Guide to Data Protection and Disaster Recovery

Transcription

1 Guide to Data Protection and Disaster Recovery Sponsors

2 Table of Contents Designing a Data Protection and DR Strategy Understanding key technologies (snapshot, image, replication deduplication etc.) Assessing the correct Backup and DR Software Data Protection for a Virtualised Environment The business side of DP and DR - a CIO perspective DR technologies for fast and granular recovery Options for long term Archive How to integrate cloud into your DP and DR strategy Note from the editor Data is currently hot we are seeing huge hype around Big Data although if you think about it, Data Analytics has been around for a long time. Of-course Technologies like Hadoop that extend the possibilities of what can be achieved with Big Data are changing the landscape. In South East Asia we have finally seen cloud become a mainstream destination for applications and data. Whilst we think there is still some maturity required before BOYD gets true corporate adoption in this part of the world, we still see unregulated business data being created, viewed and stored on mobile devices. If you have read our hot data technologies index you will know that we give highest adoption rating to Data Protection technologies. That is why we see this guide as Key. Whatever your data and wherever it is created and stored, it always Needs to be protected and in the event of disaster recovered. We hope you enjoy the Guide Yours in Storage Allan Guam

3 Designing a Data Protection & Disaster Recovery Strategy By Martin Lee Data&StorageAsean Key considerations in formulating a strategy need to include: Data Classification Recovery Time Objectives (RTO) Recovery Point Objectives (RPO) Off Site Copy Capability Archive requirements Only after considering the above is it possible to make decisions on the correct technology that will underpin your strategies. Often overlooked Data Classification is actually key to ensuring the most relevant and efficient strategy. It is impossible to decide how quickly data needs to be recovered or how long it needs to archived, until that data has been classified. Even a simple home grown system of classification can work wonders. Designing a strategy for Data Protection and Disaster Recovery by answering questions about your data, applications and infrastructure Using three tiers such as Business Critical, Business Relevant and Non Business can enable you to develop different strategies for each data type. Obviously the protection put in place for Non Business data will be very different from that used for Business Critical. Once you know what data you have it is important to set RTO and RPO objectives for each data type. Recovery TIME Objective means how quickly you would like to be able to recover your data in the event of data loss while Recovery POINT Objective refers to the most recent point you need to be able to recover back to in the event of data loss or system crash. An RPO of 1 second would mean you can always recover to 1 second before the disaster occurred. Likewise an RPO of 1 hour would mean you are prepared to lose up to one hour of data. Typical nightly backups will usually give an RPO of 24 hours. These two concepts RTO and RPO combined with good data classification will get you very close to being able to define a strong data protection and Disaster Recovery strategy. As an example you decide Business Critical Data requires an RTO of 15 minutes and RPO of 5 minutes, and that your Non- Business data can have an RTO of 48 hours and RPO of 24 hours. Knowing this and defining this gets you a long way towards having your top level strategy in place. Once you have these details it is possible to engage technology providers and find out how they can help you achieve these service levels objectives. The two other headline concepts that nearly always need to be factored into any Data Protection and Disaster Recovery (DR) plan are Archive or Retention policy and Off- Site considerations. Archive is all about how long backup up data needs to be retained. This is also not the same for every type of data. However it does not always follow that data classified as Business Critical needs to have a long retention time. Therefore considerations about Archive often need to be made outside of the initial data classification. Regulatory and statutory considerations may mean that backups of some data need to be retained and archived for many years, whereas other data may not need to be retained beyond one or two backups. This means that different classifications for Archive need to be made, calculated and then appropriate technology for Archive selected. Key considerations in formulating a strategy need to include: Data Classification Recovery Time Objectives (RTO) Recovery Point Objectives (RPO) Off Site Copy Capability Archive requirements

4 Designing a Data Protection & Disaster Recovery Strategy By Martin Lee Data&StorageAsean The final major consideration that needs to be factored into a Data Protection and Recovery plan is whether off site copies of data are required. Again, the technology you use for Offsite will depend on the reason why offsite copies of your data are needed. If the offsite requirement is about a safe retention location rather than fast recovery, then using a service to collect tapes and store them at a third party facility might be fine. On the other hand if you want offsite copies of your data for fast recovery in a DR scenario, then an entirely different replication based technology might be required. In short off- siting your backup and recovery data is based on classification followed by selection of the right technology to match the need. The concepts described above will help you design the strategy suitable for your needs. The articles that follow will help you to apply different technologies to enable you to build and implement that strategy.

