Best and worst practices for Exchange archiving

Transcription

1 practices for Exchange archiving

2 Managing an system can be difficult and frustrating. Add to that the burden of archiving and even the most experienced IT pro is challenged. In this expert e-guide from SearchExchange.com, find out how to break bad archiving habits by replacing them with best practices. Plus, learn how to ensure your Exchange archive remains compliant with a helpful checklist. By Stephen J. Bigelow, Senior Technology Writer Managing an system can be difficult and frustrating. administrators battle with Exchange maintenance and storage allocation while scurrying to meet stringent business plans and hunting down the CEO's lost message. Enterprise environments add to this burden with the demands of archiving -- storing the right content in the right place for the right length of time. Roles and responsibilities archiving involves long-term storage and recovery of incoming and outgoing messages. The choice of which messages to keep, how long to keep them and where to store these messages are all part of the organization's overall records retention and regulatory compliance policies. Archived messages and attachments must be searchable and recoverable to meet the daily needs of users, as well as the more demanding needs of compliance auditors and legal electronic discovery (ediscovery). Many tools are available to automate and manage message archiving and retrieval. But, even with the best third-party tools, a fundamental lack of ownership of message archival policies results in weak (or nonexistent) processes. This leaves a company vulnerable to unnecessary risks. Page 2 of 11

3 "Archiving is not an infrastructure thing; it's not an application thing. I think that's why it falls to the wasteland," said Rand Morimoto, president of Convergent Computing, a solution provider headquartered in Oakland, Calif. "Historically, there has not been anybody in an organization responsible for archiving." Morimoto also points out that archiving is not a requirement for most regulations, such as Health Insurance Portability and Accountability Act (HIPAA), Sarbanes-Oxley Act (SOX) and others. Consequently, businesses often handle archiving and other content inconsistently or erratically. Who is responsible for archiving? While dedicated -archiving personnel within an enterprise are exceedingly rare, the responsibility should fall to a principal Exchange administrator. If this is possible, however, depends on the size and exposure of the organization. "If it's a large organization, they will have an administrator," said Allen Zuk, president and CEO of Sierra Management Consulting LLC, a Parsippany, N.J.-based independent technology consulting firm. "For smaller organizations, usually somebody who's wearing multiple hats -- a network engineer or a systems administrator -- assumes the administrator function." The key here is not so much who manages archiving but that a responsible administrator handles the process reliably and consistently. Breaking bad archiving habits Consistency is key when it comes to -archiving policies and procedures. An Exchange administrator may be in charge of archiving or it may be someone else within the organization. No matter where the responsibility lies, it's easy to adopt poor habits, make mistakes or fail to follow procedures. Poor habits could ultimately compromise archives and even jeopardize the company's compliance or e-discovery posture. Regardless of who manages a company's archiving process, the following oversights are common and companies should make every effort to avoid them. Page 3 of 11

4 Failure to observe retention policies -- Many Exchange administrators don't pay attention to retention periods or storage space when archiving messages. Instead, they tend to focus on the content. "They're not aware of the company's policy regarding data retention," Zuk said. "They keep stuff; they don't know why they're keeping it or they don't know how long they will keep it for." Erring on the side of caution -- Saving every message for the maximum allowable time or moving messages from the server to the archive when the message database exceeds a certain threshold (500 GB, for example) -- is a mistake. Mapping the company retention policies to storage can better meet the needs of the business, while saving considerable storage and index/search demands. You may not need to keep everything. Morimoto notes that many Exchange administrators save all messages for some period of time when they could potentially save nothing except messages they're legally obligated to keep. "There's a lot of stuff that people send that can just be purged and deleted," Morimoto said. Eighty to ninety percent of , such as meeting confirmations, can be deleted after day one, he noted. Retention isn't just about keeping data. Exchange administrators must also be diligent in purging or deleting content that exceeds its retention period. For example, if a message must be retained for five years, it should be permanently deleted at five years and one minute. Third-party archival tools can automate the deletion process by using date metadata created when the data was stored. The catch with these tools, though, is that administrators must approve deletions prior to the actual date. Page 4 of 11

