Stop Hugging Those Servers!

Transcript

Chase Cunningham: 98% of businesses are not in the cloud entirely.

Rahul Subramaniam: There’s been an incredible amount of fear mongering.

Chase Cunningham: Bill Gates and Jeff Bezos don’t wake up in the morning and give a about your cloud security.

Rahul Subramaniam: It’s imperative that you start adopting the cloud. So you might as well think about it now.

Chase Cunningham: I have to be careful with the server huggers because they’re not wrong for wanting to hug those warm servers.

Hilary Doyle: This is AWS Insiders, an original podcast by Cloud Fix about the services, patterns and future of cloud computing at AWS. Cloud Fix is a tool that finds and implements 100% safe, AWS recommended cost savings. It’s fixes, not just analytics. I’m Hilary Doyle, joined by Rahul Subramaniam. Rahul, how’s it going over there in Chennai?

Rahul Subramaniam: Really well, Hillary. How are things at your end?

Hilary Doyle: I’m fine. It’s getting a little chilly over here. Give me a quick temperature update and then we can move on.

Rahul Subramaniam: It is about 30 degrees centigrade here, so a lot warmer than at your end. But I’m happy to trade temperatures anytime.

Hilary Doyle: I’ll be there in 18 hours. Welcome to my head swap. In this episode, the timely topic of real estate. What kind of home do you want for your data, your stack, your instances? Where should you house your architecture? In a nice bare metal colo rack bungalow? Or maybe something a little more penthouse fabulous. A few stories up overlooking the treetops, something up in the clouds. Yes, in this episode we debate on on-premise versus public cloud. Rahul, how are you defining our terms?

Rahul Subramaniam: The first is what I would call the on-premises.

Hilary Doyle: Okay.

Rahul Subramaniam: And I have a pretty broad definition for that one. It ranges from a server sitting under a developer’s desk and being used as a footrest or leg rests or foot warmer, to what others might refer to as their private data centers. And of course the second is the public cloud. And for me, it really is just the three main players in this space. You have AWS, Google, and Microsoft.

Hilary Doyle: And where does a private cloud fit into this living arrangement?

Rahul Subramaniam: Okay, so some people refer to these on-premise setups as private clouds because, well, you can access the server from anywhere. I mean, let’s just say that, in most cases the word cloud is being used with a generous sprinkling of literary license. I mean, when someone says private cloud, I have usually found them to mean, I don’t understand this, so it must be the cloud.

Hilary Doyle: Oh. I’m going to use that for anything I don’t understand. Not to worry, it must be a cloud. Okay, thank you for the context. So the fundamental question here is, can enterprise do this better than public cloud? Even for a cloud computing wizard/nerd like you, the case for public cloud may be harder to make than we think. You’re going to discuss this and more with our guest Chase Cunningham. He is a former Chief Cryptologic Technician with the NSA. I mean this guy does not play when it comes to security; he has worked with the best of the best. Plus we’ve got a tasty use case. I’m going to take that back. I don’t know that it’s tasty, but it is food related. And you have hot takes your tips and tricks, but first here are your AWS headlines.

We have some big news here at AWS Insiders and it has to do with re:Invent. You and I are going to Las Vegas for it.

Rahul Subramaniam: Yay.

Hilary Doyle: So is the podcast, I know. We are taping a special episode each day of the conference so that our listeners can feel like they are on the floor with us except up in this very fancy suite at Nobu.

Rahul Subramaniam: And of course we will be hosting a series of keynote watch parties.

Hilary Doyle: Very excited.

Rahul Subramaniam: And right after every one of those keynote ends, we will record our reactions to all of the news and pop it right into the feed.

Hilary Doyle: And we will also be joined by a special guest in every episode. Rahul, you are an OG of reinvent, you’ve been to everyone. I want to know what you’re looking forward to.

Rahul Subramaniam: So I think given the current climate, it’s fairly obvious that they should be talking about cost and optimization and efficiency. So I’m assuming that there are going to be tons of announcements around that this year.

Hilary Doyle: We’ll be covering Adam Selipsky’s talk as well as Werner Vogels’. What are you anticipating some of the launches will be?

Rahul Subramaniam: Oh, I think they’ll continue down the serverless setup, but I think they’ll also double down on how customers can leverage these more efficiently. So it’s definitely a cultural shift for them.

