For all the distress the coronavirus has caused, most businesses would agree on a couple of things - it’s not the last crisis they’re likely to face, and in many respects it’s exacerbated pressures that already existed, but were perhaps easier to ignore. Realistically, enterprises have to be ready for disruption as a matter of course. 

Whether in technology, regulation, the competitive landscape or customer expectations, the pace of change means every business is regularly called on to manage transformation and navigate shifts to a degree that was unthinkable just a couple of decades ago. Viewed in that context, cloud doesn’t just provide the elasticity to ensure an organization can weather the pandemic and its aftereffects. It grants access to the speed, agility and collaborative capabilities that a digital business environment has demanded for years, and will demand even more in the future. These capabilities come at a cost; cloud requires significant and sustained investment, and a clearly defined strategy. But as some early adopters are demonstrating, the end result is a competitive edge.

Yet the coronavirus outbreak has also highlighted the ability of some companies - take Netflix or Zoom for example - to leverage the cloud to scale into unprecedented levels of demand, with minimal fuss and seemingly overnight. 

So what separates a cloud adopter from a business that’s cloud-centric, or a solid cloud strategy from one that stumbles? According to ThoughtWorks experts, it starts with a few guiding principles.

“The advantage of that is that you can start thinking about innovative release and software development cycles that couldn’t exist when your infrastructure was physical,” Chawla says. “Yet companies don’t take advantage of that virtuality, or ability to experiment.” 

Cloud also opens “great opportunities for companies to unlock future businesses by understanding their data,” Chawla adds. More cloud providers are developing platforms that give companies on-demand access to artificial intelligence and machine learning solutions, enabling a ‘plug and play’ approach with components that they might struggle to develop in-house. “It’s hard to do machine learning and AI on premise - it takes knowledge, it takes hardware and it’s a different skill-set. But on the cloud, it’s literally at your fingertips.” 

That access paves the way for more data-driven approaches to development where customer feedback is seamlessly collected, analyzed, and directly translated into product enhancements or even new products; and that makes it feasible to spot customer or market trends while they’re still taking shape. In volatile times, anticipatory intelligence of this kind can rapidly become a business’s biggest asset.

“In the past, once an application was delivered it was handed over to an operations group which would have ways of escalating incidents, and it wasn’t until the very end that the team responsible for maintaining that application might get involved,” says Shaw. “They’re going to need to get involved much more quickly. Development teams will have to change, to add operations into their skillset, to understand how to build software so they can find out what’s going on with it in production and fix problems.” 

Business leaders should also be aware of the changes cloud can bring to operating cost models. The assumption is often that cloud will generate savings by reducing the expenses associated with maintaining (and constantly expanding) on-premise infrastructure, but the reality is more complex. What’s more, excessive focus on costs may blind companies to cloud’s more compelling opportunities.

Chawla notes that cloud tends to absorb parts of the budget that companies don’t anticipate, such as software licenses. It also doesn’t necessarily adhere to old annual budgeting cycles. Costs may not be fully visible until projects are up and running, and can (and should) be optimized on a rolling basis. 

“There’s much more of a learning curve for finance,” he says. “They can’t just show up once a year. They should be part of the feedback loop, part of your cloud center for excellence, immediately.” 

“Cloud delivers primary value as an accelerator, not as a cost savings engine,” says Murray. “Many enterprises will see rising costs unless it’s carefully managed - some due to lack of oversight and some due to seizing delivery acceleration opportunities that use more resources than would have been available on-premise. But given cloud provides such a wide range of utility services, talking about ROI on a cloud investment is a bit like trying to calculate ROI on your electricity investment.”

Ultimately in the cloud journey, as in product development, questions about where or how much to invest, and which projects to prioritize, have to be examined in terms of value to the customer or end-user. 

“When people ask me what infrastructure tools they should have or what cloud features they should use, the questions I have are: What you are trying to achieve, and what do you need to be delivering to users?” says Morris. “If that’s not clear, you need to stop and work out the user journeys, the offerings and the products first. Then bring it down to identifying the software you need to build to deliver on those things.” 

Considering the degree of change involved in a cloud transition, particularly for large enterprises, an incremental approach where transformation is pursued in “vertical slices” can be less jarring - and reduces the chances of problems only becoming apparent when it’s too late to alter course.  

“Rather than starting with a piece of infrastructure or particular application, start with a customer need, whether it’s to add a new product or feature, or improve an existing product,” Morris explains. “Pull together all the people that are needed to make that happen from across the stacks. Tackle a slice that’s small enough to start with and tractable. The important thing is to get the feedback cycles, to get something out into users’ hands so you get their input and find out whether it worked and what could be better.”

