Proofpoint Email Archiving Whitepaper: A look at the pros and cons of Software-as-a-Service and how they apply to email archiving. threat protection compliance archiving & governance secure communication
For today s increasingly overburdened IT departments, Software-as-a-Service (SaaS) solutions provide a compelling alternative to traditional software deployments. However, SaaS solutions do not make sense for every business in every situation. In order to make the case for or against a SaaS solution, IT departments need to have a complete and accurate understanding of the time, effort, and costs involved with both SaaS offerings and the in-house alternatives. This paper reviews both the benefits and potential drawbacks of SaaS, taking an in-depth look at how they apply to email archiving. 2 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 01/12
Contents Overview... 4 How do You Know when Software-as-a-Service (Saas) is the... 4 Right Choice The Benefits of SaaS...4 Potential Drawbacks of SaaS Solutions...5 Core Versus Context Applications...5 Understanding Email Archiving Requirements: Time, Cost and... 6 Effort Involved Up-front Planning...6 Getting Up & Running...6 Maintenance & Management of Data...7 Backups of Archived Data...8 Summary & Conclusion... 9 Proofpoint s Software-as-A-Service (Saas) Email Archive... 9 Citations...10 About Proofpoint, Inc. and Proofpoint Email Archiving...10 3 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 01/12
Overview From email storage issues to legal discovery requirements and the Federal Rules of Civil Procedure (FRCP), the number of reasons to implement email archiving has grown significantly over the past few years, extending well beyond the initial regulatory compliance concerns that initially drove the market. With more companies turning to email archiving to address retention issues, the challenge for many businesses is not whether to archive, but how to archive. The first generation of email archiving products, many of which are still available, consisted almost exclusively of products designed to be deployed and managed internally. More recently, an increased number of managed and Software-as-a-Service (SaaS) solutions have been introduced to the market. Since both have their benefits, the real question is which makes sense for your organization? For increasingly overburdened IT departments, Software-as-a-Service (SaaS) can provide a compelling alternative to traditional software deployments. However, SaaS solutions do not make sense for every business in every situation. In order to make the case for or against one type of email archive, IT departments need to have a complete understanding of the time, effort, and costs involved with both solution types in order to make an accurate comparison. This paper discusses the overall benefits and drawbacks of SaaS solutions, outlining the type of situations that are best suited for this kind of implementation. An in-depth look at the time, costs and effort involved in implementing and managing an email archive is also presented, including a breakdown of the requirements for both in-house and SaaS solutions. How do You Know when Software-as-a-Service (Saas) is the Right Choice? The benefits of Software-as-a-Service (SaaS) from ease-of-use to lower cost of ownership have been well publicized over the past few years, due in part to the success of companies like Salesforce.com. This increased attention has resulted in the SaaS model growing in both awareness and popularity among North American businesses. In fact, analyst firm Gartner Inc. is projecting a compound annual growth rate of 22.1% for the SaaS market as a whole through 2011 1. Despite this trend, not all applications are appropriate for the on-demand model, and IT departments should be aware of the downsides of SaaS as well as the benefits. The Benefits of SaaS To accurately assess the value that Software-as-a-Service can offer, an understanding of the potential benefits and drawbacks of SaaS is required. When considering a specific solution, it is important to review each of these benefits and drawbacks against the solution under evaluation, as they will not apply in every case. A breakdown of common SaaS benefits follows. 1. Faster, Less Expensive deployments: With no underlying infrastructure to purchase and install, and minimal customization required, SaaS deployments typically take much less time to implement than in-house solutions. 4 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 03/12
2. Lower Up-front Capital Investment: Acquiring software traditionally required significant infrastructure purchases (hardware, middleware, networks, etc). Through a SaaS model, much of this investment is unnecessary and can be eliminated. SaaS solutions can also be treated as an operating expense, making it easier for departments to remain within their budgets. 3. Lower TCO, Pay-as-you-Go: SaaS solutions are typically less expensive than inhouse solutions for at least the first few years. When you take into consideration the considerable cost of software upgrades, a lower TCO can often be maintained for much longer periods of time. SaaS also allows companies to purchase only those services that are immediately required, with the option to expand services whenever needed. This can prevent big up-front purchases that often end up as shelfware, going unused. 