Hilary Doyle: What do you mean: cultural shift?

Rahul Subramaniam: If you come to the world today, you’re finding developers completely confused about what the best way to put together these 900,000 API looks like. And so AWS is being forced to offer opinions about the right way to do some things. And this goes against the grain of 15 years of culture. So it’ll be interesting to see how this shift happens and I’d love to see this mutation in their DNA.

Hilary Doyle: Okay, so check the feed from November 28th to December 1st for Rahul’s watch party. And now back to regular, but also very interesting news. Some timely pricing updates from the cloud. We are in an energy crisis, as much of the world works to divest itself from Russian oil. That’s been a long time coming. Public cloud prices are expected to jump by 20% in America and almost 30% in Europe. This will not spare the three big providers. Rahul, how is this shaping your thoughts on cloud migration?

Rahul Subramaniam: Well, let’s not just pull the ejection handles yet on public cloud. I mean, you can tell that I just got around to watching the latest episode of Top Gun.

Hilary Doyle: Oh my God, at last. Okay. Yeah. That’s why you’re wearing the helmet.

Rahul Subramaniam: Absolutely.

Hilary Doyle: Yeah.

Rahul Subramaniam: The projected price hikes are attributed to the increase in energy prices as well as the increase in cost of capital in both the US and Europe. I mean, here’s my take on this. AWS, I feel is unlikely to raise prices on existing services, but it’ll probably look at raising prices on some of the new instance types or services that they create. The other providers have had a history of raising prices, so I wouldn’t put it past them to do it again. The point however is, that the vast majority of customers at the public cloud use low level compute services, which have no advantage in terms of price, and they really need to move up the stack.

Hilary Doyle: Okay, so is that the best way to avoid price hikes?

Rahul Subramaniam: Yeah, I mean the use of higher order services is what will cut your cloud bill by 90%. Lastly, I mean no one seems to look at cost in terms of the total cost of ownership. The cost you should compare must include all your Oracle and Microsoft and all those other kinds of licenses, as well as the people cost associated with managing your non-cloud setup. When you do the math, the public cloud still comes out way ahead.

Hilary Doyle: And finally, Rahul, you’ll like this. There was a great quote in the register recently that said, “It’s not software as a service, it’s software as a hostage.” Respond.

Rahul Subramaniam: When it comes to Oracle licensing, absolutely.

Hilary Doyle: Rahul, before you landed on the public cloud, what did you use?

Rahul Subramaniam: Wow, that is a long time ago. So there was a time when I was involved in managing servers in large racks in a room, and the dress code was a big snow suit. Because, I mean, they used to keep those rooms so unbelievably cold and-

Hilary Doyle: You needed the foot warmers.

Rahul Subramaniam: Yeah. So from there we had a few colo facilities before moving most of our servers to Softlayer, which is now owned by IBM. And this was back in the early 2000s. I’m so glad those days are behind me now. I’ve had my share of nightmares with all of those servers.

Hilary Doyle: How did you first come to the cloud, which was then only AWS, right?

Rahul Subramaniam: So this is back in 2007 that we’re talking about and a time when the entire company ran basically on Lotus Notes. Our main server had crashed and tech support had estimated that it would take days if not weeks to fix that.

Hilary Doyle: Oh god.

Rahul Subramaniam: And that was when I was really looking for a beefy machine to replace it immediately. Again, we had a crashed server. As I was looking for alternatives, I came across AWS. At that time they just had EC2 with maybe a couple of instance types and I was able to create an account and launch an instance in a matter of minutes. Best of all, I was getting charged by the hour instead of needing to make this year long commitment that I had with these colos and that experience just blew my mind.

Hilary Doyle: Sounds like a really welcome evolution in the beginning of a beautiful love story. For anyone emerging from the cold grim history that you’ve just described, you’d think they’d be all up in the cloud at their first opportunity but we’re seeing a significant majority of enterprise still on-premise. If the cloud is so great, why is the adoption so low?

Rahul Subramaniam: Moving to the cloud is a huge organizational change, and it takes really strong leadership to overcome that inertia. To give you some sense of that, the day we decided to shut down Lotus Notes and move over to Google Workspaces, or what was then Gmail, we had hundreds of employees tell us that it was possibly the worst decision that the company had ever made.

