Cloud Computing and Distributed Business Systems

Introduction

Cloud computing has transformed information technology from a capital-intensive ownership model into an on-demand service model. Instead of purchasing and maintaining all servers, storage, networking equipment, and software internally, an organization can obtain computing capabilities from a provider through a network, usually the internet. For an MBA manager, cloud computing is not merely a technical alternative. It is a strategic means of improving agility, supporting digital business models, enabling geographic expansion, and converting some technology expenditure from fixed capital expenditure into variable operating expenditure.

Cloud systems are distributed systems: their processing, data, storage, and control functions are implemented across multiple physical or virtual resources. This distribution creates benefits such as scalability and resilience, but it also introduces challenges involving latency, security, governance, integration, vendor dependence, and cost control. Effective managerial decisions therefore require comparison of deployment models, service models, reliability mechanisms, and economic trade-offs.

Learning Objectives

By the end of this chapter, the reader should be able to:

1. Compare public, private, hybrid, and multicloud deployment models.
2. Distinguish IaaS, PaaS, and SaaS and select an appropriate service model.
3. Explain cloud services and the architecture of distributed business systems.
4. Evaluate availability, scalability, elasticity, and resilience.
5. Apply basic methods for cloud cost management and total-cost analysis.
6. Assess governance, security, regulatory, and strategic implications of cloud adoption.

1. Cloud Computing as a Business Capability

A useful definition of cloud computing is the provision of configurable computing resources—such as networks, servers, storage, platforms, and applications—over a network with rapid provisioning and measured usage. The important characteristics are self-service, broad network access, resource pooling, rapid elasticity, and measured service.

Resource pooling means that a provider serves multiple customers using shared physical infrastructure while maintaining logical isolation. Virtual machines, containers, software-defined networks, and access-control mechanisms make this sharing practical. Rapid elasticity allows capacity to increase or decrease in response to demand. Measured service permits usage-based billing and operational monitoring.

Cloud computing differs from traditional outsourcing because it normally provides standardized, automated, and highly scalable services. It also differs from simple hosting because cloud platforms expose programmable interfaces, automation tools, and elastic resource pools. The distinction is not absolute: some managed hosting arrangements incorporate cloud characteristics.

A distributed business system divides an application or service across multiple computing nodes. A node may be a virtual machine, container, database instance, serverless function, or physical server. Components communicate through networks and coordinate through protocols, queues, APIs, and data-replication mechanisms. Users experience one business service even though the underlying work is distributed.

Typical cloud-enabled business systems include online banking, enterprise resource planning, customer relationship management, e-commerce, supply-chain platforms, data analytics, and collaboration software. Their business value arises from faster deployment, access to advanced infrastructure, improved collaboration, and the ability to handle demand that is difficult to predict.

2. Cloud Deployment Models

A deployment model describes who owns, operates, and accesses the underlying cloud environment.

Public Cloud

In a public cloud, a provider owns or leases the infrastructure and makes computing services available to many customers. Customers typically pay for consumption, reservations, or subscriptions. Public cloud is particularly attractive for variable workloads, development environments, digital products, and organizations seeking rapid access to sophisticated services.

The fact that infrastructure is shared does not mean that customer data is openly accessible. Isolation is implemented through identity management, virtualization, encryption, network segmentation, and provider controls. Nevertheless, the customer remains responsible for configuring its resources correctly. A public-cloud provider can secure the physical data center, but it cannot automatically prevent an administrator from granting excessive database permissions.

Private Cloud

A private cloud is dedicated to one organization. It may be located in the organization’s own data center or operated by a third party. Private cloud is appropriate where the organization requires highly specific architecture, predictable control, specialized performance, or stringent regulatory arrangements.

Private cloud should not be confused with an ordinary server room. A genuine private-cloud environment normally includes automated provisioning, pooled resources, self-service interfaces, monitoring, and measured usage. Its disadvantages include the cost of infrastructure, specialist staff, capacity planning, maintenance, and technology refresh.

Hybrid Cloud

Hybrid cloud combines private and public environments through functional integration, such as shared identity, secure networking, data movement, orchestration, or workload coordination. For example, a manufacturer may retain sensitive product designs in a private environment while using public-cloud analytics during periods of high demand.

Hybrid architecture is not automatically simpler or cheaper. It creates dependencies across security policies, network connections, data formats, service levels, and operational teams. A hybrid strategy is successful only when the business reason for distributing workloads justifies this complexity.