5 Understanding Key Technologies By Martin Lee Data&StorageAsean Backup In information technology, a backup or the process of backing up refers to the copying and archiving of computer data so it may be used to restore the original after a data loss event. Typically a backup of data is copied to a location separate from where the source data is created and stored. For this reason removable media such as tape has long been the backup media of choice for data backup. Backups have two main purposes. One purpose is to create a second copy of data that is recoverable after a data lost incident, such as an accidental deletion or some kind of data corruption. Another purpose of backups is to recover data from an earlier time, according to a user- defined data retention policy. For some businesses and organisations it is important to maintain recoverable copies of backups going back many years. Replication Data replication involves making a real time or very near real time copy of data to a secondary and remote location from the source data. Replication is carried out to enable Fault Tolerance, ensuring an exact copy of primary data is available and ready for use in the event the source data becomes unavailable through some kind of unplanned outage such as a natural disaster. Understanding the key Data Protection technologies is vital in order to be able to to dicipher what vendors are telling you and then build your DR plan. Snapshot A snapshot is a read only frozen point in time copy of a data set used for backup purposes. Once the Snapshot has been created, it provides a read only separate point in time copy of the primary data set. Any backup application is then able to backup the snapshot rather than the live primary data. This means that application up time and user access to files is not impacted at all by backup. Once a first snapshot has been completed, future snapshots can be taken very quickly (a matter of seconds) as they simply take the changes and build a new frozen point in time copy by pointing the changes back to the original. Disk Image backup A disk Image takes a copy of the entire contents of a disk volume. An image bypasses the file system and generates sector level copy of the disk. This means that an Image backup will create an exact copy of the structure of the volume it copies, including settings and operating system level information. Image backups are able to create an exact copy automatically removing unused blocks in order to save space. Bare Metal Recovery A Bare Metal Recovery (BMR) is a very fast recovery process, usually minutes in the event of a total server failure situation. BMR utilises an image backup to recover a complete system in just a few simple steps. Typically a Bare Metal Recovery is performed by first booting an emergency OS (such as windows PE), then recovering an entire image from an Image Backup, and rebooting the system again. On reboot the exact system as copied into the image backup will be restored and run exactly as the system that failed. BMR can usually be used to recover to dissimilar hardware. Concepts explained: Backup Replication Snapshot BMR Image CDP Deduplication P2V

6 Understanding Key Technologies By Martin Lee Data&StorageAsean Continuous Data Protection (CDP) CDP is a type of backup that runs continuously as a service backing up every change to primary data in real time or near real time. Deploying this method of copying data allows for recovering to any point in time over the retention period that data is being copied. CDP differs from Replication in that it is not always designed for instant system recovery or for sending data to a remote redundant location. CDP by its nature is not well suited to utilizing tape- based media as a target. Rather it is best used with disk based technology. Deduplication Data deduplication is a specialized data compression technique for eliminating duplicate copies of repeating data. Due the nature of this technique, deduplication is particularly well suited for improving storage utilization for backups made to disk, where duplicate copies of files take up a large amount of space. P2V Also referred to as Physical to Virtual Backup, P2V is a process where a physical server is backed up in a format that enables it to be recovered instantly as a virtual machine on a hypervisor such as VMware or Microsoft Hyper- V.

