ClOUD COmpUting by fdh56iuoui


									                                               SURF is a quarterly publication issued by the joint
                                               surF organisation (surFFoundation, surFnet and
                                               surFdiensten). subscribe to the english edition on

    SeptembeR/2010              03
also in this number

Protecting privacy a tricky
matter at institutions

e-mail, calendar, and storage
space within the cloud

licence news
university libraries
choose e-only

           ClOUD COmpUting
           JOS van HillegeRSbeRg (UniveRSity
           OF twente)

         ‘ Q U i C k aCC e SS tO
           new FUnCtiOnality’

Jos van hillegersberg
(universiTy oF TwenTe):
‘cloud comPuTing gives
you a greaT oPPorTuniTy
                          Photo: Martin Bosker

To Focus on suPPorT For
The Primary Process’

2   03 2010
QUiCk aCCeSS tO new FUnCtiOnality

C lO U D
CO m p U t i n g
popular internet services such as youtube, gmail, and skype have been
around for years now, but the concept of ‘cloud computing’ is relatively new.
What is its value in higher education and research? What is the future of this
technology? We put five questions to prof. jos van hillegersberg (university
of twente).

       what role does cloud computing play                    sharepoint environment. it’s a pity. cloud comput-
       in your field, business information                    ing can also be extremely useful when collaborating
       systems?                                               on a project: you decide what functionality you
       ‘i see cloud computing as part of the trend – one      need, set up the necessary services, and at the end
       that started years ago – towards ‘making less          of the project you just pull out the plug.’
       yourself and buying in more’. it began with con-
       tracting out software development. around the          what cloud computing options are there
       beginning of the present century, we saw the rise      for higher education and research
       of application service provisioning (asp), in          institutions?
       which software that an organisation had either         ‘it offers ict departments a great opportunity to
       developed itself or purchased was installed on the     finally focus on supporting the primary process
       hardware of the asp service provider. this was         rather than devoting the majority of their time to
       followed by software as a service (saas), the pro-     management and maintenance. after all, it’s a lot
       curement of software in the form of components.        more interesting to help end users select the right
       We have now arrived at the stage of cloud com-         solutions and then integrate them for them.
       puting, a broad range of ready-to-use services.
       Whatever service you need – a back-up facility,        staff and students at every organisation – including
       storage space, or e-mail – you find it somewhere       higher education and research institutions – already
       on the internet – i.e. within the ‘cloud’ – and you
       subscribe to the service for as long as you need it.   ‘Very few organisations have
       cloud computing is extremely interesting because
       it quickly provides you with the new functionality      thought about protecting
       that you require.’
                                                               sensitive data when using
       what about cloud computing in dutch
       higher education and research?                          cloud computing’
       ‘it isn’t used much at the moment, according to a
       study that we carried out. one or two institutions     rent back-up space at amazon on a case-by-case
       are switching to e-mail from within the cloud, for     basis, or use dropbox to exchange large files. the
       example google’s gmail. but hardly any serious         ict department can throw up all kinds of objec-
       use is yet being made of cloud solutions for office    tions and simply block services such as skype, but i
       applications such as word processing or docu-          think that’s a pointless way to go. you can’t stop
       ment and calendar management. that’s despite           the trend in any case, just like you couldn’t stop the
       ict departments devoting a lot of manpower and         onward march of the pc back in the 1980s. it’s far
       energy to setting up such things as their own          better to think hard about how to support the

                                                                                                                  03 2010   3
                                                                                                 Jos van hillegersberg, professor Business information
                                                                                                 systems, University of twente

                                                                                                 publications – to be supported from within the
                                                                                                 cloud. at the moment, it’s still mainly traditional
                                                                                                 tools that are used – like ms project or oracle
                                                                                                 Finance – and that are installed locally. that’s
                                                                                                 extremely clumsy, definitely when it comes to col-
                                                                                                 laboration within european research projects. i
Photo : Martin Bosker

                                                                                                 think that cloud computing will become very
                                                                                                 important in that kind of context.’