Multicloud

Multicloud uses two or more public-cloud providers. An organization might use one provider for enterprise applications, another for machine-learning services, and a third for regional availability. Multicloud can reduce concentration risk and provide access to specialized capabilities.

However, multicloud is not the same as portability. Applications may depend on provider-specific databases, identity services, or analytics tools. Moving data between providers may create egress charges and performance limitations. Therefore, managers should adopt multicloud for a clear strategic or risk-management reason rather than treating it as an automatic best practice.

3. Cloud Service Models

Service models define the layer of technology managed by the provider and the layer managed by the customer.

The exact division of responsibility differs by provider and service. A responsibility matrix must therefore be reviewed for each product.

Infrastructure as a Service

IaaS supplies virtual machines, block and object storage, networks, firewalls, load balancers, and related infrastructure. It provides substantial control and supports legacy applications that cannot easily be redesigned. The customer is responsible for operating-system patches, application security, access configuration, backup policy, and much of the architecture.

IaaS is flexible but can reproduce the administrative burden of a traditional data center. Organizations that provision excessive virtual machines or leave test environments running may experience uncontrolled cost growth.

Platform as a Service

PaaS provides a managed application platform, including operating systems, runtimes, deployment tools, databases, and scaling services. Developers can concentrate on business functionality rather than patching servers. PaaS can shorten time to market and improve development consistency.

The trade-off is reduced low-level control and possible platform lock-in. Applications may use provider-specific interfaces that make migration expensive. PaaS is most valuable when speed, standardization, and developer productivity are more important than infrastructure-level customization.

Software as a Service

SaaS delivers a complete application through a browser, mobile application, or API. The provider manages the application, infrastructure, upgrades, and most operational controls. SaaS reduces implementation time and internal support requirements, but the customer must evaluate data location, integration, identity, service availability, contractual terms, and exit arrangements.

SaaS does not eliminate governance. Managers remain responsible for appropriate user access, lawful processing, data retention, configuration, vendor oversight, and business continuity. A badly configured SaaS system can expose information even when the provider’s underlying platform is technically secure.

4. Distributed Infrastructure and Cloud Architecture

A typical distributed business system contains several layers:

1. Client layer: browsers, mobile applications, or partner systems.
2. Application layer: web servers, APIs, microservices, and business rules.
3. Data layer: relational databases, NoSQL stores, caches, and object storage.
4. Integration layer: message queues, event streams, enterprise service buses, and API gateways.
5. Operations layer: identity, monitoring, logging, security, backup, and deployment automation.

A request may pass through a DNS service, a content-delivery network, a load balancer, an application service, a cache, and a database. Each additional component can improve capacity or specialization, but it also creates another possible failure point.

A monolithic application packages most functions into one deployable unit. A service-oriented or microservices architecture divides functions into independently deployable services. Microservices may allow teams to scale and release components independently, but they increase network calls, observability requirements, data-consistency challenges, and operational complexity. The choice should reflect business and organizational needs, not fashion.

Distributed systems must address four fundamental concerns:

• Communication: Components exchange requests, responses, events, or messages.
• Coordination: Services agree on state, sequencing, permissions, and transactions.
• Consistency: Replicated data may need strong or eventually consistent updates.
• Failure management: Networks, services, and data centers can fail independently.

In strong consistency, a successful read reflects the latest committed write according to the system’s rules. In eventual consistency, replicas may temporarily differ but converge if updates stop. Financial settlement may require strong consistency, whereas product recommendations may tolerate eventual consistency. This is a business decision as well as a technical one.

5. Availability, Reliability, and Resilience

Availability is the proportion of time that a service is accessible and performs its required function. A basic availability measure is:

Uptime and downtime must be measured over the same period and defined using an agreed service-level objective. If a service is available for 8,760 hours in a year and unavailable for 8.76 hours, its availability is approximately 99.90%.

Availability percentages can hide substantial operational differences. Approximate annual downtime is:

These figures assume continuous measurement and a 365-day year. Contracts may define exclusions, maintenance windows, and measurement methods differently.

Reliability concerns the probability that a system performs correctly for a specified period. Resilience is the ability to continue or recover operations despite disruption. High availability is achieved through redundancy, health checks, automated failover, replicated data, backups, geographically separate facilities, and tested recovery procedures.