5 Not including archives in backup and disaster recovery (DR) strategies -- Archives are not backups, so any mail and other data that is relegated to archives must still be backed up. The archival storage platform itself may provide some level of resiliency at the disk level such as RAID 5 or RAID 6, but it is often prudent to perform regular backups to tape or an off-site location for DR purposes. Fortunately, archived data is generally a low priority for DR restoration. Relying on Exchange for compliance -- Generally speaking, Exchange does not provide very dynamic archiving features. Businesses must select third-party archiving tools that address compliance concerns across all types of data. Morimoto explains that it's not just an Exchange issue. "When choosing an archiving tool, the Exchange administrators spend a lot of time looking at it just from an Exchange basis as opposed to a policy basis," he said, noting that an archiving tool should also handle other data types, such as files and instant messages, because all of that other data is covered by compliance obligations -- it's still potential evidence. The decision of an archiving tool must go beyond the amount of mail that must be kept. Consider the retention of all data types. Allowing.pst file proliferation -- Every Microsoft Outlook user can archive messages in a personal storage (.pst) file located on each user's desktop. While.pst files are not harmful, they are space monsters -- consuming up to 2 GB on each desktop. This can cause the size of a user's online backup to balloon. Further,.pst file archives aren't subject to retention policies, so the file can retain far longer than the company's set requirements. When messages are purged from the server/archive side, those messages are not removed from a user's.pst files. This can pose a significant threat for any company, since.pst files are often included in e-discovery requests. Therefore, old messages in long-forgotten Page 5 of 11

6 .pst files can be used as evidence long beyond the time that the message was lawfully removed from a company's archives. No media upgrade or refresh plan -- Archived data is often retained for much longer than the storage systems holding that data exist. But technology upgrades are rarely -- if ever -- factored into archive recovery or restoration plans. For example, if a new archiving tool is selected, it must interoperate with the archival storage platform. Similarly, if the archival storage system is upgraded or replaced, there must be a plan in place to migrate existing data to the new storage system. "Another mistake is archiving stuff on media," Zuk said. "Then they [administrators] get wrapped up in a technology refresh and nobody goes back to look at the old information on a different format and transfer it." When a technology changes, verify that backups and archives are accessible. Otherwise it may be impossible to recover archives, which can leave the company vulnerable to disasters or compliance audits. Building on best practices archiving isn't just about problems and mistakes. Many organizations and Exchange administrators have adopted sound -archiving practices. Whether you're a small shop looking to improve existing processes or a large organization taking the time to reevaluate everyday activities, here are five points you should adopt in your organization: 1. Review archival and retention policies regularly -- How often you should review the policy varies depending on the size of your business and its industry. For example, a small business that isn't governed by lengthy retention requirements may adopt a short-term retention policy. Page 6 of 11

7 "I just finished with a client whose [retention] policy was 30 days and they were on the ball -- [they saved] nothing over 30 days. They didn't keep anything," Zuk said. However, an annual review of the policy is certainly in order. For larger Exchange organizations, a frequent review is recommended. The review not only reinforces the policy for Exchange administrators, it also gives companies an opportunity to consider industry changes that might affect retention, such as upcoming legislation. Companies can also reevaluate infrastructure issues such as storage resources and backup/dr planning. 2. Separate archival and DR storage -- Generally, data archives are one of the lowest priorities in DR, so archival data is typically backed up to inexpensive high-volume storage -- tape or optical media -- instead of online disk storage. If disaster strikes, the emphasis should be on restoring Exchange servers and their local message storage. Administrators should focus on archival restoration later in the recovery process. This approach lowers the cost of backup storage and helps speed the recovery of the most urgent corporate resources. 3. Centralize storage -- Years ago, Exchange servers typically existed at every site. And this type of distributed deployment made archiving difficult. Administrators are doing a better job of keeping track of where archive data is stored, often opting to consolidate Exchange servers and storage to ease data retention and management. "I see more organizations centralizing information," Morimioto said, noting that centralizing Exchange servers has improved an organization's ability to manage data. "I think the idea of regionalizing Exchange and managing it centrally is a good practice people have been doing for the last year or two." Page 7 of 11

