|RESEARCH PROPOSAL |
|On |
|CLOUD COMPUTING AND SECUTITY |
|Submitted |
|for Ph.D. Approval |
| |
| |
|By Mr. MBANZABUGABO Jean Baptiste(BE,MSSE,MCA) |

TABLE OF CONTENTS

ABSTRACT..................................................................................................3

1. INTRODUCTION........................................................................................4

1. GENERAL OBJECTIVE OF THE STUDY.................................................................................................. 5

2. SPECIFIC OBJECTIVES .......................................................................5

2. LITERATURE REVIEW ...........................................................................6

3. METHODOLOGY .....................................................................................9

4. METHODS ..................................................................................................14

5. ETHICS .......................................................................................................17

6. REFERENCES ...........................................................................................17

ABSTRACT

One of the latest paradigm in this ever changing field of Information Technology is that of Cloud computing. The world’s 14th largest software company operates entire on cloud (Salesforce.com), this market of cloud computing was already to cross $160Billion by 2011 and the official figures are yet to be announced (Merrill Lynch).The simplest terms in which this cloud computing can be defined is- It is a combination of IT resources and business models used to deliver the IT related capabilities like the Softwares, Platforms and hardware which can be scaled up and down as per the demand and requirement. Thereby, it provides a lot more efficient computing by centralizing the storage, memory, infrastructure, etc
One of the most attracting features of the cloud computing which promises to enormously reduce the operating cost is the “pay per use “feature. The concept of virtualization is yet another major driving force behind the Cloud computing which allows the Cloud service providers to run multiple virtual servers simultaneously on one particular host.

Cloud computing is one of the latest innovations of IT which claims to be all capable of driving the future world of IT within minimum costs. This concept of cloud computing being one side widely accepted by normal users while on the other hand majority of the Organizations have some serious security concerns before moving to this form of IT evolution. In this research proposal all the potential security and confidentiality threats associated with the cloud computing were first investigated and then appropriate security and confidentiality recommendations is to be proposed and published. A diminutive computing interface providing cloud computing based services is also to be designed in-order to explain more precisely as how these suggested cloud computing security and confidentiality recommendations be implemented...Practically.

1. INTRODUCTION

Cloud computing and Security is a new buzzword in the business industry today. The idea leading to cloud computing paradigm is that the computing resources and software are available to the end user, whether an organisation or an individual, in a virtualized environment (cloud) and the user can access it on demand and using a ‘pay as you go’ approach. These services in industry are respectively referred to as Infrastructure as a Service (Iaas), Platform as a Service (PaaS), and Software as a Service (SaaS) (Hayes, 2009). One of the issues faced by the organisations in the world today is need to make the organisational data globally accessible while taking into account the intra organisational and extra-organisational data and a cloud can be a very enabling medium for achieving this.

Enterprise resource planning software is a enormous piece of software that integrates the entire organisation into one giant entity while capturing, changing and automating the organisational processes.

Chances of a successful implementation of an ERP in an organisation are less. Also, it takes sizeable amount of manpower, cost and effort to deploy and maintain the ERP. An entire ERP application being outsourced is a relatively new idea and has been under discussion frequently for its advantages and some latent disadvantages. In today’s world with such economic conditions, it becomes imperative for an organization to reduce its operating costs while increasing overall efficiency with the same amount of resources and to fulfil consumer demands simultaneously. This is where a cloud and secured based ERP can really help an organisation, if not for some very pertinent disadvantages that have to be overcome to make this a more viable option to a “best of breed” or an off the shelf ERP solution, globally.

Cloud computing can also help to divert the attention of the dedicated workforce away from maintenance and development and direct it towards the core processes that actually benefit the organisation in a much better way.

Barriers to adoption of a cloud computing are organisation specific based on massive data Security. However, there are some common issues that push organisations towards the adoption of such a system. These comprise of cost savings, fault tolerance, on demand service, scalability and flexibility, massive data storage, reliance and compliance of data formats.

Concerns regarding a cloud based system include security, scalability, ease of migration and licensing issues. There are some notable disadvantages that need to be overcome. A very pertinent issue is regarding the security of the organizational data. Since the data is stored in the cloud, an organization does not have a direct control over it. The security of the organizational data is the responsibility of the service provider and this throws up a lot of issues for an organization to consider before and after migrating to a cloud based Systems. Another important issue is of a possible vendor lock in that might disallow the organisation to migrate to another service provider when it desires it.

