Liberty Mutual Group SVP Discusses the Internal Cloud

While the term "cloud computing" and the hype surrounding it are relatively new, some of the concepts behind the technology have been around for quite some time. Liberty Mutual SVP of enterprise architecture and application services Mark J. Kirby points out that the Boston-based carrier has been leveraging the cloud for years,

"Accessing information from the department of motor vehicles to check on someone's driving record is essentially a 'cloud' software service, as is checking on someone's credit history," he suggests. I&T recently sat down with Kirby to discuss how Liberty Mutual's cloud computing strategy has evolved since those humble beginnings and how the organization balances the benefits of the cloud with its potential risks.

How does Liberty Mutual view the benefits and risks of cloud computing?

Kirby: Cloud computing is a very important paradigm for us. The most important part of it is the idea that the delivery of technology services -- and the complexity of that delivery -- can be isolated behind a clear service definition that people can consume. ... For us, one important opportunity is that we can, within IT, define the services that we are providing to deliver business applications without requiring the consumer to get into the underlying complexity and "sausage-making" execution side of things.

Because [Liberty Mutual] is so large, the IT landscape is increasingly complicated by the fact that everybody wants their own special solutions. That becomes a massive, long-term cost because nothing is standard. If we can move to a point where the people that need services are defining them based on what needs to be delivered rather than how they are configured, we can simplify our environment and reap a lot of cost savings as a result.

So the rewards are really about the simplification of the technology environment. On the risk side, you have to be able to effectively operate those services and provide them with a high degree of predictability.

How is Liberty Mutual currently leveraging the cloud, and what are your future plans for cloud technology?

Kirby: We do take advantage of software-as-a-service (SaaS) options, with Salesforce.com being one example. But our main focus right now is on the infrastructure platform -- infrastructure-as-a-service, and platform-as-a-service on top of that. We've been doing virtualization in different flavors over the past three to five years. This year, we're specifically looking to increase the centralization of those different virtualization pieces and collapse that into a single platform that provides cloud services -- infrastructure services, in this case -- to all of our business units.

First and foremost, we plan to deliver cloud services from an internal cloud perspective. In 2010 we'll increase the central [internal] cloud platform and get it to a point where it is operationally robust. Then we'll look to extend it by potentially adding some external providers, [though] that is not something we're actively planning. The infrastructure side could grow to add more services, such as messaging, to our internal cloud. On the software side, we'll look at more one-off cases to take advantage of external providers.

How do you define the "internal cloud"?

Kirby: When I say "internal cloud," I am referring to the fact that every piece of hardware and data would reside completely within our network and within our firewalls. We wouldn't be taking advantage of either hardware that somebody else owned or putting any of our data on a platform that we didn't own.

What characteristics of that environment make it a cloud as opposed to a traditional in-house IT environment?

Kirby: IT delivery, traditionally, works where the business comes along with a business problem and asks ... IT to do whatever it takes to make the problem go away. In certain circumstances that may mean buying software from multiple vendors and doing whatever is necessary to make it work. The paradigm for cloud -- and the reason it is valuable to us -- is that a cloud approach insulates the business from what it takes to solve that problem. For example, when the power company decides to install a new transformer, you don't get a knock on the door. They just change it, and you don't even see the cost. There's insulation between the complexity of delivering services and the customer that is consuming them. That's what is truly valuable in the cloud.

[The cloud] is fuzzy and a little bit confusing -- you don't know exactly what is running in there. The important thing is that you shouldn't care. It's separating needs from service delivery. ... The cloud is a good approach for that. You don't care how the people in the back room are making it happen. All you care about are cost and services.

Are there security risks to not knowing "exactly what is running in there"?

Kirby: We are concerned about a lot more than security. That's just the most obvious. There are a lot of other [concerns], such as how quickly the provider can respond to an outage. You want to have control of the operational procedures.

At some point, we will be comfortable with an external provider who says it can provide, in addition to security assurances, an interface that will allow us to escalate on an outage if it is important or view our server performance levels. We need to get that right internally, then look at an external provider and marry that to an external provider agreement.

We would not be embracing cloud computing if it was only external. [The external cloud] is for very small environments that don't have the ability to scale. Our goal is to take advantage of the paradigm and set things up so that it could be external, but it doesn't have to be.