For IT Infrastructure & Operations Professionals Client Choice topic January xx, 2008 Online Backup Services Take The Pain Of Data Protection by Stephanie Balaouras with Simon Yates, Liz Herbert, Rachel A. Dines EXECUTIVE SUMMARY Backup is a struggle for both enterprises and small and medium businesses (SMB). It s a complex ecosystem of backup software, networks, servers, disk arrays, and tape systems. Many firms have difficulty completing backups in the time available and a large number of backups fail or complete with errors. In addition, there are gaps in backup coverage. SMBs and enterprises often don t protect corporate PCs and enterprises often don t protect machines at remote offices. Given the headaches associated with backup and the gaps in coverage, many firms are considering an online backup service. An online backup is just the beginning. It s just the first step towards the delivery of multiple infrastructure related services such as disaster recovery, archiving, and security delivered as SaaS IT operations professionals. TABLE OF CONTENTS Backup Is Time Consuming And There Are Gaps In Protection Online Backup Is Software As A Service For IT Operations Online Backup Is Optimized For The WAN Who Uses Online Backup Today? Critical Selection Criteria For Online Backup Several Pricing Models Are Available The Vendor Landscape For Online Backup Is Built On Acquisitions Vendor Segmentation RECOMMENDATIONS Consider Online Backup If You Have Limited Staff And Gaps In Protection WHAT IT MEANS Online Backup Is Just The First Step In IT Ops- Focused SaaS NOTES & RESOURCES Forrester interviewed 16 vendor companies, including Arsenal Digital Solutions, Asigra, AT&T, Berkeley Data Systems, BitLeap, BT, Carbonite, EMC, EVault, IBM, Intronis, Iron Mountain, Remote Backup Systems, Seagate Services, SunGard, and Symantec. Related Research Documents Storage Service Providers Rise From The Ashes [38034] March 6th, 2006 Will Data Deduplication Finally Make Disk As Cheap As Tape? [42752]] July 23rd, 2007 The Universe Of Corporate PC Backup Options [42908] October 16th, 2007 Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 1 of 17
BACKUP IS TIME CONSUMING AND THERE ARE GAPS IN PROTECTION Backup is an essential IT operation. Regular and frequent backups are necessary to help restore data and resume critical business operations in the event that data is lost, destroyed, or corrupted as a result of hardware and software failures, human error, or other misfortune. However: Backup is error-prone and time consuming to manage. Most backup applications do not report meaningful information when backups fail or complete with errors. As a result, administrators spend a lot of time attempting to determine and address the root cause of failures and errors. In addition, backup administrators must periodically conduct a full data restore and perform functional tests in order to validate that backups run correctly. Backup is capital intensive. The technology needed to support backup is extensive and includes backup application software, backup media servers, network infrastructure, automated tape libraries, tape drives, tape cartridges, and increasingly, specialized disk appliances such as virtual tape libraries. Firms often do not protect their PCs. Many firms focus much of their energy protecting servers that support mission-critical applications and do not backup corporate PCs. Given that critical corporate information is also stored on employee PCs, data loss from a PC hardware failure or the loss of theft of a PC can drastically impact revenue and employee productivity. 1 There are reports of lost or stolen laptops and desktops on an almost weekly basis. The most recent case, a laptop owned by the Pennsylvania Department of Aging was stolen from the home of an employee it contained the personal information on 21,000 senior citizens including names, addresses, Social Security numbers, and some medical information. 2 Offsite tape vaulting exposes the company to the risk of lost or stolen tapes. Most firms, even those who backup to disk initially, ultimately vault their backup data to tape and physically transport these tapes offsite for the purposes of disaster recovery or long term retention of backup versions. However, physically transporting tapes offsite risks tape loss or theft, leaving critical corporate data at risk of exposure unless you also invest in encryption technology. Firms often do not protect their remote offices. Once again, critical corporate information resides at the remote office and corporate IT has little insight into whether remote site backups are regular or successful and whether tapes are regularly taken offsite. In addition, there is also limited IT staff at the remote office to even manage backups let alone troubleshoot failed backup and restores. Remote office backup represents a huge risk exposure for firms today. As a result most firms are seeking to consolidate remote office backup in some fashion. Online Backup Is Software As A Service For IT Operations Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 2 of 17