1.1 GENERAL OBJECTIVE OF THE STUDY:

To investigate the possible long and short term advantages and the disadvantages that an organisation can derive from the adoption of a cloud based Systems and/or Cloud based ERP and the potential security and confidentiality threats associated with the cloud computing.

1.2 SPECIFIC OBJECTIVES:

• To analyse if a cloud systems and ERP could prove to be a suitable alternative to the traditional on-premise ERP and for local , massive data storage accessibility (mission critical application). • To identify the merits and demerits of a cloud computing Technology and suggest best practices as of the security concerns to be implemented as pertinent issue is regarding the security of the organizational data stored in the cloud.

2. LITERATURE REVIEW

ERP systems are currently the prevailing form of business computing and storage for many large organisations in the private and public sector (Gable, 1998). An ERP manages and integrates all the business functions in an organisation and this makes it much more than simple software that take no thought to acquire (Boykin, 2001; Chen, 2001; Yen, Chou, & Chang, 2002). Organizations view ERP-enabled standardization as a vital means to integrate dispersed organizational systems and provide a seamless access to information organization-wide (Osterle et. al, 2000). ERP stores and processes data and allows it to be accessed in an appropriate format, while stretching beyond the organisational boundaries (Gupta, 2000) (Al-Mashari & Zairi, 2000) (Gardiner et al, 2002). Because these systems touch so many aspects of a company’s it internal and external operations, their successful deployment and use are critical to organizational performance and survival (Tanis et. al, 2000).

One of the major challenges in ERP adoption is flexibility with the integration of newly-acquired business functionalities into its data processing systems with the minimum time possible (Gupta, 2000). The flexibility of ERP systems refers to the extent to which an ERP system may be dynamically reconfigurable to define new business models and processes (Stedman, 1999). In the near-term perspective, managers find ERP implementation projects the most difficult systems development projects (Wilder and Davis, 1998). ERP projects are set apart by their complexity due to enterprise wide scope. Failures of ERP system implementation and integration (Glass & Vessey, 1999) have been known to lead to organizational bankruptcy (Bulkeley, 1996 ; Davenport, 1998 ; Markus & Tanis, 2000) or partial adoption of the ERP system with only a few modules in place (Bingi et al., 1999; Davenport, 1998).Customization is meant to describe changes or additions to the functionality available in the standard ERP software. Even in the light of the benefits of implementing ERP software, some organizations still choose to customize (Davenport, 1998; Light, 2001). However, customization is very difficult when an organisation wants to implement a whole new set of modules.

The online delivery of the software has been a long standing dream of the software vendors and distributors, alike. Sato et al. (1999) and Bennett et al. (2000) put forward several areas for future research, including integrating ERP and other systems on the Internet. Cloud computing is a fairly established system and has been in the offering since 2000-01 (Bennett et al., 2000). The concept is deceptively simple and logical. Instead of buying the the license for an application like an ERP software and then installing it on a machine, it is much cheaper and convinient to lease the application from a company that created the software (Dubey & Wagle, 2007).

A Cloud is a type of parallel and distributed system consisting of a collection of interconnected and virtualised computers that are dynamically provisioned and presented as one or more unified computing resources based on service-level agreements established through negotiation between the service provider and consumers (Fox, 2009 ; Buyya, et al., 2008). Applications built on cloud architectures run ‘in-the-cloud’ where the physical location of the infrastructure is determined by the provider (Varia, 2008) and is abstracted from the organisation, thus allowing the focus to shift from IT to business innovation. The benefits of cloud computing are widely discussed in practice, focusing on increased agility, availability, flexibility, cost savings and interoperability (Kim, 2009).

The separation of service provider from infrastructure provider has made it much easier for new services to be established online quickly and with low financial risk, and to scale those, services as demand dictates (Murray, 2009 ; Buyya, 2009). Using someone else’s infrastructure on a pay-per-use basis converts the fixed costs into a variable cost based on actual consumption , reducing initial investment and risk (Buyya, et al., 2008) (Fox, 2009). Also the demand for online services can be very variable and poor response due to overload can risk losing customers (Pandey, et al. , 2009). Cloud computing provides easy scalability and the flexible creation and dismantling of resources that customers need only temporarily for special projects or peak workloads (Leavitt, 2009 ; Fox, 2009 ; ECONOMIST, 2009) giving it choice and control over its infrastructure. The ability to scale the use of cloud power to match the demand also mitigates the risk of failure (ECONOMIST,2009) while making the organisations more adaptable.

