Return to: Articles Index


Hybrid Clouds Move to the Forefront

Neal Leavitt

Companies are increasingly turning to hybrid clouds, which offer the benefits of both public and private clouds in an integrated system.

Despite cloud computing's enormous popularity and high profile, many companies have been dissatisfied because they haven't found what they want in a single cloud architecture.

Private clouds, which organizations run internally, are secure, accessible without requiring Internet availability, and customizable. Public clouds run over the Internet, and are scalable, less costly, and simple to adopt and use.

Until recently, organizations could not easily and economically integrate and operate both types of architectures as part of one overall cloud system. Now, though, companies are seamlessly merging private and public approaches, creating a hybrid cloud that lets them reap some of the benefits of each, noted Panos Tsirigotis, chief software architect and cofounder of hybrid-cloud vendor CloudVelocity.

Hybrid-cloud adoption will be easy for many organizations because they already have an in-house cloud and need only leverage existing public capabilities, explained University of Texas at Dallas associate professor Murat Kantarcioglu.

The technology potentially represents a big business opportunity. In fact, market research firm IDC predicts hybrid-cloud management tools will generate $3.6 billion in revenue worldwide by 2016. Corporations, service providers, governments, and independent software vendors are all looking to capitalize on this opportunity.


Hybrid-cloud architectures started gaining popularity in 2008. Some of the earliest technologies developed to facilitate hybrid-cloud options included CloudSwitch's cloud VLAN (virtual LAN) technology and Eucalyptus Systems' cloud platform. There has also been open source software such as OpenStack for building Amazon Web Services-compatible private and hybrid clouds.

Hybrid clouds combine the public cloud's cost savings and elasticity—enabling the on-demand acquisition and release of resources based on temporary needs without having to acquire additional infrastructure—with a private cloud's security, control, and customization.

"Enterprises can't build infinite compute sources internally, so being able to easily use external public-cloud computing resources is a great benefit for them," added Vikas Aggarwal, CEO of hybrid-cloud vendor Zyrion.

"Companies can take advantage of public clouds to handle 'spiky' usage patterns and peak workloads without the need for expensive hardware and infrastructure," said Beth Cohen, senior cloud architect for consultancy Cloud Technology Partners.

But some enterprises are reluctant to host sensitive data on external public cloud networks for security reasons, added Aggarwal.

And, noted Kantarcioglu, some hesitate to move their sensitive data to public clouds because of concerns about compliance with government data-protection regulations such as the US Health Insurance Portability and Accountability Act.

In addition, some are worried that using public clouds for mission-critical tasks would give them less control over their data and infrastructure.

Most corporations' business units already use public clouds and software-as-a-service (SaaS) cloud deployments for many IT functions, including customer-relationship management, analytics, and rapid market testing.

Other companies have their own private clouds, which makes it easier for them to expand to a hybrid-cloud infrastructure, Cohen said.

Most large corporations have built their own hybrid cloud infrastructures. However, numerous service providers sell hybrid-cloud platforms primarily to small and midsize companies, including Eucalyptus Systems (Eucalyptus Cloud software), IBM (IBM SmartCloud Enterprise), Microsoft (Windows Azure), Oracle (Oracle Cloud), Rackspace (RackConnect), Red Hat (Red Hat Hybrid IaaS Solution), and SoftLayer (CloudLayer).


The technology used to build hybrid clouds varies from vendor to vendor and product to product.

Key components

In most cases, hybrid-cloud implementations have a controller that keeps track of the locations of public or private clouds and servers, IP addresses, and other important resources used to run the systems effectively.

Other key components typically include a

  • cloud provisioning and orchestration manager for public-cloud resources including virtual machines, storage, and networks;
  • cloud gateway located at the private cloud to serve as one endpoint of the secure virtual private network connection between the private and public clouds;
  • VPN gateway at the public cloud that serves as the other secure-connection endpoint;
  • cloud-adaptation manager that customizes software stacks from the operating system all the way to the application so that they can run in both the public and private clouds, which aren't necessarily identical or compatible;
  • data transfer and synchronization element to efficiently exchange information between the public and private clouds; and
  • configuration monitor to track the changing configurations of network, storage, and other resources deployed in the hybrid cloud.


Integration of one or more public and private clouds into a hybrid system can be more challenging than integrating on-premises systems, said Oracle vice president of product marketing Rex Wang.

Because different clouds usually have distinct APIs, integrating public, private, and legacy systems often requires custom code, added UT Dallas' Kantarcioglu.


There are two primary hybrid-cloud deployment models.

In the cloudbursting model, Kantarcioglu said, organizations use an in-house cloud infrastructure to deploy applications and public-cloud services to mitigate applications' sudden activity bursts. This provides several advantages such as adaptability to changing computational capacity requirements and cost savings through the efficient use of public-cloud resources.