7 Assesing the right backup and Disaster Recovery Software By Vijayant Rai, Director, India & SAARC for CA Technologies The explosive growth of data is fuelling businesses to re- examine how they assure their critical data. With the plethora of storage choices today - on premise, off premise, SaaS, Cloud etc, IT executive must deftly choose and capitalize on the right data protection/assurance solutions. They need to ensure that the business need of each line of business or department is met in terms of system availability and the required recovery point as well as mandated time to recover from an outage (RPO and RTO). Today, most organisations find that periodic backups alone are just not good enough to meet business objectives and service level agreement requirements. Customers are seeking continuous data protection and high availability solutions to complement their existing backup strategy. In addition, to add to the customers data management complexity the market is seeing adoption of a variety of virtualization technologies. What we observe in the market today is that most organizations have or are moving to a mixed or hybrid environment with both physical and virtual environments to be protected. This increases the complexity in terms of data protection, recovery and availability especially in terms of management and reporting. There are a wide range of proven technologies available to customers to protect their virtualized and physical systems as well as applications and data. These solutions range from traditional tape backup to new disk- based snapshot backup. Features like data de- duplication help minimize backup storage for disk- based solutions. Bare metal restore helps you rebuild servers after loss or damage and data replication and continuous data protection called CDP complement your backup strategy by protecting data between periodic backups and snapshots. Server clustering is used for load balancing and for server failures but may be complex to deploy and manage. RAID storage devices protect against drive failures, but these may be too costly for some organizations. No matter what industry you re in, your Backup and Data Management Solution strategy should ensure the total protection, recovery and availability of systems, applications as well as data in both physical and virtual environments. The backup & high availability software should help you simplify as well as automate system / data protection and recovery tasks. It should manage costs and complexity more effectively, minimize risks to your data, improve application and data availability minimising business disruption and maintaining worker productivity. It should have the capability to leverage the cloud for business continuity and disaster recovery. We recommend to our customers to look for solutions that deliver a complete strategy to manage backup, recovery, and availability in both virtual and physical environments. The solution must gives you control over your changing business by delivering total protection, recovery and availability for systems, applications and data. It is the only solution that offers a full range of products from bare metal restore to fully automated failover for high availability. Choosing the right Software for backup and DR is not always a straigtforward choice. CA s Vijayant Rai advices you how to make an informed choice Vijayant Rai is Director, India & SAARC for CA Technologies. He has over 20 years of experience and demonstrated success in senior management roles with leading international organizations. He is currently Country Head for CA s Data Management business for the region with independent revenue & team responsibility.

8 Data Protection for a virtualised environment By Allan Guiam Editor Data&StorageAsean For years, storage professionals have been telling us that backups are a necessary part of good housekeeping and no IT person should ever be caught off guard without any backup of data, preferably as recent as possible. Why? Because Murphy s Law of anything that can go wrong will go wrong is still very much with us. One approached to take is the rule, best illustrated below by the helpfulhacker, which suggests that (1) you need to keep three backup copies of your data at all times the frequency depends on how critical the data is and how often it gets updated; (2) you need to store your backups in two media types internal disk or external disk or cloud as long as it s not stored on the same media; and (3) keep on copy offsite particularly true for enterprises. Keeping at least three copies of the data will ensure that if the primary data is corrupt, you will have two additional copies to fall back into. You can also use deduplication technology to shrink the data that needs to be copied. You may elect to have a clone copy of the production data for the third copy to increase your data protection odds. Finally, to mitigate any further risks associated with any potential corruption of data, you will need to perform regular restore tests to guarantee the integrity of copied data. Every media type has the potential to fail. DVDs can develop bubbles. Tapes can form mildew or become brittle or demagnetized. NAS firmware updates can fail. So having at least two media different media or media types reduces the risks of two media failing at the same time. Today there is a multitude of media options for enterprises including LTO tape, NAS, WORM systems, to name a few. So pick at least two media depending on your business priorities and budgets. Earthquakes, typhoons, flooding and fires are frequent occurrences in Asia raising the potential for data lose among enterprises in the region. Best practice therefore calls for backup copies to be stored in remote sites far from the primary site. Companies with multiple sites can use one of their other sites for backup. For everyone else, an online backup service is an effective and cheap alternative. Why buy your own hardware and software when pay as you go is just as reliable without having to be concerned with running out of space, media compatibility or reliability? The only other things you d have to consider is security and for this encryption should be standard in your arsenal of data protection. Where it involves vaulting, you complicate the issue with proximity to the backup site. Let me share with you a true story Some time ago, I spoke to the CIO of a large conglomerate in Asia (anonymity is required here) and he confessed that for years they have been religiously backing up their data to tape at nights when server load was at its lowest. They even set up a dedicated link to another office that automatically backs up production data to a disaster recovery site. The followed the 321 rule above: (1) perform regular backup; (2) backup to a different media; and (3) backup to an offsite location. One day disaster struck the primary datacentre rendering the entire facility down. The DR strategy kicked in converting the remote site into the temporary datacentre production facility. The rule excellent illustarted by helpfulhacker below is as relevant in Virtualised environments as it has been for Physical Look for a solution that can see all your storage, both virtual and physical. The solution must allow for granular and application level of recovery

