Disaster Recovery and the Cloud: New solutions for offsite data protection

Transcription

1 A NASUNI WHITE PAPER Disaster Recovery and the Cloud: New solutions for offsite data protection 2010 Nasuni Corporation. All Rights Reserved

2 ... Table of Contents Abstract... pg. 2 Key Considerations in DR Planning... pg pg pg pg pg pg. 4 Tape Backup... pg. 4 Disk Backup: tape and mirroring... pg. 6 Online Backup... pg. 9 Cloud Storage Gateways... pg.11 Discussion... pg.14 1

3 Abstract IT departments planning for disaster recovery are all-too-frequently fooled by the deceptive simplicity of backing up to tape or disk. Traditional DR plans fail to adequately protect against irretrievable data loss. The typical backup model adopted by most companies is fairly simple: once a week, the business s data servers are copied to magnetic tape. Incremental changes are backed up as the week progresses. In general, a full week s tape set is regularly sent offsite. Some businesses may back up to disk as well as tape, keeping the disks local and the tapes offsite some may abandon tape entirely and find an alternative offsite storage plan. While details vary, what remains consistent is that in the event of disaster, mission-critical data is safe. This practice is as old as data itself it is tried and true. Isn t it? In reality, what seems like an elegant backup method is not so effective when disaster strikes. The ironic truth is that data restoration is hardly as straightforward and that IT departments planning for disaster recovery are all-too-frequently fooled by the deceptive simplicity of backing up to tape or disk. Traditional DR plans fail to adequately protect against irretrievable data loss be it from natural disaster, software corruption, hardware failure, or simple human error. An examination of current strategies, including tape and disk based solutions, as well as alternatives in the cloud, may help companies understand how best to prepare for catastrophe. Cloud storage has emerged as a simple and cost effective means to implement offsite data protection. The cloud offers an unlimited supply of reliable storage at a very low cost. Traditionally slow access speeds prevented the real use of the cloud in disaster recovery planning. However, modern cloud storage gateways accelerate the speed of access and can provide immediate access to data stored in the cloud. Key Considerations in Disaster Recovery Planning There is no universal disaster recovery plan: our aim is not to draft one for you, but to build a set of considerations that should factor into DR planning. We ve identified five key concerns to guide our analysis of popular DR methods: 2

4 Time is money: a study by Contingency Planning Research estimated the cost of downtime at about $18,000 per hour for many businesses 1. Traditional restoration methods can take from hours to days, and when you re recovering data, you are not conducting business. An effective DR plan, therefore, means a short recovery window. In a Pepperdine University report titled The of Lost Data, Dr. David Smith calculates that a single lost megabyte costs upwards of $10,000. How much data can you afford to lose? Your data center s cooling system fails. Your servers overheat. The data is lost. You spend half a day loading dozens of tapes, and as you restore you are told, again and again, Unable to read media. This scenario should ring familiar with any IT veteran. It s unfortunate, but data restores are often less than 100% successful; some files are simply gone for good. When these files pertain to customers, transactions, or anything else not easily reproduced, data lost becomes revenue lost. In a Pepperdine University report titled The of Lost Data 2, Dr. David Smith calculates that a single lost megabyte costs upwards of $10,000. How much data can you afford to lose? As your business becomes more reliant on continuous access to stored data, the more data it will store and the more it must back up. Hardware and infrastructure are plenty costly now add the window in which critical data is inaccessible, and DR can pose a significant strain upon your budget. Modern DR plans typically involve needless layers of complexity. When your backup system is separate from your primary storage system, this is almost unavoidable: you must track your backups full as well as incrementals and ensure that every time your file server is upgraded, your backup server is as well. What results, in the event of disaster, can be an organizational nightmare. 1 Double-Take Software, Inc. (2009, October). Disaster Recovery Planning with Virtualization Technologies