Cloud based ERP has a much smaller time scale for configuration and deployment. This has a fundamental impact on the agility of a business and the reduction of costs associated with time delays (ISACA, 2009 ; Hayes, 2009) allowing organisations to realise the competitive advantage at a much earlier stage than the non adapters. Organisational data is available and accessible globally through internet improving the overall collaboration in the organsation (Scale, 2009 ; Armbrust, et al., 2009).

When data is stored beyond the organisation, even with lock-tight security and data management standards, there are confidentiality and privacy risks associated with this model, not to mention potential industrial sabotage (Fox, 2009 ; Leavitt, 2009 ; Pandey et al., 2009 ; Das et al.,2009). Also, with a distributed application architecture, there is no possibility for local customization and development an you are limited to the interface the service provider gives you (Fox, 2009).

Besides security, there are legal and regulatory issues that need to be taken care of. When moving applications and data to the Cloud, the providers may choose to locate them anywhere on the planet (Pandey et al., 2009) which subjects it to the laws of that country. For example, specific cryptography techniques could not be used because they are not allowed in some countries. Performance concerns may stop some companies from using cloud computing for transaction oriented and other data-intensive applications (Leavitt, 2009) (Hayes, 2009). Cloud services have reduced the cost of content storage and delivery, but they can be difficult to use for nondevelopers, as each service is best utilised via unique web services, and have their own unique quirks. (Tari, et al., 2009). A user could also get a nasty surprise if they have not understood what they will be charged for (Broberg, et al., 2008). Vendor lock-in is another problem that an organisation may have to face if they want to migrate towrds a new service provider. (Armbrust, et al., 2009).

People are focusing on the core technologies that will lead their business forward over the next five years and want to know how to manage varying degrees of risk wisely. They are wary of making a complete jump in computing ideology in one fell swoop (ECONOMIST, 2010)

3. METHODOLOGY

The learning style assessment was undertaken by the researcher adopted from Kolb and McCarthy (1984). The results indicated that the researcher’s style is one of the interpretivist and a diverger.

Research, according to (Smith & Dainty, 1991), is concerned with problem solving investigating relationships and building on the body of knowledge. It is a plan or design with the view to finding a solution to the research problem by social workers. Formulating and clarifying the research topic is the most important aspect of the research project as it is the starting point of the entire process (Alvesson & Skoldberd, 2000 ; Ghauri & Gronhaug, 2005 ; Mouton & Marais, 1990). Once the research topic is finalised, it becomes easier to choose the research method. To understand the pros and cons of a cloud based ERP system impacted on security, it is essential, that the background of the cloud based systems and virtualization of resources is established along with the factors that may affect the bias of the subject (Denzin & Lincoln, 1998 ; Bogdan & Biklen, 1992).

Methodology is a way of thinking about and studying social reality (Strauss & Corbin, 1990). Bazeley (2004) mentions that approaches taken to defining “qualitative” and “quantitative” have long been associated with different paradigmatic approaches to research, different assumptions about the nature of knowledge (ontology), and the means of generating it (epistemology) . Babbie and Mouton (2001), Denzin and Lincoln (1994), Du Plooy (2001), Marshall and Rossman (1995), and Mason (2002) describe qualitative research as a paradigm that allows the researcher to get an “insider perspective on social action”. Babbie and Mouton (2001) further describe the primary goal of this research approach as describing and then understanding as opposed to merely explaining social action. Qualitative research contributes to discovery and theory-building (Gilles, 2000) which is what is being attempted by the researcher here with respect to a cloud based ERP with a deep consideration of security.

Qualitative techniques based on the interpretation of non-numerical data can provide meaning to human behaviour missing in quantitative data (Rossman & Marshall, 1999 ; Creswell, 1994). It seeks to develop sensitizing concepts and the meanings of central themes in the life world of the subjects (Maykut & Morehouse, 1994). Acquisition of an ERP is a major decision which affects the organisation on multiple levels. The ‘intangible’ factors related to changes and its adaptability or competitive advantage, are difficult to quantify and a qualitative approach is a better suited mode of research here. Qualitative approach is based on the belief that the persons are actors who take an active role in responding to situations and the realisation that the response is based on a certain meaning (Strauss & Corbin, 1990 ; Rossman & Rallis, 2003). The understanding of this meaning is defined and redefined through interaction with sensitivity to conditions and the relationship between condition, action and the result. Qualitative analysis allows for finer differences to be brought to light which will allow the researcher to investigate his case thoroughly. Denzin & Lincoln, (1998) summarise the characteristics of this approach as enabling the researcher to study phenomena in their natural settings, while attempting to interpret these phenomena in terms of the meanings people bring to them.

