Cloud Storage: Top Concerns, Provider Considerations, and Application Candidates

Cloud Storage: Top Concerns, Provider Considerations, and Application Candidates

As cloud technology and deployment models become increasingly sophisticated, once-wary storage professionals are plunging headfirst into their initiatives. Before you follow suit, make sure you know which data should and shouldn't be sent to the cloud, as well as the key questions to ask if you're considering a provider. This E-Guide will go over these and other critical factors to take into account as you navigate your cloud storage project. Learn how to classify potential cloud application candidates, ensure compliance with industry regulations, and properly assess supplier policies and processes. In this expert interview, Wayne Pauley, a senior analyst at Enterprise Strategy Group, explains how cloud strategies are evolving as the technology quickly changes. Backup and archiving, along with hybrid strategies, remain popular starting points, but new offerings are making it simpler to move more data move to the cloud. Beyond backup, what are some types of data best suited for the cloud? Wayne Pauley: You could run your whole business in the cloud if you wanted to. It depends on the size of company, and it depends on the kinds of applications that you think are going to be best suited for you to run in the cloud. There certainly are companies that run their whole business in the cloud and store everything there. There are just a lot of variables there. Are there certain cloud providers that excel in handling one type of data but not another? Pauley: The type of data that you're going to store in the cloud really is dependent on [if you have] specific compliance regulations that are going to make you not want to put things in the cloud because you have to have a high standard of protection. Page 2 of 10

Backup and archives are obviously a good place to move things from [the] point of view of using the cloud as a target. The one thing that most people are a little bit leery of moving to the cloud today is really intellectual property [IP]. [They like to] keep that on the premises. Still, most companies are hesitant to put IP out there in the cloud. There are a lot of applications now that are moving to the cloud more and more. A good example is Microsoft Office 365. It lets you put all of your Office [documents in the cloud] and use SharePoint and Exchange basically as cloud services. I think we're kind of at the crossing-the-chasm point with what some providers are offering today. How prevalent are private clouds becoming? Pauley: Private clouds -- let's just do a little definitional semantics here. I think virtualized data centers are very common and moving to where the virtual data center is actually providing self-service and on-demand services. There's a service catalog that someone deals with, and it does more than generate a work order for someone in IT to go off and provision a VM [virtual machine] for them. I think many large data centers are kicking the tires with that. But I think that calling a data center purely a cloud today, a private cloud, is still a little ways out. There are some services that they're providing, but it's still in the early stages. Let's talk about hybrid projects. Do you see companies using both private and public clouds? Pauley: We definitely see that, whether it's shadow IT -- where people are going around what IT is doing -- or very specific capabilities that they want from a public provider. I've seen companies that we've talked to who are doing test dev. That's kind of a natural [project] for doing test and development. The second one is for backup and archiving, again a natural one. Certain Web services are pretty prevalent and easy to do now with many of the providers. Those are some of the key ones [or] at least good starting points. What kinds of challenges exist for cloud providers that need to handle very large files like images and video? Page 3 of 10

Pauley: I don't know that it's really a problem for the cloud providers themselves -- it's the movement of the data to the cloud. So now you have to look at what your usage model is. Many of the cloud providers have a fairly inexpensive ingest price, so the economics make a lot of sense for moving the data there. The egress part of moving the data back out is a much different animal. For some providers, it's even 10 times what it costs to move data into the cloud. You have to look at that usage model. If you're moving a lot of data in and storing it, that's one thing. If you're going to have data come out and be provided to a lot of people on the egress side, then you have to think pretty hard about what the economics of that are going to be. We hear a lot about getting your data out of the cloud. Is this more of a technology issue or a service-level agreement issue? Pauley: I think it's more of an economic issue. It's not that the service couldn't be provided and run very well from a performance point of view. It's not a technology issue. Cloud providers can move data in and out as well as anybody. It's [the] way they've structured their economic model, so that they can make money on the pipes, basically, that they're providing. So, it's a cost issue. What kinds of technologies are out there helping companies store more frequently accessed data in the cloud? Pauley: There are a good number of vendors, if you're talking about purely storage. There are a good number of vendors that are providing gateways that allow a cloud's object store to provide an extension of network-attached storage only through the gateway to the cloud provider. And masking that there's even a provider on the back end, there's quite good technologies there. They have caching built into them [quite] often. That's one approach. Another is to use a CDN, a [content] delivery network. Some of the big providers have their own. Then there are other vendors out there that are CDN experts, and that's all they do. Page 4 of 10