9 Data Protection for a virtualised environment By Allan Guiam Editor Data&StorageAsean Fast forward to today when according to estimates and predictions by analysts between 60 to 70 percent of Windows- based datacentres are virtualized, with Linux about 35 to 45 percent there. The initial drivers of cost and efficiency are being displaced in favour of flexibility and scalability. Today it s hard to find server technology that is not already virtualized or virtualization- ready out of the box. This 2014 we will see network and storage hardware accelerate their virtualization transformation. How will this impact data protection strategies and policies? One major impact is Physical to Virtual or P2V. Even for those companies that are not rushing towards a virtualised infrastructure for production, having just one machine on standby running a hypervisor provides a level or Disaster Recoverability that was just not within the reach of many IT departments before virtualisation became a reality. Recovering a physical server into a virtual server enables full recovery from a total physical server failure within minutes. When looking for solutions that offer this, try and find solutions that are create a VMware or Hyper- V bootable image from a physical server backup. The real challenge we see is what to look for in a backup and recovery solution for use in virtual environments. Look for a solution that can see all your storage, both virtual and physical. The solution must allow for granular and application level of recovery. Why try to recover an entire image when all you need is a file? Make sure your chosen solution provides all levels of recovery full virtual machine, individual virtual disks, virtualized application, and database servers, along with standards like file, folder, and granular objects such as an individual . Application awareness is an essential component of virtual machine backup. While most backup products provide crash consistent backups meaning those applications use integration with technologies like Microsoft Volume Shadow Copy Service (VSS), many backup products do not perform required post- process functions like log truncation, which ensure you are protecting the application completely. Many backup applications can t perform granular recovery of those virtualized applications either. Many business- critical applications like Exchange or SQL Server will only do certain types of maintenance only when a successful backup occurs. Application- aware backup solutions ensure this maintenance can take place. Usually, this requires some sort of software (i.e. an agent, whether it s deployed beforehand or injected and uninstalled on demand) in the virtualized application server. More and more organizations are running multiple hypervisors within their environment, especially as alternatives to VMware are gaining popularity especially Microsoft Hyper- V. Finding a single solution that supports all of your hypervisors will simplify backup complexity and licensing, streamline management, and reduce costs. While some IT organizations have invested in multiple separate tools for backup one for physical servers and virtual servers customers have consistently asked for a single vendor to manage both environments. This is because a differing approach to backup leads to inconsistent data management, backup confusion, increased cost, and even conflict between various IT organizations. The solution is for IT to bring together the virtualization and backup teams, assign ownership, authority, and resources for backup of both physical and virtual machines..

10 The Business Side of DP & DR A CIO Persepctive By Allan Guiam Editor Data&StorageAsean Mid- to- large enterprises in Asia today carry a data protection (DP) and a disaster recovery (DR) strategy as part of their portfolio of services. What has been changing is the impact of emerging technologies such as cloud computing in terms of how internal management view the viability of outsourcing DP and DR to an external party. The rationale behind DP and DR have not changed significantly but the complexities of undertaking and the degree of understanding of the tools available have grown significantly, allowing organizations to focus on what is important their business. An interview with Suk- Wah Kwok, Regional Chief Information Officer - Asia Pacific, Lockton Companies (Hong Kong) Ltd provides insight into the business side of DP and DR. Ranked 9th in the world; Lockton Companies is the world s largest privately owned insurance broker. An outspoken and candid technologist Suk- Wah is a familiar face in Hong Kong s IT landscape. How does a financial service company define data protection and disaster recovery? SWK: In our business, we have two kinds of critical data: corporate data and client data. With data protection we are charged with protecting both data from unauthorised and unintended use and access. Data protection is about recognising the criticality of all data categories, how they are being used, how they should be used, how leakage and misuse can occur, and where the exposure and risks are for the company, and finding ways to mitigate such risks. For me, disaster recovery is a set of measures designed to ensure reasonable and acceptable recovery IT services to meet business demand. In the insurance industry, our goal is to ensure business exposure is kept to a minimum. In this regard, what IT does has to be related to what the business commits to the client. Our clients are mostly corporate clients who have in- house compliance expertise themselves, hence they will challenge and scrutinize our systems and processes and demand a certain level of service guarantee from us. Thus in our business, Service Level Agreement or SLA is a common business concept. Before a client signs their business to us, it is common for them to check that we have DR measures in place, and they may ask us about uptime, support level, compensation for outages and things like that. As a result, IT has to develop disaster recovery systems and strategies with full awareness and understanding of what the business has committed to our clients. What makes these different for a financial service provider like Lockton when compared to a bank or insurance company? SWK: The average bank deals with consumers as customers it is retail and as such the transaction volume can be huge. Service demand tends to be consistently high at all times throughout the year. As a consequence demands on IT are generally also consistent, daily in fact, throughout the year. You can just imagine the non- stop demand on DR. Designing a strategy for Data Protection and Disaster Recovery by answering questions about your data, applications and infrastructure Thus in our business, Service Level Agreement or SLA is a common business concept. Before a client signs their business to us, it is common for them to check that we have DR measures in place