Online backup has similar characteristics to other Software as a Service (SaaS) offerings in human resources (HR), enterprise resource planning (ERP) and supply chain management (SCM) (see Figure 1). Like these application solutions, online backup is an alternative to an on-premise software application, uses a multi-tenancy architecture and allows you to buy a subscription-based service. Why would firms use an online service for such a critical IT operation? For two reasons: 1) backup is a complex, expensive, and challenging IT operation; and 2) online backup is optimized to work over very limited bandwidth connections between corporate locations and the vendor s data center. Specifically, online backup service providers: Ensure backup integrity. With an online backup service, the vendor takes on the responsibility for ensuring the success of backups and restores. Vendors offer 24x7 support and often provide a web-based portal to view completed backups, view backup version histories, initiate restores, and run reports. Help you manage costs using a subscription-based model. For online backup service providers, the cost of building and maintaining the infrastructure to support the application is spread across numerous customers, allowing them to offer the service at a lower cost than would otherwise be possible. For a monthly service fee typically based on capacity, firms can avoid the investment, ongoing maintenance and upgrade of server, disk and tape infrastructure. Make PC backups easier and automatic. There are many online backup vendors that offer PC backup and even offer both PC and server backup. Some PC backup vendors such as Iron Mountain also offer PC encryption. The same software agent that is deployed on the PC to facilitate backup also facilitates the encryption of files. If a PC is lost or stolen, only an individual with the appropriate encryption keys can access the data. Eliminate the risk of transporting physical tapes. With online backup, there is no longer the need to physically transport tapes. Backup data is copied electronically over the wide-area network (W A N) to the vendor s data center. In addition, data is encrypted as it s transmitted to the vendor (encrypted in-flight) and it is encrypted at the vendor s data center (encryption at rest). Even the vendor cannot read your data. In addition, because the data is automatically stored offsite, it also provides some disaster recovery protection. Give remote offices the same protection as headquarters. By implementing an online backup service for remote offices, you can implement a consolidated remote office solution that provides for regular and automated backups without local staff or significant bandwidth it reduces risk of revenue or productivity losses. It may also reduce infrastructure requirements at the remote site such as the reduction of local tape systems and media servers. It provides for a disaster recovery solution because the data is automatically offsite. Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 3 of 17
database servers, firms can perform a local backup to a D V D or removable drive and then ship the data to the vendor in order to seed the first backup. Data reduction techniques reduce the amount of data transmitted over the WAN. Data reduction techniques such as compression and de-duplication reduce the amount of data to be transmitted over the W A N and hence the amount of bandwidth required to support online backup. Compression can reduce data by two to three times while more advanced de-duplication techniques can reduce data by 10 to 20 times. 3 Data reduction ratios will vary from firm to firm, much of it depends on data type and the amount of redundant data in the environment. Backups over the WAN really aren t difficult at all, the real challenge is restore. Restores of individual files and small backups are possible over the W A N, but restores of large backups over the W A N are more challenging. For large restores, the vendor will quick ship a D V D, removable drive, or N AS appliance to the customer site in order to conduct the restore locally. This means that in some cases, a firm s recovery time objective will be as long as 24 hours the time it will take to quick ship the media. For this reason, some firms will opt for a hybrid approach if it s available. Backups are performed locally to a disk appliance and then a second copy of the data is vaulted to the vendor s data center. Who Uses Online Backup Today? SMBs have been the early customers of online backup for both PCs and servers the services appeal to SMBs because typically they have limited IT staff, want to replace tape backups and also need to get their backup data offsite for disaster recovery. Based on Forrester client inquiries and advisories, large enterprises are increasingly interested in online backup but not to replace core data center backups of mission-critical and business-critical servers but in using online backup to backup corporate PCs and also to backup PCs and small servers at remote offices. Some enterprises with smaller data capacities might also use an online backup service for both PCs and critical servers. If they do so, they will probably take advantage of an online backup service that supports a hybrid approach where backups are first conducted locally to a disk appliance and then a second copy of the data is later vaulted to the vendor s data center. This ensures that the enterprise still has instant restore from a local target rather than wait for a quick ship of media (see Figure 2). Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 5 of 17
data stored in the United States could be subject to compliance with the US Patriot Act. For global enterprises, a vendor that has data centers in North America, Europe and Asia is critical not only to ensure compliance with data privacy laws but also for performance reasons. Expertise and support. It s important for the vendor to have expertise in advising and supporting firms in backup and recovery, particularly in the restore of business applications such as Exchange, ERP, CRM etc. Restoring an application isn t as simple as restoring a file. If you have a challenge restoring one of these applications, it s best to have support from a vendor that has a history of supporting these restores and staff who have training and certifications. The vendor should monitor your service 24x7 and offer in-region technical support. Customer references. Customer references provide evidence of customer satisfaction with the service as well as the expertise and support of the vendor. Rather than generic references, focus on references from within your industry or geography or from a customer with a similar environment and size. Additional services. What's the vendor's larger strategy to deliver online infrastructure services? While you may be only interested