5 The most common method of backup is perhaps also the most unreliable. While tape is a great asset for archival purposes, it simply falls short with respect to each important DR consideration. is a crucial element in offsite storage; once your data leaves the premises, it is essentially in a hostile environment. Your backup plan must guarantee that your files are safely encrypted and that the encryption keys are safely protected. There are three major storage options in use today: tape, disk generally hybridized with tape or with mirrored sites, though sometimes with an online backup service and online backup. The following is a discussion of each type with respect to the above 5 concerns. Accompanying each analysis is a summative rating based on whether it is adequately equipped to handle disaster. Tape The most common method of backup is perhaps also the most unreliable. While tape is a great asset for archival purposes, it simply falls short with respect to each important DR consideration. Suppose you ve lost five terabytes of data. Step one is to identify which tape set you need from your offsite storage provider, and then request a delivery. This can take anywhere from hours to a day. Next you must correlate each tape you ll have roughly 25 with your logbook, and determine which to load first. At roughly 150 minutes per terabyte, you ll spend another day restoring all five. That s 48 hours of downtime for 5TB of data 3. What if you d lost more? 3 Cases very. From an interview with one of Nasuni s IT experts: this one assumes LTO 1/LTO 2 tapes and a backup server with a PCI SCSI card, connected to tape loader via SCSI cable. 4

6 With a full day between backups, you will inevitably lose at least twelve hours of productivity; but in all likelihood, you will lose more than just that. Estimations suggest that up to 20% of nightly backups do not successfully copy all data and further that 40% of tape recoveries fail completely 4. Tape is a primitive technology; the more you reuse it, the less reliable it becomes the more likely it is to corrupt your files. Can you afford to lose that much data? Estimations suggest that up to 20% of nightly backups do not successfully copy all data and further that 40% of tape recoveries fail completely. There s a reason tape is so wildly popular: it s the cheapest backup medium available. Tapes are relatively inexpensive, easily transported, and storage facilities offer affordable services. There are hidden costs, though. The price of hardware, software, maintenance, may run into the thousands of dollars 5. Because tapes wear out easily, you will often have to buy new ones. Scalability is also a problem: you can only put so much data on a single tape. Thus, as your storage grows, so will the number of tapes you need. More tapes mean bigger tape drives and greater expenses. We shall address the issue of simplicity with simplicity: tape is complex. You call your storage facility. You sit on hold. You give your account number. You read a serial number from an invoice you received when the tapes were picked up. You give a customer ID. You wait for the tapes to be delivered. You pray that they bring the correct set. The process has hardly begun: once you ve scrutinized your logbook to determine which tape correlates with the last full backup because your facility s numbers don t match your own bookkeeping you put a tape in the drive and wait for it to load. 4 Double-Take Software, Inc

7 If you re lucky, it s the right tape. If you re lucky, it s not damaged. Finally, you restore that tape s data just in time to twiddle your thumbs and surf the web through each of the remaining tapes. In a disaster scenario, offsite tape storage no longer meets modern business continuity needs. Tape is a wonderfully simple and relatively cheap archival method: you copy data and send it off. But when you need that data back promptly you will find yourself mired in complexity. There s no denying that most reputable backup facilities provide superb security. Plus, the data you back up can be encrypted though you risk losing the encryption keys if they are poorly managed. Furthermore, tapes are sometimes lost or damaged in transit all that s needed is an improperly closed door on the back of a truck, and your data is on the street. In a disaster scenario, offsite tape storage no longer meets modern business continuity needs. Tape Disk Backup: disk/tape hybrids and site mirroring As tape gradually loses its popularity, many IT departments have turned their eyes to disk-based backup. This typically falls into two hybrid categories: disk-totape and disk mirroring. Under disk-to-tape, onsite backup disks are periodically backed up to a disk backup target; this is periodically copied to tapes, which are sent offsite. This 46

8 keeps a recent data set local, with geographically disparate older versions. With disk mirroring, a duplicate set of servers is kept offsite changes made locally are recorded to the mirrored site, either synchronously or asynchronously; Virtual Tape and Virtual Disk arrays allow for traditional backup servers to interface with newer software. The disk approach eliminates many of the problems that accompany tape. Disk backup reduces downtime but does not eliminate the problem. The fastest you can hope to restore your data whether from onsite disks or a mirrored server is in a matter of hours. To use the same 5TB example as above, a 1GB link will copy your data in no fewer than 12 hours though you can increase performance by using multiple links. Under the disk-tape hybrid, however, any compromise of your onsite disks lands you neck-deep in the quagmire that is tape recovery. Furthermore, disk mirroring itself cannot be considered a viable backup method in disaster recovery. It is useful in the event of disk failure, but disk failure is not the only cause of data loss; common causes include software corruption and accidental erasures, both phenomena that would be replicated to the mirrored server. 47