Observations are the starting point for this approach (Kvale, 1996) and seek to develop theory, but not test it (Rossman & Rallis, 2003). Qualitative researchers analyze their data inductively using a bottom up approach. Induction is usually described as moving from specific observations to broader generalisation and theories (Miles & Huberman, 1994). Glaser & Strauss (1967) and later Strauss & Corbin (1990) mentioned grounded theory where the theory is grounded in the observations made by the researcher. Inductive approach is intended to aid the researcher to understanding of meaning in data through the development of emergent themes or categories. These themes are likely to be based on premises of the research such as security, adaptability, performance factors, scalability etc and will guide the researcher when examining and analysing the data, thereby forming theory. Since qualitative methods can be used to explore substantive areas about which little is known or have conflicting views (Stern 1980; Rossman & Marshall, 1999), this approach is better suited to this research topic.

Grounded theory is an inductive, comparative, and interactive approach research that offers several open-ended strategies to identify emergent themes. Grounded theory used the inductive approach towards the research with no preconceived notions (Glaser & Strauss, 1967) about the research topic. This use of induction and deduction is supported by Bryman and Bell (2003) who argue that grounded theory is an iterative process which includes elements of both induction and deduction. The analysis within grounded theory is done as the constant comparative method. This included comparing incidents within each category, comparing categories to each other, clarifying the developing theory, and writing a coherent theory as a result. (Glaser & Strauss, 1967 ; Strauss & Corbin, 1990). A key concept for this approach is “theoretical sensitivity” (Glaser, 1978), which can be described as an ability to perceive the interactions between the relevant themes and factors. The researcher finds this an apt approach due to his interpretivist nature and the fact that the cloud computing is a novel concept that can be adopted by every organisation due to various set of factors which can have a varying degree of influence on the decision.

Interview is the primary technique of the researcher here. The main task in interviewing is to understand the meaning of what the interviewees say (Kvale, 1996). An interview seeks to determine the factual information along with the contextual information. An interview with the subject in its natural environment brings out the nuances in their perspectives and the definitions are continuously refined (Kalnis 1986 as cited in Marshall and Rossman, 1995). However a cloud based ERP is a relatively new concept and is a major decision on behalf of an organisation to actually adopt it. It is important that the data gathered from an interview be viewed in relevance to the background of the subject being interviewed as some of the factual information may not make much sense or may stand to be misinterpreted if it is not seen along with the circumstances that affected it (Saunders, et al., 2003).

Quantitative research allows the researcher to familiarize him/herself with the problem or concept to be studied, and perhaps generate hypotheses to be tested. This approach is often viewed in contrast to qualitative approach (Bogdan & Biklen, 1992) (Firestone, 1987). In this paradigm, the emphasis is on facts and objective data (Bogdan & Biklen, 1998) leaving out the circumstantial evidence. Guba & Lincoln, (1994) say that research and in has been dominated by a need to quantify the hypotheses. Guba & Lincoln (1994) have further challenged the effectiveness of quantitative techniques to quantify hard facts when social factors are concerned due to the objective nature of the approach as it tends to leave out the context of the information. Also, it limits the scope of the research as it does not encourage the researcher to look beyond the aims and objective.

Every method has its drawbacks and qualitative approach is no exception. According to Stiles (1993), Patton ( 2001) and Lincoln & Guba (1985), validity and reliability are the factors that affect the quality of the traditional qualitative research. Denzin & Lincoln (1998) put forward four factors to establish the correctness of the data and research: credibility, transferability, dependability, and conformability. It would be very difficult for another researcher to reproduce the survey and replicate the finding for confirmation of the research with the same amount of validity and personal bias. Generalizing the findings of the report is an aspect of the high quality reports. Maxwell (1992) suggests that it is easier to generalize findings in the quantitative research and is a potential drawback in this study. Patton (2001) argues that the generalizability is a criteria that is subjective to the individual case study. Also, according to Cassell & Symon (1994), it is easy to drift from the original context of the research when using the qualitative approach due to the changing context of the research

A phenomenalist considers that each event is unique and is controlled by variables such as time, location and culture which lead to the conclusion that in probability, no two events are of similar or identical (Bolender, 1998) when taken with their context. Every organisation may have its own reasons to either acquire or shun a cloud based ERP systems and these factors are unique to each organisation which reflects the disposition of the organisation lending itself to being subjective. The end result would be a descriptive that is mainly expressed in qualitative terms.

