Outsourcing backup and recovery

By Ray Ganong

Using outsourced services is not often an IT manager's first choice when he or she is considering options for data backup. Even though it is the core component of the data-protection process, evaluating and spending money on backup software and services are often pushed to the back burner. However, threats of natural or man made disasters, the constant possibility of human error, and emerging technologies have recently strengthened the arguments in favor of outsourcing backups.

Organizations recognize that their data is a key competitive differentiator and that customers and employees must have rapid and continuous access to that data. Simply put, downtime equals lost revenue. These conditions are exacerbated by the current economic climate, where companies may be willing to spend money on data protection, yet be stingy about adding personnel.

Online backup technology can make the process of data protection and recovery faster, more secure, and more readily available than with traditional backup methods. Online backup enables organizations to automate data protection and recovery by transmitting data online to secure, off-site vaults. Data can then be accessed, through a Web browser from a central location, in minutes. This service can make it easier and safer for organizations to store data off-site by allowing it to be managed by an outsourced provider.

The first question in evaluating whether to outsource data protection is: "Are backups a core competency of my company?" Chances are, they aren't. Another consideration is to determine whether the existing IT staff has the requisite skills to undertake complex tasks such as establishing and monitoring appropriate backup and data retention schedules on all the systems in your organization. Developing the requisite capabilities in-house may take too long to support your immediate data-protection goals.

Outsourcing options

The two main types of hosted services are shared services and dedicated backup services. Most backup needs can be met through shared systems at the service provider location. The shared backup server accepts data each night from multiple companies. The service provider can provide the best price in a shared backup approach because of economies of scale.

However, due to a need for fast data recovery or other reasons, a company may request that the backup server be dedicated to its specific recovery or security needs. The ser vice provider manages a dedicated data protection and backup server, but the server only contains data from your company. In the event of a major data loss, the dedicated server may actually be shipped directly to your primary (or alternate) location. By plugging this recovery server into your network, you have the fastest recovery time possible for rebuilding a server. The same level of firewall security, monitoring, and performance management is offered for both dedicated and shared service offerings.

One problem with traditional backup methods such as tape is that technology continually evolves, making previous investments obsolete. Outsourcing data protection and recovery can take the headaches out of time-consuming and difficult tasks, including managing upgrades, media, and multiple operating systems.

Reduce downtime, improve security

Downtime costs are a major drawback to the growing complexity of application servers. The penalty for not protecting data grows relative to the revenue generated by or through the critical applications. Forrester Research, a Cambridge, MA-based market research firm, estimates that for each hour of downtime on a Website, 20% of that hour's transactions are lost. Many customers come back later, but some who experience disrupted transactions will move on to competitors that are just one click away. For an e-commerce powerhouse, the lost business can be devastating. For example, Dell conducts $50 million a day in transactions on its site, and 20% of one hour's loss would amount to $420,000. In this environment, there is no choice but to protect the data via a hierarchy of strategies, including remote backup.

Protection against suffering losses, maintaining corporate data security, protecting user privacy, and other hard-to-quantify values of a properly administered backup program are all part of the value proposition of a backup service provider. Physical security is another important aspect, and a backup service provider can usually offer a higher level of security than your own data center. Service providers have secure physical plants, the doors are locked, access to the server floor is restricted, and wire cages separate production servers. Access to the server farm is closely controlled and monitored, and the facility employs 24×7 security guards and strict access control mechanisms. All sites employ emergency batteries and back-up diesel generators to withstand outages of up to seven or more days.

In addition to physical security, service providers have intrusion-detection systems and skilled personnel to respond to alarms around the clock. Detecting denial-of- ser vice attacks, viruses, and other common assaults on backup server systems is a part of routine operations.

"Backup of the backup" is another important concept, and all service providers back up their production servers. This gives you an extra layer of protection that you would not have with a traditional backup system at your location. If you took a single backup tape off-site every night and something happened to that tape, your ability to recover would be compromised.

Tips on choosing a provider
Choosing a data-protection provider can be challenging. In addition to determining technical strengths, you should also examine the provider's financial viability.
  • If it's a private company, ask about financial backers, total capital invested, and the amount of cash in the bank.
  • What level of technical support can the backup provider offer? Does support consist of knowledgeable people answering the phone 24×7, or only on the provider's Website?
  • What features are part of the standard service offering? For instance, what software tools are included for administration and monitoring of your backups?
  • In probing the strengths and weaknesses of a potential provider, the best source of information is existing customers. Try to find the "good, the bad, and the ugly" details of the services under real conditions.

Ray Ganong is chief technology officer and vice president of operations at EVault (www.evault.com) in Walnut Creek, CA.

This article was originally published on August 01, 2002