If two components must both operate for a service to function, and their failures are independent, series availability is:

If either of two independent components can serve the request, parallel availability is:

The independence assumption is often unrealistic because components may share power, networks, software defects, or human operators. Consequently, simply adding replicas does not guarantee the calculated improvement.

Business continuity requires recovery-point objectives (RPO) and recovery-time objectives (RTO). RPO specifies the maximum acceptable amount of data loss measured in time. RTO specifies the maximum acceptable time to restore service. Lower RPO and RTO usually require additional replication, automation, and expense.

6. Scalability and Elasticity

Scalability is the ability of a system to handle increased workload by adding resources or improving design. Vertical scaling increases the capacity of an individual machine. Horizontal scaling adds machines or service instances. Horizontal scaling often supports greater resilience, but applications must be designed to distribute work and manage shared state.

Elasticity is the speed and precision with which capacity changes in response to demand. A system may be scalable but not elastic if expansion requires manual procurement. Cloud platforms support elasticity through autoscaling, serverless execution, managed databases, queues, and container orchestration.

A useful operational relationship is:

Both quantities must use the same unit, such as requests per second, transactions per second, or CPU work. Utilization approaching 100% may increase queueing delay and reduce resilience; organizations therefore maintain headroom.

A business should scale on meaningful indicators rather than CPU alone. Queue length, response time, active sessions, order volume, and database throughput may be better indicators. Scaling policies also need limits, cooldown periods, and budget alerts so that a software defect cannot generate unlimited instances and expenditure.

7. Cloud Cost Management

Cloud cost management combines financial governance, architecture, procurement, and operational discipline. The main cost categories include compute time, storage capacity, data transfer, managed services, licenses, support, security controls, and staff effort.

A simplified monthly cost model is:

Each component should be measured in the provider’s billing units. For example, compute may be priced per instance-hour, storage per gigabyte-month, and transfer per gigabyte. The formula is a planning model, not a universal billing equation; discounts, taxes, credits, minimum commitments, and tiered prices must be included in a detailed estimate.

A workload costing $0.08 per instance-hour and using 20 instances for 720 hours has compute cost:

This excludes storage, transfer, licenses, and other charges. If average demand is only half the peak and the system cannot scale down, the organization pays for unused capacity. Conversely, aggressive scaling may reduce idle cost but increase operational and data-transfer charges.

Important practices include:

• assign owners, departments, projects, and environments through mandatory tags;
• create budgets, alerts, and approval thresholds;
• shut down idle development resources;
• select appropriate instance sizes and storage classes;
• use reservations or committed-use discounts only for predictable demand;
• monitor data-egress and inter-region traffic;
• compare managed-service convenience with its premium;
• allocate shared costs transparently using showback or chargeback;
• review unit economics, such as cost per customer, order, or transaction.

Total-cost analysis should compare cloud expenditure with the relevant alternative, not merely with server purchase price. It should include facilities, power, cooling, maintenance, software, personnel, downtime risk, migration, integration, training, security, and exit costs. Cloud is not inherently cheaper; its strongest economic advantage is often flexibility and speed under uncertain demand.

8. Governance, Security, and Regulation

Cloud governance establishes decision rights, standards, controls, and accountability. A governance framework should cover identity and access, data classification, approved regions, encryption, logging, vulnerability management, backup, incident response, architecture review, supplier management, and cost control.

The shared-responsibility model divides duties between provider and customer. The provider commonly protects physical facilities and core infrastructure. The customer commonly controls identities, data, application configuration, permissions, and workload security. The boundary changes between IaaS, PaaS, and SaaS, so it must be documented rather than assumed.

Key risks include misconfigured storage, excessive privileges, insecure APIs, weak credentials, supply-chain vulnerabilities, outages, data residency violations, and vendor lock-in. Controls should follow risk rather than compliance checklists alone. Encryption in transit and at rest, multifactor authentication, least privilege, network segmentation, immutable backups, centralized logging, and tested incident procedures are foundational controls.

Regulatory analysis may involve privacy, financial services, health information, records retention, cross-border transfers, and contractual audit rights. A provider’s certification does not automatically make a customer compliant. The organization must demonstrate appropriate processing, access, retention, and accountability for its own use.

Ethically, cloud decisions should consider surveillance, employee monitoring, unequal access to digital services, environmental impact, algorithmic discrimination, and responsible disposal of hardware. Managers should ask not only whether a system is technically feasible, but whether its use is legitimate, proportionate, transparent, and socially responsible.