                                                                                                 what you think of surF’s aims in this
                                                                                                 field as set out in its strategic Plan
                                                                                                 ‘all in all, i agree with those aims. surF’s role is to
                                                                                                 bring people together and to provide guidelines,
                                                                                                 in this case on how to take and justify decisions
                        Jos van hillegersberg                                                    on cloud computing and on what needs to be
                                                                                                 considered as regards privacy and security.
                        jos van hillegersberg is a professor of design and implementation of     there’s still a lot of missionary work that needs to
                        business information systems at the faculty of management and            be done, because it has major consequences for
                        governance at the university of twente. he specialises in ‘information   your ict organisation. that’s why i think it’s a
                        systems for a networked World’. prof. hillegersberg is a member of       good idea to set up a kind of ‘test environment’.
                        surF’s scientific technical council (Wtr) and one of the authors of      i see surF as the driving force that turns the
                        the council’s trend report on ict – basis for innovation [ict -          spotlight on to new possibilities. that’s a good
                        Fundament voor vernieuwing] (2008). that report formed the basis         way of getting people moving.’
                        for surF’s strategic plan 2011–2014.                                                                            Daphne Riksen
                                                                                                       mORe inFORmatiOn

                             mORe inFORmatiOn                                                          ‘cloud computing and the poWer to

                                                                              choose’, educause reVieW may/june 2010

                                                                                                       ‘cloud computing in het onderWijs, minder

                                    trend. What rules need to be observed, for exam-                   zorg om techniek, meer proFijt Van ict’,

                                    ple, so as to protect sensitive data? Very few                     published by the surFnet/kennisnet

                                    organisations have actually thought about this, let                innoVation programme

                                    alone developed a strategy.’                             
                                    what will the situation be in ten years
                                    or so?
                                    ‘i hope that the ict expert who currently man-
                                    ages the e-mail server will be helping teaching                   cloud computing
                                    staff to select the most appropriate tools for their
                                    discipline, their approach to education, and the                  the internet is often seen as a kind of ‘cloud’,
                                    number of students that they teach. a lot of the                  and ‘cloud computing’ means providing or
                                    tools in fact already exist: for teaching online, for             using scalable services via the internet.
                                    pinning up student papers on virtual display                      because these services can be provided
                                    boards, aids that facilitate interaction and collab-              ready-made, more time and scope becomes
                                    oration. but instructors don’t really know how it                 available for supporting the primary process,
                                    all works and they have trouble making use of all                 namely education and research. surF’s
                                    the different possibilities. they're busy enough                  recent strategic plan 2011–2014 gives cloud
                                    already just dealing with their actual discipline.                computing a prominent place, as well as such
                                                                                                      important related aspects as security and
                                    as far as research is concerned, my ideal is for the              privacy.
                                    whole of a project – from the initial idea right
                                    through to the reports, financial accounting, and                       mORe inFORmatiOn


                         4           03 2010
                                     LICENCE NEWS
                                                   SpeCial:                      that

                               UniveRSity libRaRieS CHOOSe e-Only
                                                                           per download is therefore significantly        nals in the humanities and social sci-
                                                                           lower in the netherlands than in many          ences. administering the subscriptions
                                                                           other countries.’                              for them often costs more than they
                                                                                                                          yield, so why not publish them via a
Photo: DieDerik van Der Laan