8 4. Outsource and archival tasks -- Problems with archiving and retention often stem from lack of attention from overworked administrators. This is especially the case in smaller organizations where administrators already assume a wide range of responsibilities. One way to address this issue is to outsource archiving. "They're [administrators] looking at third-party vendors -- outsourcing completely," Zuk said. Outsourcing shifts responsibilities and policy-adherence requirements to the provider, allowing the client to monitor and manage content remotely without the burden of system ownership, licensing and so on. "It's cheaper for a smaller organization to just outsource it [ ]." However, any outsourcing initiative must include a careful evaluation of data security using technologies like encryption. 5. Maintain older readable versions of archival data -- Technology refreshes can render older data formats unreadable and inaccessible. The challenge is that overworked administrators are hard-pressed to refresh existing archives to new formats or platforms. This can cause serious problems when a compliance audit or discovery request arrives. It's a good practice to incorporate an archival refresh into the technology-refresh process while retaining an older version of the data for prospective requestors. "A third-party vendor or agency may not have the latest and greatest technology," Zuk said. "They [administrators] have the capability to provide that information on a format or media that the requestor was working with." Such awareness can help ensure that discovery requests are met promptly and successfully, mitigating any possible penalties or charges of spoliation. Page 8 of 11

9 Complying with government regulations such as Sarbanes-Oxley Act (SOX), HIPAA and several others is critical when creating an -archiving policy. Use this checklist when planning your -archiving strategy. Create and refine -archive policies No organization can meet compliance and regulatory obligations unless they have developed and implemented relevant policies. At a minimum, have an -retention policy that defines the type of mail and the duration of storage requirements. In addition, have an archive policy that defines the storage locations, allocated space, search and recovery and backup processes needed to protect stored messages. Remember: Compliance is typically not an IT function, so it's important to involve corporate management -- legal council, human resources, the CTO -- in the policy-development process. Document and prepare servers Proper documentation and preparation of servers will demonstrate "due diligence" for compliance auditors and help IT staff recover from problems. For example, document all server configurations, remove all outdated alias databases, complete all alias database rebuilds and move all stored logs to a separate (Syslog) host prior to archiving. Implement security for archiving compliance often includes the use of security processes and technologies that restrict access and guard against loss or theft. For example, archive access should require the use of strong authentication, such as public/private key pairs or multifactor authentication. Archive access should also be restricted to only a limited number of IT and legal/management personnel. Regardless of personnel restrictions, implement comprehensive auditing to track archival access and review audit logs to ensure adherence to access policies. Finally, consider technologies like Page 9 of 11

10 encryption or hashing to protect archived . It must be unreadable to anyone other than authorized users; hashing can help ensure data integrity by protecting against tampering. These protections can be particularly important when working with a thirdparty -archive vendor. Plan for technological interoperability Archive requirements may persist longer than the working life of archiving tools and storage systems. Remember that inaccessible archives are not compliant. Anytime a change occurs in the archive infrastructure, make certain that existing archives remain accessible with the new tools and technologies, or implement a refresh plan to migrate archives to the updated infrastructure. Consider third-party compliance implications Some organizations, particularly smaller businesses, may outsource and archiving tasks to a third-party provider. When trusting messages to an external provider, use a comprehensive service-level agreement (SLA) to address your specific needs for archive handling and management. The SLA should also cover topics like availability (uptime), data access, data integrity, security and logging/auditing. Understand what happens when the third-party contract terminates and have a plan in place to transfer the data to another provider or bring it in-house. Page 10 of 11

11 Free resources for technology professionals TechTarget publishes targeted technology media that address your need for information and resources for researching products, developing strategy and making cost-effective purchase decisions. Our network of technology-specific Web sites gives you access to industry experts, independent content and analysis and the Web s largest library of vendor-provided white papers, webcasts, podcasts, videos, virtual trade shows, research reports and more drawing on the rich R&D resources of technology providers to address market trends, challenges and solutions. Our live events and virtual seminars give you access to vendor neutral, expert commentary and advice on the issues and challenges you face daily. Our social community IT Knowledge Exchange allows you to share real world information in real time with peers and experts. What makes TechTarget unique? TechTarget is squarely focused on the enterprise IT space. Our team of editors and network of industry experts provide the richest, most relevant content to IT professionals and management. We leverage the immediacy of the Web, the networking and face-to-face opportunities of events and virtual events, and the ability to interact with peers all to create compelling and actionable information for enterprise IT professionals across all industries and markets. Related TechTarget Websites Page 11 of 11