9. Applied Case: Northstar Retail’s Cloud Transformation

This is an illustrative case. Northstar Retail operates 120 stores and an online channel. Its seasonal sales produce demand five times higher than ordinary weeks. Its privately operated data center is reliable but requires purchasing capacity for the annual peak. Online response time deteriorates during promotions, while the company’s finance department is concerned about unpredictable cloud bills.

Problem. Northstar must improve peak performance without losing control of customer data or creating an unmanageable architecture. It also needs a defensible recovery plan and clear cost accountability.

Analysis. Customer browsing, product images, and recommendation workloads are variable and can tolerate eventual consistency. Payment settlement, inventory reservation, and financial records require stronger consistency and stricter controls. The company’s peak traffic does not justify permanently owning five times its average capacity. Its existing warehouse system also relies on specialized software that cannot immediately be redesigned.

Approach. Northstar adopts a hybrid model. Sensitive financial and inventory functions remain in a controlled environment during the first phase, while the web front end, content delivery, image storage, and analytics use public-cloud services. An API layer separates online channels from internal systems. Autoscaling handles web demand, queues absorb temporary bursts, and monitoring tracks response time, queue depth, error rates, and cost per order. Identity is centralized, multifactor authentication is mandatory, and data flows are classified by sensitivity.

The company chooses PaaS for new customer-facing services to accelerate delivery and IaaS only where legacy software requires operating-system control. It establishes an RTO of two hours and an RPO of fifteen minutes for the online order system, then tests restoration rather than relying on contractual promises. Finance receives daily cost reports by business unit, and alerts are triggered when projected monthly spending exceeds approved thresholds.

Outcome. Northstar reduces idle peak capacity, improves promotional response time, and gains faster release cycles. Costs initially increase during migration because the firm pays for parallel environments and data transfer. After optimization, unit cost per online order becomes more predictable. The hybrid design remains more complex than the former data center, but the complexity is explicitly governed.

Learning points. Deployment should follow workload characteristics and risk. A hybrid model is useful when data sensitivity and demand variability differ, but integration must be funded. Cost management must begin during architecture design. Finally, availability and recovery objectives should be expressed in business terms, tested, and periodically revised.

10. Contemporary Developments and Best Practice

Serverless computing abstracts infrastructure further by charging for function execution or managed requests. It can reduce idle capacity and accelerate development, but introduces execution limits, observability challenges, and provider dependence. Containers package applications consistently, while orchestration platforms automate deployment and scaling; they do not remove the need for security and operational expertise.

Edge computing places processing closer to users or devices, reducing latency and bandwidth use. It is valuable for industrial control, real-time retail interactions, and connected devices, but it increases the number of locations requiring security and management. Artificial intelligence services are increasingly delivered through cloud platforms. Their benefits depend on data quality, model governance, privacy, explainability, and control of inference costs.

A mature cloud program should use the following decision sequence:

1. Define business outcomes, workload variability, data sensitivity, and service objectives.
2. Select the deployment model based on risk, control, capability, and integration needs.
3. Select IaaS, PaaS, or SaaS according to the required level of control and speed.
4. Design for identity, failure, observability, backup, recovery, and exit.
5. Estimate full lifecycle cost, including migration and data movement.
6. Pilot with measurable success criteria.
7. Automate deployment and policy enforcement.
8. Review architecture, suppliers, security, performance, and cost continuously.

Chapter Summary

Cloud computing provides on-demand, measured access to shared computing resources and has become a strategic foundation for distributed business systems. Public cloud offers speed and elasticity; private cloud offers control; hybrid cloud combines environments; and multicloud uses multiple providers but increases governance complexity. IaaS provides infrastructure control, PaaS provides managed development platforms, and SaaS provides complete applications.

Distributed systems divide processing and data across components connected by networks. Their design must address communication, consistency, coordination, and independent failure. Availability depends on redundancy and tested recovery, while scalability concerns capacity and elasticity concerns the speed of adjustment. Cost management requires resource visibility, workload optimization, financial accountability, and full lifecycle analysis. Governance must integrate security, privacy, regulation, resilience, supplier management, ethical responsibility, and exit planning.

Key Terms

Cloud computing: On-demand provision of shared, configurable computing resources over a network.

Distributed system: A system whose components operate across multiple networked computing nodes.