In general, the researcher is pursuing an inductive qualitative approach due to which a relation can be established between what the subject is expressing, what he means, the background and the culture he is from and what he requires. This is supported by Elliott (1995) and Strauss and Corbin (1990) who has taken the position that qualitative research lends itself to understanding participants’ perspectives Saunders et al. (2003) and Bazeley (2004) articulate a case for the epistemological relevance of both forms of knowledge and that it is important to understand how both are established and grounded. It is not that the researcher does not want to pin the issues empirically and statistically. It has more to do with the caution of not rushing into the subject and realising the fact that the decision to adopt a cloud based ERP by an organisation is influenced by a lot of contextual factors and the responsible factors are is not easily fathomed through quantification (Strauss & Corbin, 1990). Apart from this, an ERP is not pervasive, “everyday” computing and it becomes difficult to gather statistical data from varied sources.

4. METHODS

4.1 INTERVIEWS

Interviews are the primary method of data gathering here. Interviews are descriptive and identify the issues in depth in a holistic perspective (Kvale, 1996). Interviews are an important part of any action research project as they provide the opportunity for the researcher to investigate further, to solve problems and to gather data which could not have been obtained in other ways (Cunningham, 1993). On the downside, they are time consuming and, unless sampling is done carefully, may yield low quality data. Researcher should also keep his personal bias in check or the results could be skewed which jeopardizes the entire research (Williams, 1993 ; Saunders et al., 2003).

Interviews are primarily of three types: Structured, unstructured and semi structured (Saunders, et al., 2003). The researcher here intends to use semi structured interview approach as this helps him to delve deep into the interviewee’s background and giving him enough flexibility to probe and explore any themes that he may find relevant to his research in some depth (David and Sutton 2004). Probing is the way for interviews to explore new paths that were not considered at the beginning (Gray, 2004). This may be achieved through additional questions that were not in the interviewer’s mindset earlier.

One of the drawbacks of a semi structured interviews is that interviewer may not recognise and prompt those themes of which he is ignorant about due to a mismatch in the backgrounds of the interviewer and interviewee and this should be kept in mind before taking this approach (David & Sutton, 2004).

4.2 FOCUS GROUPS

The aim of the combined use of multiple methods is to add something unique to the researchers understanding of particular phenomena. This approach relates to ethnography which is a blend of interviewing and observation (Willis, 1990) and is very useful to add various perspectives to the data, due to the cascading effect (Lindolf & Taylor, 2002) of the discussions that is gathered through other qualitative methods such as individual interviews etc. These would be difficult to gather and identify through interviews solely. The group interview is essentially a qualitative data gathering technique that finds the interviewer/moderator directing the interaction and inquiry in a very structured or unstructured manner, depending on the interview's purpose (Denzin & Lincoln, 1994).

The researcher will have small sized groups of 5-7. The idea is to keep the group size small enough to be managed effectively while capturing the essence of the discussion easily. Homogeneity of the group is an important factor and this is automatically taken care of , since all the participants are from India.

4.3 SAMPLING:

Purposive sampling is one technique often employed in qualitative investigation (Rossman & Marshall, 1999). With a purposive non-random sample the number of people interviewed is less important than the criteria used to select them. Marshall (1996) describes three methods of sampling which are convinience, judgement and theoretical sample. The researcher would pursue theroretical sampling where he would analyse the emergent themes and choose the next sample to elaborate these themes. Glaser and Strauss (1967) propose that the samples should be taken and the emergent themes should be compared to the previous samples in an interative format unless a theoretical saturation point is achieved. This would increase the validity and strength of the researcher’s theory.

4.3.1 CASE SELECTION :

It is very important to have a criteria or a framework of requirements in place on the basis of which each individual is chosen to be interviewed. This would give some sort of credibility to the data being collected. Researcher also keeps in mind that it is difficult to achieve statistical representation of all the organisations in India that use or are likely to use cloud based ERP. Hence snowballing is the most practical approach to get the next suitable subject for the interview but it is this set of criteria that actually justifies him to be an ideal candidate to be interviewed.

4.4 DATA ANALYSIS

The technique for data analysis is microanalysis (Strauss & Corbin, 1990). The researcher analyses the data as he gathers it and codes it into probable emergent themes which are based on his judgement and supported by literature. As and when new data is gathered, same process of coding is repeated with it. These codes are then compared to the previous codes and if any new themes emerge are noted. This is an iterative process called ‘constant comparison’ that is done every new set of data that is collected until the researcher saturates the themes i.e. no new insights can be obtained from the data.

Axial coding is then applied to the derived themes and these are collated towards a central theme based on the linkage between their properties. This helps in abstracting the high level factors and their inter-relationships. These higher level factors then form the basis for the construction of the theory.