11 The Business Side of DP & DR A CIO Persepctive By Allan Guiam Editor Data&StorageAsean The technology side is relatively simple. As long as you have a CIO or Head of IT who knows what he/she is doing and management is willing to invest in the necessary technology, putting automatic data protection measures in place is relatively straight forward. The second aspect is about education and awareness and making sure that HR puts in manuals, procedures and processes, including training and regular refresh to ensure that employees understand what data protection and business ethics mean to the company and its clients, and their individual obligations. In Lockton, we have IT, HR and compliance officers working together to set up systems and processes to mitigate the risks that come as part of doing business. The hardest part to control is actually human behaviour because it is subject to individual discipline. You can get someone trained as much and as frequently as you like, but it is difficult to change habits and control user behaviour. This is where IT can help the business by taking a proactive role to reduce potential damage caused by wrong user behaviour, as well as resorting to automatic monitoring to help identify system detectable non- compliant user behaviours. We are fortunate that at Lockton, our business staff are permanent employees and licensed brokers who are constantly reminded of their corporate and industry responsibilities and obligations. It is more difficult for insurance companies that use self- employed agents whose behaviour and discipline are much harder to control. In a multi- country operation such as yours, what is the approach you take to ensure compliance with regulations around disaster recovery? SWK: When you are in a regional position like mine when I have to provide for a business that operates in multiple countries, the best practice and most economical way to ensure we meet regulatory compliance as well as SLA commitments to clients is to centralize our infrastructure including our DR effort. And this is what Lockton has been doing for all wholly owned subsidiaries in Asia Pacific. This means country IT does not have to worry about DR - it is all taken care of at the regional level. And I consider this the most efficient in terms of cost, time, and resources. Both require significant investment in time, money and resources do you get asked by the CEO about the payback of such systems? How has cloud computing changed your view or approach to disaster protection and disaster recovery? Business compliance is strictly speaking outside my jurisdiction as we have a compliance officer (CO) who takes care of it. That said I work very closely with the CO to ensure we are aligned. For an international insurance broker like Lockton, DR and Compliance is a global mandate. Countries won t pass internal audits unless they have a proven working DR in place. Because disaster recovery has now become a universally accepted requirement of doing business, I don t really get asked by management on issues like payback. I am, however, constantly required to find the most cost- effective way of providing DR. Right now, I am exploring newer approaches including the use of public cloud services for our regional infrastructure and DR services. I am obviously required to go through cost and benefit analysis for the various approaches.

