IDC research shows that the top 5 concerns among medium-sized businesses are:

Global Headquarters: 5 Speen Street Framingham, MA 01701 USA P.508.872.8200 F.508.935.4015 www.idc.com SPECIAL STUDY Managing Risk in Medium Sized-Businesses: A Storage Software Solution Duncan Brown IN THIS SPECIAL REPORT IDC research shows that the top 5 concerns among medium-sized businesses are: Reliability and up-time. Security. Performance. Software cost. Privacy. Despite these concerns, medium-sized companies are not deploying sufficient resources to protect their data. This is mainly due to the misperception of today's technology capabilities, and a lack of understanding of the tangible cost-benefit business case that accompanies modern backup and storage software solutions. In this special report, IDC highlights the key issues for medium-sized businesses: It is vital to recognise the multiple sources of risk, and plan accordingly. The worst thing a company can do is to underestimate risk. They must identify risks, measure them, and take appropriate action. Technology available today can reduce exposure to risk, increase regulatory compliance, and lower overall IT costs. IDC Recommendations: Understand the potential impact to your business from data loss Measure the value of data, and manage it accordingly Determine the life cycle of each type of data all data is not equal Store/backup data according to its life cycle needs Define a backup process for your organisation and then use it Include laptops in your backup policy Manage the storing and use of non-business data, such as MP3s Identify and archive redundant data Understand your legal and regulatory obligations for data management Filing Information: September 2004, IDC #SR15L : Special Study

INTRODUCTION IT'S ALL ABOUT RISK What would happen if your IT didn't work? Try switching off your PC. Now try planning for the next board meeting, or retrieving last month's sales data, or completing this month's accounts, or communicating with all of your staff, or tracking your competitors, or servicing your customers. The fact is that most medium-sized organisations (100 250 employees) have made IT an integral part of their business. They reap the considerable benefits offered by IT, including improved operational efficiency, lower costs and access to a wider market. IDC research shows that 33% of organisations do not have a business continuity solution in place, citing budget constraints as the main inhibitor Unfortunately it is also true that most organisations do not apply appropriate prudence when it comes to protecting their IT investments, and their data in particular. It is a widely held perception that protecting data is expensive, in terms of technology infrastructure, skills required and time consumed. Such organisations are playing a dangerous game. In today s business environment, acceptable downtime is measured in seconds and data loss is not permissible. The cost of downtime can be as high as 34,000 per hour for medium-sized businesses, once lost revenue, lost productivity, employee costs and remedial expenses are factored in. IT now encompasses continuous availability and has to include all devices, networks, applications, people, and data to keep information online in the threat of "disasters" of all kinds. The cost of downtime can be as high as 34,000 per hour for medium-sized businesses What Are the Risks? The sources of risk to businesses are ever increasing. There will be no let-up in the ingenuity of the criminal, in the carelessness of some staff, in the impact of incoming regulation, or in the weather. The effect of a data loss on a firm increasingly impacts the profitability of that company. Data is at risk from a variety of sources: Security violations Businesses worldwide have seen wave after wave of security attacks continue to increasingly affect business productivity. Viruses and worms, denials of service and the compromise of sensitive data have led to productivity problems, customer service issues and legal liability debates. Regulatory compliance A series of changes in regulation, such as data privacy/regulation, and industry accountability, such as maintaining audit trails, are introducing strict controls on many businesses operations. Penalties for noncompliance from data loss can range from fines and lawsuits to loss of trading licenses. Fines for non-compliance of data protection legislation are typically 7,500, and can be unlimited High availability Many medium-sized businesses must be available 24 hours a day, 365 days a year with mission critical information residing throughout the organisation on various distributed sites. Data loss has a direct and immediate effect on business performance. Technology dependency and complexity The proliferation of mixed hardware and software IT solutions creates a management and administrative nightmare. Dependency on computers and networks is inevitable, but leaves firms exposed to high management overheads, system failure, and unpredictable power surges. 2004 IDC #SR15L 1

Disasters and contingent insurance Disasters do happen, whether man-made or natural, large-scale or localised. Many insurance companies now insist on (or weight premiums in favour of) rigorous data backup and recovery capability. Staff negligence Protecting data would be more straightforward if people were not involved. Unfortunately, this is rarely the case, and backup processes depending solely on people tend to be poorly implemented. Insurance companies state that 32% of data losses are caused through human error. 32% of data losses are caused through human error What Must Companies Do? It is important to understand that business continuity is a business issue and not just an IT issue. In planning business continuity, a company has to bridge the gap between business strategy and IT strategy, addressing both IT and non-it components and their interdependencies. Business continuity is not just an IT function or responsibility but must take into account business processes, facilities and people. This includes not only natural or man-made disasters or malicious viruses or other attacks, but also company strategy such as mergers and acquisitions. Such events can impact on the company infrastructure and lead to the inability to carry out normal business processes. FIGURE 1 Western Europe Business Continuity Purchasing Factors Data security Virus attack Risk of software/hardware failure Failure of internal data backups Risk of power cuts/surges Increased use of networks Risk of security breaches Fire/flood risk Insurance requirement/insurance cost saving Increased risk of human error Risk of theft Dependence on ebusiness Threat of terrorism Risk of labor strikes 0.0 0.5 1.0 1.5 2.0 2.5 3.0 3.5 4.0 (Ranking) Source: IDC, 2003 2 #SR15L 2004 IDC