Content: What you ll learn in this tip: Undertaking new cloud initiatives is at the top of many data storage professionals to-do lists, but determining what information to place in the cloud can be overwhelming. We list a number of non-strategic applications that can be among the first items your organization places into the cloud. IT professionals keep hearing about why they should be cautious before undertaking a cloud storage project. At the same time, any IT pro who has been paying attention has heard about the huge benefits of cloud storage. The result is often extreme: Some organizations avoid breaking into the cloud environment altogether, fearing a loss of control over data with a cloud migration or concerns with cloud security. Other organizations go all-in, only to find themselves locked into a multi-year contract with a generic infrastructure and customer service spread across customers just like the costs. Some people call it a Goldilocks approach -- nothing too hot or too cold, but something just right to get started. This is done by classifying applications into two groups: strategic and nonstrategic. Strategic applications are those that provide the organization with a competitive advantage in the marketplace. If the application contains any secret sauce (a process developed especially for the company), then it may not be a good candidate for cloud placement. Non-strategic applications are necessary, but offer the firm no market advantage vs. competitors. These types of applications are ideal candidates for a cloud configuration. Here are some examples of non-strategic applications: 1. Backup and recovery. Every organization needs to back up its data, but it s rarely a differentiator. Off-site cloud backup can minimize tape usage, eliminate off-site tape rotation and provide a platform for disaster recovery. This is usually facilitated with backup appliances or virtual tape libraries that can deduplicate, compress Page 5 of 10

and encrypt data. Find a cloud storage provider that supports your appliance of choice. 2. Email. E-mail may be a mission-critical application to most organizations, but that doesn t make it a competitive differentiator. Third parties can often host or provide email services at a substantial savings over in-house deployments. If uptime is a concern, most providers can offer uptime guarantees. 3. Laptop backup. Similar to backup and recovery, but most organizations address laptop backup as a separate entity, if they address it at all. Numerous cloud providers offer laptop backup that's entirely self-service to the user, thereby relieving IT of the entire burden. 4. Customer surveys. If your organization regularly surveys customers for market research purposes, numerous cloud solutions exist for this purpose. Only those organizations needing the most nuanced survey capabilities would consider an in-house solution. By identifying non-critical applications, data managers can separate the associated data and then apply more generic data management schemes to it. This is an ideal environment to begin a cloud strategy. Routine data management practices provide all the requisite availability and protection -- frequently at a lower price. Standardizing non-critical data management practices means organizations can simplify operations and speed provisioning, which is typically a top priority for those tasked with managing data storage. So you've decided to pursue public cloud storage for a particular data set and use case. If you're a developer building a Web-enabled application, then you'll likely be interested in a cloud object store such as Amazon S3 or OpenStack Object Storage. If, on the other hand, you're an enterprise data storage professional looking to take advantage of the cost-effective scalability of the cloud to protect traditional block or file data for backup or disaster recovery (DR) purposes, then chances are you'll want to deploy an Page 6 of 10

