Kroll Ontrack VMware Forum Survey and Report
Contents I. Defining Cloud and Adoption 4 II. Risks 6 III. Challenging Recoveries with Loss 7 IV. Questions to Ask Prior to Engaging in Cloud storage Solutions 8 V. Myths of the Cloud 10 Customer Reference 11 2
This report examines key findings from a recent cloud survey conducted by Kroll Ontrack, the leading provider of data recovery, e-discovery and information management. The survey was conducted at VMware Forums globally from April through June 2012, with 367 IT professionals participating in-person. Fifty-one percent of those surveyed represented enterprises while 32 percent were service providers. Participating Countries The following report will: 10% UK 19% IT 15% CH 15% DE 27% US 5% FI 3% DK 3% SE 2% NO 1% NL Define cloud and look at adoption trends; Identify the benefits and risks associated with the cloud; Explain why cloud and virtualization data recoveries are challenging; Provide questions organizations should ask prior to engaging in cloud storage/ solutions; and Address the myths and realities associated with the cloud. 3
I. Defining Cloud and Adoption Cloud computing is the wave of the future for information management, with other business management functions quickly jumping on board. Data center virtualization is a key element for the successful deployment of cloud solutions. Fortunately, mass adoption of virtualization technologies like VMware and Hyper-V have prepared organizations for the cloud of today. Organizations looking to streamline technology infrastructure and cut information technology (IT) costs are increasingly turning to this model for data management strategies. According to the Kroll Ontrack survey of IT professionals, 62 percent of organizations reveal that they leverage the cloud and/or virtualization for their data storage and/or data management. There are three major types of cloud environments: Public Cloud: Public storage and software solutions that are hosted by a third party where the hardware and software are outside the direct control of the contracting party. Private Cloud: Private storage and software solutions that are hosted internally. This is also referred to as the Enterprise Cloud. Hybrid (public/private) Cloud: A mix of public and private cloud offerings. Approximately how much of your current storage environment is cloud-based? None 16% None, but considering cloud storage 1% - 24% 22% 22% 25% - 49% 50% - 74% 75% - 100% 10% 15% 15% 4
The benefits to using one of these cloud environments, include: No sizable, up-front hardware investment; Limited internal IT training or staffing for installation or maintenance; Consistent, predictable fees; and The ability to be up and running in minutes. In addition to these benefits, companies also have different types of cloud-based environments they can choose to deploy, including: Software-as-a-Service (SaaS) -- the most accessible of cloud service offerings because it provides full application functionality through a web-based interface. For example, there are complete office productivity applications that are available through only a web browser and an internet connection, such as Salesforce.com. Infrastructure-as-a-Service (IaaS) -- the most established of the cloud service offerings (i.e. Amazon EC2, Rackspace and Google) because it allows organizations to use only what they need for computer system requirements. For example, IaaS allows customers to have access to offsite, virtualized computers and storage without having to pay the associated hardware costs or facility expenses.»» Platform-as-a-Service (PaaS) -- is targeted at rapid application development and leverages the two previously mentioned cloud services. Think of PaaS as the intermediary between SaaS and IaaS; this cloud service may be closer to adoption than was previously thought because it will enable more SaaS functionality. For example, this offering could be a combination of machine, storage, OS, development and web environments all rolled into a single offering. 5
II. Risks Similar to non-cloud solutions, cloud computing has been and continues to be subject to the following concerns/scrutiny, including: Potential data loss; Privacy law violations, as cloud computing makes it difficult to pinpoint where information is stored; The threat of hackers or viruses taking control of the stored information; and Inadvertent exposure with host providers, administrators or other cloud customers. While 62 percent of organizations reveal leveraging some form of the cloud or virtualization or both, only one-third of respondents test their data recovery plans to ensure proper protocols are in place to protect this data. Whether it be for traditional, virtualized or cloud storage, backup systems are not 100 percent reliable and data loss can occur. Moreover, because backups may not happen in real-time, critical data may not be included in the most recent backup. Archived data can offer another challenge; data may prove inaccessable due to the various file formats and numerous operating system updates. Forty-nine percent of organizations reported experiencing some type of data loss in the last year, but not necessarily from the cloud. Fifty-five percent denoted data was lost from traditional storage devices. This compares to 26 percent who reported a loss from a virtual environment, 3 percent who reported a data loss from the cloud and 16 percent who experienced data loss from both a virtual environment as well as the cloud. However, a recent Gartner prediction noted that by year-end 2016, more than 50 percent of global 1,000 companies will have stored customer-sensitive data in the public cloud. 1 As businesses start utilizing the cloud for more mission-critical business functions, more enterprises are moving to virtual backup systems and virtualization, and cloud contracts can claim no liability for data corruption, deletion, destruction or loss, it is more imperative than ever to frequently check the validity and accessibility of your data. Further, it is critical for enterprise IT administrators to proactively include a data recovery service provider in their contingency plans and ensure their third party providers do the same. Yes, virtual and cloud storage Yes, cloud storage 3% Yes, virtual storage 16% 26% 55% Yes, traditional storage Have you experienced data loss from the cloud and/or other systems? 6 1 Gartner, Gartner Reveals Top Predictions for IT Organizations and Users for 2012 and Beyond (Dec. 1, 2011) http://www.gartner.com/it/page.jsp?id=1862714