in online backup today, you may be interested in other services in the future. It s best to select a vendor who can support your future requirements. Several Pricing Models Are Available All online backup services are subscription services that follow some kind of usage based pricing, but there are nuances in the pricing models. Each has its advantages and disadvantages. Price per production capacity. In this model, the vendor charges a fee for each gigabyte of capacity per machine per month. For example, if you have a file server that has 100 GB of capacity, you are charged to protect that 100 GB each month. Sometimes it is a combination of a license fee per machine plus a price per gigabyte of storage. This pricing model is straightforward and transparent. You know how much capacity you have on each machine in your environment and so you re not surprised or confused by your bill at the end of the month. The disadvantage is that aside from a reduction in bandwidth requirements, you re not seeing any of the benefits of capacity optimization techniques such as compression and deduplication. Price per vault capacity. In this model, the vendor charges a fee for each gigabyte of capacity that is stored at their data center. The benefit of this model is that the vendor charges you for capacity after data has been compression and de-duplicated. For example, if you have a file server that has 100 GB of capacity and you achieve at least two times compression ratio, the vendor would only charge you for 50 GB for the first full backup. If the vendor supports deduplication, they would charge you even less. The difficulty with this model is that billing is much more complex. Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 9 of 17
For either model, the pricing for online server backup today is about $7.50 per gigabyte per month and PC backup is $3-$5 per gigabyte per month. All vendors offer discounted pricing for large scale environments. Vendors also offer contract terms of varying lengths, from no required contract term to as long as five years. Vendors will certainly offer more competitive pricing for longer contract terms but it s not worth locking into anything longer than two to three years as prices continue to decline in this market. THE VENDOR LANDSCAPE FOR ONLINE BACKUP IS BUILT ON ACQUISTIONS As with an emerging and rapidly growing market, there are emerging vendors who have blazed the trail and large vendors joining the market either through acquisition and or their own technology development (see Figure 4). There have been a number of acquisitions in the online backup market as vendors strive to gain a foothold in this critical marketplace. IBM gets into the online backup business through acquisition. On December 6th, 2007 IBM Global Technology Services announced its acquisition of Arsenal Digital Solutions, a major player in the online backup service provider market. Arsenal not only provides online backup services to customers directly but also to other service providers particularly telecommunication providers who then re-brand and resell Arsenal s online backup services as their own. Arsenal is profitable, cash flow positive and has not required funding since 2002. It has approximately 3400 customers. IBM did not disclose the value of the acquisition. It s important to note that IBM Global Technology Services made the acquisition, not IBM Tivoli or IBM System & Technology Group. This acquisition is not about filling in a product gap or feature gap in IBM Tivoli Storage Manager (TSM). In fact, the engine of Arsenal s service is EMC Avamar what Arsenal provides is a SaaS wrapper around Avamar, everything you need for SaaS such as multi-tenancy, billing, and reporting. Seagate and EMC bought their way into online backup also. In December 2006, Seagate Technology acquired EVault for $185 million and in October 2007, EMC acquired Berkeley Data Systems (the company behind Mozy) for $76 million. It all really began however, with Iron Mountain s acquisition of LiveVault in 2005. It was necessary for EMC to acquire Mozy or for Symantec to develop a new technology platform for the Symantec Protection Network despite the fact these vendors have their own backup application software EMC Legato and Symantec Backup Exec and NetBackup. It s not always possible to take software designed for premise-based deployment and use it to support a SaaS offering. SaaS service offerings rely on software such as Asigra, EVault, and Iron Mountain s LiveVault that were developed specifically for the SaaS delivery model. Symantec is developing a new platform for online backup services. Symantec launched the beta version of its Symantec Protection Network in the spring of 2007 and will not officially launch the service until early 2008. Rather than launch the online backup service immediately, Symantec Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 10 of 17
wanted to develop a core platform that would provide a single customer portal for registration, management, support, billing for not only online backup but all future SaaS offerings. Vendor Segmentation Forrester segments the vendor landscape into the following categories: Disaster recovery service vendors. These are vendors that offer traditional fixed-site disaster recovery (DR) services such as HP Services, IBM Business Continuity and Recovery Services, and SunGard. By adding online backup to their portfolio of disaster recovery services, they can expand to serve small and medium businesses and also offer another recovery option to enterprises. These vendors are focused on expanding and deepening their availability and recovery offerings. Information management and protection vendors. These are vendors that offer online backup but also will offer other information management and protection SaaS offerings such as endpoint security, archiving, and online records managements. Vendors include EMC, Iron Mountain, Seagate Services, and Symantec. Telecom-based vendors. Global