9.2.1 Pilot Study

The pilot study aims to evaluate and revise the research method on one digital library, in terms of completeness and rigorousness. For this aim we used Google Scholar, which is one of the most voluminous and commonly used digital libraries. The initial research question is formed based on the pilot article “Decision support tools for cloud migration in the enterprise” [12]. The initial search proved to be too general, after which we reduced the context, for example, by explicitly defining “business application” or “enterprise application” instead of “business or enterprise” and “application”. In addition, the initial search revealed synonyms that are used in the final search strings. To make sure that the protocol was implemented correctly, we consulted a similar systematic research in the SOA migration field [14].

9.2.2 Search Strategy

After the pilot study identified the needed components for a complete review and helped us refine them, the systematic literature review was conducted. The following sections describe the strategy employed by this literature review study.

9.2.3 Data Extraction

The data extraction from each of the primary studies was facilitated by the data extraction form given in Table 9.5. For each study we recorded the identified measures or indicators, benefits, risks, and models.

Many of the primary studies that were examined did not have the data we needed explicitly shown in the form it was expected in the data extraction form, such as benefits or risks. Therefore extra work was needed to extract or identify these types of measures. Many of the studies included implicit measures that aid migration in the models or frameworks they described, which required even deeper analysis.

9.2.4 Data Analysis Method

The aim of this review is to identify and categorize different factors that can aid companies evaluate if migrating their legacy application to the cloud is beneficial. In order to achieve this, a method of analyzing the studies was needed. Given that most of the measures we found are qualitative, manual analysis and synthesis was inevitable.

We differentiate benefits and risks as a special kind of factors because they represent an explicit indicator of the possible gains or losses of a migration approach. In this work we use the following definitions of benefits and risks: a benefit is an advantage or profit gained from migrating an (enterprise) application to the cloud, whereas a risk is an undesirable event that may happen if you migrate your application to the cloud. These measures are typically qualitative in nature. Therefore they do not have any measuring units specified and are characterized only by category.

The risks and benefits categories identified in the pilot study [12] were used as classification categories of all types of measures (including identified benefits and risks), which include the following: financial, technical, organizational, legal, and security. The studies that categorized their measures either had the same or similar categories or had a more fine-grained technical category. Technical subcategories were translated simply into technical as we were interested in the type of the categorization of measures rather than their subcategories. The description of a measure, if identified in multiple studies, was taken from the one that had the most descriptive name or best explanation. If a measure in a study did not specify any category, the most logical category of the set of starting categories identified was chosen. When we encountered a specific category that was not present in the list of categories, it was replaced with the most logical one.

The found measures and indicators are summarized in a tabular form, augmented with the corresponding narrative description. The description is taken from the source articles, unchanged (if it was present) or reported as a combination of the definitions (if found in multiple articles). A mapping of the measures in one study to the same or similar measures found in other studies was reported in these tables.

The models found in the studies were also evaluated and compared by looking at the proposed steps and the stage of the migration they cover. An evaluation of models for cloud migration is given in [7], which presents a descriptive summary of models/frameworks of migration and an evaluation of their missing features. However, our analysis of the models is not based on model completeness – as [7] suggest – but on the perspective they consider for migration and when a certain perspective starts to appear or becomes predominant.

9.3.1 Overview of Primary Studies and Quality Evaluation

An interesting fact found when analyzing the included studies is that 3 out of the 12 studies (also quite detailed and high in quality) share a coauthor, Khajeh-Hosseini (Table 9.6). Most of the primary studies are from 2012 and 2013, whereas the earliest study dates from 2010.

From the 12 initially selected articles, one more was eliminated and further used as a reference. Namely, the article “A Survey of Cloud Computing Migration Issues and Frameworks” [7] is a summary of the quality and completeness of 11 models or frameworks for application migration. The article includes a summary of models that were not evaluated by the authors themselves but were taken from other articles and analyzed as defined or were not available. Therefore we used this article exclusively as an example for evaluating other models found in the rest of the primary studies. Three of the models identified in [7] were also found in separate studies and were used to extract measures and indicators from their original articles.

Two articles [2] and [10] do not report on any benefits or risks identified and because of that do not completely satisfy inclusion criterion 2. However, these articles have very detailed models and general measures which have been evaluated on real-world case studies. Therefore, they were included as primary studies.

A shortcoming in most of the articles is that their findings were not evaluated on real-world case studies (or case studies that mimic real applications in general). There were six such articles, and one in particular, even though it states that it is based on the migration of applications in the Iranian telecommunications industry [9], does not specify any details of the company, staff size and composition or characteristics of the migrated applications. Eight of the included studies presented models or frameworks for migration. As can be seen in Fig. 9.1, the average quality of the studies is around 0.8, based on the quality criteria point system (see Section 9.2.2.8).