9 Disk backup provides significantly stronger data integrity than tape. Whereas tape will inevitably recover corrupted data, backup software offers greater protection. And should you need to go further back than the most recent backup, this model allows you to do so: all versions are saved. The risk with disk is that it renders you dependent on hardware: fragile hardware. Disk mirroring and RAID ensure data redundancy; in the event of a disaster, however, you will still lose all data produced after your last backup. Even if you ve implemented synchronous replication, you are not protected against data loss: if software is corrupted or data is deleted in your main server, that problem will be copied to your backups, and you will not be able to access older versions of your files though backup-to-disk does allow for more frequent incremental backups. The risk with disk, as with tape, is that it renders you dependent on hardware: fragile hardware. A disk will not function optimally unless all its moving parts are in pristine condition; while disk is not as fallible as tape, your business can lose money merely as a result of a dropped disk. SATA drives are inexpensive, and deduplication can significantly trim the amount of data you store thus trimming costs as well. Scalability is an issue, however: as your data storage grows, you will need to buy more disks, and more enclosures to store them. The expense in offsite mirroring comes with hardware and bandwidth: essentially, it requires you to purchase a duplicate set of servers for your data. As your storage grows, so will your backup costs often into the hundreds of thousands of dollars, or more. Forget about the toil of loading dozens upon dozens of tapes: backup programs make the process smooth and streamlined. Another advantage is that each backup is not a full one only deltas are stored. But that is not enough. Disk-related backup fails to provide an elegant offsite 48

10 backup solution: one model requires you to send tapes offsite; the other replicates your onsite data in a disparate location which, as we have discussed, is not inherently practical. Once you back up your disks to tape, you are playing with fire in the event that they become inoperable or lost. This is entirely dependent on your internal security mechanisms: if they are strong, your backups will be secure. But once you back up your disks to tape, you are playing with fire in the event that they become inoperable or lost. Disk Backup Online Backup Online backup is the precursor to cloud storage. Both systems rely on offsite service providers to store data; however, online backup, as its name suggests, only supports the backup use case from specific vendors. Online backup is a good solution if you have a relatively small data set to protect. The best online backup service providers offer reliable data storage by mirroring data asynchronously across at least two separate geographic sites. Online backup customers tend to keep their backup at less between GB, depending on the bandwidth of their Internet connection, out of concerns that bigger backups require longer to restore over the Internet. 49

11 By mirroring your data across multiple sites, online backup providers ensure data integrity in the event of data loss, recovery is as simple as logging back in to your online backup account. The Achilles heel of online backup, as a disaster recovery strategy, is that downtime grows with the amount of data protected. Online backup offers adequate restore times for small data sets; a single file, directory, or inbox can be restored in relatively short order. However, because the full data set must be restored before failed applications can be brought back into operation, a complete file server restore can far exceed any reasonable recovery time objectives: restoring 100GB of data over a T1 connection requires almost a week. By mirroring your data across multiple sites, online backup providers ensure data integrity. Versioning further protects against corruption: if you can t rely on your last backup, you have access to every one preceding it. Online backup involves none of the hardware-related costs inherent in tape or disk backup. Vendors charge you only for the storage you use; while this alone cuts costs tremendously, storage software goes further: through data compression, the size of your data is reduced dramatically before it is sent to the online backup. This reduction translates to a drop in price as well. However, the costs are still in addition to your current storage needs. And since restore time can be very lengthy, your business still may lose money from downtime in the event of a disaster. Online backup storage involves no tapes, no drives, no differing systems of inventory; all you must do is download software, or in some cases have additional hardware installed. In the event of data loss, recovery is as simple as logging back in to your online backup account. Intelligently-implemented online backup storage provides security far superior 10

12 to tape or disk backup you needn t worry about damaged hardware or tapes falling from trucks. Your primary concern is encryption; you must be sure that your service provider encrypts your data before it leaves your site, so that it is secure in transit and at rest. Key management is also crucial, as poorly-managed keys can be lost or stolen: no one should have access to your keys but you. If the right precautions are taken, there is little more secure than data at rest in the online backup servers. Online Backup A new generation of cloud storage gateways promises to dramatically simplify disaster recovery. Cloud Storage Gateways Cloud storage providers create multiple copies of data and store them in many disparate servers. Should a server fail, data is already safe in several others; plus, the data is automatically duplicated to a new server. All of the major cloud providers have data centers with thousands of servers, and can guarantee storage in multiple geographic locations virtually ensuring that those with the right data will never all fail at once. Until recently, the use of cloud storage for disaster recovery was limited by the same issues that have plagued online backup namely, unreasonably long recovery times for large data sets. A new generation of cloud storage gateways promises to dramatically simplify disaster recovery. These gateways are designed to bridge existing customer sites with the tremendous reliability offered by the major cloud storage providers. The use of advance caching algorithms allows data recovery from the cloud to be virtually instantaneous: if a critical server is lost, a quick download of the gateway virtual machine can reestablish the connection to the cloud so that all of the data is available. Cloud storage gateways allow customers to meet their recovery time objectives by prioritizing access to the most critical data first. 11