telecom vendors such as A T&T and BT as well as national players such as Qwest and Verizon are continually looking for new services that complement their existing network offerings. They are in a good position to offer infrastructure SaaS offerings because they have extensive global networks and data centers and already possess vast customer bases that consume network-centric services. Finally, they know how to price, deliver and manage services in a competitive environment. Pure-play backup vendors. Vendors like BitLeap, Carbonite and Intronis will concentrate on primarily on online backup services for consumers, home offices and small and medium businesses. They may expand into archiving but not likely to expand into other information management and protection services. Specialized vendors. Vendors such as AmeriVault, who focuses on small and medium businesses in the US or an Eze Castle Integration that focuses on midsize financial services firms in the Northeast will license SaaS enabled software to create their own suite of online backup and disaster recovery services. They typically focus on a particular market segment such as small and medium businesses, specific regions or specific industries such as financial services or healthcare. OEM-focused suppliers. OEM-focused vendors may or may not be service providers themselves but they have a large business based on licensing their technology to other vendors. This includes vendors such as Asigra and Remote Backup Systems who are only technology providers. It also Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 11 of 17
includes vendors who are service providers themselves such as Iron Mountain LiveVault, Seagate Services (EVault), and MessageOne. Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 12 of 17
Develop a cost comparison of a premise deployment versus a service. There are numerous benefits to online backup but at the end of the day IT operations has to convince senior management that it is not only the best solution but the most cost effective one. Quantify the costs of an internal deployment by considering the costs of software licensing, capital acquisition of media servers, networking hardware, disk appliances, and automated tape systems, maintenance fees and labor costs. Also consider the cost of future software and hardware upgrades and the migration and conversion costs associated with backwards read/compatibility and technology obsolescence. The more you can build a detailed cost comparison together with the technical benefits and justifications the easier it will be to make the appropriate decision. W H A T I T M E A N S ONLINE BACKUP IS JUST THE FIRST STEP IN IT OPS-FOCUSED SAAS Online backup is just one SaaS solution that might appeal to IT operations. What do data backup and archiving have in common? They both are IT operations that companies are compelled to perform because of necessity, regulatory compliance, legal risk, or corporate policy, they are capital, labor, and time intensive to deploy and maintain and at the end of the day they provide little competitive differentiation. There are already several online email archiving services but today these are standalone SaaS offerings from specialists such as MessageOne and ZANTAZ. In the future, vendors will offer a suite of SaaS offerings related to data protection and data management such as online backup, disaster recovery, archiving, and security. Iron Mountain is the furthest along in the realization of this vision. The company offers PC backup, PC encryption, server backup, disaster recovery support, email continuity, email archiving, and online records management. There is also a set of SaaS offerings for IT service management services that deliver functionality such as Information Technology Infrastructure Library (ITIL) incident management, change management, release management, configuration management etc. Vendors such as Servicenow.com focus specifically on IT service management SaaS offerings. Ideally, the vendor would support these services with a common technology engine but today, these services, even when offered from the same vendor, are standalone services the vendor must deploy separate agents on each PC or server, the customer must set up the policies for each service in separate web portal and the customer likely receives separate invoices for each service. Iron Mountain offers consolidated invoicing across some of its product lines and services and has plans to expand its consolidated invoicing capabilities in 2008 as well as to integrate portals. BT is able to offer consolidated billing for its network and online PC backup customers. Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 16 of 17
Companies Interviewed For This Document Arsenal Digital Solutions Asigra A T&T Berkeley Data Systems BitLeap BT Carbonite EMC EVault IBM Intronis Iron Mountain Remote Backup Systems Seagate Services SunGard Symantec ENDNOTES 1 Some of the most valuable information in the company actually resides on individual PCs not just on wellprotected servers in the data center. A lost or damaged PC, a failed disk drive, or even just an accidental deletion can lead to lost revenue, lost customers, lost market share, and a drastic decline in worker productivity. See the October 16, 2007, The Universe of Corporate PC Backup Options report. [42908] 2 Source: Jan Murphy, Stolen laptop holds data on seniors, The Patriot-News, December 19, 2007. 3 Deduplication eliminates the storage of redundant data; depending on the environment, the amount of redundant data can be significant (imagine all the duplicate files, duplicate data within files, and duplicate data in database and email stores across the organization). Backup vendors with deduplication technology are claiming deduplication ratios of 20:1 or more. See the July 23, 2007, Will Data Deduplication Finally Make Disk As Cheap As Tape? report. [42752] Printed by Rachel Dines 28-Dec-07 10:37 AM 42947.doc Page 17 of 17