By Jonathan Lewis, NS1
Cloud computing offers many advantages for the retail industry, and we’re seeing even more established retailers look to cloud adoption as they face a boom of new online competitors entering the marketplace. It’s happening fast and furious — a 451 Research study released in 2016 found that retail was boosting its spending on cloud storage faster than any other industry.
However, as more retail companies move to public cloud services, the more concerns about Internet outages have risen.
Advertisement
The recent Amazon S3 outage, for instance, had a significant impact on many Internet retailers. In fact, analysts found that the AWS downtime affected more than half of the top 100 internet retailers with a decrease of 20% or greater in performance. Many web sites went down entirely.
There’s a degree of truth in the idea that public cloud services have a higher risk of outages than those running on private infrastructure that is not shared by multiple customers. A primary exposure of using a shared service is the increased risk of attacks such as denial of service (DDoS). The target of such attacks can be the service provider itself or attacks that target their customers.
In such instances, as a subscriber, you can wind up in the unfortunate position of “collateral damage.” Each subscriber is a shared party to the cumulative, collective risk of all subscribers. In many cases, the service itself is attacked, although the target is only one of their subscribers — impacting all subscribers.
Shared services bring with them another risk as well: the increased scale and complexity of multitenant, highly dynamic data center operations. These operate at much larger scale, are more dynamic and are functionally more complex than dedicated private data centers. Subscribers are dependent on their providers “getting it right” 100% of the time. Logic and experience tell us this is not possible.
These risks seem to suggest that retail companies need to rethink the transformation strategies that are driving their adoption of cloud services. Should they confine these to non-critical functions only?
The real story is that you are merely substituting one set of risks for another by taking mission-critical services in-house, while foregoing the cost and agility benefits that are vital to maintaining competitive advantage. Most infrastructure services require specialized skills to operate effectively and reliably. The cloud providers that deliver these services have that as their primary mission. They have the staff, expertise and focus to do it better than the vast majority of enterprises can do on their own. So in spite of the aforementioned risks and issues, bringing services in-house is not the answer.
The answer lies, first and foremost, in coming to terms with the fact that regardless of the provider and the 100% service-level agreement they offer, outages will happen. The right response is to make sure you have designed your deployment of public cloud services for redundancy. You may need to think a couple of levels deep. The S3 outage revealed unexpected dependencies, in that businesses that weren’t even S3 subscribers were still impacted. So to whatever extent is practical, avoid “downstream” single points of failure in your redundancy strategy.
This applies to your DNS service as well. It is critical to have a secondary provider — and one that is not using the same facilities as your primary. Ensure that you are running storage and database services from more than one facility. Sometimes there are added costs and complexity to redundancy, but that’s not always the case. Have a detailed discussion with your service provider about what redundancy options are available. If that discussion does not yield the answers you need, talk with other providers. Make sure that you get the redundancy you need so that your online business stays up and running.
Jonathan Lewis is Vice President of Product for NS1. He brings more than 25 years of experience in the IT industry in a career comprising product management, product marketing, customer service and systems engineering roles. Prior to NS1, Lewis led teams at Nortel that brought numerous network and security products to market including IPsec gateways, SSL VPNs and end point security. He played key product marketing roles, contributing to the success of mid-size and start-up companies, including Arbor Networks and SSH Communications Security. He holds B.S. and M.S. degrees from McGill University, an M.B.A. from Bentley College and a CISSP certification.