4. Reduced Management Overhead: SaaS solutions allow IT departments to offload time-consuming operational activities, allowing them to focus on higher-valueadded, more mission-critical tasks. 5. On-demand Access to Powerful Infrastructure: By sharing computing resources among customers, SaaS providers can provide a high level of computing performance on-demand, regardless of how frequently the customer requires access. Potential Drawbacks of SaaS Solutions Though the benefits are great, the Software-as-a-Service model can suffer from some serious drawbacks that are often overlooked. A quick overview of these drawbacks follows: 1. Limited Customization and More Basic Functionality: Since SaaS delivers the same general functionality to every customer, customization can sometimes be limited. As a result, there are fewer opportunities to use SaaS solutions to provide a competitive advantage. Similarly, SaaS solutions sometimes provide fewer features and functions than on-premise offerings. 2. Hidden Costs: When evaluating SaaS solutions, be aware that some have hidden, add on costs for items such as testing, support, storage and integration that may not be apparent during the initial sales process. 3. Usage Commitments: SaaS solutions often price in bundles, requiring the customer to commit to paying for a certain volume over a period of time, regardless of whether or not the actual volume usage goes down. 4. Less Control for IT: With up to 85 percent of SaaS solutions being sold directly to business units without the input of IT, there is a potential for businesses to make software decisions that cause problems in the long run in terms of integration with other systems, availability and corporate security requirements. 5. Security Concerns: By sharing data with a third party, SaaS solutions may increase exposure to security threats. Core Versus Context Applications Applications that differentiate a business and impact customer purchase decisions (sometimes referred to as core applications 2 ) are usually best maintained in-house, where a high degree of control and customization can be applied. Other applications those that are required to keep the business running, but don t have a direct impact on the top line (often referred to as context applications) are typically good candidates for SaaS deployments. 5 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 03/12
By outsourcing context applications such as email archiving to a SaaS provider, the burden on internal resources can be relieved, allowing them to focus on core systems and activities and ensure those systems are constantly improved and running at peak performance. At the same time, the customer benefits from the constant upgrades and high level of service that a SaaS provider can offer. Understanding Email Archiving Requirements: Time, Cost and Effort Involved To accurately assess the different email archiving options available, a full understanding of the true time, effort, costs and benefits involved with each deployment model is required. The following section reviews the tasks IT should be prepared for when implementing an email archive, from planning through to management, specifically breaking down those tasks for both an in-house archive and a SaaS archive 3. The table on the next page summarizes the differences in requirements when deploying SaaS versus in-house solutions for email archiving. Each requirement area is discussed in more detail in the following sections. Up-front Planning The up-front planning requirements for in-house versus SaaS email archiving solutions are substantially different. Let s take a closer look at the requirements for both. In-house Solutions Before implementing an in-house email archive, IT must first take the time to plan the deployment. This planning includes identifying the required infrastructure, designing the implementation, projecting growth requirements and determining the up-front capital costs involved. On average, the time required to conduct adequate planning will run between three to six months. SaaS Solutions With a Software-as-a-Service implementation such as Proofpoint Email Archiving, a limited amount of planning is required on the part of the customer. For a small deployment (e.g., 100-1000 users), this planning can be done in a day or two. A larger customer with multiple sites and thousands of users might need up to two weeks for planning. Getting Up & Running Once the planning stage is complete, the process of getting the archive up and running begins. In-house Solutions To implement an in-house email archive, the IT team must purchase the required hardware, install the archiving software and integrate with existing systems. In some cases, IT may also need to procure additional datacenter resources to accommodate the archive. If a redundant copy of the archive is to be maintained as a risk-reduction feature, this process must then be repeated in a secondary datacenter, and budgets should be adjusted to reflect this. 6 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 03/12
