To read the industry news is to be reminded, almost daily, that backup tapes occasionally get lost on their way to offsite storage. And against a backdrop of growing concern over identity theft and protection of consumer privacy, those losses carry ever more dire consequences.
One solution to the problem is to encrypt tapes, at the cost of more backup and restore complexity. A second solution is to forego the transport of tapes altogether and to send encrypted backups over the network directly to an offsite location. Online backup services offered by companies such as EVault, Arsenal Digital Solutions and a number of others do just that, and they are obviously attractive to smaller businesses that may lack the in-house storage expertise required to automate and monitor backups, let alone handle backups of sensitive information.
Will lost tapes reported recently by the likes of Iron Mountain, Ameritrade, Bank of America and Time Warner drive larger organizations in the direction of online backup services too? Doug Chandler, program director at IDC, doesn't think so.
"I don't see customers moving in droves to a different model because of that," says Chandler.
Instead, he points to a second path that leads enterprise customers to turn, in a more limited way, to online storage providers. "There are two value propositions," he says. "One is we can take the trucks out of the picture and do it for less. The other is, instead of trying to replace something that you are already doing, we can get that branch office backed up. And you haven't been able to do that."
SMBs, Branch Offices Have An Answer
Getting that branch office backed up is an elusive goal for many larger corporations. In backup, enterprises often face in remote offices the same problem that small businesses face — in a word, lack of experienced storage management staff.
Tony Barbagallo, senior vice president of marketing at EVault, says data protection efforts at remote locations are often "haphazard at best." And, he says, branch office data can be as or more sensitive than data stored at the primary data center. "A lot of customer data is actually stored at the branch offices, so you need to have some level of expertise," he says.
Frank Brick, chairman and CEO of Arsenal, says that half of his company's active prospect base are large businesses, and that backup of branch offices is their number one concern. They cite the "relative unreliability of low-end backup solutions for their remote locations" in seeking to outsource backup tasks for these offices.
SMBs remain a large part of the customer base for online backup service providers. Barbagallo says EVault has the most traction among customers of around 20-500 employees, backing up 200-300 GB compressed over the network, or, at the "higher end of S and pushing into M."
The key differentiator between companies that successfully back up data in-house and those that choose managed online services is, not surprising, a focus on storage management. "Our best managed-solutions customers are mid-market customers where data protection isn't, and shouldn't be, a core competency," says Barbagallo. "Data protection for those IT staffs has always been a side job."
Smaller customers of Arsenal's are often from regulated industries. "In the SMB sector, we're seeing the greatest interest from small banks, small financial institutions, law firms, and medical practices," says Brick. For these customers, the challenge of dealing with privacy and retention regulations, such as HIPAA, compounds the complexity of server backups and is a big factor in favor of outsourcing.
Media Firm Takes the Plunge
Red8 Studios, a media production company with offices in Los Angeles and Shanghai, is a smaller Arsenal customer that chose an on online backup service for another reason: location.
"We need to back up our media files from our Shanghai office because that's where most of our production is actually done," says Randy Shiozaki, an executive producer at the company. "What we were doing in the past was buying relatively inexpensive firewire drives ... but people weren't always following the protocol."
So Arsenal's ViaRemote product helped to automate the process, and, just as important to Red8 Studios' clients, it ensured that their data was backed up to secure locations in the U.S. "As I'm approaching new clients, I can explain to them that their data, while being produced 8,000 miles away, is actually residing within the United States," says Shiozaki. "That's a huge, huge, comfort to them."
For SMB customers of The Planet, which provides managed online backup along with server hosting and a variety of other services, ease-of-use is an important consideration. Says Sam Fleitman, vice president of managed services, the ability to "schedule backups through a GUI, do recoveries, schedule retention periods, encryption, all of that through an easy-to-use GUI, was huge for them."
Backing up data over the public network obviously puts the spotlight on data security. Services from EVault, Arsenal, and others, encrypt data in flight and offer a variety of methods for encrypting data at rest at the service provider's data center. When data is encrypted for storage, it is encrypted on the client and can only be decrypted using the client's keys, so backup data is never visible at the backup location.
Sodexho: Mobile Enterprise Backup
Sodexho, a 110,000-employee food service and facilities management company headquartered in Gaithersburg, Md., is moving to EVault's online service as the backup mechanism of choice for its thousands of mobile laptops.
All new laptops use EVault for backup, and more than 200 existing laptops have been converted, but the process is just beginning. "Sodexho has adopted Evault's backup solution as a standard for our laptops," says Neil Block, senior business technology analyst in Sodexho's healthcare division, but he adds, "EVault is, in the scheme of things, fairly new to the Sodexho environment."
Block says the company has a goal of having a thousand laptops on EVault's service in the next year.
Before EVault, Sodexho supplied each user with a secondary drive for backup. "The end user would actually have to initiate the backup," says Block, and that meant that in many cases, backups were not completed. "Our end users just were not backing up." Moving to EVault's online service allowed Sodexho to schedule and automate backups for remote users.
Sodexho uses over-the-wire encryption for its laptop backups, but does not use EVault's at-rest AES encryption option. Thousands of individual laptop users would mean thousands of individual passwords, and key management is simply impractical. Says Block, "Having the end user [determine the password] is great, but if we don't have the ability to reset it, and they forget it, then it actually does no good for them."
In addition to its fleet of laptops, Sodexho backs up some of its remote office servers to EVault's storage vaults. Those servers that have been moved to EVault's service are those that were most in need of a backup upgrade. These were servers that were not backed up in accordance with "newly-defined security standards and Sarbanes-Oxley standards," says Block.
A Storage Service with Legs
Storage services, in general, have not met the heady expectations of a few years back.
"They ran into, looking back now, some fairly expectable problems in selling that model," says IDC's Chandler. Larger customers were conservative, not wanting to outsource anything involving storage.
But backup services, because they offload an otherwise unavoidable burden from smaller companies, because they can be effectively applied to remote offices of large companies, and because the data needs to go off-site anyway, offer a bright spot.
Tony Barbagallo, EVault
Frank Brick of Arsenal sees a good year for the company's online backup service. "[ViaRemote] is probably going to represent 80% of our total aggregate growth in 2005," he says.
Chandler sees great potential in providing online backup services to SMBs, but notes that selling to a large number of customers in a variety of industries is a tough job. He says that telcos might have some success. "One idea that has floated around, and I think it's a valid one, is for the telcos, who sell a lot of services already to those companies, to add this to their menu."
For more storage features, visit Enterprise Storage Forum Special Reports