Planning for business continuity is all about weighing up the business risks. The only way to do this is to conduct a business impact analysis. Business continuity is all about staying in business: if the firm does not have a plan and something happens, it could be out of business completely. The worst thing a firm can do about risk is to ignore it. Companies must respond to risk by facing up to it and take appropriate action: Conduct an audit of the environment (servers and applications) to determine the potential areas of vulnerability. Determine the potential impact to the business caused by downtime and/or data loss. Look for tangible and intangible costs. Decide the acceptable level of downtime and/or data loss. Compare the financial risk of downtime and/or data loss against the cost of appropriate protection. Technology can help in reducing exposure to business risk. A recent IDC survey showed that organisations use technology to address a variety of business risks. MANAGING RISK THROUGH TECHNOLOGY Risk Mitigation Reducing Vulnerability You can start to reduce your organisation's vulnerability to multiple sources of risk simply by backing up your data. Unfortunately, backup processes can be timeconsuming, requiring daily administration. They can be technically complex in deciding what to back up and to where. They are also perceived as requiring costly hardware, such as tape drives and complex storage architectures. Support of IT can incur a significant cost, and any technology that reduces this cost, while adding tangible benefit to the business, must be considered seriously. The Solution Modern Windows-based backup solutions are easy to implement and operate with easy-to-use wizards to navigate backup processes and options. Once they are set up, they will back up your organisation's data automatically, with minimal supervision and maintenance. Backup solutions can also incorporate automated laptop and desktop protection. These features allow for the synchronisation of desktop and laptop data when connected to the network. This means that data can be stored locally to the end-user, but protected centrally. End-users can even restore their own data, again reducing support and maintenance costs. Up to 60% of a company's data may be stored on a laptop or desktop, with no backup provision Importantly, backup solutions should not require additional hardware to be purchased. Data can be backed up to existing servers, desktops or laptops, removing the need to buy tape devices and complex storage architectures. 2004 IDC #SR15L 3

All of this technology can be implemented across multiple office sites. So if you have a network of offices, all of your company data can be backed up centrally. This reduces the need for backup capability at each site. Risk alleviation recovering from data loss Backups are like insurance you hope you'll never need them. But if the worst happens, you want remedial action to be swift and painless. Recovering servers from backup tapes, however, is often perceived as complex and time consuming, requiring skilled administrators. There will be multiple tapes containing operating systems, application software and data files, which must be restored in the correct order. Get the order wrong and you may have to start again. Meanwhile, your business suffers. The Solution Recovery from backup doesn't have to be this way. Today's sophisticated backup solutions restore systems to their prior state in a single smooth process. There is no need for a collection of tapes and multiple reboots. The single process also eliminates the scope for errors by administrators. In fact, no skilled administration is required. The whole recovery process can be conducted in an automated manner. Clearly, this approach is much faster to restore data. Added to this, reduced complexity, accurate restoration of data and easy administration all help to keep costs down. Risk Management Continuous Improvement How much of your data do you really need? IDC research shows that, for the average organisation, between 30% and 80% of stored data has no current business use. Much of the data on systems is out-of-date, duplicate or not related to business (such as file types like mp3, jpg and so on). IDC research shows that, for the average organisation, between 30% and 80% of stored data has no current business use Yet typically, 100% of this data is backed up. This means costly and wasteful use of IT infrastructure. It may also mean contravention of software licensing arrangements, data protection laws and other regulations. Exposure to viruses from files sourced from the Internet and email increases the longer they are stored on systems. Infrastructure costs are also artificially high, as hardware resources are consumed by ever-increasing amounts of data. All in all, IDC estimates that data management can absorb up to 55% of storage costs. The Solution IDC estimates that data management can absorb up to 55% of storage costs A state-of-the-art data storage solution can inhibit risks associated with poor management practices. Modern solutions allow for the identification of non-business files, enabling swift deletion and automatically blocking offending file types. They can also detect files that have not been accessed recently, are duplicated, or may be elicit copies of applications. 4 #SR15L 2004 IDC

