Some Cloud services providers are finding that firms aren’t running to them at full-speed to migrate their infrastructure to the ‘new cloud world’ and for some reason, they are delaying decisions. Why might that be?

There are many articles written that suggest security and supplier stability is the biggest barrier, but I think there is another factor  to consider.

Many firms have already invested in their in-house technical infrastructure, often running a virtualised server and storage (SAN)  environment (referred to as a ‘private cloud’). These firms will need a ‘step change’ to help ‘push’ them to a cloud service.  What could a step change be?

• Current data centre runs out of space or requires significant investment. For example, air conditioning replacement, new UPS or a new fire suppression system.
• Current technical infrastructure requires a significant upgrade or replacement due to age, capacity or performance.  For example, if a firm is still operating separate physical servers with no virtualization, migrating to a cloud service would be a good opportunity to reap the benefits of virtualization.
• Premises relocation, which would require an in-house hosted data centre to be rebuilt in a new location.
• Additional premises capacity required by the business, forcing the data centre to move out of the firm’s premises to a hosted service.
• Segregated infrastructure. For example, suppose a firm only hosts and operates systems that are used in-house with no external client access. If a new requirement was to offer Internet facing services, there would be a strong argument to physically separate the different infrastructure.
• Introduction of disaster recovery services.

So that is some of the step changes that would make it the right time to consider cloud services. However, there are situations when a cloud service might be unattractive.

• When the computing capability can be sourced by simply upgrading the current infrastructure.  For example, if additional storage and processing capacity is required, it could be achieved by a relatively low incremental investment in additional disk for a current SAN and an additional virtual server host.
• When the infrastructure that would be replaced by the cloud service was purchased and not fully depreciated. For example: Let’s assume that the firm’s depreciation policy is five years, that the infrastructure cost £100,000 when purchased and has been used for two years. A financial ‘write-down’ of £60,000 would be incurred (the remaining depreciation amount). In many  companies this would be added to the project cost – making it an unattractive proposition financially.
• When the infrastructure that would be replaced by the cloud service is leased and not at the end of the lease period. As with  the previous point regarding depreciation, the remaining lease costs and sometimes an early termination penalty could be added to the project cost – making it an unattractive proposition financially.

I’m not arguing against cloud services – far from it – I am a cloud advocate.  I am suggesting some reasons why firms haven’t rushed to migrate everything to the cloud.

For some Cloud providers, the best marketing strategy could be to ensure prospective clients understand your service capability, then wait until the time is right.

With Cloud based services becoming commoditised, will the smaller players will be able to compete against the likes of Salesforce.com, ProofPoint, Microsoft’s Azure, Office365 and Amazon’s EC2 ?

Last week, we saw the launch of a new and powerful IaaS service (vCloud) from Foreshore (Jersey).  Why would you choose to host your Cloud based services with a supplier who will undoubtedly charge more than a big player such as Microsoft?  It may seem a bizarre question, so here are my thoughts on things to consider before shipping your data to a different location in order to reduce (immediate) costs.

What’s a jurisdiction?

• A jurisdiction is more than just a location. For example, knowing that your Internet transaction processing system is hosted in the USA isn’t enough – you need to know which state(s) it is in and understand the legal and tax implications of those states.
• You need to look at the legal and tax implications of all the relevant jurisdictions, including where you and your business are located, where the hosted servers physically are (including any disaster recovery facility) and also where your hosting provider’s headquarters are.

Client perception

• Where do your clients think their data physically is?
• Do your clients actually care where their data is ? For example, a Trust client may take a keen interest in data jurisdiction, whereas a client of an online shop probably takes no interest as long as their data is secure and their goods are delivered.
• How would your clients react if their data was hosted in a different location to where they thought it was?

Client agreements

• Do any of your client agreements specify the physical location or jurisdiction of their data?
• If you haven’t repapered clients recently and sought their agreement to the changes (if required), you may be bound by legacy client agreements.
• If you have ‘click-wrap’ agreements, this may be easy for you. In other words, if you have the ability to change your agreements and simply republish online for them to become effective.

