in the long run. Another general explanation of what Cloud Computing entails is the

0

0.5

1

1.5

2

2.5

3

3.5

4

4.5

55

2

3 3

11

Cloud Computing Understanding


54/123

47

capability of multiple as a service solutions, encapsulating software, hardware and

infrastructure.

4.1.4 Benefits, Issues and Concerns

4.1.4.1Benefits

Every business operates with the aim to make a profit; therefore, the majority of key

decisions are made by keeping the year-end profitability in mind. The decision either to

in

Documents

Incorporating Cloud Computing Services Within Maltese Registered Business Organisations