Following the set-up process, IT must conduct extensive testing to ensure the system works and does not create issues with other applications. Overall, implementation and testing of an in-house deployment can take anywhere from two to four months. SaaS Solutions A SaaS solution such as Proofpoint Email Archiving can be up and running in as little as a day, with very little testing time. The time required on the part of IT is minimal; anywhere from one to five days is generally recommended, depending on the size of the customer and the number of locations involved. Table 1: Comparing SaaS and In-House Email Archiving Offerings Planning SaaS Archive 1 day 2 weeks (for a large company with multiple locations and thousands of users) On-Premises Archive Average 3-6 months Implementation Time 1-5 Days Average 2-4 months Testing 1 day Minimum one month Ongoing Capacity Planning None required Required Monitoring 24 x 7 monitoring included Requires additional resources Data Redundancy / Backup copies Issue Resolution Upgrades Search time/performance 2 active primary copies, one secondary automatically stored Problems identified and fixed 24x7 Automatically applied, no additional costs Guaranteed, regardless of archive growth Continuous Data Validation Ongoing None Typically one active copy plus periodic tape backup is maintained Issue resolution is responsibility of in-house IT; rarely 24x7 Additional cost & implementation time Degrades significantly as archive grows; maintaining real-time search is generally prohibitively expensive. Maintenance & Management of Data Once the archive is up and running, IT must be prepared to deal with ongoing maintenance and management of the solution. In-house Solutions Because an email archive contains business-critical data, IT must ensure the availability of that data on an ongoing basis. This means that the management of an in-house archive requires a high level of priority within the IT organization. Ongoing management of an in-house archive generally consists of the following tasks: 1. Data disposition: On a regular basis, IT must manually dispose of archived data that has met or exceeded the retention term specified by the organization s policy. 2. Ongoing capacity planning: The nature of archiving is such that you will eventually run out of storage. As a result, it s advisable to conduct capacity planning exercises every six months to ensure that storage requirements are sufficiently met. At regular intervals, the team can also expect to purchase and deploy additional servers and datacenter space. 7 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 03/12
3. Moving archived data: With a typical hardware cycle of 3-5 years (a period in which hardware options will inevitably undergo significant changes), the chance that an IT team will need to migrate data to newer storage technology is very high. This can be a highly complex and time-consuming task that requires a high level of expertise and time-intensive volume restructuring. It may also require the rebuilding of indexes. 4. Searching and exporting of data: In the case of legal discovery or other businessrelated discovery requests, IT is generally responsible for searching the archive and exporting the requested data. As the archive grows, in-house solutions typically experience serious degradations in search performance that require ongoing hardware upgrades. IT should have a clear understanding of the hardware that will be required to ensure that searches can be conducted within the short timeframes required for legal and compliance purposes. 5. Monitoring and troubleshooting: IT should plan to have some type of monitoring setup to identify issues within the archive. Additionally, the team should be prepared to fix and troubleshoot outages, hardware failures and other issues as they come up. SaaS Solutions With a SaaS archive, the management and maintenance of data, as well as capacity planning, monitoring, and troubleshooting is all taken care of by the solution provider s staff. In the case of Proofpoint Email Archiving, customers benefit from 24x7 monitoring and issue resolution, and a Continuous Data Validation (CDV) process that ensures that archived data is always available. A SaaS archive such as Proofpoint s can be managed by existing messaging staff in the customer organization without a material impact on workload. In fact, in some cases, workload is reduced as a result of improved email storage management, shorter backup windows and end-user archiving features including search and discovery. Additionally, by leveraging the shared infrastructure of a multi-tenant SaaS architecture, SaaS solutions such as Proofpoint Email Archiving can provide access to hundreds of servers on-demand, ensuring enterprise-grade search performance. In fact, Proofpoint backs this up with the only search performance guarantee in the industry. Backups of Archived Data Archived data should be backed up on a regular basis. Backup can be particularly challenging as the archive grows over time. In-house Solutions With an in-house email archive, a backup copy should be taken on a regular basis. According to Osterman Research 4, the backup process for an email archive requires, on average, ten person-hours per week per 1,000 employees. For those organizations with a long retention period for email, the time required can be much greater. Keep in mind that as the archive inevitably grows larger, the backup time required may extend beyond the window available. It s also important for IT to be aware of the inherent risks with maintaining one backup copy on tape. According to analyst estimates, the failure/corruption rate for tape is as high as 40 percent. As a result, in the case of a primary archive failure, the chance of not having a full recovery from backup copies is very high. This is particularly concerning because of the legal 8 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 03/12