12 The Business Side of DP & DR A CIO Persepctive By Allan Guiam Editor Data&StorageAsean What is your advice on the topic of data protection and disaster recovery? SWK: In my view, data protection and disaster recovery are mainstream IT services. Hence these should already be in the IT service catalogue of all CIOs. Like any IT service, there are so many different ways to achieve similar purposes. I have been in similar capacity for well over a decade and have gone through different ways myself in providing such services. I feel that the vendors have definitely matured enormously and emerging technologies are becoming increasingly affordable and practical. This means CIOs no longer have excuses to keep status quo. They should constantly challenge their old or existing ways of doing things and open their minds to newer and more cost efficient ways of addressing the critical data protection and DR needs. Over the years, I have personally moved from individual countries doing local DR, covering measures like country redundancy, replication and backup, to taking it to a full blown regional approach combining experience and technology automation. The challenge is to be constantly aware of new technologies and processes and explore their potential. For example, right now, I am exploring cloud DR services. What is your advice to vendors selling you these technologies and services? SWK: As a frequent adopter of vendor services, I ask myself a few questions before I decide which vendor to use to support a specific undertaking: Internal Expertise Do I have internal expertise to do so, if not, is it more cost effective to hire someone in- house to do so, or should I consider outsourcing? Efficiency Even if I have internal resources, will it be more efficient for internal resources to do the job, or should we resort to vendor? Bearing in mind my view of efficiency includes responsiveness to business needs and unplanned problems that arise. Cost Will it be cheaper to do it in house or use vendor services? Value to my customers Will the business and my stakeholders be more satisfied with using internal IT services or using vendor services? The pattern is clear as emerging technologies become mainstream they get cheaper. The other good news is that these days emerging technologies prices are coming down a lot quicker, so we can make practical use of them earlier. One thing I ve also learned is that if we dig deeper into the real cost base of providing a lot of IT services in- house versus using vendor services, I often find using vendors financially a no brainer. That said I am a very open minded CIO who is willing to explore new options.

13 If it takes you more than 3-5 minutes to restore a server it is taking too long By Greg Wyman, Vice President Asia Pacific, StorageCraft With more than 25 years experience in IT and in particular, storage and backup, Greg Wyman and his team has been instrumental in assisting StorageCraft to become the No. 1 provider of disaster recovery solutions for virtual and physical environments. The Asia Pacific team at StorageCraft has experienced exponential growth over the last 6 or so years growing from 0 customers to over 50,000 users. When you think backup, or more importantly recoverability, only two points really matter the RTO or Recovery Time Objective, and the RPO or Recovery Point Objective. With real- time recovery the other major benefit is a drastically reduced RPO of less than 15 minutes. The RTO is how long it takes to return a server or system back to full production that is the state where users are able to start accessing their data again. The RTO should be as fast as possible as the longer a server is down, or inaccessible to users, the more impact that downtime has on the business. Historically, a physical server crash could easily result in several hours spent rebuilding the operating system, then take several more hours to install all the applications, service packs and security updates. Then you need to find the correct licence keys, and only when all that is done can you start restoring from backup. If it took eight hours to back up, it will take at least eight hours to restore the data. All in all, a typical server can take anything from 8 36 hours to restore to a full production environment. But using the latest in fifth generation real- time recovery technology, that uses sector- based imaging instead of file- based backup technology, the new standard for RTO is 3 5 minutes to restore a server, then a few more minutes for final configurations before users are back to full production. This incredible speed is achieved by being able to boot off the backup image and restore that physical server into a temporary virtual environment. With real- time recovery the other major benefit is a drastically reduced RPO of less than 15 minutes. Imagine your backup product runs every night starting at 7pm. What happens if a critical (e.g. an Exchange) server crashes at say 17:01 today? You will need restore from last night s backup and lose about eight hours of data. If you have 100 users, that is 800 hours of s, which is painful for any company. You d want a solution that would allow you to be back up in the shortest possible time, preferably within minutes after reboot. For virtual servers the process is almost as quick and simple. By pre- staging the recovery process, only the last few 15 minutes of incremental backups need to be applied before finalising the process and spinning up the For virtual servers the process is almost as quick and simple. By pre- staging the recovery process, only the last few 15 minutes of incremental backups need to be applied before finalising the process and spinning up the disaster recovery server into a full production environment again, with typically less than 15 minutes of data loss.

14 If it takes you more than 3-5 minutes to restore a server it is taking too long By Greg Wyman, Vice President Asia Pacific, StorageCraft Of course, recoverability is not just being able to recover the entire server. Most recoveries are for a single file or folder which takes just a few seconds rather than minutes or hours - literally seconds. You d also want a solution that delivers granular file level recovery and offers replication technology that delivers offsite or remote disaster recovery.