                                                                           e-only                                         repository? that makes them immedi-
                                                                           how can one explain that lead as               ately available to everybody.’
                                                                           regards usage? ‘We are a country of
                                                                           ‘early adopters’,’ says Verhagen. ‘We          major deals
                                                                           switched to e-only much earlier than           many people view the publishers as ‘the
                                                                           libraries in other countries. if we can        enemy’, but nol Verhagen is prepared
                               nol verhagen, librarian,                    get a journal in digital form – which is       to say a word on their behalf. ‘since the
                               University of amsterdam                     very often possible nowadays – then we
                                                                           drop the paper version. that saves us a
                                                                           lot of money, including where internal         ‘We are a country of
                               Digital en maSSe                            management is concerned.’
                                                                                                                           early adopters’
                               University libraries are sometimes          the question that then arises, however,
                               thought of simply as ‘book museums’,        is who can have access to the digital
                               but nowadays students who use them          journals. ‘there are often ‘incubator          arrival of digital journals,’ he says, ‘they
                               spend most of their time at a compu-        companies’ on a campus, for example,’          have been concluding major deals with
                               ter, where more and more is available.      says Verhagen. ‘are they part of the           the library consortia.’ these major con-
                                                                           university? and what about staff after         tracts significantly expand the amount
                               ‘news from the battlefield’: that was       they’ve retired? What happens if one           of information that libraries can pro-
                               what european and american librarians       publisher says they can access the dig-        vide, but the pricing does restrict uni-
                               wanted to talk about right away during      ital journals and another says they            versities as regards selecting contracts.
                               the six-monthly conference of the           can’t?’                                        ‘to give one example,’ says nol
                               international coalition of library                                                         Verhagen, ‘the university of amsterdam
                               consortia (icolc). as nol Verhagen,         We put that question to surFdiensten’s         used to take 350 journal titles from
                               the librarian of the university of          pim slot. “that’s what we have                 elsevier, and they were spread out
                               amsterdam, explains, when they talk of      surFfederatie for,” he says. “it’s a serv-     physically between sixty institutes. We
                               ‘the battlefield’, they mean negotiations   ice that applies access security when          now have sixteen hundred, and a
                               with publishers. mr Verhagen has been       people log in so as to keep close track        researcher or student from the univer-
                               involved for about twelve years now.        of the type of users concerned and             sity can consult them from anywhere in
                               ‘For example, we discuss how much our       what permissions they have. it’s all just      the world as soon as he’s turned on his
                               licence fees have gone up by again, and     a question of making the right arrange-        computer. that alone has produced an
                               what we get in return.’                     ments – and then implementing them.’           enormous improvement in the knowl-
                                                                                                                          edge infrastructure.’
                               the battle on behalf of the netherlands     tactical weapon
                               is being fought by the ukb and              another phenomenon is the repositor-                               aad van de wijngaart
                               surFdiensten. the ukb is the consor-        ies in which each university stores the
                               tium representing the university librar-    publications generated within it. nol                mORe inFORmatiOn:
                               ies and the national library of the         Verhagen sees repositories as primarily              the conFerence oF the
                               netherlands. ‘in informal discussions       a tactical weapon to use against the                 international coalition oF
                               within the icolc, i have noted that we      publishers: ‘if they really go too far,              library consortia (icolc) is
                               are in quite a favourable position as       then we have an alternative,’ he says.               taking place in amsterdam on 4–6
                               regards our licences with most of the       ‘but repositories are also a logical                 october 2010 and is being organi-
                               big publishers,’ says Verhagen. in addi-    means of publishing all kinds of ‘grey’              sed by surFdiensten and the ukb.
                               tion, dutch researchers and students        material, for example collections of                 iF you are interested, please con-
                               are major users of scientific and schol-    conference papers, a lot of disserta-                tact surFdiensten’s pim slot
                               arly material in digital form. the cost     tions, theses, and all kinds of little jour-

                                                                                                                                                          03 2010     5
                                                                                                                          published in SURF magazine September 2010


Online appliCatiOnS FOR
HigHeR eDUCatiOn anD ReSeaRCH
                                                                                              UP              down

e-mail, calendar,
and storage space
Within the cloud

     like google, microsoft intends                                   COllabORatiOn anD mObility
                                                                      corno Vromans, deputy head of library & it
     providing online applications for
                                                                      services at tilburg university, has been involved
     higher education and research via                                in exploring cloud services from the very begin-
     surFfederatie. surF is thus the first                            ning. ‘collaboration and mobility are key elements
                                                                      in what we want to make available to our students
     organisation with which microsoft
                                                                      and staff. three years ago, we joined with a
     has entered into this kind of                                    number of other universities in listing what we
     collaboration.                                                   wanted in the way of cloud services. one impor-
                                                                      tant requirement was that we should be able to
                                                                      direct things ourselves. surFnet and

               a      ccess to Web-based services is becoming
                      increasingly important in higher education
               and research. thanks to surFfederatie, university
                                                                      surFdiensten were closely involved.’

