Data Protection for Cloud-Based Services. White Paper

Transcription

1 Data Protection for Cloud-Based Services White Paper December 2010

2 Summary There is little doubt that companies will increase their use of IT infrastructure and applications that operate outside of the corporate walls. These services are known by many names and buzz words, including time-sharing, application outsourcing, software-as-aservice, and cloud services. Regardless of the name, however, CIOs and business heads who adopt these services as part of the business-delivery platform maintain ultimate responsibility for ensuring that the services deliver both application availability and data protection in line with business requirements. They can outsource the platform, but not the responsibility. It is incumbent, therefore, that business and IT decision makers familiarize themselves with the information-technology and data-protection architectures that underlie these services and demand, as part of their outsourcing contracts, that applications be available and data be protected. Definition of Cloud-Based Services While this white paper uses the term Cloud-Based Services, collectively this includes traditional time-share systems, application outsourcing, software-as-a-service, hosting, and other shared-it-services that operate outside of the corporate walls of an organization. Not included in this white paper's use of the term is co-location services, where the IT infrastructure is selected and managed by the IT-staff of the customer, or remotemanagement services, where the IT infrastructure is owned by the customer, but managed by a third party. Reasons for Moving to the Cloud Businesses have found a variety of uses for Cloud-Based Services, including rapidly provisioning an application development and testing sandbox, delivering software as a service, managing peak-load requirements, backing up and archiving files and data-bases, enabling digital-forensics, electronic records management and e-discovery services, and disaster recovery.

3 Development and Testing Sandbox Rapid application development teams that want to quickly build a prototype application, will often use cloud-based services to host the development environment. Cloud-based services enable developers to avoid the more-lengthy internal requisitioning process for dedicated servers and storage. By using cloud-based services, developers can rapidly create, scale, and delete development environments, without being encumbered by internal processes and without being saddled with unneeded systems and software at the completion of the development cycle. When developers need to test an application at scale, they can easily turn on more resources for the test, and just as quickly turn them off at the completion of testing. Software as a Service Established developers of third-party packaged applications are finding an increasing demand for software applications delivered as a service. At the same time, many newlyformed software companies are bypassing the packaged-application alternative and are instead delivering their applications using a software-as-a-service (SaaS) model. Some SaaS companies will deliver from an internal, private cloud, while others will leverage publiccloud resources. Peak-load management All businesses experience both predictable and unpredictable peaks in IT infrastructure requirements. An example of a predictable peak is the seasonal change in consumer buying patterns. An example of an unpredictable peak is a stock market sell-off related to the business effects of a natural disaster. Many companies also have ad hoc requirements for large amounts of compute and storage resources. This is often associated with modeling and analytics applications where new algorithms are being tested against large databases.

4 Digital forensics With the rapid growth of electronic communications and electronic records, cloud-based services companies are offering digital forensics (e-discovery) services, to enable companies to respond more cost effectively and more accurately to e-discovery demands in an increasingly litigious world. Few companies are adequately equipped to effectively respond to e-discovery demands related to electronic communications. Disaster Recovery Large companies will often maintain multiple, geographically-distant data centers to provide in-house disaster recovery capabilities. Smaller organizations, however, often depend on third-party organizations for disaster-recovery services. Increasingly, small and medium-sized businesses are discovering not only the risk, but also the operational disruption associated with data loss and are, at a minimum, backing up desktop and server data using cloud-based service providers. Economic and Business Drivers From an economic and business-value perspective, there are a number of reasons for leveraging cloud-based services that include both cost and quality-of-service considerations. Variable Cost One of the immediate benefits of many cloud-based offerings is that as usage goes up, costs go up, and, more importantly, as usage goes down, costs go down. This usage-based pricing model fits well with the needs of companies that have substantial seasonality in their business. When companies with substantial seasonality maintain their applications in house, they are faced with either sizing the IT infrastructure for peak requirements, knowing that much of the available capacity will be unused and wasted during the year, or they size for average requirements, knowing that for periods of peak requirements, they will offer a poor quality of service. Neither choice is good for the business.

5 Lower Cost Cloud-based services providers tend to be among the larger consumers of IT infrastructure. As such, they demand more favorable pricing from infrastructure suppliers, than would be offered to smaller organizations. In addition, cloud-based service providers have the scale, the resources, and the skills necessary to invest in tools for intelligent, automated management. As such, they are able to derive more value from IT infrastructure investments than most organizations. Combined, these two factors enable the providers to pass on some of their savings and benefits from efficiencies to their customers. Best in Class By spreading the costs associated with best-in-class IT solutions often used by the largest organizations, cloud-based service providers can provide best-in-class solutions at an affordable price to mid-market companies. Few small or medium-sized businesses can afford to acquire highly-available, fault-tolerant, replicated systems with redundant networks and automated failover, however, when delivered as a cloud-based service to a large number customers, these best-in-class solutions are not only affordable, but are valuable differentiators among cloud-based service providers. Responsibility for Ensuring Data Protection and Application Availability While the economic and quality-of-service benefits of moving at least some of a company's workload to a cloud-based service provider are clear, the migration does not relieve the CIO or the business-unit manager from the responsibility of ensuring that corporate data is protected and that applications are available. It is still the responsibility of the business leaders, risk and compliance officers, security officers, and the CIO to classify applications in terms of data protection and application availability requirements, and ensure that the cloud-based service providers can meet the business requirements. Among the workloads for which most companies will demand zero data loss are transaction databases, electronic communications, and any other discoverable data.