QSR NVIVO is going to be used in this research to transcribe and analyse the interviews and will utilise the “node” feature in the software to perform coding and develop central themes.

5. ETHICS:

Once the research project is embarked upon, care should be taken to keep in mind the concerned ethical issues (Field and Morse 1992). Ramos (1989) mentioned the problem areas that the researcher should be aware of: the researcher/participant relationship, the researcher’s subjective interpretations of data, and the design itself. The principles of ethical propriety, upon which most of these guidelines are based, involve fairness, honesty and openness of intent. Some of the ethical issues that should be considered here are informed consent, data protection, confidentiality and anonymity.

Interviewer’s should inform the subjects about the purpose of the study, expected time for interview and the scope of the study to enable the subjects to reach their own decision of whether or not they want to be a part of the study. This should be done orally and in writing (APPENDIX).Interviewer should comply with the laws of data protection and confidentiality and the arrangements for the same should be conveyed to the participants. If a subject wants to remain anonymous, it should be left on him/her.

Certainly, no person should be asked to cooperate in any research that may result in a sense of self-denigration, embarrassment, or a violation of ethical or moral standards or principles (Leedy, 1997)..

6. BIBLIOGRAPHY AND REFERENCES

✓ Dubey, A., & Wagle, D. (2007, May). Delivering software as a service. The McKinsey Quarterly Web Exclusive .

✓ ISACA. (2009). Cloud Computing: Business Benefits With Security, Governance and Assurance Perspectives. Rolling Meadows, USA: ISACA Emerging Technology.

✓ Kim, W. (2009). Cloud Computing: Today and Tomorrow. Journal of object technology , 8 (1).

✓ ECONOMIST. (2009, November 10). Cloud Computing : Economist Debate. Retrieved December 13, 2009, from http://www.economist.com: /debate/files/view/CSC_Cloud_Computing_Debate0.pdf

✓ Al-Mashari, M., & Zairi, M. (2000). Supply-chain re-engineering using enterprise-resource planning (ERP) systems: an analysis of a SAP R/3 implementation case”,. International Journal of Physical Distribution & Logistics Management , 30 (3/4), 296-313.

✓ Alvesson, M., & Skoldberd, K. (2000). Reflexive Methodology. SAGE Publications Ltd.

✓ Armbrust, M., Fox, A., Griffith, R., Joseph, A., Katz, R., Lee, G., et al. (2009). Above the Clouds: A Berkeley View of Cloud Computing. University of California at Berkley, USA, Technical Report No. UCB/EECS-2009-28,.

✓ Babbie, E., & Mouton, J. (2001). The practice of social research. Cape Town: Oxford University Press.

✓ Bazeley, P. (2004). Issues in Mixing Qualitative and Quantitative Approaches to Research. In R. Buber, J. Gadner, & L. Richards (Eds.), Applying Qualitative Methods to Marketing Management Research (pp. 141-56.). Palgrave Macmillan.

✓ Bennett, K., Layzell, P., Budgen, D., Brereton, P., Macaulay, L., & Munro, M. (2000). Service-based software: the future for flexible software. Seventh Asia-Pacific Software Engineering Conference (pp. 214-221). APSEC .

✓ Bingi, P., Sharma, M. K., & Godla, J. K. (1999). Critical issues affecting an ERP implementation. Information Systems Management , 16 (3), 7-14.

✓ Bogdan, R., & Biklen, S. K. (1992). Qualitative research for education: An introduction to theory and methods. Boston: Allyn and Bacon.

✓ Bolender, J. (1998, April). Factual Phenomenalism: a Supervenience Theory. SORITES , pp. 16-31.

✓ Boykin, R. F. (2001). Enterprise resource-planning software: a solution to the return material. Computers in Industry , 45, 99-109.

✓ Broberg, J., Buyya, R., & Tari, Z. (2008). MetaCDN: Harnessing ‘Storage Clouds’ for high performance content delivery. Technical Report GRIDS-TR-2008-11, Grid Computing and Distributed Systems Laboratory, University of Melbourne, Australia.

✓ Bryman, A., & Bell, E. (2003). Business Research Methods. Oxford: Oxford University Press.

✓ Bulkeley, W. M. (1996). A cautionary network tale: Fox Meyer’s high-tech gamble. Wall Street Journal Interactive Edition .

✓ Buyya, R. (2009). Market-Oriented Cloud Computing: Vision, Hype, and Reality of Delivering Computing as the 5th Utility. 9th IEEE/ACM International Symposium on Cluster Computing and the Grid.