                                                                      among the requirements were that people should
               students and instructors can log in to a range of      be able to continue e-mailing from their own uni-
               service and content providers on the internet          versity address and that the system should be
               from their own institutional account. since early      user-friendly and secure. ‘google and microsoft
               this year, google apps has been available and          provide so much storage space for e-mail and
               before the end of 2010 tilburg university will be      documents,’ says corno Vromans, ‘that it makes
               the first institution to start utilising microsoft’s   me dizzy to think of our providing the same
               live@edu service (see the box for more informa-        amount in our own physical environments. and
               tion). a lot of institutions have now expressed an     the solutions they provide are also free of charge.
               interest in the two parties’ cloud solutions.          one major advantage is that microsoft guarantees

6    03 2010
available applications

google apps is a free service providing, amongst other
things, e-mail, calendar management, online document
sharing and editing, and website creation. microsoft live@
edu is also free and comprises e-mail, a calendar, to-do
lists, contact persons and chat functionality. each user
also has 25 gb of online disk space. a de luxe commercial
version, bpos, is also available for higher education and
research. it includes sharepoint and live meeting.

that the data will be stored within the eu. that means
that the strict american legislation doesn’t apply.’

Own inStitUtiOnal aCCOUnt
inholland university of applied sciences has also
decided to use microsoft’s live@edu. ‘We have been
following developments from the very beginning,’ says
ict director cees plug, ‘and we’ve even had talks with
microsoft ourselves. a cloud environment has definite
advantages. obviously there’s the low cost, but for us
it’s mainly about the service provided. one advantage
is that upgrading is easier and more gradual than if we
had to implement a complete new package every few
years. things like e-mail and calendar management
have now become commodities, and educational insti-
tutions simply can't offer the same level of service in
that respect.’ inholland university of applied sciences
will be introducing live@edu gradually and expects
there to be few problems if microsoft has the federa-
tive link under control.

according to those involved, that link is a major break-
through. bert van zomeren, the manager for
information services and architecture at delft
university of technology, is enthusiastic: ‘both
microsoft and google can guarantee that as far as the
outside world is concerned, you are working with a
delft university of technology account.’ delft is also
interested in bpos, the commercial version of live@
edu. ‘sharepoint in the cloud would be ideal for us,’
says Van zomeren. ‘We intend rolling out sharepoint
ourselves in any case. it may perhaps involve a mix.
We will be looking at whether it can be integrated
effectively and whether it offers sufficient security.’

                                             martijn vet

     mORe inFORmatiOn:

     link betWeen surFFederatie and google apps: > best practices
     microsoFt liVe@edu:
     google apps For higher education:

                                                             03 2010   7
Photo: ivar PeL

                                                                                                                       rené ritzen, Corporate
                                                                                                                       information security officer,
                                                                                                                       Utrecht University

                      ClOUD COmpUting at inStitUtiOnS:

                      ProTecTing Priva
                      a Tricky maTTer
                      data security is extremely important for every organisation, including
                      institutions for higher education and research. how do they tackle security
                      and how do they make use of cloud computing? We hear from two data
                      security officers.

                                   t     he erasmus university medical centre
                                         (erasmus mc) has a large and complex ict
                                   environment: 12,000 employees, 2500 students,
                                                                                              expliCit ReQUiRementS
                                                                                              jan Willem schoemaker thinks cloud computing
                                                                                              is an interesting development from the point of
                                   9000 workstations, and a large number of critical          view of saving money and flexibility. erasmus mc
                                   applications. ‘the integrity of our information pro-       utilises calculation capacity within the cloud, for
                                   vision is vitally important – it’s literally a matter of   example. ‘For scientific research, we are linked up
                                   life and death,’ says security officer jan Willem          to life science grid, which means we can carry
                                   schoemaker. ‘take the need for calculating pre-            out the calculations much faster, for example.
                                   cise dosages of medication, for example.’ erasmus          needless to say, we first took a good look at the
                                   mc also has stringent requirements regarding               security systems for the grid.’
                                   availability: for some care applications, it’s simply
                                   unacceptable for the application to be ‘down’ and          erasmus mc is currently looking at collaboration
                                   there need to be effective emergency procedures.           options, and outsourcing within the cloud is one
                                   data confidentiality also needs to be monitored            of the possibilities. ‘but we have explicit require-
                                   strictly, not just as regards patients but also staff      ments as regards availability, integrity, and relia-
                                   and students. ‘that’s why we have regular cam-             bility, and it’s not certain whether a provider
                                   paigns to increase people’s awareness of security          within the cloud can comply. there’s also an eu
                                   matters,’ says schoemaker.                                 directive stipulating that confidential data cannot