Hilary Doyle: Of course.

Rahul Subramaniam: For most organizations, personnel backlash like that is just too much friction to overcome and the status quo just feels simpler and easier. For us, the change to public cloud and using best of breed managed SaaS services was the real growth driver and game changer. And while initially extremely painful, it was the right decision to make at that time.

Hilary Doyle: Before we get to our chat with Chase Cunningham, Rahul, let’s smash today’s use case. Puns will be rife through this, so a word of warning to those who have a difficult time with puns. Here’s my question for you. Do you enjoy a cheeseburger?

Rahul Subramaniam: Hilary, you just struck a nerve.

Hilary Doyle: Oh.

Rahul Subramaniam: I mean you guys make it so complicated with what you call things.

Hilary Doyle: Yeah.

Rahul Subramaniam: You know that I’m vegetarian, and so the first time I came to the US I ordered a cheeseburger.

Hilary Doyle: Right.

Rahul Subramaniam: Cheese being the operative word.

Hilary Doyle: It always is.

Rahul Subramaniam: Only to discover that it was a beef burger with some cheese thrown in. Where I come from, you order a burger but get to choose a veggie or a meat patty. So the long answer to your question, I love a burger with a vegetarian patty and cheese.

Hilary Doyle: I’m sorry that this has started out as such a painful use case for you. But welcome to cheeseburger history.

Speaker 4: Your order, please.

Hilary Doyle: Jack in the Box is one of America’s first burger chains. It’s over 70 years old, has a tradition of innovation. In fact, they invented, Rahul, they invented the two way intercom thingy that we use in drive-throughs.

Rahul Subramaniam: Did you say they were a burger company or a tech company?

Hilary Doyle: They’re a burger company with some tech thrown in for good orders. And their tech has led to major growth and a degree of obesity. They now have over 2200 franchises serving half a billion annual customers. And despite that, over the last decade, they’ve seen a really steep decline in revenues year over year, due in part, fine, to healthier eating trends. Welcome. And, let’s face it, the hipster burger. But also due to a sudden lack of innovation on the back end, which has been having a negative impact on their kitchen. Rahul, please take the line order on this use case.

Rahul Subramaniam: Hillary, have you seen the wild picture of a Big Mac that some guy let sit on a table for months?

Hilary Doyle: I have not, but I can imagine what it looks like. Exactly the same.

Rahul Subramaniam: It’s a petrified burger. You could say the same for Jack in the Box’s data center.

Hilary Doyle: Yeah.

Rahul Subramaniam: I mean you’re going to think I engineered this so I could talk about the things that I hate the most, but they were running Oracle and Microsoft SQL Server legacy databases, and what Jack in the Box wanted to do was fully revamp that old data pipeline and build a scalable and flexible infrastructure pipeline. This was the goal when they started a full migration to the cloud. This story is already starting to make me hungry.

Hilary Doyle: Not me. We are talking about Jack in the Box. But somebody got this guy a snack while I get Chase Cunningham. Chase is the chief strategy officer at Ericom Software, a web isolation and remote application access software company. He is a former, wait for it, Chief Cryptologic Technician with the NSA, where he ran cybersecurity and worked closely with the FBI, CIA and the Department of Homeland Security. Oh my god, I’m so excited to speak with this man. Let’s get right to it. Chase, it’s terrific to meet you.

Chase Cunningham: Yeah, thanks for having me on.

Hilary Doyle: Welcome to the show. Let’s start here. I know Rahul is all in on the public cloud, but we know that a majority of enterprise isn’t. So what does enterprise know that the rest of us?

Chase Cunningham: Well I think I saw a study that was published, this month actually said, I think it was, 98% of businesses are not in the cloud entirely, which is a pretty staggering statistic. And it’s because there’s been a rush to go cloud, cloud, cloud, but no one really stopped and thought about, what should actually go to the cloud and how should we migrate to this thing correctly? And then they took 10 pounds of crap and shoved it into a five pound sock and thought they got it right.

Hilary Doyle: That’s a delightful visual metaphor. Rahul, where is on-prem fitting into your thinking these days?

