UBISTOR WHITE PAPER: Reducing Corporate Risk: Best-practices Data Protection Strategy for Remote and Reducing Branch Corporate Offices (ROBOs) Risk: Best-practices Data Protection Strategy for Remote and Branch Offices (ROBOs)
Table of Contents Introduction 3 Data Recovery Challenges of ROBOs 4 Elements of a Disk-to-Disk Data Protection and Recovery Plan 5 Choosing a Disk-to-Disk Backup and Recovery Plan 7 Backup and Recovery in a 24/7 Culture 8 2
Introduction It was a major lawsuit and the insurance company was confident it had complied fully with the regulation in question. But a mandatory litigation preparedness meeting is approaching fast, and the company s three Midwest offices can t find the records demanded by the court. The reason: the records were kept on a server that crashed and the backup tapes were lost. A bank branch in Mississippi loses critical data when the computers are damaged. A major customer decides to terminate its account because the bank is taking too long to respond to requests for the account status. The reason: the backup tapes are stored at the bank s headquarters in North Carolina, but it will take a week to find the right tapes, ship them to the bank, and restore the files. It s a busy day at the medical clinic, but everything stops when a call comes in from a distraught mother, asking what drug had been administered to her son now seriously ill the day before. The entire clinic stops work and searches, but simply can t find the boy s electronic file. The reason: a power surge shut down the computer last night, and the technician hadn t saved the file. Backups only take place at night, and the surge took place before the scheduled backup. The risks of losing critical data are daunting and dangerous for banks, credit unions, insurance companies, health care providers, retailers, and other businesses with remote and branch offices. The remote/branch office (ROBO) can be a competitive differentiator for a business, but it can be uniquely vulnerable in the event of system failure or employee malfeasance. Worse, a data systems failure or loss of critical data can create organizational risk that goes beyond the branch office level. Regulatory compliance, business continuity, and litigation preparedness all may be put at risk for the parent company if critical data is lost at even one remote office. Yet remote offices, outfitted with high-performance hardware and software, are often left without data protection, backup, and recovery processes of comparable quality to those at the headquarters office and, as a result, can leave business-critical data dangerously exposed and place the business at risk. This white paper examines the vulnerabilities of today s remote and branch office IT landscape, and details the advantages of a disk-based backup and recovery strategy for managing, and protecting, the data contained in these systems. 3
Data Recovery Challenges of ROBOs The data protection challenges that face ROBOs those that exist at the edge of enterprise computing can be many and varied. Data protection, backup, and recovery may be staples of enterprise IT policy, but they pose challenges to ROBOs that require special solutions. More data, limited resources, and less time ROBOs typically face a myriad of data protection issues: Increasing data traffic and volumes Remote-office workstations and servers have evolved from centralized and client-server systems to become complete mini-data centers in their own right, handling more data by the day. More data means a greater potential for vulnerability, as well as more time and effort required for backup and recovery. Limited IT resources ROBOs may be equipped with powerful customer-facing technologies, but often they are faced with few choices for data backup and recovery. For local backup, employees may resort to consumer-quality backup systems, but such products are slow and less than robust in their recovery techniques. Remote offices may send overnight batches for tape backup by the enterprise data center, but this grows more difficult, and risky, as data volumes increase. Security, Reliability, Productivity Tape backups performed on-site at the ROBO, present security and reliability challenges. This approach forces businesses to rely on the local ROBO staff to perform the backups. This means reliance on manual processes inserting and loading and ejecting the tapes and then having a service pick them up and transport them offsite for secure storage. Tapes can be mishandled, mislabeled and accidentally overwritten; or backing up can simply be forgotten, placing the company at risk in terms of business continuity and compliance. Additionally, having employees at the remote sites manage backups impacts other tasks they could be performing for the business. Backing up over-the-wire to tape at headquarters can also present security and reliability issues as the data may not be encrypted in order to save time and storage space. 4