Learn to look at security differently

The cloud also necessitates new security practices - though perhaps not in the way business leaders expect. Research shows security vulnerabilities remain by far the biggest concern for companies contemplating a cloud transition, particularly when it comes to the public cloud (that is, cloud services provided by third-party vendors via the public internet). Most fears center on possible data loss and breaches of confidentiality.

The reality is the formidable resources deployed by major vendors make public cloud services far more secure than the typical enterprise systems. “There’s no one on the planet doing infrastructure security better than the major cloud providers,” says Murray. “They know more about security and threats than anyone else ever could, because they’re operating a large part of the world’s internet infrastructure and seeing the attacks first.”  

Enterprises need to learn to distinguish between infrastructure security - most of which is outsourced to cloud vendors - and application security, which they must address as they build and manage software on the cloud. Historically, enterprise security teams have been more infrastructure-focused and may lack the software capabilities needed to achieve security outcomes in the cloud environment.

“If your security organization doesn’t have a development team that can go in and build and execute the guard rails, or doesn’t know how to leverage the APIs, they won’t be able to secure your cloud,” Chawla notes.  

Cloud calls for a more iterative, risk-based approach where security isn’t a series of constraints introduced at the beginning or end of the process, but a shared responsibility, integrated into development through exercises like threat modeling workshops. 

“Security people need to be going into development teams and working with them to understand what they see as the important threats, and providing the tools they need to respond,” says Morris. “As a developer, I shouldn’t have to wait until I’ve got a release ready to go for it to be tested to find out whether it’s secure. It’s too late by then - and it’ll be very expensive to fix.”

As with development, security in a cloud environment may require teams to be more collaborative, dynamic, and even to learn new or retool existing skills. But despite that, it shouldn’t be viewed as problematic, or a burden that’s likely to slow the company’s progress - in fact, the opposite is true.

“In the old world of hardware and large monolithic assets, it was considered more secure to throttle change with toll gates and security reviews under the assumption that your existing site was secure and any change might introduce a vulnerability,” says Shaw. “But in the cloud-native world, the faster you can move, the more secure you are. The assumption is that you’re fundamentally vulnerable all the time and an attacker may have already gained access. By continually renewing and rebuilding your hosting environments, you’re always returning to a safe state and able to quickly roll out patches when vulnerabilities are discovered.”

“Cloud (providers) are becoming much more effective at giving sensible defaults or even higher-order services that reduce some of the risk, but there are fundamentally still some spaces in which developers will have access to new tools that they don’t know how to use securely,” says Murray. “However the solution to that can’t be to not go to the cloud, because inherently the cloud can only be more secure.” 

“The way to respond is organizational education, organizational structure and making sure operating models get updated for the speed of delivery and tooling cloud provides,” Murray adds. “You should never look at the cloud as a risk to security - only an opportunity.”

Multi-cloud strategies can also benefit the business by providing access to a particular vendor’s strengths, or better pricing arrangements. At the same time, as many firms have discovered, juggling or switching between multiple vendors can significantly complicate the many challenges of cloud deployment and management. 

Ideally the enterprise and its primary cloud vendor forge “a very intimate relationship,” Chawla says. “You want the vendor to understand your business, and to care. If you do it right you’re going to have a great opportunity to leverage them again to help you build what you want to build. Managing any cloud vendor, getting your systems up and running, teaching everyone a new way of working is complex. And it’s not linear when you take on the next provider. You have to learn a whole new suite of concepts and processes.” 

“Strong commercial and architectural relationships with your cloud vendor can yield a lot of value,” agrees Murray. “Always engage your cloud provider as a strategy partner in your efforts. Large organizations with significant spend can be marquee customers, getting significant discounts and technical support, even driving the cloud provider’s product roadmap.” 

Shaw points to business criticality as another important factor to consider. For projects with a defined start and end that aren’t likely to require ongoing maintenance - a website set up for a special event, say - companies can entrust everything to a single vendor and take advantage of all the associated productivity gains with near-complete peace of mind. Longer-running, business-critical assets may be a different story.

“If you’re building a core system that you’re going to have to maintain for 20 years, you have to understand the relationship you’re entering into. Do you really want to put all your eggs in that one basket? Or put structures in place that lower the risk of having to move the asset to a different vendor some place down the road? You’re going to pay now to build in the portability necessary, or pay later to re-platform, which almost never goes well.” 

The guiding principle, says Chawla, should be to pursue portability when there’s a business need - not simply for the sake of it. 

“Don’t put half your e-commerce system on one platform and half on another based only on the notion that you might get mad at a cloud provider and walk away,” he says. “Engineering leaders tell us all the time they spent millions of dollars and hours to be portable and never left - and now they look back and see it as a waste. If you’re going to be multi-cloud that’s cool - but there has to be a case, and you’ve got to be able to manage the complexity.”