                  8      03 2010
                                                                                                 how secure is cloud computing?
                                                                                                 just as with an institution’s own ict services, cloud com-
                                                                                                 puting requires paying attention to aspects such as conti-
                                                                                                 nuity, confidentiality, integrity, and control. but cloud com-
                                                                                                 puting involves relinquishing operational management to a
                                                                                                 different organisation, so it’s particularly important to know
                                                                                                 what the provider actually does and what it can guarantee.
                                                                                                 a checklist for these aspects will therefore be appearing
                                                                                                 later this year, covering, for example:

                                                                     Photo: iLya van MarLe
                                                                                                 continuity: Who makes the back-ups, what happens in the
                                                                                                 case of emergencies (for example insolvency, fire, etc.),
                                                                                                 how do you get your data back when the contract
                                                                                                 confidentiality: What data is involved, how important is it
                                                                                                 for the organisation, where is privacy-sensitive data stored,
                                                                                                 what legal system applies there?
                                                                                                 integrity: how much of a problem is it if unknown persons
 Jan Willem schoemaker,                                                                          alter information, what information requires special protec-
 security officer, erasmus                                                                       tion, and should some information remain only within the
 Medical Center                                                                                  institution’s own ict environment?
                                                                                                 control: how can you make sure that the service provider
                                                                                                 complies with what has been agreed?

acy sTill
                                                              data security and privacy and whether or not the
                                                              service can be integrated with other services.
                                                              outsourcing the service and using cloud comput-
                                                              ing impose more stringent requirements as
                                                              regards managing the it landscape. perhaps the
     simply be processed outside the eu. you have to          solution for more sensitive information would be
     take careful account of all those different aspects.’    to have a dutch ‘edu-cloud’ covering the whole
                                                              higher education and research sector.’
     SaFe HaRbOUR
     utrecht university (more than 7000 employees             apart from corporate selection of cloud comput-
     and almost 30,000 students) is currently imple-          ing, students and staff also utilise such services of
     menting google’s gmail for its students. corporate       their own accord. ‘We don’t really have a clear
     information security officer rené ritzen has this to     idea of that,’ says rené ritzen, ‘so we pay a lot of
     say: ‘gmail enables us to provide students with          attention to raising awareness. in doing so, we
     greater functionality, specifically storage capacity,    make the maximum possible use of cybersave
     at lower cost. protecting privacy was a tricky mat-      yourself campaign material.’
     ter, however. even though google does not guaran-                                                                Daphne Riksen
     tee where data will be stored, it does comply with
     the eu’s ‘safe harbour’ privacy principles, meaning
     that google provides a level of security the same           surF activities regarding security
     as that required by the eu. For student e-mail com-         surF pays a great deal of attention to security by concentrat-
     munication, we think that’s sufficient. students can        ing expertise, sharing knowledge, and developing tools. in addi-
     also choose to have their e-mail forwarded to a dif-        tion, surFnet coordinates the cybersave yourself campaigns to
     ferent provider. For staff e-mail, however, we do           make students and staff more aware of the risks inherent in
     require – at the very least – a guarantee that it will      using the internet. surF is also working on an audit for institu-
     be stored within the eu.’                                   tions, a tool that was trialled at a number of institutions in
                                                                 2009. it gives an indication of the institution’s situation as
     StRingent ReQUiRementS                                      regards data security, identity management and incident man-
     Whenever a new service is required, utrecht                 agement, and how it compares to other institutions.
     university takes a critical look at whether it should
     provide the service itself or contract it out or                                   mORe inFORmatiOn

     acquire it from within the cloud. ‘among the things                           – topic security
     we consider when deciding,’ says rené ritzen, ‘are                            

                                                                                                                                                 03 2010   9

To top