Increasing compliance, litigation activities Because remote offices often deal with sensitive customer-related or industry-confidential information, they can be on the front lines of lawsuits or compliance challenges. The enterprise may have the infrastructure in place to respond to a lawsuit, but the entire business can be at risk if a remote office is unable to produce relevant data data that might be lost to poor backup and or recovery techniques. Elements of a Disk-to-disk Data Protection and Recovery Plan A data protection and recovery strategy for remote offices must take into account these challenges, and should be consistent with the business objectives and the IT principles of the parent company. Without such a strategy, or with enterprise-level inaction, remote offices are left to their own devices, exposing the business to risk. Tape Backup Too Slow for Dorset County Council The Dorcet (UK) County Council recently moved from tape-based to disk-to-disk backup and recovery for their several dozen remote branches and satellite offices. The Dorcet County Council, which oversees education, health, highway management, libraries, services for the area, found disk-based backup/recovery to be faster and more cost-effective than their tape-based systems, according to Gary Phipps, an IT analyst with Dorcet. Data volumes were increasing of course, but our two main problems were the time it was taking to back up to tape and the fact that many of our remote sites had their own tape backup systems but were often recording over the same tape every day making recovery of information older than 24 hours impossible, he said. Now, he says, Dorset County Council remote sites can be backed up quickly and their data is protected as we can now recover older data and we can do so very quickly. The overall cost-effectiveness of moving to a disk-based system and the increased level of automation means that backup and recovery have been transformed into pretty straightforward activities, leaving us free to focus on delivering better services in other areas. Centralized, automated, and offsite To start, the remote-office backup and recovery strategy should adhere to three principles: it should be centralized, automated, and include offsite storage. 5 Centralization is important because it ensures consistency, in everything from frequency and timing of offsite backups to overall backup-recovery policy. Automation supports centralization, and smoothes operation, by removing administrative chores from employees. Offsite backup is essential for data protection; local backups might take place every hour, for instance, but at least
once per day all files should be backed up to one or more offsite facilities, in order to mitigate against the risks of fire, theft, or other threats to the building. Choosing disk over tape A disk-to-disk backup and recovery architecture offers substantial benefits. It uses adaptive compression techniques to reduce data at the source, and to de-duplicate data at the storage vault. It reduces the backup window the time necessary to transmit and it maximizes security while minimizing bandwidth requirements. Moreover, disk-based backup offers these advantages: Offsite backup time savings Disk-to-disk technology can cut the time it takes to perform offsite backups by two-thirds or better over conventional tape systems. This is largely because of its inherent advantages in data compression, and its ability to perform block-level updates, and so limit the actual backup transmission to only the data that has actually changed during the day. Greater reliability The savings in transmission time translates to a greater likelihood of success, since it reduces exposure to the possibility of network spikes or outages. The alternative, sending the tapes themselves for offsite storage, runs the risks associated with transportation: tapes may be lost, damaged, or stolen in transit. Additionally, tape suffers from inherent technical disadvantages, which greatly reduce reliability industry experts note that 30 percent or more of tapes cannot be restored due to improper backups or tape failure. Tape backups are also a manual process, relying on people to insert and eject tapes, properly labeling them and shipping them offsite. Disk-to-disk backup is more reliable because it is completely automated. Backups are automatically scheduled and performed and files are instantly accessible. More timely backups Disk-based backup solutions that allows each remote office to maintain both its own storage onsite and that simultaneously replicates to an offsite location is ideal. This approach enables each office to benefit from LAN-speed backups. Because the office is saving to local device, it is possible to have more frequent backups than one nightly backup. That way, data is fresher, providing more frequent recovery points (RPOs), and so more useful in the event that a recovery becomes necessary. In addition, data is safe for disaster recovery purposes because it is replicated to an offsite storage location. Faster, simpler recovery Disk storage is inherently more flexible, and more easily organized than tape storage, which is linear in form. As a result, disk systems can apply a higher level of intelligence to recovery mechanisms in order to simplify the process for the user. 6