9.3.2 Benefits and Risks

Benefits and risks, as a special type of qualitative measures, are classified according to the five categories defined in Section 9.2.4. Five of the studies that were chosen did not have a category specified for their risks and benefits. Not defining a category for the risks and benefits is more common than in the case of general measures. The reason for this may be the opinion of authors that specifying something as a risk or benefit is self-sufficient and does not need any other classification information.

Beserra et al. [5] have much more detailed technical subcategories for the risks and benefits such as communication, performance, availability, and suitability, which can be useful if the accent is put on the technical aspects of migration.

Especially interesting categorizations were given by Azarnik et al. [3], who use cost category in the equivalent sense as the financial category. One particularly interesting category of risks they identify is the outsourcing opportunism risk (see Table 9.8), which takes into account the risks that may emerge from using cloud providers without (clearly defined) SLAs. If a risk or benefit does not fit any of the four previously mentioned categories, they simply categorize it as other.

In general, many of the articles had specific subcategories defined for the categories we use. The list of subcategories for the technical benefits and risks category include: communication, availability, suitability, performance, operational, and agility. In contrast, Azarnik et al. [3] also use super categories for some of the classification categories. Such is the outsourcing opportunism risk category, which integrates the technical, legal, and organizational categories. The distribution of our categories in the studies is given in Fig. 9.2.

Besides the defined super- and subcategories for measures, the following category synonyms were encountered: cost or economic for the financial category, operational or functionality as technical subcategories, and political as a synonym for organizational. Selected lists of benefits and risks, along with their original and assigned classification categories, can be found in Tables 9.7 and 9.8, respectively.

9.3.3 General Measures

General measures and indicators are those measures that, depending on the values they take and the context in which they are measured, can be seen either as benefits or risks in the process of migration. Without their values, it is difficult to say if they describe an upside or downside of migration. For example, let us consider network bandwidth as a measure. Low bandwidth values are a hindering factor towards the migration decision, if we want to migrate an application that has large bandwidth demands. If the bandwidth values are high enough for the application needs, then bandwidth is a beneficial factor towards migration.

The measures and indicators in the studies were less frequently explicitly listed as measures compared to the risks and benefits. Yet, the classification of measure and indicators was much more easily extracted and more often explicitly specified. There is also a bigger overlap in identified measures and indicators across the studies compared to risks and benefits.

There is an overlap in some of the risks and benefits and the general measures identified. A typical example would be the “bandwidth” general measure which prescribes examining the bandwidth available in the cloud and if it is sufficient for the concrete application. The equivalent risk is “low bandwidth”, which describes the unwanted effects of migration if bandwidth was not taken into account.

The classification of general measures is similar to the risks and benefits across the papers (Table 9.9). The technical category had the most subcategories: operational, computational, application-usage characteristics,¹ application-technical characteristics,² application and monitoring, user management and security, IaaS, PaaS, monitoring, and multitenancy. The financial category has only one subcategory – billing, whereas organizational has the migration strategy characteristics, provisioning, user interaction, and SLA subcategories. Beserra et al. [5] use the cloud provider characteristics super category which includes the security, organizational, financial, and technical categories. Alonso et al. [2], on the other hand, use the business supercategory to classify measures in the financial, organizational, and legal categories. An overview of the general measures and their original categories is shown in Table 9.9, and the categorization across studies is presented in Fig. 9.3.

9.3.4 Models and Frameworks for Cloud Migration

The analysis of the models and frameworks of migration revealed four distinct types of models, based on the extent to which they cover the migration process:

•  Type 1: Models that focus only on one aspect of migration

This is the simplest type of model found, and can be seen more as guidelines. Examples are the Cost modeling framework [12] that deals with the financial infrastructure costs and the Informal migration feasibility assessment framework [11] that deals with the organizational impact of migration.

•  Type 2: Models that support migration decision making from multiple perspectives

These models can be seen as an extension of the type 1 models, which take the diverse nature of factors of migration into account. The factors match the categorization of measures and indicators and comprise of technical, organizational, financial, etc., feasibility assessment. For instance, the Cloud Adoption Toolkit [10] includes the Cost Modeling framework [12] and augments it with technical feasibility, energy consumption, stakeholder and responsibility analysis. Another example of this type of model is the ARTIST cloud modernization framework [2], which in the analyzed study only describes the premigration phase. The full ARTIST framework can be seen as type 4 model, but the paper that describes it only presents the internal tools working rather than the migration and evaluation phases.

•  Type 3: Incremental migration support models

The incremental migration support model type can be seen as composed of three general stages: premigration, migration and validation/testing. In the premigration stage the technical characteristics and requirements of the application are determined and profiles of the cloud providers are made. The application characteristics are compared to the profiles and the most suitable one is chosen. The migration phase encompasses the actual moving of the application and data, which is done in two separate steps: either first migrating the application then the data or vice versa. In the validation phase performance tests and optimization of the cloud environment are done. The following frameworks can be classified as type 3 migration models: AWS cloud migration framework [16], The five step methodology to cloud migration [4], and the Incremental data-application cloud migration model [1].