✓ Buyya, R., Yeo, C. S., & Venugopal, S. (2008). Market-oriented Grids and Utility Computing: The State-of-the-art and Future Directions. Journal of Grid Computing , 6 (3), 255-276.

✓ Chen, I. J. (2001). Planning for ERP systems: analysis and future trend. Business Process Management Journal , 7 (5), 374-86.

✓ Creswell, J. (1994). Research Design: Quantitative and Qualitative Approaches. Thousand Oaks, CA: Sage.

✓ Das, A., Reddy, R., Reddy, S., & Wang, L. (2009). Information Intelligence in Cloud Computing-How can Vijjana, a Collaborative, Self-organizing, Domain Centric Knowledge Network Model Help. Proceedings of the 5th Annual Workshop on Cyber Security and Information Intelligence Research: Cyber Security and Information Intelligence Challenges and Strategies. Oak Ridge, Tennessee: ACM NewYork.

✓ Davenport, T. (1998). Putting the Enterprise into the Enterprise System. Harvard Business Review , 121-131.

✓ David, M., & Sutton, C. (2004). Social Research: The Basics . London: Sage Publications Ltd .

✓ Denzin, N. K., & Lincoln, Y. S. (1998). The landscape of qualitative research: Theories and issues. Thousand Oaks: Sage Publications.

✓ Du Plooy, G. M. (2001). Communication Research: Techniques, Methods and Applications,. Juta: Landsowne.

✓ Dubey, A., & Wagle, D. (2007, May). Delivering software as a service. The McKinsey Quarterly Web Exclusive .

✓ ECONOMIST. (2009, November 10). Cloud Computing : Economist Debate. Retrieved December 13, 2009, from http://www.economist.com: /debate/files/view/CSC_Cloud_Computing_Debate0.pdf

✓ Elliot, R. (1995). Therapy process research and clinical practice : Practical strategies. Research foundations for psychotherapy practice , 49-72.

✓ Firestone, W. (1987). Meaning in method: The rhetoric of quantitative and qualitative research. Educational Researcher , 16 (7), 16-21.

✓ Fox, R. (2009). Library in the clouds. OCLC Systems & Services , 25 (3), 156-161.

✓ Gable, G. (1998). Large package software: a neglected technology. Journal of Global Information Management , 6, 3–4.

✓ Gardiner, S. C., Hanna, J. B., & LaTour, M. S. (2002). ERP and the re-engineering of industrial marketing processes: a prescriptive overview for the new-age marketing manager. Industrial Marketing Management , 31, 357-365.

✓ Ghauri, P., & Gronhaug, K. (2005). Research methods in business studies: A practical guide. Essex : England: Pearson Education Limited.

✓ Gilles, L. (2000). Improving the external validity of marketing models: A plea for more qualitative input. International Journal of Research in Marketing , 17, 177.

✓ Glaser, B. G., & Strauss, A. L. (1967). The Discovery of Grounded Theory: Strategies for Qualitative Research. New York: Aldine Publishing Company.

✓ Glass, R., & Vessey, I. (1999). Enterprise Resource Planning Systems: Can They Handle the Enhancement Changes Most Enterprises Required ? Proceedings of First International Workshop on Enterprise Management and Enterprise Resource Planning Systems: Methods, Tools and Architectures.

✓ Glasser, B. (1992). Basics of Grounded Theory Analysis: Emergence Versus Forcing. Mill Valley, CA: Sociology Press.

✓ Glasser, B. (1978). Theoretical sensitivity: Advances in the methodology of grounded theory. Mill Valley: CA: Sociology Press .

✓ Gray, D. E. (2004). Doing Research in the Real World. London: Sage Publications.

✓ Guba, E. G., & Lincoln, Y. S. (1994). Competing paradigms in qualitative research : Handbook of Qualitative Research. Sage.

✓ Gupta, A. (2000). Enterprise resource planning:the emerging organizational value systems. Industrial Management & Data Systems , 100 (1).

✓ Hayes, B. (2009). Cloud computing. Communications of the ACM , 51 (7), 9-11.

✓ Hoffer, J. A., Valacich, J. S., & George, J. F. (1999). Modern Systems Analysis and Design. Reading, MA: Addison Wesley.

✓ Kolb, D. A., & Fry, R. (1975). Toward an applied theory of experiential learning. London, UK: John Wiley.

✓ Kolb, D. (1984). Experiential Learning experience as a source of learning and development. New Jersey: Prentice Hal.

✓ Kvale, S. (1996). Interviews: An Introduction to Qualitative Research Interviewing. London: Sage Publications.