Rahul Subramaniam: I agree with Chase, that a lot of people have rushed into the cloud without really understanding what the cloud is good for. They typically opt for lift and shift, which really is a crappy way of doing things. I mean, it’s not what the cloud is meant for. You leverage the cloud for its elasticity, you leverage it for its scale, you leverage it for also taking away a lot of your operational burden. At the same time, there’s been an incredible amount of fear mongering about the cloud. People point to those few instances of disastrous implementations that has just prevented a lot of enterprises from moving the right way to the cloud.

Chase Cunningham: I don’t know if a few’s correct, because man, on a bad day if I woke up and decided I’ve just had it and I’m willing to wear an orange jumpsuit, I could destroy so much cloud infrastructure. Bill Gates and Jeff Bezos don’t wake up in the morning and give a damn about your cloud security, they don’t. They give you resources, you have to secure the resources. There’s this massive misconception with security of the cloud, and in the cloud.

Rahul Subramaniam: I distinguish the security aspects in two ways. One is, if you put a moron in either the private data center or a private cloud or the public cloud, you can create an equal amount of disasters. I think there’s an incredible aptitude for ineptitude, and that exists in both the public cloud as well as the on-premise data centers. But there’s some aspect of that infrastructure security that you are trusting the likes of AWS to do, but then there is a large amount of security and stuff that still falls on you because you are developing the application. If you don’t understand that and you just say, oh everything is AWS, I mean that’s just wrong. AWS has very publicly and constantly said, it’s a shared security model.

Chase Cunningham: It’s shared in that, that’s a marketing term that they put out there to say, “We share your security, we,” whatever. I mean it’s given Barney Fife a nuclear reactor. I mean like, “Yes, we’ll give you all this cool capability and we share the responsibility, but when things go sideways for you,” it’s not on them. They give you the stuff, you screw it … like you said, I love your point on the aptitude for an aptitude, I’m totally stealing that.

Hilary Doyle: When you’re talking about mis-configuration, where does that start? Is that starting at the enterprise level and then moving into the cloud or is that something that’s happening within the cloud? How do we work against that?

Chase Cunningham: Well, I mean the cloud is great as far as scope and scale and spin up and spin down and Kubernetes and all these other cool things, because that’s what it’s there for. But scale is also problematic if you don’t have a really good plan, technology and capability in place to manage the scale. A problem of X1 on an on-prem thing, I can live with that. A problem of X37 in the cloud, all of a sudden it’s an end of day’s mother of God type of issue. And that’s proven itself time and again. So I have to be careful with the server huggers because they’re not wrong for wanting to hug those warm servers. I mean, it keeps you warm at night and-

Hilary Doyle: They are so warm.

Chase Cunningham: Yeah. There’s benefit to be had if you do it correctly, but most of the time correctly is a bridge pretty far.

Rahul Subramaniam: So I’ve got to borrow this server hugger from you. That’s a really neat way of putting it.

Hilary Doyle: This is a nice back and forth between the two of you. You’re going to walk away talking just like one another.

Rahul Subramaniam: So here’s a question for you, Chase. When you talk to customers, of course there’s this first category of folks who are basically, they don’t know what the cloud is, it’s a buzzword and they’re like, “No, we are just going to the cloud.” I call those folks people with a lack of education. So let’s talk about the other ones who have evaluated the cloud but then decided that, “Nope, we are going to stay on-premise.” What are their typical reasons for choosing on premise? What do they feel that they’re better at on premise as against the cloud?

Chase Cunningham: Well, usually I think what happens with the folks I talk with is they run into the realization that the benefit that they would get from cloud over time is not as great as they had initially thought. Either, whether that’s financially, or organizationally, they’re not really coming with a very valid reason of why to go to the cloud. I was doing some stuff with a candy company, I can’t say their name, but they make candy. And their thing was we’re going to move to cloud because somebody had sold them on cloud stuff and then they were also going to set up their own security operations center. And my point was like, “You guys make candy. So why are you using all this crazy newfangled stuff when you don’t need to?”

And then there’s also the organizations that look at the cloud sort of posture and they will back off and go, “You know what? From a risk profile, I’m not willing to accept the risk that we will have some sort of overt problem like everybody else has.” And they table the cloud for now. I think we’re starting to see, honestly, a lot more of that because hybrid cloud sort of on-prem for X and off-prem for Y is becoming a pretty dominant strategy. I think logically it makes sense. Strategically, I think it can make sense. But the cost is an issue there. The OpEx, operational cost as well, can be part of that whole thing.

Rahul Subramaniam: True. And in terms of the cost comparison that you just spoke about between on-prem and cloud, how do they go about doing the math for it. Just for some context, I mean I’ve been involved in over 150 acquisitions of enterprise software companies, and in my experience the average server utilization that I’ve found in data centers that we’ve acquired as part of this process has been less than 5%. People over provision like crazy. I can’t even begin to describe how much over provisioning and waste happens in the on-premise data centers. Is that even a consideration when these folks do this comparison?

Chase Cunningham: Yeah, some of the more adept organizations are starting to ask that. But then I’ve also run into some organizations where they look at it and they go, “Well, you know what? With the way that VMware and Dell and some of these other organizations are able to upgrade their capabilities and really almost have cloud type capabilities,” they’re moving to that. Because I mean if Moore’s Law continues to apply, we continue to get more capability. I mean the servers that we had now are not the servers we had three years ago.

Rahul Subramaniam: But that kind of utilization is still really, really hard to do.

Chase Cunningham: Well, and that’s where some of the SLAs outsourcing and third parties can help too. Because I have seen organizations that have got really specific things with their partners that are managing, maintaining and feeding the beast that are working to kind of dial that in where they’re not dumping 95% of something down the toilet.

Hilary Doyle: Chase, you’re a security expert. Security is often paired with compliance. So, which does compliance better, on-prem or cloud?

Chase Cunningham: Well, that’s where I think that the hybrid model makes a lot of sense, because if I’m hugging my servers that have my compliant information in it, then I have a really bounded compliance thing that I can kind of solve for. That’s a lot of advice I give to organizations is, your super critical stuff, your compliant data, those types of things, it makes sense for me to upgrade, optimize, continue to keep that kind of hybridized on-prem type thing, literally for the sole purpose of minimizing the misery from a compliance engagement. Whereas, if you take everything and you go, “Let’s go super cloudy,” you skidder that across whatever. Guess what? That whole cloud now becomes a compliance problem.

Rahul Subramaniam: But Chase, on that I actually see a huge hypocrisy with large enterprises.

Chase Cunningham: Yeah.

Rahul Subramaniam: Here’s the thing. The other part of it, which I get really surprised by, the largest organizations that talk about, “Hey, we are so compliant, we are so security conscious.” If you look at the number of fines and penalties that they’ve paid to the regulators over the years for just breaches in their own private data centers, you know that they’ve not got stuff right.

Hilary Doyle: Rahul, a common thread we hear about on premise ERP is cost. I know that you’ve talked a lot about this misunderstanding we seem to have, the rest of us as lay people have around cost of ownership. That we don’t think about cost of ownership correctly when we’re comparing on-prem versus cloud. Could you just walk through that argument for me quickly?

Rahul Subramaniam: Yeah. I think what we don’t realize when we deal with a lot of the on-premise stuff is that, we’ll only look at the server cost and traders CapEx and then amortize it over the next three or five years or whatever time period they chose and choose, that as the number to argue against the cloud. But when it really comes down to the math of it, of course there’s a massive difference between OpEx and CapEx. When I talk about total cost of ownership, it is all of your license fees that you pay for on premise stuff, and Oracle and Microsoft do an amazing job of squeezing every last bit that they can from you year over year. And no one takes that cost into account.

You should just assume that your cost of license is going to go up by 20% year on year. Nobody accounts for that. You don’t account for the people that are involved in managing all those servers, managing all those contracts, managing procurement, all the compliance stuff that you had to go through just getting all that hardware. Nobody’s talking about any of that stuff. So when you want to do apples to apples comparisons of cost, you have to for all of that stuff and not just that amortized cost of the server alone.

Chase Cunningham: But you should also, when you look at the cloud, which people seem to forget, is you should look at all the services things that all of a sudden fall into the cost of cloud, whatever else because there’s all these little, death by a thousand cuts things that vendors are putting into cloud systems. And before you know it, you’ve got an arterial bleed because you’ve been like, “Well, I have to have this.” And then they go, “Well, that makes this work better. And then this is your optimizer and,” da da, da. I set up some dev stuff I was doing and I needed a node. And before I knew it, I was paying 500 bucks a month for this node to operate. And I’m sitting here going like, “Well, what? Wait, this was supposed to be a $1,50 type of problem.” And then oh, all of a sudden I’m six, seven X, what I would have been.