13 This is still an emerging space with many startups attacking the problem from different angles. Nasuni offers the Nasuni Filer, a file server that can recover almost instantly from the cloud. Other firms offer block-level devices; others, still, offer application-specific gateways. We believe that file servers, due to their size, are typically the hardest piece to protect in a disaster recovery plan. The rest of this section focuses on the Nasuni Filer. As the Filer uses a local cache, more data does not mean more recovery time; the restoration process will be complete within minutes not hours, not days. Disaster recovery with the Nasuni Filer takes practically no time at all: all you must do is log in to your Nasuni account, download a new image of the Filer, and reinitiate the setup. Nasuni s setup wizard will recognize that you had a previous Filer configured, and will lead you through a simple restore procedure. You ll need to upload your encryption keys; the Filer will then download the metadata necessary to bring all file systems online. As the Filer uses a local cache, more data does not mean more recovery time; the restoration process will be complete within minutes not hours, not days. Integrity While its security measures alone protect data from corruption, the Filer goes further: periodic snapshots let users roll back to any period in the life of a file, directory, or file system; its high-performance local cache allows for primary storage with the same functionality as traditional local storage. To ensure immediate and long-term data integrity, your data is assigned a signature upon initial commitment to the cloud by the provider. Whenever a copy is made, it is verified against the original signature if the data is corrupted in one server, the cloud will notice, and retrieve your data from another. 12

14 With Nasuni, disaster recovery is part of the package. We charge $300 per month this gives you license to use the Filer, and absorbs costs associated with individual cloud providers plus fees based on how much storage you use. As the Filer optimizes your data by saving only deltas to the cloud, these fees are appreciably curtailed. Nasuni offers the simplest available approach to disaster recovery: it combines the comfort of offsite storage with the accessibility of onsite storage. If you can press a button, you can use the Nasuni Filer to recover lost data. The Filer uses OpenPGP encryption with the AES-256 standard which has been approved by the National Agency for top-secret material to compress each piece of data and metadata in transit and at rest. Customers hold their own encryption keys, so we never see the data we store nor can anyone else but its owner. For more information on security in cloud storage, read our white paper on the topic at Nasuni Filer 13

15 Discussion The Contingency Planning Group and the Strategic Research Corporation estimate that 43% of US companies, following a disaster, never reopen; of businesses that do, 29% close within two years. Traditional approaches to disaster recovery cause excessive downtime and unnecessary costs; in addition to leaving companies comatose while data is restored, they frequently fail to restore all data. The combination of traditional backup with offsite data protection schemes stretches recovery time objectives well beyond what most businesses can or should tolerate. Modern business continuity needs leave no room for hassle, no room for downtime or data corruption: anything less than near-instantaneous and complete recovery is unacceptable. The Contingency Planning Group and the Strategic Research Corporation estimate that 43% of US companies, following a disaster, never reopen; of businesses that do, 29% close within two years 6. Given the popularity and cost of tape and tape/disk recovery, this is hardly surprising. Many IT departments accept the shortcomings of tape and disk because they are the norm. We acknowledge that for archival purposes, they are great options; but disaster recovery presents a set of challenges the norm cannot meet. Cloud storage has emerged as a simple and cost effective means to implement offsite data protection for businesses. Cloud storage gateways offer fast restores at a fraction of the cost and pain. With cloud storage and the Nasuni Filer businesses may rest assured that should disaster strike, their critical data will not be harmed. Nasuni Corporation, based in Natick, MA, was founded in April 2009 by storage industry veterans. Nasuni is focused on solving the file growth problem facing most IT departments today by leveraging the unlimited capacity of the cloud. The company designed and developed the Nasuni Filer, a NASlike downloadable virtual file server that establishes a secure, high-performance link to cloud storage. Call or info@nasuni.com for more information. 6 Sales: sales@nasuni.com, Support: support@nasuni.com, or 888-6NASUNI 2010 Nasuni Corporation. All Rights Reserved 4