6 Transaction Databases Depending upon the industry, the loss of transaction data can cost companies significant amounts of money. While financial services companies often mentioned, because of the large financial amounts associated with some of their transactions, such as stock trades and wire-transfers, they are not alone. There are similar risks associated with loss of data in healthcare, manufacturing, retail, and other industries. In addition, as far too many companies have recently discovered, there is also substantial damage to corporate reputations and brand, when customer and transaction data is lost. Electronic Communications Companies operate today in a world of electronic communications that is quick, easy, and largely uncontrolled. These electronic communications, however, represent a significant portion of the business records, and, as such, are often demanded as evidence in disputes between corporations or between corporations and government organizations. While the destruction of electronics communications as part of a well-designed and wellimplemented records-management policy is standard good-business practice, the loss of electronic communications during a time of litigation, can have a significant negative impact on the outcome of a case. Therefore, it is incumbent upon business managers to ensure that electronic communications records that are stored by cloud-based service providers encounter no data loss. Discoverable Data Electronic communications are not the only electronic business records that are discoverable in legal disputes. Financial reports, engineering diagrams, client and customer records, and other written electronic documents are also discoverable. Like electronic communications, the loss of these records, which represent legal evidence, can also have significant negative impact on the outcome of a case.

7 Components of Data Protection When considering a cloud-services provider, CIOs should carefully review the attributes and components of the provider's data protection capabilities. Critical considerations are the number of data centers, the physical distance between data centers, the method of data replication, the recovery-time service level, and the recovery-point service level. A provider that operates a single data center will be limited in its ability to protect against the impact of fires, floods, or terrorist attacks. Providers that have all data centers located within a single geographic region will be vulnerable to disruptions in communications systems and power distribution systems that often come with regional natural disasters such as earthquakes and hurricanes, as well as made-made disruptions from wars. Cloud providers may offer synchronous and asynchronous data replication capabilities. Unfortunately, as typically implemented, neither approach alone provides optimal data protection. Synchronous replication ensures that an exact replica of data is located in two separate data centers, a recovery-point service level of zero (0), but can only be implemented when data centers are relatively close together. This makes data protected with synchronous replication vulnerable to regional disasters. With synchronous replication, greater geographic separation between data centers yields slower application performance. In general, due to physical limitations on transmission speeds, distances greater than a few tens of kilometers introduce a noticeable and unacceptably large impact on application performance. In addition, synchronous replication is typically expensive to implement. Asynchronous replication does not suffer from the application-performance impact of synchronous replication, enabling data to be protected across multiple geographic regions and at a lower cost than synchronous replication. And because most asynchronous replication solutions enable application-consistent snapshots of data sets, the recoverytime service level can be relatively short. Unfortunately, this benefit is offset by the high probability that data will be lost in the event of a disaster, since some amount of data may be written to the storage system at the primary site, but not to the secondary site.

8 A New Approach to Data Protection Cloud-services providers now have the opportunity to offer a new approach to data protection that brings together the benefits of both synchronous and asynchronous replication approaches. With the Axxana Phoenix Enterprise Data Recorder (EDR), providers can eliminate the local, synchronous data center, and exclusively use geographically distributed data centers, protecting the bulk of customer information using asynchronous replication. The Phoenix EDR, which leverages technology similar to what is used in flight data recorders, has the ability to protect all of the data that has not yet been written to the remote data center. The data which is stored in the Phoenix EDR can survive unusual and extreme conditions, such as fires, floods, explosions, and building collapse, thus carrying data through a disaster. After a disaster occurs, the Phoenix EDR enables the data to be journaled to the remote site. By eliminating the full, local synchronous copy, The Phoenix EDR dramatically reduces the the storage costs, and yet still protects all of the data that has been written by the application. Conclusions Cloud-based services will increasingly become a core component of IT services that support business operations. CIOs should carefully evaluate the service and data-protection approaches of cloud-services companies. Application availability, recoverability and data protection are key considerations in choosing a cloud-services provider. Ideally, the provider will offer a variety of data-protection options that enable CIOs to match business requirements with IT service levels. While in the past, cost limited the amount of data that could be protected using synchronous methods, and application performance requirements limited the ability of companies to leverage data centers in broadly geographically dispersed locations, a new class of data protection solution, called the Enterprise Data Recorder, which is currently available from Axxana, enables companies to protect all of the data from all applications, across a broad range of disaster scenarios, at an affordable price. Cloud services companies, who are at the leading edge of technology adoption, should consider implementing the EDR as a key component of their data center strategy.