The consequence is a one-time overall reduction in data stored. Continuous monitoring of the environment, typically using quota management, inhibits recurrence of the problem. Backup and restore times can therefore be reduced substantially, along with the associated media costs. Removing nonbusiness files and duplicate data alone can eliminate 20% of storage media costs A large proportion of the remaining data will be information that is required to be kept as a business record, but is not required to be in the frontline application. Physically archiving this information removes it from the continuous backup cycle yet protects its long term availability, providing benefit to the backup and information retention functions. Risk of infection from viruses is reduced, as potential problem file types are instantly identified and quarantined. Duplicate or illegal software applications are also removed, reducing the risk of regulatory compliance contravention. Hardware resource costs are also reduced, since more free space is released for legitimate business purposes. Sophisticated data life cycle management (DLM) technology marks data according to its type, usage and importance. Data can then be stored in the most appropriate place: online for immediate access, nearline for important but rarely accessed data, and so on. Once policies for different data types are defined, DLM automates the process. DLM enables a long-term view of data management, ensuring regulatory compliance over the lifetime of data, while making best use of storage resources. One of the most obvious places to benefit from such technology is in email archiving. Data management costs can be reduced from 55% of the storage budget to 15% By using modern data management technology, data management costs can be reduced from 55% of the storage budget to 15%. An Industry Example VERITAS Software One company that is addressing these issues is VERITAS Software. VERITAS offers a comprehensive data storage and management solution that enables an organisation to store and protect its data in a manageable and cost-effective manner. It combines easy-to-use backup capability with data recovery and data management technology to reduce risk and data storage costs. There are seven main components in VERITAS's solution: VERITAS Backup Exec for Windows Servers The cornerstone to the VERITAS solution that allows fast and easy-to-use backup and restore capability on the Windows platform. The Desktop and Laptop option allows automated protection of locally-stored end-user files by ensuring they get backed up centrally. VERITAS Storage Replicator Adds to Backup Exec for Windows Servers by enabling centralised backup of data from remote sites without the need to invest in local hardware and people at those sites. VERITAS Intelligent Disaster Recovery A single process server recovery solution allowing the fast and reliable restore of downed servers, both locally and remotely, with minimal human intervention. 2004 IDC #SR15L 5

VERITAS Storage Foundation for Windows with the FlashSnap option Allows for the creation of "point-in-time" snapshots that are copies of mirrored data volumes on the server. These snapshots can be easily moved to another server for backup or other purposes such as testing or data mining. Snapshots may also be kept on the same server for rapid recovery from data loss. VERITAS StorageCentral A data management solution that separates valid business data from personal files, illegal software copies and other problem file types, reducing the overall amount of data to be managed. It also has quota management capabilities to slow down data growth and save money on storage investments. VERITAS Storage Foundation Allows storage capacity from multiple vendors to be centrally managed to increase storage capacity utilisation and to simplify management. KVS Enterprise Vault Recently acquired by VERITAS, KVS provides an information management solution that uses policies and rules to archive from a variety of applications into a central repository that can be managed across a variety of storage devices. Data can be retrieved by the user, on demand through a variety of non-intrusive direct links, or through comprehensive search capabilities. KVS Enterprise Vault provides a complete archiving and discovery solution. CHALLENGES FOR VERITAS Although business continuity affects the business of an organisation, storage and backup software solutions are seen largely as being in the technical domain. This misperception means that responsibility is typically handed to the IT manager or office manager, who often must fund data management and protection from a diminishing IT budget. This tends to support the procurement of point products, rather than holistic solutions. Proving the value of a robust data backup, recovery and management solution is like asking for a leap of faith its success is often invisible to the company. Improving visibility of the importance and vulnerability of data at the business level must, therefore, remain an ongoing campaign. IDC therefore believes that VERITAS must support decision makers in user organisations in understanding the true value of their data, and their exposure to risk from data loss, in order to support the change to a holistic approach to data resilience. 6 #SR15L 2004 IDC

CONCLUSION This special report, commissioned by VERITAS, has investigated the reasons behind organisations being slow to deploy sufficient resources in order to protect their data. IDC can conclude that business leaders are still misunderstanding current technology capabilities and TCO/ROI potential, thus leaving their organisations open to significant risk. In today's 24 x 7 business environment, IDC believes it is vital that companies do the following to ensure minimum negative impact to their bottom lines: Conduct a risk assessment of your operation understand where the risks lie and how you currently protect against them. Conduct a business review including your IT department in today's business environment IT managers can be the key to lowering IT costs while ensuring security and regulatory compliance. Use the results to calculate the acceptable level of downtime this can aid you to understand the risk/benefit equation of protecting your organisation better. Copyright Notice External Publication of IDC Information and Data Any IDC information that is to be used in advertising, press releases, or promotional materials requires prior written approval from the appropriate IDC Vice President or Country Manager. A draft of the proposed document should accompany any such request. IDC reserves the right to deny approval of external usage for any reason. For further information regarding this document please contact: Marketing Department Tel: +44 (0) 20 8987 7100 Copyright 2004 IDC. Reproduction without written permission is completely forbidden. 2004 IDC #SR15L 7

IDC is a subsidiary of IDG, one of the world s top information technology media, research and exposition companies. Visit us on the Web at www.idc.com To view a list of IDC offices worldwide, visit www.idc.com/offices IDC is a registered trademark of International Data Group