Going to the cloud must be cheaper than an onsite server! Right??
For many years small business has budgeted for upgrade of the company server every five years or so. And yet, for several years now CTP has been met with a hearty laugh in response to that upgrade cost – even knowing that the cost is pretty much in line with cost for the same work in the past. But – what business is still paying $1,200 month for 1.5Mbps Internet service when 100 times the service is available at a tenth the cost! Indeed, moving to cloud based service is not only fashionable, but works out dollar wise over the five year lifespan of the traditional server.
How to make sense of the claims for on-premises versus cloud hosted services? I like to start with an assessment of your business IT requirements. These will differ, for your company, of course, but to walk through an example, a business likely has:
- e-mail – on-premises Exchange, or hosted Exchange, or hosted IMAP / POP service
- File shares, with domain security to restrict access as appropriate
- Domain services for security and device management (Active Directory)
- Business specific applications – accounting, CRM, specialized software for you business.
- Backup, anti-virus
- Remote access – VPN or other technology.
- Security – multi-factor authentication, monitoring, encryption
For hosted services, this blog entry will focus on Microsoft Office 365. Microsoft developed a comprehensive and secure on-premise solution, hosted by Windows server operating system and Windows-10 or earlier PC operating system. All of the services listed in the table fit nicely into this system. To say the obvious, Microsoft has taken on with enthusiasm their cloud services platform – and they have worked tirelessly and aggressively to bring all of the functionality to Office 365 that was available on-premises, such that your on-premises server is no longer needed. In fact, Office 365 is a bundled suite of services targeted to just your business:
- Exchange Online – Full featured Exchange, secure mail, accessible via Outlook, smartphone, web portal, or other mail client.
- SharePoint Online – takes the place of your file server, though offering far more capability.
- Azure Active Directory (Azure AD) – This is an identity service, providing only some of the functionality of Active Directory. But it is sufficient to securely connect and manage a PC or mobile device, and provide SSO (Single Sign-On) for end-users of your company, with MFA (Multi-Factor Authentication) – sufficient for a small business to operate without an on-premises server.
- Remote access – Office 365 services are Internet based, and all access is encrypted by the same technology that is typically used for VPN solutions.
- Network security and monitoring – Microsoft has put very significant effort into network security and monitoring, and further, provide extensive tools to allow a customer company to also monitor access to their services.
In short, Microsoft has ported all of the Microsoft services that are available to the on-premises server – to Office 365.
That leaves two questions: what about my other business applications, and how to compare cost.
Regarding business applications – there has been such a concerted effort across the industry to offer cloud hosted services that it makes good sense to investigate the applications in use by your company to determine whether it is available as a service.
On the topic of pricing, it is likely that your company will find that you come out ahead with Office 365, and without the up-front hardware cost. There are many variables, of course – but our point here is that strong sell points for cloud services are i) cost savings through shared resources, ii) support by an organization that is focused on keeping software fully patched and up to date, and iii) a very high level of service and security. For a small company it becomes increasingly more difficult to justify replacement of that on-premises server.
Frequently Asked Questions
I have migrated all services from my local on-premises server to Office 365, turned off and disposed of my local server. I now access my data via secure HTTPS connections to Microsoft services. Do I still need a firewall for the company network?
CTP does recommend that all businesses operate behind a firewall, for these reasons:
- protect all network resources from inbound Internet connections and attempts to gain control of established connections. This includes computers, and also any other IP based devices – the Internet of Things, IoT.
- security services provided by most firewalls provide inspection of all traffic, looking for a range of problems – virus or other malware, transmission to known compromised Internet addresses, possibly disallowing from known high risk countries or locations, blocking access to known compromised web sites, and more.
- Throughput – as part of the processing of migrating resources from a local server to cloud hosted, attention should be given to the Internet connection. It has become commonplace for business class connections to provide 100Mbps service and faster. It follows that the firewall protecting the local network should be able to support that bandwidth, rather than serving as a bottleneck at significantly lower bandwidth. And this measure of throughput should take into account the impact of security services on data throughput.
- Availability – Having data cloud based will not help in the event that company Internet service is down. Granted employees can work from another location. However, firewalls can generally receive connections from two or more Internet Service Providers (ISP), such that Internet service remains available in the event that either of the ISPs goes down.
- Other security services may be available – for instance decryption of TLS connections for inspection, and restriction of web sites by content type.