Legal and regulatory

• Have you ensured that the jurisdiction you are considering for hosting has data protection, regulatory and legal standards at least as high as your current location? For example, would you want to be associated with a non-white listed OECD country by hosting your data there?
• For example, Singapore does not have one unified data protection law. Instead, it is subject to over 140 disparate and  sector epecific statutes that regulate the use and disclosure of personal data.
• Some jurisdictions could have more stringent laws than your current jurisdiction. For example, Germany currently has some of the most onerous data protection laws in Europe. This may place more demands on your organisation.
• How will you maintain compliance across multiple jurisdictions? For example, the storage and processing of payment card data.
• If the relationship between you and the hosting provider turns sour, are you comfortable with the legal process in their jurisdiction? You may need to use it.
• Does your regulatory regime require you to physically inspect the data centre used?
• Microsoft, being a USA company, have confirmed that their European data centres are subject to the USA Patriot act. Are you comfortable with this?

Tax

• Have you taken taxation advice about the jurisdictions, to determine if you will need to pay tax there? You need to think about where you are, where your company’s operations are, where your clicnts are and where you are hosting.
• If you host a transactional website in the USA, it can create a taxable presence for USA federal income tax purposes. Just storing data would not usually be deemed to be conducting business for USA tax purposes, however the activity can be treated as the conduct of business if the non-USA person stores data for the account of others or allows clients or other third parties access to the data. Click here to read an interesting document regarding the USA tax implications - it’s written for Australians but the principle is the same.
• If you are considering hosting in the USA, don’t forget that the USA has fifty states (hence it’s name!), each with it’s own laws and taxation regime. Make sure you know which state(s) your data will be in and how that state’s laws and taxation will impact you. Click here to read about the Amazon challenge on a new California tax as an example.
• If you host a transactional website in Singapore, you could be liable for Singapore tax if it is deemed that your Singapore presence is deemed a permanent establishment – ie you have a fixed place of business in Singapore and you carry-out your business activities wholly or partly through that place. You can start to see that a hosted Internet transaction website could be deemed as taxable in a jurisdiction other than where you may be located. Click here to read an interesting document regarding Singapore tax implications – it’s written for Australians but the principle is the same.
• Is there a double taxation agreement in place between your business jurisdiction and the hosting jurisdiction? You don’t want to pay tax twice !

And finally ….

The message here is that all that glitters is not necessarily the most appropriate for you and your business. An apparently low cost solution may not be the best solution for your business. If all you need is e-mail and Microsoft Office type functionality, then Office 365 could be good for you and your organisation. If you need transaction processing capability, look before you leap to an apparently lower cost supplier and different jurisdiction.

Also read this

• Clouds and data jurisdiction
• Cloud service provider due-diligence
• Real-life advice for adopting private Cloud technology

There’s no denying that Cloud Computing is the latest buzzword, but is it just another way of selling outsourced services?

Firstly, some definitions….

• Outsourcing – this is the contracting out of a business function, normally one previously performed inhouse, to an external provider.
• Cloud Computing service – for this article. I am not referring to a ‘Private cloud’ hosted in a firm’s building. I am referring to a Cloud type service that is hosted outside a firm’s premises – whether that be a Public Cloud or an externally hosted Private Cloud.

There’s no getting away from the fact that if you are using a service provided by a supplier, it is either an outsourced service or very close to being so. However, a Cloud service is so much more than that.

Why would you outsource?

Outsourcing occurs for a number of reasons, typically:

• Supplier can provide a better quality of service
• Supplier can provide service for lower cost.
• The function isn’t the outsourcing company’s core focus. I.e., don’t try and be the best at everything.

Why would you use a Cloud service?

Firstly, it depends on what type of Cloud service you use. Let’s look at two examples.

IaaS (Infrastructure-as-a-Service) services include Microsoft’s Azure platform. and Jersey Telecom’s OneSource. