A Cloud-Based Business Continuity Framework for Universities.

Abstract

- Adopting cloud computing as a strategy for business continuity rather than building expensive secondary backup sites is taking center stage in modern organizations. These organizations leverage the pay-as-you-go and pay-forwhat-you-use models to minimize expensive investments on licenses, storage and infrastructure. However, universities in Kenya, Africa and the developing world still find it difficult to adopt this strategy due to contextual constraints and challenges. The purpose of this paper is to introspect cloud computing for business continuity frameworks from literature, and identify existing challenges that hinder their adoption in Kenyan universities. These challenges include lack of expertise, connectivity challenges, communication costs, legal and regulatory issues, culture, security, optimization, support and maintenance, possible loss of access to data, database location and effective integration with existing systems. A comparative survey of three Kenyan universities' business continuity plans was done to contextualize the study. Finally, a context sensitive business continuity conceptual framework based on cloud computing and the people, process and technology frameworks is proposed.

Keywords

• cloud computing
• business continuity
• framework

I. INTRODUCTION

Universities in developing countries face socio-economic and political challenges that limit their capacity to invest in expensive information communications technology (ICT) systems [ 1 ]. On the flipside, just like other leading universities in the world, they have a growing demand for different information technology (IT) services to support critical operations like teaching, research, estates management and finance [ 2 ] both during normal and crisis periods. Perhaps, nothing illustrates the need for proper continuity planning better than the recent outbreak of Covid-19 which effectively brought operations of nearly all universities in Kenya to a standstill. Of the seventy-four (74) universities and constituent colleges, less than five (5) continued some form of teaching operations using an assorted array of online tools targeting oncampus students that were now forced to stay home. Teaching staff are ill equipped to work on digital platforms with most of them still using teaching content developed on paper. A few have digitized their content in form of presentations held on personal computers. Only two universities (United States International University (USIU) and Mt. Kenya University) seemed to transit seamlessly to online teaching due to their better preparedness in terms of hosting most of their teaching content on digital platforms. These figures amplify the great need for Kenyan universities to urgently consider adopting cloud computing for daily and business continuity (BC) purposes. The cloud platform offers clear benefits for educational institutions such as flexibility, agility, scalability, availability, cost-effective utility computing, elasticity, extensibility, collaboration flexibility, improved disaster recovery and back-up capabilities [ 3 ] [ 4 ]. Despite these benefits universities in developing countries are still reluctant to deploy their business to the cloud because of challenges such as lack of awareness and support from top management, difficulties in integration with existing systems, perceived loss of control, vendor lock-in, security issues, privacy and business data confidentiality, government telecommunication infrastructure policies, lack of relevant skills , reliability and availability issues, and poor internet connectivity, low speed and high communication costs per megabyte of data [ 4 ] [ 5 ]. This study done on three Kenyan universities revealed that 79% of the respondents appreciates the importance of business continuity , but still rely on traditional methods of data backup and archiving paper records. The study also reveals that 40.7% have replicated their servers for business continuity on safe sites a strategy which is ideally costly, complex and frequently does not meet recovery objectives while these are actually the advantages of using cloud infrastructure to simplify recovery [6]. Enterprises should invest in cloud computing over buying resources for an offsite location since cloud computing allows pay-per use model which significantly reduces operational cost [ 7 ]. Moreover, in case of a contingency, cloud based recovery is faster and reliable than traditional recovery techniques. A search through literature indicates that pitching BC on cloud computing solutions is not something new. However, there are many challenges and or constraints which face Kenyan universities when planning to implement such strategies. Existing literature, which identifies and analyses the challenges for the cloud-based context, mostly consider security and privacy perspectives [ 8 ]. Limited literature considers a systematic procedure for assessing and managing challenges and making users aware of the issues that need adequate attention before considering the adoption of a cloud for business continuity strategy. This paper examines the constraints faced by Kenyan universities before, during and after cloud adoption for business continuity. The study further proposes a framework that supports (i) consideration of people aspect; (ii) systematic process for assessing and managing process challenges; (iii) technology challenges that will prepare deployment and support planning for organizational BC using cloud computing.

II. LITERATURE REVIEW

A. Cloud Business Continuity Framework

Business Continuity Planning (BCP) is the careful laying down of strategies and protocols designed to ensure that the business can continue to operate even during a disruptive event or disaster [9]. The plan ensures that business operations and services continue before, during, and after disruptive events. Closely related is Disaster recovery (DR) which encompasses a set of processes, policies and procedures that maintain the availability of data and applications in case critical IT infrastructure like servers and data centers are disrupted or damaged [ 10 ]. DR focuses on making sure the IT infrastructure is restored to operation as quickly as possible after a disaster. Ochara [ 11 ] proposed the fit-viability model (FVM) as the framework for cloud based business continuity management (BCM) targeting container terminals in South Africa. This model captured in Figure 1 was first proposed by [ 12 ] in 2001 for evaluating organizational adoption of internet initiatives.

Fig 1: Fit-Viability model Ochara [ 11 ] argues that organizational resilience can be achieved through cloud based BC planning if the digitized BCM architecture fits the cloud computing model; and if the cloud computing model is a viable model that can contribute to managing complexity in the business organization’s units which usually have differentiated size, structure and ICT investment levels. The architecture addresses the gaps on cloud’s viability and proposes several factors based on the constructs of: Technology readiness (Robustness, Scalability, Server Configuration Management, Virtualization), Economic Viability (Delivery, price, Quality), Organizational viability (Smart BCM) [ 11 ]. The model however, misses out on the peoples’ aspect such as management support and expertise, government policies, legal framework and integration. Tariq et al [ 12 ]. evaluated factors that influence cloud adoption in institutions of higher learning and developed a model with five contexts (Security, Technical, Organizational Challenges, Environmental and External Pressure and Advantages). They then connected them with cloud adoption issues [ 13 ]. This framework too fails to address cloud adoption for business continuity challenges such as possible loss of control over data, and integration challenges with existing systems and infrastructure. In order to ensure a successful cloud based business continuity management plan, Hiran et al. [ 14 ] proposes a model with five key elements: Discovery and Plan, Control and Automation, Management, Replication, and Networking. The model fails to address organizational challenges, Service level agreement (SLA), government policies and regulations and possible loss of data in case of contract lapse. Al-shammari [ 15 ] introduces a disaster recovery plan for database services based on multicloud environment consisting of two components: database recovery in multi-cloud and maintaining business continuity. The framework focuses on minimizing the cost with respect to Recovery Time Objective (RTO) and Recovery Point Objective (RPO) at the same time ensure high availability, reliability and ensure continuity for business before, during and after the disaster incident. Education institutions should be encouraged to adopt cloud for technology-based teaching and learning to improve and overcome their operational and academic challenges. The Hybrid EduCloud framework is based on Ethiopian higher education , which is one of the subSaharan African country. EduCloud has five implementation strategies: Cloud based learning strategy (awareness seminars, training with service providers), Evaluate higher education needs for adoption of cloud (Infrastructure, usage, data for migration), Experimenting cloud applications, selection of cloud provider (service delivery and deployment model), Implementation and maintenance of cloud [ 16 ]. The EduCloud model focusses on cloud adoption in Universities in sub Saharan Africa a case of Ethiopia. The model cannot be used for business continuity purposes since it misses out on integration. Government policies are not addressed before the migration to cloud.

Google [ 17 ] too has developed cloud computing adoption framework based on the people, process and technology model. The framework identifies four themes (Learn, Lead, Scale, Secure) and the practices in each theme fall into three phases (tactical, strategic, transformational) through which cloud adoption maturity can be assessed to come up with the baseline situation before embarking on the adoption process. One strong point with Google is its strong foundation on the people, process and technology aspect which the proposed framework is also based on. Amazon Web Services (AWS) [ 18 ] have the AWS Cloud Adoption Framework and Microsoft [ 19 ] have the cloud adoption framework for Azure. Although AWS is the market leader and offers over one hundred and seventy (170) services across compute platforms, one big challenge is pricing. Organizations find it difficult to understand the complex metrics tied to the architectural decisions they make and the cost implications of supporting them [ 20 ]. On the other hand, many organizations that are used to Microsoft products find it easier to adopt Azure because of productivity and workflow solutions like Office 365 and Teams. The framework however, does not discuss people aspect and how organizations should align themselves before adopting cloud. The three cloud service providers: Amazon, Cisco and Microsoft adoption frameworks generally guide users on how to adopt their cloud services, while the proposed framework does not limit users to a specific cloud service provider.

B. Field survey

A study on business continuity plans of three universities (Egerton, Kenyatta and Strathmore) in Kenya was done to assess existing challenges identified from literature review and to give a contextual touch to the study. Out of the three universities selected, two universities are public while one is private; therefore the findings of the study maybe applicable to other universities in Kenya. The target population was 120 ICT staff from three selected universities who have knowledge in cloud computing. Most respondent were administrators (security/Systems and database) at 43.2% since they are familiar with data centers, systems administration and server environments, 29.7% were managers (IT managers and Security managers), 24.7% were IT technicians while 2.5% were Director ICT. The sample size was 92 and respondents were 81. Primary data was collected using a questionnaire which had both open and closed ended questions. Once the responses were received, they were coded and edited for completeness and consistency. Data was analyzed using Statistical Package for Social Sciences (SPSS) version 20.0

Based on the factor loading ten factors were picked as the main challenges and issues. The study revealed that 85.2% of the respondents feel that the initial, maintenance and upgrading cost should be clear before cloud adoption with 81.5 agreeing on having management support before cloud adoption. All universities have some of the services running on cloud for example emails but majority are skeptical on running their core enterprise resource planning on the cloud due to security and privacy which were rated at 88% while 72% were concerned over loss of data and lack of control of their data. 88% of the respondent felt that there was need to evaluate the existing infrastructure and expected infrastructure upgrade once universities move their business continuity to the cloud. The challenges are also found in the previous studies done by Al-Shqeerat et al. [ 3 ]. Universities should have an understanding on the legal requirement and implications, third party licenses, understand data privacy laws, Intellectual property Rights, Service termination/failure agreements. 76% agree that there is need to have a clear legal framework during the whole process. 92% agree that the cloud vendor should focus on the optimization; Manage workload to maximize performance, Prioritize workload with advanced scheduling. Another 92% agree that there is need to understand the SLA between the universities and the cloud vendor. Based on the research findings, 82% of the respondents agreed that employees should enhance and strengthen their expertise through professional training and certification. These findings agrees with the survey done by Kumar et al. [ 4 ] and Zhang et al. [ 8 ].

C. Conceptual Framework

After the literature review and a field survey of three Kenyan universities, the paper adopted the people, process, technology conceptual framework [ 21 ] and focused on ten challenges that hinder IHL adopting cloud for business continuity as shown in Fig 2. The people, process and technology framework was adopted because it underpins the objectives of the study.

Fig 2: Conceptual Framework

Universities willing to adopt the proposed framework to change from their current state to a successful cloud-Based BCM, need to ensure first of all that the employees (people) appreciate, buy in and have the knowledge of the new technology and they should be available during the migration process. Once the people aspect has been met, they can proceed to the process aspect. To implement the processes, universities should identify the steps by reengineering their current business processes to align with cloud-based BCM. Universities should ensure that existing SLAs’ with third parties and other regulations approvals are done before adoption. Proper internet and cost analysis should be done at Adoption of new technology in Sub Saharan Africa contextual, cultural, economic, and infrastructural factors hinder adoption. Furthermore, access to technology is not readily available to a majority of the population [ 22 ]. Many students come from geographically disparate locations where internet speeds are low. Despite cloud computing popularity, enterprises are still reluctant to host sensitive user data in the cloud due to security, trust of data and privacy challenges which were found to be the leading determinant in cloud this stage as well. Finally the new technology is introduced .Technology should fit in the universities’ need and users should be sensitized on data security changes and infrastructure changes as they relate to their jobs.

The conceptual framework can be interpreted as captured in Table 1:

Explanation Trainings and certification, sensitization, availability, hiring. user Steering team, commitment ,culture Controlled Integration, deployment documentation

management Interfaces, Functional

Cloud computing

Models, switch over Regular Monitoring of the usage, Modification and Maintenance, Monitoring and Reviewing of framework, SLA between institution and cloud service provider, SLA between Institution and third party licenses, support and maintenance Initial cost, Lease period/operational expenditure, running costs, License costs, Pay-per-usage/ on demand service Reliability, backup service provider, cost.

Intellectual property Rights, Service termination/failure agreements, data protection laws, legal framework, government policies, data disposal at end of contract.

Where the cloud providers store their clients’ data, how the cloud providers isolate their clients’ data from others, and how the cloud providers are committed to investigating inappropriate or illegal activities.

Firewall, replication tools, emergency power backup, VPN, switches, configuration of desktop and web based applications.

Manage workload to maximize performance, Prioritize workload with advanced scheduling to attain SLAs, Move workload to appropriate infrastructure and ensure Provision and de-provision of resources. adoption decisions [ 22 ]. Lack of control over user data, vendor lock-in, regulatory compliance and SLA with cloud service provider were the three most rated concerns [ 4 ]. A study done by Wyche et al. [ 20 ] in Nairobi Kenya highlights constraints that influence use of technology as: poor infrastructure settings: limited bandwidth, high access cost, different perceptions of responsiveness and threats to physical and virtual security. Tariq et al. [ 13 ] Did a study on factors participants considered as most influential in cloud adoption in higher education institutes in Punjab. Challenges such as insufficient skilled staff, staff trainings, organization culture, integrity, integration with other systems, operation costs, regulatory, government support were highly rated.

III. CONCLUSIONS AND RECOMMENDATIONS The objective of the paper was to introspect cloud computing for business continuity frameworks from literature, and identify existing challenges that hinder their adoption in Kenyan universities and propose a context sensitive cloud based business continuity conceptual framework based on people, process and technology frameworks.

The findings show that universities in Kenya have made significant effort in implementing business continuity plans, however majority are relying on backups while a small percentage have redundant sites for business continuity. For universities to migrate to the cloud for their business continuity plans, there needs to be a proper understanding of the perceived challenges and how to overcome the challenges before migrating to the cloud. .

Based on the research findings, the study recommends the need for Kenyan universities to strengthen their people related aspects. Some of these aspects include expertise, training, certification and management support. People factor will become more effective in enhancing cloud computing system for business continuity if the aspects are improved. The study also recommends the need for universities in Kenya to strengthen and understand the process related aspects. These are; Business process reengineering, SLA, Cost, Internet connectivity and regulatory framework . This will avoid a deadlock situation during implementation and it will improve the project success rate. Further, the study recommends the need for universities in Kenya to strengthen their technology related aspects. These are: security, infrastructure and optimization. Framework < [Accessed:

References

[1] Karim , F. , & Rampersad , G. ( 2017 ). Cloud Computing in Education in Developing Countries . Computer and Information Science , 10 ( 2 ), 87 - 96 .

[2] Seke M. ( 2015 ), Higher Education and the Adoption of Cloud Computing Technology in Africa

[3] Al-Shqeerat , K.H. , Hammoudeh , M.A.A. and Abbasi , M.I. , 2016 . Design and Analysis of an Effective Secure Cloud System at Qassim University. International Journal of Computer Science and Information Security , 14 ( 8 ), p. 12 .

[4] Kumar , D. , Samalia , H. V. , & Verma , P. ( 2017 ). Exploring suitability of cloud computing for small and medium-sized enterprises in India . Journal of Small Business and Enterprise Development.

[5] Kajiyama , T. , Jennex , M. , & Addo , T. ( 2017 ). To cloud or not to cloud: how risks and threats are affecting cloud adoption decisions . Information & Computer Security.

[7] Saquib , Z. , Tyagi , V. , Bokare , S. , Dongawe , S. , Dwivedi , M. and Dwivedi , J. ( 2013 ), “ A new approach to disaster recovery as a service over cloud for database system” , In 15th International Conference on Advanced Computing Technologies (ICACT) , pp. 1 - 6 .

[8] Xuan Zhang , Nattapong Wuwong, Hao Li , and Xuejie Zhang . “ Information security risk management framework for the cloud computing environments .” In Paper presented at the 10th IEEE International Conference on Computer and Information Technology (CIT) , Cork, Ireland, 29 June-1 July 2010 .

Wang , L. , Harper , R.E. , Mahindru , R. and Ramasamy , H.V. ( 2016 ), “ Disaster Recovery for Cloud-Hosted Enterprise Applications” , In IEEE 9th International Conference on Cloud Computing (CLOUD) , pp. 432 - 439 .

[10] M. Dey , "Business Continuity Planning (BCP) methodology - Essential for every business," 2011 IEEE GCC Conference and Exhibition (GCC) , Dubai , 2011 , pp. 229 - 232 , doi: 10.1109/IEEEGCC. 2011 . 5752503 .

[11] Ochara , N. M. ( 2020 ). Assimilation of Cloud Computing in Business Continuity Management for Container Terminal Operations in South Africa . Available at SSRN 3560745.

[12] Tjan , A. K. ( 2001 ). Finally, a way to put your Internet portfolio in order . Harvard business review , 79 ( 2 ), 76 - 85 .

[13] Tariq , M.I. , Tayyaba , S. , Rasheed , H. and Ashraf , M.W. ( 2017 ), “ Factors influencing the Cloud Computing adoption in Higher Education Institutions of Punjab, Pakistan” . In International Conference on Communication, Computing and Digital Systems (CCODE) IEEE , pp. 179 - 184 .

[14] Hiran , K. K. , Henten , A. , Shrivas , M. K. , & Doshi , R. ( 2018 , August) . Hybrid educloud model in higher education: The case of Sub-Saharan Africa, Ethiopia . In 2018 IEEE 7th International Conference on Adaptive Science & Technology (ICAST) (pp. 1 - 9 ). IEEE.

[15] Al-shammari , M. M. , & Alwan , A. A. A Conceptual Framework for Disaster Recovery and Business Continuity of Database Services in Multi-Cloud.

[16] Sabi , H. M. , Uzoka , F. M. E. , Langmia , K. , Njeh , F. N. , & Tsuma , C. K. ( 2018 ). A cross-country model of contextual factors impacting cloud computing adoption at universities in sub-Saharan Africa . Information Systems Frontiers , 20 ( 6 ), 1381 - 1404 .

[17] Google ( 2020 ), The Google Cloud Adoption Framework . < https://cloud.google.com/adoption-framework > [Accessed 10 /6/2020]

[18] Amazon ( 2020 ), AWS Cloud Adoption https://aws.amazon.com/professional-services/CAF/> 10/6/2020]

[19] Microsoft ( 2020 ), Microsoft Cloud Adoption Framework for Azure https ://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ [Accessed: 10/6/2020]

[20] Wyche , S. P. , Smyth , T. N. , Chetty , M. , Aoki , P. M. , & Grinter , R. E. ( 2010 , April). Deliberate interactions: characterizing technology use in Nairobi, Kenya . In Proceedings of the SIGCHI Conference on Human Factors in Computing Systems (pp. 2593 - 2602 ).

[21] Prodan , M. , Prodan , A. and Purcarea , A.A. ( 2015 ), Three new dimensions to people, process, technology improvement model . In New contributions in information systems and technologies , Springer, Cham, pp. 481 - 490 ).

[22] Seifu , S. D. , Dahiru , A. A. , Bass , J. M. , & Allison , I. K. ( 2017 ). Cloud‐computing: Adoption issues for Ethiopian public and private enterprises . The Electronic Journal of Information Systems in Developing Countries , 78 ( 1 ), 1 - 14 .