One reason companies have justified an on-premises server is local performance – no one wants to have time to go find a cup of coffee while waiting for a file to open!
Performance will always be faster for the on-premises server – and yet many of the perceptions of local vs hosted services (LAN (Local Area Network) versus WAN (Wide Area Network) come from days when a fast ISP (Internet Service Provider) connection was 1.5Mbps (a T1 line), and often was much less. Today a typical business Internet connection is 100Mbps – the speed of the LAN not so long ago.
The question is not really fair – “is cloud service slower” – on a technical level, of course service will be slower working over the Internet. A different question might be whether performance accessing documents and information over the Internet is acceptable, or whether it is slowing down employee productivity. One perspective is that satellite offices of large companies have been operating over the WAN for many years – larger companies typically have a central data center, and do not place servers in satellite offices.
Discussion of network performance often centers around bandwidth. As important is latency – the time required for data to be received after placing the request. Years ago latency was typically in the 80 msec (MilliSecond) range – today it is generally below 14 msec. This can be the difference between waiting an inordinately long time to open or print a document, and having that operation complete in moments time.
The short answer is that performance of cloud service has been found to be excellent and highly workable for most companies over a number of years.
Where performance falls below acceptable, there are generally good options in the Boston area, including high speed fiber, coax and microwave.
With a smile!
Truly – for the needs of most small business, Office 365 services, including Azure AD (Active Directory) can provide all of the network services that have been provided traditionally by the on-premises office server.
There are office applications that are well known to not work well over the Internet or other WAN. Accounting programs are a widely used example. The transition by software companies to SaaS hosted solutions is widespread – it is highly likely that any software package that your company is currently using is now available as a cloud hosted service.
That leaves the networking services – DNS for name resolution, DHCP for automatic network configuration of computers attached to the network. Both of these services can be provided by the local Internet router or firewall present on the company network.
It follows, then, that the old on-premises server can be tossed following migration to cloud hosted services, including Office 365.
Office 365 services, including Exchange Online and SharePoint Online, provide highly available service through redundancy of databases, replicated both locally within a Microsoft data center and between different data center locations. These mechanisms make it highly unlikely that data will ever be lost for any of these services.
Data backup is different from replication. For instance, in the event that a corrupt file is saved, that corrupt file will be faithfully replicated to all instances, replacing the previous valid copy of the file. To be fair, both SharePoint and Exchange Online services include provisions for retrieving an older version of the corrupt file in this example. This does not get around the fact, though, that data is not backed up by Microsoft.
Third party services are widely available for backup of Office 365 services. CTP does recommend a third party backup, both for the case of retrieving a file version that cannot be retrieved from the Office 365 system, and also from the good practice of maintaining a full copy of your company’s data in more than one location – Microsoft, and the data center of the third party service.
Two-Factor Authentication requires an end-user provide a password and a code from a physical device. The term Multi-Factor Authentication (MFA) has taken the place of two-factor authentication, simply because the technology deployed initially for two-factor authentication has evolved, such that the implementation has become much broader than the initial systems for two-factor authentication, while retaining the requirement of authenticating with both something memorized and something obtained from a physical device.
Information stored as e-mail and file share data often makes up a significant share of the intellectual assets of a company. Said simply, loss of e-mail and file share data would be a very significant loss for many companies. In the traditional model of the past, that data was stored on a server located on-premises, backed up daily to removable media that was then stored off-site.
Moving of all company resources to a hosted cloud service is compelling from the cost standpoint. In the case of Microsoft Exchange and SharePoint Online, company data is stored in a shared database – either SQL in the case of SharePoint, or a close relative for Exchange. These databases are replicated to other servers – it is likely that Microsoft is maintaining at least four database replicas across more than one physical location.
If data of many companies is stored in a common database, how is that data kept private and secure? Here the respective platforms, Exchange and SharePoint, rely on security structures that restrict access of data to authorized accounts, and these structures are faithfully extended to all aspects of the service – the company address book, as displayed in Outlook, for instance, shows only company employees. And not to overlook, your company data can also be encrypted on either of these platforms.
Exchange and SharePoint Online are hosted services – Software as as Service – SaaS. Indeed, the model of providing a software as a cloud hosted service is not new, and has been widely adopted by business.
And so the answer is that corporate data, hosted on Exchange or SharePoint, is stored in a common database, kept private by security structures of the software, and optionally encrypted at the file or message level via a key that is unique to your company.