III. Challenging Recoveries with Loss Organizations today are managing huge amounts of structured and unstructured data within both cloud and virtual environments. This makes data recovery all the more difficult in the event of a data loss. With data residing in multiple locations, high availability means it is constantly moving between storage layers, leaving companies dangerously unaware of where their data is at any given moment. While providers are trying to make storage easier for end users, they are actually generating more complex recovery scenarios in the event of a data loss. As a whole, most individuals surveyed had confidence that their organization could successfully recover data from the cloud in the event of a data loss incident. Yet, industry statistics say otherwise. Roughly 68 percent of IT staffs report that managing data across physical, cloud and virtual environments is the toughest test in disaster preparedness. 2 Due to resource constraints across businesses of every size, IT staffs are often asked to do more with less, and they simply don t have resources to handle recoveries without third party assistance. How confident are you in your organization s ability to recover data from a cloud data loss incident? 5% Not at all confident 24% Not very confident 23% Very confident 48% Somewhat confident 2 InformationWeek, U.S. SMBs Lag In Disaster Recovery Readiness (Jan. 19, 2011) http://www.informationweek.com/news/smb/security/229000933?pgno=2 7
IV. Questions to Ask Prior to Engaging in Cloud storage Solutions The key to minimizing these risks and reaping the benefits of cloud-based solutions require both an information management solution and a strategy that easily prepares business for data management and recovery. Further, organizations contemplating the cloud should address specific technical, security and legal questions with their cloud provider prior to committing to storing data in the cloud. Technical Considerations Interruptions to power supply and electrical spikes can cause data loss, data corruption and data availability issues. Does your cloud provider have a record of technical reliability to cope with your needs? What type of storage is used? Is a form of RAID used that has redundancy? What hypervisor is used? What certifications does the provider s employees/data center have? Are backup systems and protocols in place? Do these systems and protocols meet your own in-house backup standards? Does your cloud vendor have a data recovery provider identified in its business continuity/disaster recovery plan? In instances of data loss, it is imperative that a rapid response procedure is adhered to. What are the service level agreements with regard to data recovery, liability for loss, remediation and business outcomes? Can you share data between cloud services? If you terminate a cloud relationship can you get your data back? If so, what format will it be in? How can you be sure all other copies are destroyed? Security Considerations What measures does the provider take to secure your data? Is end-of-life data erased? Who certifies that it has been deleted? Do you still own your data once it is cloud-based? 8
In the event of a data loss/corruption, who do you usually turn to first? 4% The cloud service provider 13% Not sure 14% Data recovery company 46% In-house IT staff /data recovery company 23% The hardware/software vendor (i.e. VMware/EMC) Legal Considerations Can the cloud provider retain data in accordance with your company s corporate document retention policy? Will the cloud provider offer assurances that it will comply with data protection regulations? In case of litigation or an investigation, will you or your external e-discovery provider be able to access and either extract or preserve all electronically stored information? If so, how quickly is access provided? Where exactly is your data stored? Where is the data center located geographically? 9
V. Myths of the Cloud The ability to successfully recover data from databases, virtual systems and/or the cloud is similar (and sometimes greater) when compared to hard drive recovery. As enterprises are responsible for increasing amounts of data and many are moving to new database and cloud-based technologies, it is critical to employ a recovery provider that has proprietary recovery technologies for these environments. When choosing a recovery provider, ensure: They have the capabilities to recover from complex RAID, SAN, virtual and cloud environments. They have the capability of repairing and recovering data from within damaged files, such as server and desktop-based e-mail, databases, and office productivity applications (word processing, presentations and spreadsheets).»» They ve developed specific tool sets for encrypted data recovery. It s essential that they can recover encrypted data and return it in an encrypted form. 10
Customer Reference Curtis Birkmann Senior Vice President and Chief Information Officer, Bank of Manhattan, NA Thank you Mr. Burmeister and all of Kroll Ontrack for the complete professionalism that the Bank of Manhattan has experienced in working with your teams on the recovery of our Netapp Storage Area Network with VMWare ESXi 4.1 running numerous Microsoft Server 2003 and 2008 Operating Systems. When the Bank of Manhattan had a recovery event that needed to be performed, Kroll Ontrack was contacted and they were able to very quickly start a recovery event with continuous 24x7 operations until the event was resolved. Kroll Ontrack was successfully able to utilize their proprietary solutions for our complex multiple layered operating systems platform and provide prompt and attentive service throughout the resolution path. The Bank of Manhattan benefitted by using the Kroll Ontrack recovery process in three key areas: Limited Downtime By using Kroll Ontrack, The Bank of Manhattan was able to restore key virtual servers in 30 percent less time than our traditional offsite recovery process. Recovery vs. Restoration Kroll Ontrack provided The Bank of Manhattan with complete images of key virtual servers, at the exact time of hardware failure, rather than at the time of last backup or snapshot. This approach allowed us to recover multiple integrated servers at the exact point of failure. Continuous 24x7 Resolution Kroll Ontrack employed teams in geographically separate time zones to provide the Bank of Manhattan with a continuous resolution path while reporting hourly, sometimes up to the minute, statistics on the project and its estimated completion hour. Having this information at hand allowed the Bank of Manhattan to accurately staff the recovery implementation, which allowed us to bring the servers back online within the most efficient schedule realizable. In summary, thank you Kroll Ontrack for your expertise in complex recovery solutions. You have provided the Bank of Manhattan with prompt and attentive service, professionalism, an efficient approach to recovery, and a highly desirable option for our Business Continuity planning. 11
For more information, call or visit us online. 800.872.2599 in the U.S. and Canada +1.952.937.5161 www.krollontrack.com Copyright 2012 Kroll Ontrack Inc. All Rights Reserved. Kroll Ontrack, Ontrack and other Kroll Ontrack brand and product names referred to herein are trademarks or registered trademarks of Kroll Ontrack Inc. and/or its parent company, Kroll Inc., in the United States and/or other countries. All other brand and product names are trademarks or registered trademarks of their respective owners.