•  Type 4: Multiple perspective integration migration support models

The type 4 models can be seen as a synthesis of the type 2 and type 3 models. This model explores the multiple perspectives of migration in the pre-migration stage as described in the type 3 model. A representative example is the Cloudstep [5] model.

9.4.1 Findings and Lessons Learned

•  The shortage of migration specialist to perform the migration increases.

The analysis of measures and indicators revealed a comparable number of organizational and technical risks. One of the risks gaining importance over time is the need of migration specialists in the staff to both perform the migration and be able to monitor the life cycle of the application once it is migrated. This risk was first mentioned in 2010 in the works of [11]. After that it gained popularity from 2013. This risk is important to be pointed out as it defies the belief, common at the time, that outsourcing an application to the cloud is sufficient and does not require further effort.

•  Employees' resistance to migration is a prominent organizational obstacle towards migration to the cloud.

Another prominent organizational obstacle is the staff's resistance to migration, motivated by fear of losing their job. As a result, possible risks include loss of valuable and experienced engineers and a decrease in the productivity and morale of the rest of the staff. This risk also appears as early as 2010 and has been the most often identified risk.

•  Legal restrictions on data location may prohibit migration.

From a legal standpoint, migration is most often not possible because of the strict requirements of data location. Namely, many countries' laws require that private and sensitive data of the country and their citizens be kept within the country borders. As cloud providers expand and open more data centers, this risk is slowly, but certainly starting to disappear, at least for the larger Western countries. The appearance of this risk is evident in 2011 and 2012 and slowly disappears in 2013, just to be replaced with the general measure of the type of SLA offered by the cloud providers. The reason lies in the fact that nowadays cloud providers offer the option of keeping certain types of data within country borders and guarantee it through their SLAs. This trend explains the low number of legal risks and measures identified in the studies.

•  Better SLAs offered by cloud providers eliminate many security risks.

The low amount of security risks can also be explained by the more detailed SLAs offered by cloud providers. Risks such as interception of infrastructure management messages in transit or private data accesses by other customers sharing the same infrastructure are explicitly engineered against by cloud providers and guaranteed in the SLAs they offer. Risks such as Denial of Service attacks cannot be avoided by cloud providers and can happen even if the application does not reside in the cloud.

•  Nowadays software license migration is done along with the migration of software.

Another advancement, which is visible from the cloud providers' side, is the offering of easy migration of software licenses alongside the application. Cloud providers in cooperation with third party software suppliers offer cloud licenses for a small additional fee for the most commonly used support services, such as Oracle database. So if a company already has a license for a software product, it can easily move to the cloud by extending its existing license.

•  Green computing is an important additional benefit of the migration to the cloud.

An important benefit emerging from the literature is green computing, which authors relate to energy savings. In [12], the authors enlist, among the additional resources for their study, reduced energy consumption as a benefit that leads to greener organizations. Erfan goes a step further by characterizing cloud computing as a “green IT tool for the 21st century” [9, p. 4], [3, p. 5] identify green computing as a benefit of cloud computing because cloud providers, according to them, are better at managing voltage conversions and cooling as compared to on-premise computing centers, and consequently are more energy-efficient. Furthermore, because cloud providers use virtualization of their servers, they reach better resource utilization that leads to lower energy consumption. Azarnik et al. [3] also believe that businesses today care more about the environment and run companies in a greener way, therefore it is plausible that in the near future they will turn to using cloud computing because of its (promised) green benefits.

•  Migration models vary in the focus and detail of the migration phases.

As far as the different types of model are concerned, we could not spot any trend across different years. This may be a result of the relatively small number of primary studies. Apparently the depth in which cloud migration is considered in these models is diverse and models of all types are equally appearing in 2010, 2013, and 2014. Our suggestion, based on the primary studies, is to turn the focus to technical, financial, and organizational factors when considering cloud migration. Special care should be taken when calculating the postmigration costs from the financial aspect and the staff impact the migration may have from organizational aspect. A detailed SLA can eliminate the majority of legal and organizational risks and as such is a mandatory ingredient of any migration process. If a migration model or framework is to be used, in the initial phase (considering whether to migrate or not) models of type 1 and 2 are more suitable. When planning the migration itself, however, models of type 4 are preferable as they cover all migration phases.

9.4.2 Threats to Validity

Even though this review was performed based on the systematic literature review guidelines provided in scientific literature (Section 9.2), there may still be some threats to its validity. In particular, the following threat to validity was identified: most studies do not have the same classification of measures and indicators or have no explicit classification at all. Therefore most of the classification done in this paper is done based on the context in which the measures are mentioned. The classification is naturally influenced by the specific context reported in the primary study. However, the authors could have defined the measures/indicators for more generic applications.