✓ Leavitt, N. (2009). Is cloud computing really ready for prime time? Computer , 42 (1), 15-20.

✓ Leedy, P. D. (1997). Practical Research : Planning and Design. New Jersey: Prentice Hall.

✓ Light, B. (2001). The maintenance implications of the customization of ERP Software. JOURNAL OF SOFTWARE MAINTENANCE AND EVOLUTION: RESEARCH AND PRACTICE , 13, 415–429.

✓ Lincoln, Y. S., & Guba, E. G. (1985). Naturalistic inquiry. Beverly Hills: Sage Publications.

✓ Lindolf, T. R., & Taylor, B. C. (2002). Qualitative Communication Research Methods, . Thousand Oaks, California: Sage .

✓ Markus, M. L., & Tanis, C. (2000). The enterprise systems experience – from adoption to success. In Framing the Domains of IT Research: Glimpsing the Future Through the Past , 173--207.

✓ Markus, M. L., Axline, S., Petrie, D., & Tanis, C. (2000). Learning from adopters’ experiences with ERP: problems encountered and success achieved. Journal of Information Technology , 15, 245–265.

✓ Marshall, M. N. (1996). Sampling for qualitative research (Vol. 13). Fam Pract.

✓ Mason, J. (2002). Qualitative Researching,. London: Sage.

✓ Maxwell, J. A. (1992). Understanding and validity in qualitative research. Harvard Educational Review , 62 (3), 279-300.

✓ Maykut, P., & Morehouse, R. (1994). Beginning Qualitative Research: A Philosophic and Practical Guide. London: The Falmer Press.

✓ Miles, M. B., & Huberman, A. M. (1994). Qualitative data analysis (2 ed.). London: Sage.

✓ Mouton, J., & Marais, H. J. (1990). Basic Concepts: The Methodology of the Social Sciences . South Africa: HSRC Press.

✓ Murray, P. (2009). Enterprise Grade Cloud Computing. Hewlett Packard .

✓ Osterle, H., Fleisch, E., & Alt, R. (2000). Business Networking. Berlin: Springer.

✓ Pandey, S., Buyya, R., & Vecchiola, C. (2009). Cloudbus Toolkit for Market-Oriented Cloud Computing. In Proceeding of the 1st International Conference on Cloud Computing (CloudCom2009). Beijing, China: Springer: Germany.

✓ Parr, A., & Shanks, G. (2000). A Model of ERP Project Implementation. Journal of Information Technology , 15 (4), 289-304.

✓ Patton, M. Q. (2001). Qualitative evaluation and research methods. Thousand Oaks: Sage Publications.

✓ Rossman, C., & Marshall, G. B. (1999). Designing qualitative research. Thousand Oaks: Sage Publications.

✓ Rossman, G. B., & Rallis, S. F. (2003). Learning in the field: an introduction to qualitative research. Sage Publications.

✓ Saunders, M., Lewis, P., & Thornhill, A. (2003). Research Methods for (3 ed.). Harlow: Prentice Hall.

✓ Scale, M. S. (2009). Cloud computing and collaboration. Library Hi Tech New , 26 (9), 10-13.

✓ Smith, N. C., & Dainty, P. (1991). Management Research Handbook. London: Routledge.

✓ Spens, K. M., & Kovacs, G. (2006). A content analysis of research approaches in logistics research. International Journal of Physical Distribution and Logistics Management , 36 (5), 374-390.

✓ Stedman, C. (1999). Tracking changes - a must in ERP projects; business users sometimes fail to realize importance. Computerworld , pp. 41-2.

✓ Stiles, W. B. (1993). Quality control in qualitative research. Clinical Psychology Review , 13, 593 -618.

✓ Strauss, A., & Corbin, J. (1990). Basics of Qualitative Research. Newbury Park, CA: Sage.

✓ Symon, G., & Cassell, C. (1994). Qualitative research in work contexts. Thousand Oaks, CA: Sage Publications.

✓ Tari, Z., Buyya, R., & Broberg, J. (2009). Creating a ‘Cloud Storage’ Mashup for High Performance, Low Cost Content Delivery. Proc. Service-Oriented Computing--ICSOC 2008 Workshops (pp. 178–183). Berlin: Springer.

✓ The Economist. (2009, Oct 15). Cloud Computing: Clash of the clouds. Retrieved Dec 10, 2009, from http://www.economist.com: /displaystory.cfm?story_id=14637206

✓ Varia, J. (2008). Cloud Architectures. Amazon Web Services .