Public cloud: Provider-operated cloud infrastructure shared by multiple customers.

Private cloud: Cloud environment dedicated to one organization.

Hybrid cloud: Integrated combination of private and public cloud environments.

Multicloud: Use of services from multiple public-cloud providers.

IaaS: Infrastructure as a Service; virtualized computing, storage, and networking resources.

PaaS: Platform as a Service; managed application-development and runtime environment.

SaaS: Software as a Service; complete application delivered and managed by a provider.

Availability: Proportion of an agreed period during which a service is usable.

Reliability: Probability that a system performs correctly for a specified period.

Resilience: Capacity to continue or recover operations after disruption.

Scalability: Ability to handle greater workload by adding or improving resources.

Elasticity: Ability to adjust capacity rapidly in response to demand.

RPO: Maximum acceptable period of data loss measured in time.

RTO: Maximum acceptable time to restore service.

Shared responsibility: Division of security and operational duties between provider and customer.

FinOps: Cross-functional practice of managing cloud economics and accountability.

Vendor lock-in: Difficulty or cost of moving from one provider, platform, or technology.

Review Questions

Short Answer Questions

1. What distinguishes a hybrid cloud from a multicloud strategy?
2. Explain the principal difference between IaaS and PaaS.
3. Define availability and state how it is calculated.
4. Why can horizontal scaling improve resilience?
5. What do RPO and RTO measure?

Long Answer Questions

1. Compare public, private, hybrid, and multicloud models for a regulated financial organization.
2. Explain how responsibility changes across IaaS, PaaS, and SaaS.
3. Discuss the principal architectural challenges of distributed business systems.
4. Evaluate the claim that cloud computing always reduces IT costs.
5. Develop a governance framework for a multinational SaaS implementation.

Analytical / Application Questions

1. A retailer has highly variable web demand but stable, sensitive financial processing. Recommend a deployment and service-model strategy and justify the workload placement.
2. Two independent service components each have availability of 99.9%. Calculate the availability if both are required, and explain why the result may differ in practice.
3. Design a cloud cost-management plan for a company whose development environments are frequently left running and whose data-transfer charges are rising.

Multiple Choice Questions with Answers

Question 1

Which deployment model combines dedicated organizational infrastructure with public-cloud resources through integration?

A. Public cloud

B. Private cloud

C. Hybrid cloud

D. SaaS

Correct Answer: C. Hybrid cloud

Question 2

Which service model normally gives the customer the greatest control over the operating system?

A. SaaS

B. PaaS

C. IaaS

D. Managed application service

Correct Answer: C. IaaS

Question 3

A service available for 8,760 hours with 8.76 hours of downtime has approximately what availability?

A. 99%

B. 99.9%

C. 99.99%

D. 99.999%

Correct Answer: B. 99.9%

Question 4

Which statement best describes elasticity?

A. The ability to encrypt all stored data

B. The ability to adjust capacity rapidly as demand changes

C. The ability to operate without a network

D. The ability to avoid all vendor dependence

Correct Answer: B. The ability to adjust capacity rapidly as demand changes

Question 5

If two independent components are both required and each has availability 0.999, what is system availability?

A. 0.900

B. 0.999

C. 0.998001

D. 1.999

Correct Answer: C. 0.998001

Question 6

Which measure specifies the maximum acceptable amount of data loss in time?

A. RTO

B. RPO

C. SLA

D. MTTR

Correct Answer: B. RPO

Question 7

Which practice most directly improves cloud cost accountability?

A. Removing resource ownership information

B. Using mandatory project and department tags

C. Increasing all instance sizes

D. Disabling usage monitoring

Correct Answer: B. Using mandatory project and department tags

Question 8

What is a principal risk of multicloud adoption?

A. It guarantees portability

B. It eliminates all data-transfer charges

C. It can increase governance and skills complexity

D. It prevents use of specialized services

Correct Answer: C. It can increase governance and skills complexity

Question 9

In the shared-responsibility model, which duty generally remains with the customer?

A. Protecting the provider’s physical building

B. Manufacturing servers

C. Configuring identities and access permissions

D. Maintaining the provider’s power supply

Correct Answer: C. Configuring identities and access permissions

Question 10

Which workload is most likely to tolerate eventual consistency?

A. Final financial settlement

B. Inventory reservation at checkout

C. Product recommendation display

D. Legal record preservation

Correct Answer: C. Product recommendation display