15 Options for Long Term Archive By Martin Lee Data&StorageAsean Until very recently long term archive or deep storage for electronic data was limited to one choice tape. However in recent years other viable options have also become available. When looking for the right media/technology for storing data for long time archive there are certain aspects that need to be factored in. Price Storage for archive is regarded as secondary or non- primary storage, as such the price you expect to pay for archive storage should be considerably less than you pay for primary storage. For archive storage rates in the region $0.01 per GB are achievable. Durability Archive storage is often in place to ensure compliance with regulatory requirements. If regulation requires that data is kept for 7 years then you must have confidence that the media on which you backup has the longevity to meet the archive duration needs. Archive is about storing data long term. Considerations for data retrieval and completely different from any other classication of data storage Portability Generally it makes sense to remove archive data from primary systems. Doing so frees resource on the primary system and, possibly more important, removing archive data in this way and storing it in a remote location from primary systems adds an element of additional redundancy. Different options for Archive storage enable portability in different ways. Offline/Near- line/online There are two aspects to whether your storage is Offline, Nearline or Online. Online will allow for the fastest recovery, through to offline, which can mean the recovery period may run into days. The other aspect is cost the cost of maintaining and powering online storage is considerably more than the costs associated with near- line or offline. In fact the cost of energy for an online storage system compared to a near- line system like a tape library can be 4 to 5 times more. These two aspects need to be weighed in and assessed before making a final choice for Archive. Broadly speaking we see four main choices for archive storage these are Tape, Deduplication, RDX Removeable Disk, and Cloud. Tape continues to evolve. LTO is the dominant tape standard with LTO 6 taking the standard to increased capacity per cartridge (up to 6.25tb with compression) and Transfer speeds of 160mb/s. Tape remains a perfect medium for long term archive. When not being used for day to day backups wear from tape drive heads is not an issue, price per GB is about as low as you can get, and the media can be kept off line reducing power consumption and costs. It is for these reasons that tape s much discussed decline has never come to pass. We can question if tape is today a viable media for daily backups, but for deep and long term archive, tape remains the gold standard against which all other options should be compared. Broadly speaking we see four main choices for archive storage these are Tape, Deduplication, RDX

16 Options for Long Term Archive By Martin Lee Data&StorageAsean Back in 2009 Deduplication was possibly the hottest storage and data technology. It was being hyped as much the same way that Big Data is today. Today many enterprise companies are taking advantage of deduplication technology and storing years of backup on deduplicated disk. Like for like, we believe that tape is still the most cost effective archive option, however Deduplication has some key strengths. If you need fast access to long archived data, it is likely that you will be able to retrieve files very quickly from deduplicated disks. In addition, due to the nature of deduplicated data, it is a very efficient way to replicate your backup data to an offsite deduplicated replication target. Cost is 50 cents per GB. RDX has silently become the standard for SME backup. Every major server manufacturer offers RDX as its internal server backup product for small business. RDX originally stood for Removable Disk Exchange and the technology provides the main benefits of tape in a disk format. Its rugged, has longevity, is portable and can be stored offline. For enterprise companies, the price per GB may make it unfeasible as an archive media. But for smaller companies (e.g. a small design shop) a 1.5TB RDX cartridge is a simple and rugged platform to archive a large amount of data and keep it speedily accessible in the event it needs to be recalled. Cloud Storage Providers are finally providing serious options for cost effective archive. As an example AWS offer Glacier for long term archive. The price is very enticing but the service level on recovery is days rather than hours, generally acceptable for long term archive data. Over the coming years cloud providers could offer the first serious alternative to tape for long term Archive. Cloud Archive means instant off- site copies of your data, and pricing seems genuinely competitive. However it s important to factor in costs for recovering data, and also challenges of sending or pulling back a huge amount of data over a network connection. We should also remember that to hit the price points they do, it is logical to think that the cloud providers themselves are utilizing tape technology for their long term archive offerings. Cost per GB Offline Speed of recovery Deduplication $0.05 No Instant RDX $0.35 Yes hours Tape $0.2 Yes hours Cloud $0.1 No days