on-premises appliance as a gateway to back-end cloud storage. One of the key decision points for each of these use cases -- and a large range of others -- is the choice of a public cloud storage service provider. While each usage scenario is a bit different, there is a core set of evaluation criteria common to all use cases that you should consider when choosing a cloud storage provider. Here are 10 questions that will help you compare cloud storage services: 1. Does the provider accommodate and support my primary use case(s)? In our example above, companies looking for an object store may find Amazon S3 attractive, but to support the storage of traditional block or file data, an AWS Storage Gateway will also be required. Not all cloud storage providers offer capabilities tailored to use cases such as backup, DR, or archiving, so you'll need to carefully compare the details of each provider's offering. 2. Where will my data be stored? The answer to this question is important for several reasons. First, you'll want to be sure that the provider's datacenter facilities are state-of-the-art, meeting high standards of operational control and security. Look for SAS 70 type II and similar certifications. Knowing the geography in which your data is stored can be important for compliance as well, and may have an impact on data access times: Depending on your data set and use case, you may achieve faster access if storage nodes are located near your corporate or branch offices. 3. What kind of security mechanisms are in place? Look here for strong encryption methods, such as AES-256 and SSL, to secure data at rest and in transit, and sufficient access control and authentication mechanisms to ensure that the wrong person won't gain access to your information. Ask for a published description of the provider's security policies and processes. 4. How does the provider ensure data durability, reliability and availability? You should look for offerings that provide redundancy across multiple facilities and systems within each facility. The provider should perform regular data integrity checks to protect against corruption. Versioning Page 7 of 10

enables additional protection, by allowing multiple versions of objects to be stored, retrieved and restored in case of failures or unintended user actions. Finally, the provider's service-level agreement (SLA) will spell out storage availability commitments. Look for a minimum of three nines (99.9%) availability over each monthly period and 10 or 11 nines of durability over a year, with the ability to withstand and sustain the concurrent loss of data in one or two facilities. 5. How easy is it to upload my data, especially when moving large data sets into the cloud? For this purpose, check out whether the provider offers a data shuttle (portable storage device) or dedicated high-speed connection for seeding initial data into the cloud. 6. How easy does the provider make it to transfer data out of the storage cloud? The answer to this question hinges in large part on the application programming interfaces (APIs) the provider supports: Industry standard REST APIs will ensure that your data is portable, while proprietary APIs may be the first step to vendor lock-in. The overwhelming majority of cloud storage providers now support a REST-like API, so it's worth looking for that in particular. One other thing to qualify upfront is the cost of transferring data out of the cloud. Most providers charge little to nothing to move data into their clouds, but do charge for data transferred out. 7. What kind of access performance does the provider support? Speed of access will be based in part on the location of your data, as mentioned above. If you're planning to store primary data in the cloud, you should evaluate the use of an on-premises cloud storage gateway, which will provide local caching of frequently accessed data and may also compress and deduplicate data before it is sent to the cloud. 8. Will the provider help me to comply with key industry regulations? If your business is subject to major regulations, such as HIPAA or PCI DSS, you'll need to know the geographic location of your data, and you'll likely also need evidence of various certifications before sensitive data can be moved to the cloud. Compare each cloud storage providers' offeringsto understand what level of regulatory compliance is built into their cloud storage services. Page 8 of 10

9. Can I be certain that the provider will still be in business five ye ars from now? If you're considering working with someone other than a major, well-known provider, you'll want to check out the provider's financial stability and track record, to ensure that your data will be in good hands. 10. Can I count on a quick response from the provider's technical support team, in case I run into problems? Many providers now offer multiple tiers of support, including across-the-board 24x7x365 access, as well as named contacts. Page 9 of 10

Free resources for technology professionals TechTarget publishes targeted technology media that address your need for information and resources for researching products, developing strategy and making cost-effective purchase decisions. Our network of technology-specific Web sites gives you access to industry experts, independent content and analysis and the Web s largest library of vendor-provided white papers, webcasts, podcasts, videos, virtual trade shows, research reports and more drawing on the rich R&D resources of technology providers to address market trends, challenges and solutions. Our live events and virtual seminars give you access to vendor neutral, expert commentary and advice on the issues and challenges you face daily. Our social community IT Knowledge Exchange allows you to share real world information in real time with peers and experts. What makes TechTarget unique? TechTarget is squarely focused on the enterprise IT space. Our team of editors and network of industry experts provide the richest, most relevant content to IT professionals and management. We leverage the immediacy of the Web, the networking and face-to-face opportunities of events and virtual events, and the ability to interact with peers all to create compelling and actionable information for enterprise IT professionals across all industries and markets. Related TechTarget Websites Page 10 of 10