When it comes to recovery, the difference can be significant. Tape recovery typically requires a half-dozen manual steps, from delivery and mounting of tapes to locating sequentially-stored data and unloading each tape to get to the next one. With a disk-based system, the system administrator simply uses the graphical management console to select the files and folders, and then calls for the restore. In a medium-to-large remote office, the difference could be five minutes for disk; two hours for tape if the tape is onsite. If the tape is at a warehouse, it could take days or even weeks to locate the tape and make it available for the backup impacting business continuity. With local storage at each remote office, recoveries can be further speeded up, as data is recovered at LAN-speed, providing a faster recovery time objective (RTO). Cost savings Tape-based backup requires specialized hardware, software, employee skills, and potentially extra transportation and security costs. By contrast, disk-based backup and recovery can be administered as a managed service that uses existing system resources. Also, incremental tape backups tend to grow larger, faster, than disk-to-disk backups, so the cost of tape hardware increases more rapidly over time than with disk. Security The security and privacy of customer data is critical. All too often, tape-based backups are not encrypted in order to save time and storage space. Disk-to-disk backup provides end-to-end data encryption: the data is encrypted during backup, in transit over-the-wire and in storage. This protects the customers identity, eliminating the chance for unauthorized access to personal data such as credit card information, social security numbers, and financial or medical records. The end-to-end data encryption benefits associated with disk-to-disk backup also prevents the company from being exposed to brand risk. All too often it is possible to read a story in a newspaper about a business that had its unencrypted tapes stolen from the office or while in transit. This puts customer data at risk and exposes the business to a potential nightmare of litigation and compliance issues that impact the integrity of the brand and the reputation of the business. Choosing a Disk-to-disk Backup and Recovery Strategy With a disk-based backup and recovery architecture, you can set strategy according to your own needs and priorities, rather than those of the hardware resources and network limitations. First and most important, you should determine which backup/recovery computing style, whether traditional, hybrid, or fully outsourced, suits you best: Traditional. Your parent company purchases and manages the entire backup-recovery system. This suits a larger company with an in-place IT infrastructure that can install, maintain, and oversee the entire system and its remote-office topology. 7 Hybrid. Your parent company purchases the backup-recovery system, but outsources management, maintenance, and support, to the equipment vendor. This reduces the administrative overhead for system support, and frees your employees to concentrate efforts on your core competencies.
Fully outsourced. You outsource the equipment and the management to an online vendor, and subscribe via a software-as-a-service (SaaS) model. This is ideal for a smaller company that wants to preserve capital, or for a company facing a high growth rate of remote offices. The next step is to deploy a prototype as a means of testing the strategy and gaining experience with the disk-to-disk architecture. For the prototype, it s best to start with a critical application, and to run the disk-based backup and recovery system in parallel with your existing methodology. That way you can compare the two, and run recovery tests, before you fully switch over to the new system. Backup and Recovery in a 24/7 Culture Today s businesses have greater access to customers, markets, and geographies than ever before, thanks to the speed and abilities of networking and IT systems. But greater access also comes with greater challenges. Businesses live in a 24/7 environment, with remote offices, call centers, product development teams often working around the globe and around the clock to do their jobs. In terms of business continuity and compliance, the information generated at these facilities is as important to the business as the information generated at the headquarters office. For remote and branch offices that rely on their IT systems, data backup and recovery are more critical than ever before, too. But data backup and recovery are challenged by smaller backup windows, and proliferating data sources. The best solution for these offices is a centralized backup and recovery strategy that employs disk-to-disk technology. Such a strategy reduces the time needed for higher data volumes, improves reliability over older methods, and eases costs and puts remote offices in an ideal position to take advantage of the unique opportunities of today s and tomorrow s markets. 8 North America 1111 Plaza Drive, Suite 600 Schaumburg, IL 60173 United States 866.312.STOR toll free www.ubistor.com 2008 UbiStor E-WP-01-0508-e