Think cloud – think strategy – think "Sun Tzu"

The steady rise of cloud over the last few years across the software, infrastructure and platform domains has forced most technology business leaders to stop and take note. The voracity with which the perceived value and adoption of cloud computing and cloud Services has grown should be viewed and actioned as a strategic initiative and not a tactical undertaking with short term goals and limited benefits. To move things along and provide context I turn to Sun Tzu's "The Art of War", that helps identify strategy elements required by executives and senior management grappling with the challenge of cloud.

The three stratagems extracted from Sun Tzu's "Art of War" as they relate to cloud strategy are:

  1. “Know thy self, know thy enemy. A thousand battles, a thousand victories.”
  2. “Victorious warriors win first and then go to war, while defeated warriors go to war first and then seek to win.”
  3. “Strategy without tactics is the slowest route to victory. Tactics without strategy is the noise before defeat.”

So “Sun Tzu?” you must be thinking, well read on.

1. “Know thy self, know thy enemy. A thousand battles, a thousand victories.”

Considering I am not an expert in Sun Tzu, I have resorted to explanations that are available across the WWW. For this one the explanation goes that, when you know your own position and the position of your opponent it is easy to figure out their tactics and how to overthrow them with your own.

Now in relation to cloud strategy, I am not saying that the vendor and service providers are enemies but there is truth in knowing what your organisations strategy is when it comes to on boarding cloud services. What questions would be required to be asked to ensure that the information, in regards to the capability of the cloud, is grounded in reality.

Also, what would be the common ground between the organisation’s maturity uplift requirements for using cloud services, and the vendor’s participation in bridging that gap? How will the organisation be in a position to ensure that no false promises are being made and that the vendors will be able to deliver and add to the organisation’s capability–and not become yet another area which will require constant management effort and input? This would be contrary to the strategy of cloud sourcing—to support business optimisation. What identified steps are required to be undertaken to commence the consumption of cloud services?

Hence: "Know thy self, know thy enemy".

2. “Victorious warriors win first and then go to war, while defeated warriors go to war first and then seek to win.”

The explanation for this one suggests, you simply cannot trust luck. It is better if we work with the assumption that luck will never be by our side. This will force you to stand on your own feet. You will feel more stable, which is a good thing, now you need to depend on your strategy of attack. Getting into a competition without really knowing what is going on; will result in a most definite loss on your behalf. Thus, do your research well before acting, this is how you win.

For cloud strategy, my view is that an organisation is required to outline its entire set of assets and services that are required to be serviced. From this set, outline which services are core and non-core, following that with an analysis of what would be most beneficial for the business, cloud sourcing core services or non-core services. This analysis will also identify the process gaps that require being remediated to appropriately manage the services within the cloud. As no strategy should be simply about obtaining technology, uplift of existing operating process is required to be outlined, and a concentrated effort applied to improve them. From improved processes there is inevitably identified the need for improved reporting and associated SLA's that the cloud services provider will be required to adhere to.

The above will ensure that the cloud services strategy can produce positive results and the outcome can be measured in terms of implementation of improved organisational process and a cloud sourcing model with appropriate reporting to business requirements.

Hence, "Victorious warriors win first and then go to war".

3. “Strategy without tactics is the slowest route to victory. Tactics without strategy is the noise before defeat.”

If there was one Art of War principle to tie them all together, and it certainly rings true for cloud computing, it’s this one. It basically says that you need to know your strategy before you act. A strategy sets out your vision and goals. Strategy is the foundation in which tactics are born. It is after you have set out a strategy, the “how tos” become clear.

In the numerous discussions that I have had with executives and senior business leaders, the focus very quickly shifts to the "how" of cloud computing and the usage of particular cloud models of Software-as-a-Service (SaaS), Platform-as-a-Service (PaaS) or Infrastructure-as-a-Service (IaaS).

The initial focus of a cloud strategy, in my opinion, should be on the requirements that guide the organisation’s privacy, data regulation and security obligations (arising out of where and how their data assets are being held and/or hosted). This is followed by the identification of services (core or non-core) that will be candidates for cloud. Once done, it demands an acceptance that an organisation-wide change will be required to evolve existing operating models to fully support cloud as a strategy. Procurement of cloud services amongst others items, including audit will then be just one of many tactical considerations or "how tos" that become clearer. I provided, in an earlier article, a list of 25 considerations, dubbed “CloudAdopt25” to assist with establishing cloud services. The 25 considerations or "how tos" were split in 4 areas: contract management, services reporting, services management and data security.

In closing, Aesop's tale on “The Fox and the Goat” comes to mind, not sure if you have read it, but the moral is quite simply “Look before you leap”. This sixth BC tale has held the test of time and holds true today, especially in the age of cloud where if you are thinking cloud, "Think Strategy".

Follow @CSO_Australia and sign up to the CSO Australia newsletter.

2 Comments

Dr Kenneth J Preiss

1

I got lost in the metaphors and the related examples. I could not see anything like a linkage between the two. It seems to me there are three strategy/tactical issues here:
1. As for "getting into a competition without really knowing what is going on; will result in a most definite loss on your behalf". Well, that is what CEOs do each and every day and get paid hansomely for so doing.
2. Thus, "..do your research well before acting, this is how you win". As Henry Mintzberg stated many years past, "strategic planning is DEAD"! The strategy process is very much alive and well - and real time!
3. Set one's strategy before leaping. Well, in the strategy process there is something called Emergent Strategy; as well as, the Agile Organization. Many executives have to deal with both every day - and Sun Tzu didn't. In fact, they are contrary to Sun Tzu's dictums.
As for Cloud computing, well time will tell. But if one steps out of Sun Tzu's tent and the band width and download speed just don't support real time requirements, then it's useless. And that would cover many trading partner developing nations.
Oh, and if good old Sun Tzu starts a conflict, then game over for Cloud computing, it will be at the forefront of economic warfare!

Oh Noes Not Sun Tzu again

2

Read this http://attrition.org/security/rant/fsck_sun_tzu/ then go and stand in the naughty corner.

Comments are now closed

CSO Corporate Partners
  • f5
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Audit Management Solutions

Manage the complete audit lifecycle from audit universe identification and risk assessment to management/board reporting and quality assurance.

Security Awareness Tip
Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.