17 Considerations for Integrating Cloud, [or any technology], into your Data Protection and Disaster Recovery Strategy By Clifford Lew, Director, Professional Services and co- founder of Pantropic Online Pte Ltd and Atego Cloud Backup Over the last ten years I ve had the privilege to engage I.T. Managers of both very big and very small companies. I would say most of those I ve met are more knowledgeable than I about many aspects of building and maintaining IT systems, yet when it comes to Disaster Recovery (DR), there is often a knowledge gap that needs to be filled before we can move on to architect a solution that meets their requirements. So, in an effort to fill part of that gap, let me summarize some of the key considerations you need to understand when embarking on a data protection or DR project. Understand Your Requirements When it comes to data protection and DR most of us have only a vague understanding of our requirements. This is not due to any intellectual laziness on our part, it s simply because having a very clear understanding of our requirements requires a lot of work and support from senior management. A clear understanding involves identifying critical business functions and all the systems that support them. This requires interviews with business unit managers, and seeking consensus from multiple parties on issues such as Recovery Time Objective (RTO) and Recovery Point Objective (RPO). Cloud Backup is not just about consumer and laptop data, it is a viable option for corporate server based data to In the process of your investigation and interviews, some of the key decisions you need to make include how long does the data of a particular application need to be retained, and how many versions should be kept. As well, what are the RTO and RPO of each application you want to protect? It s important to realize that while the business as a whole has a Minimum Business Continuity Objective (MBCO), each individual I.T. application required to support that MBCO has its own RTO and RPO. The reasons for making these decisions are of course that they dramatically affect the technology that is most viable and cost effective to achieve your objective. Some of the key pieces of information you need to collect are: how much data is associated with each application; how fast that data is growing; and how dynamic that data is (i.e. how much changes on a daily basis). The reasons for collecting this data include calculating the pricing for capacity licensed solutions, evaluating the suitability of appliance based solutions, and estimating the necessary bandwidth required to move the data offsite. One consideration that is sometimes overlooked is what circumstance or scenario(s) is the company trying to protect itself from? The answer to this question determines not only if you need to move your data offsite, but also if you need to move it out of country. The answer also helps distinguish between what solution the company thinks they want versus what they really need to protect themselves from the identified scenario. What the marketing material of a solution will never tell you are the trade- offs that you make when you choose one technology over another. There is always a trade- off. There are numerous other pieces of technical data that should be collected as well such as operating systems, whether servers are clustered, and if applications are certified to run in virtual machines. These can all affect the choice of solution. Once you have this information you re well equipped to evaluate solutions..

18 Considerations for Integrating Cloud, [or any technology], into your Data Protection and Disaster Recovery Strategy By Clifford Lew, Director, Professional Services and co- founder of Pantropic Online Pte Ltd and Atego Cloud Backup Understand What Is Being Offered When your chosen systems integrator presents his solution to you it will no doubt address prima facie the majority of your requirements. You need to decipher what is being said, and separate what you assume to be true from what is contractually agreed to. For starters, a Service Level Agreeme nt (SLA) is a must have. I have read SLA s that range from one page to ten pages long. The one page agreements are usually full of marketing truths that often boil down to we ll try our best. The ten page documents are burdensome to read (and write) but they usually give you a clearer picture of the kind of service you can expect, and what recourse you have if you don t get it. Please understand that although many companies (including my own) offer data protection which includes certain managed services, unless you re outsourcing all your IT, you re not likely to get a complete DR as a Service package. DR is a combination of policies, procedures, technology, and people. You can buy services that plug certain gaps, but don t be too quick to check off the DR box without doing some serious review of your own capability. One question that you should ask when someone sells you a cloud DR service is whether it really is cloud. By that I mean, is the service using a shared and redundant infrastructure? Is it multi- tenant? Does it have pricing that scales up and down based on usage? I ve encountered too many services that purport to be cloud based, but are actually dedicated servers hosted externally and sold on a subscription basis. You may like the privacy of having a dedicated server, but you lose the cost savings of a shared infrastructure, and you have little or no redundancy built into the service. Understand the Trade- Offs What the marketing material of a solution will never tell you are the trade- offs that you make when you choose one technology over another. There is always a trade- off. Some of the more common ones are, recovery speed vs. security, privacy vs. redundancy, simplicity vs. ability to customize, packaged (appliance) vs. scalability. Finally, if the service you are contemplating is too good (and cheap) to be true, then that should be a red flag to you. As a service operator I can tell you that it s a sizeable investment in terms of infrastructure to get started, and the operating costs in terms of hosting, bandwidth, and maintenance are not small. If a service is cheap, something has to give. In recent months, we ve read about some big name cloud storage and backup companies in North America that have stopped their service because the business model wasn t viable. If you don t want to be left in a lurch, beware of companies that offer too much for too little.

19 Guide to Data Protection and Disaster Recovery Subscribe at : Advertising & Promotions contact : mido@datastorageasean.com Press Releases : editor@datastorageasean.com Sponsors