Hilary Doyle: This has been such an enjoyable conversation. One key takeaway for listeners coming out of today. Chase, what is yours?

Chase Cunningham: For me, it’s deal with reality and strategize on everything that you think you should do, and understand the totality of the decision before you move to anything. That’s pretty much what it ought to be.

Hilary Doyle: Rahul.

Rahul Subramaniam: If I were to look at the reality today, and extend that argument, I would say, prepare for the cloud because what you were able to do over the last 10 years or more in your data center is no longer possible there. If you want to stay in business, you want to grow, it’s imperative that you start adopting the cloud. So you might as well think about it now. Strategize about it now. Learn about it now. And get there quickly.

Hilary Doyle: Right on. Chase, thanks for helping us all get a little safer. We really appreciate it.

Chase Cunningham: Yeah, it’s fun stuff.

Rahul Subramaniam: This is a lot of fun. Thank you so much.

Hilary Doyle: On-prem to public cloud, easier said than done, Rahul. For those in the enterprise world, eyeing this migration with a little trepidation, what are some useful tips they can keep in mind?

Rahul Subramaniam: Okay, here it goes. So you have to understand that the public cloud is a completely different paradigm. Trying to lift and shift your on-premise workloads as is, is like fitting a square peg in a round hole.

Hilary Doyle: So hard.

Rahul Subramaniam: And you have to leverage the public cloud for its elasticity and event driven architectures.

Hilary Doyle: Great. Tip number two.

Rahul Subramaniam: So here’s tip number two. Okay, when you’re comparing costs, you have to evaluate the total cost of ownership, and the benefits of OpEx over CapEx, and not just list prices across the two providers. It’s got to be more than that.

Hilary Doyle: You bang the drum on this often.

Rahul Subramaniam: Very often.

Hilary Doyle: We need to understand cost of ownership. Tip number three.

Rahul Subramaniam: That almost scared me, Hillary.

Hilary Doyle: Sorry. Tone it down, Doyle. Yep, go on.

Rahul Subramaniam: Lastly, do not underestimate the effort you will need towards change management. And this is really important. It is way harder than you estimated, but critical if you want a step function change in your operating model.

Hilary Doyle: Let’s get back to burgers, or chicken tenders and french fries. Maybe throw in a few tacos and some egg rolls. It’s a weird combo, but the menu’s eclectic at Jack in the Box. Some call it a historic US burger chain. Others say, “Nope, it’s just that the burgers taste old.” Anyway, when we first tabled them, they were in a real pickle and needed to catch up to the times when it came to their old school data center set up. Rahul, how did they migrate and was it a success or a lunch bag let down?

Rahul Subramaniam: So Jack in the Box is thriving.

Hilary Doyle: Is it though?

Rahul Subramaniam: Well, at least from a tech standpoint.

Hilary Doyle: Got it.

Rahul Subramaniam: So moving from the data center to AWS has revolutionized their IT, and that has had an incredible effect on their food services, so I’m told. Now using RES and Redshift for data warehousing, has automated time consuming IT admin and cut software and hosting costs dramatically. And franchisees now use a shared operational dashboard powered by AWS to analyze all of their sales, their inventory as well as the labor patterns. And they use SageMaker to predict customer traffic and optimize service time. I mean, Jack in the Box also runs their mobile app and delivery services now on AWS. So this really is an example of a company going all in on AWS.

Hilary Doyle: Great. Let’s call them a tech company and not a food company. Feels better for everyone.

That’s it for us for now. We’ll be back. You’ve been listening to AWS Insiders from Cloud Fix. I’m Hilary Doyle.

Rahul Subramaniam: And I’m Rahul Subramaniam.

Hilary Doyle: Cloud Fix is an AWS cost optimization tool. You can learn more about them at cloudfix.com. Check out the show notes.

Rahul Subramaniam: Leave us a review and please follow us.

Hilary Doyle: Catch you later.