implications of not being able to produce data when requested for discovery. In a court of law, lost or corrupt backup tapes can be considered spoliation (intentional destruction of data), which can carry severe consequences. SaaS Solutions With a SaaS email archive, there is no need for the customer to perform backups since the responsibility for keeping records available falls to the service provider (and is critical to their success). In the case of Proofpoint Email Archiving, two live copies of all data are maintained on spinning disk as well as an additional copy in a secondary datacenter providing a level of redundancy that would be prohibitively expensive for most businesses to maintain in-house. In addition to providing complete data protection, having a live fail-over copy results in significant search performance advantages. Summary & Conclusion While it is clear that Software-as-a-Service solutions do not make sense for every business in every situation, in the case of email archiving, there is a very strong case to be made. When you consider the management time, effort, and costs involved with an archive, implementing a solution in-house is a significant commitment and undertaking for IT and one that only continues to grow as the archive increases in size. Businesses that are implementing an email archive should seriously consider SaaS solutions in their vendor review process. Proofpoint s Software-as-A-Service (Saas) Email Archive Proofpoint Email Archiving is an on-demand email archiving solution that addresses three key challenges email storage management, legal discovery and regulatory compliance without the headaches of managing an archive in-house. As a Software-as-a-Service (SaaS) solution, it can be up and running in days, with no up-front capital costs and minimal planning. And since Proofpoint takes care of everything from storage to security issues, the archive can be easily managed by your existing messaging IT staff. Proofpoint s SaaS solution takes advantage of a multi-tenant architecture model. This means that customers benefit from lower costs because the physical back-end hardware infrastructure is shared among many different customers. It also means: No significant up-front costs for storage On-demand access to high performance search Capacity can be incrementally increased without having to buy large blocks of storage Proofpoint Email Archiving allows businesses to reduce the demands on Exchange and eliminate PSTs, while providing a virtually unlimited mailbox for end-users. Customers can view, search and retrieve archived data in real time from Outlook or a Web browser with guaranteed search performance. The real-time search tools and litigation hold feature also make it easy to meet legal discovery requests and FRCP requirements, while the retention policy and supervision tools address a full range of regulatory compliance requirements. 9 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 03/12
Citations 1 Report Highlight for Dataquest Insight: SaaS Demand Set to Outpace Enterprise Application Software Market Growth, Gartner, 2007. 2 The core and context application reference was originally coined by Geoffrey Moore in his book, Living on the Fault Line. 3 Based on the features of Proofpoint Email Archiving. Information may not apply to all SaaS email archiving solutions 4 Message Archiving Market Trends, 2007-2011, Osterman Research, 2007 About Proofpoint, Inc. and Proofpoint Email Archiving Proofpoint provides unified email security, data loss prevention and email archiving solutions that help enterprises, universities, government organizations and ISPs defend against spam and viruses, prevent leaks of confidential and private information, encrypt sensitive emails and comply with regulations that affect email use. Proofpoint s products are controlled by a single management and policy console and are powered by Proofpoint MLX technology, an advanced machine learning system developed by Proofpoint scientists and engineers. Proofpoint solutions can be deployed in hosted service, hardware appliance, virtual appliance, software and hybrid models, for maximum flexibility and scalability. Proofpoint Email Archiving is a SaaS hybrid solution that lets organizations easily access, search and retrieve archived data in real-time from Proofpoint s secure, state-of-the-art storage infrastructure. With industry-leading customer service, technology and expertise, Proofpoint offers customers a complete, worry-free way to meet email archiving, legal compliance and Exchange storage management needs. Visit our online resource center at http://www.proofpoint.com/resources for the latest information on Proofpoint s solutions. Proofpoint Limited 200 Brook Drive Green Park Reading, UK RG2 6UB Tel: +44 (0) 870 803 0704 www.proofpoint.com 10 / 10 2012 Proofpoint, Inc. Proofpoint is a trademark of Proofpoint, Inc. in the United States and other countries. All other trademarks contained herein are property of their respective owners. 03/12