In the second model, organizations run applications for sensitive information on a private infrastructure and outsource less critical applications to a public-cloud service provider.

Users get higher overall throughput because they increase public-cloud resource usage as demand increases, explained Kantarcioglu.

"Keeping private data locally under control in a secure private cloud enhances the security. And using public-cloud resources as needed might be cheaper than investing significant resources in building a large private-cloud infrastructure," he added.


The technological key to hybrid-cloud computing is management. Systems are quickly evolving from single-cloud to multicloud management.

The latter must manage all types of cloud applications—including SaaS, platform as a service (PaaS), and infrastructure as a service (IaaS)—through the entire development and deployment life cycles.

Because of the way cloud operations work, management systems also must enable functions such as self-service provisioning and automatic scaling. Hybrid-cloud management goes even further by working across multiple clouds, allowing apps and workloads to be moved from one to another.

"To do that, these systems must talk to multiple clouds, which requires well-defined APIs and standards for interoperability," Wang said.

Some public clouds provide their own management tools, while various third-party companies offer management services.


To secure hybrid clouds, organizations use techniques such as access-control policies, authentication, and encryption in both public and private clouds. These include a combination of managed hosted appliances and cloud-based security services.

Approaches such as firewalls and intrusion-detection systems are often implemented in a hosted environment dedicated for use with the hybrid-cloud system, said Rackspace product manager Jonathan Hogue.

"Due to potential data-disclosure risks, companies might want to limit the amount of sensitive data they outsource or they should consider encrypting outsourced sensitive data to protect it against potential disclosures in public clouds," Kantarcioglu said.

Although encryption-based approaches could protect sensitive data outsourced to public clouds, processing encrypted data is generally more complex and costly.


"Hybrid clouds," said Wendy Cartee, Hewlett-Packard's vice president of global converged cloud marketing, "can be built to suit nearly any IT need or environment, whether for a specific department or an enterprise-wide IT makeover."

"Organizations that see that public data—whether from statistical analyses done by government entities or social media analytics or even published university studies—can enhance their ability to analyze their own internal corporate data stand to gain the most from pursuing hybrid-cloud opportunities," said Moe Abdula, IBM vice president of strategy and director of IBM's SmartCloud Foundation, the company's technology infrastructure for private and hybrid clouds.

But for big-data analysis and high-performance computing, moving the vast amounts of information involved between clouds is challenging, making hybrid clouds impractical for these applications, said John Howie, chief operating officer of the Cloud Security Alliance consortium.


While hybrid clouds are becoming more feasible for the masses, new problems will emerge as more people use them.

Security and compliance with statutory and regulatory data-protection provisions are two of hybrid-cloud adoption's biggest roadblocks, noted Jeff Spivey, international vice president of ISACA, a global nonprofit IT trade organization.

"The risk can be significant if these factors are overlooked or forgotten," he explained.

In a July 2012 Coleman Parkes Research survey for Hewlett-Packard of 550 senior business and technology executives with midsize to large US-based companies, 62 percent of respondents said the approach's biggest challenges stem from a lack of understanding of security requirements, and 55 percent stated that they're due to procuring services without screening the provider. However, two-thirds said cloud services could ultimately be as secure as on-premises datacenters.

Because hybrid clouds are new for numerous organizations, many IT professionals don't yet have the skills or information they need to effectively build, manage, and use them.

Some companies are reluctant to adopt or adapt to new technologies, said Hemendra Godbole, Tata Consultancy Services' head of transformation solutions for IT infrastructure services. They might also be concerned about the lack of standardization for many hybrid-cloud technologies, he added.

Some organizations might not be convinced that the hybrid cloud offers enough benefits to justify the time and money that implementation requires.

A February 2012 Coleman Parkes Research survey for HP found that 75 percent of responding organizations plan to adopt a hybrid-cloud model.

According to Sebastian Stadil, CEO of Scalr, a cloud management services vendor, hybrid clouds will become commonplace in the near future.

"Hybrid-cloud technology will eventually allow for workload portability, where the computing environment can change as the needs of the workload change," said Rackspace's Hogue.

"Private clouds will continue to be popular because not all workloads will be suited to the public cloud," said Lilac Schoenbeck, senior manager of cloud-computing marketing at IT-management vendor BMC Software. "The hybrid cloud is complicated and shouldn't be embarked upon without careful consideration of how private and public clouds can be managed holistically."

Said Mike Pearl, a principal in PricewaterhouseCoopers' advisory practice and its US cloud-computing leader, private clouds serve many needs but certain workloads lend themselves to the public cloud, which means hybrid clouds will be the primary architecture for many future deployments.

Neal Leavitt is president of Leavitt Communications (, a Fallbrook, California-based international marketing communications company with affiliate offices in Brazil, France, Germany, Hong Kong, India, and the UK. He writes frequently on technology topics and can be reached at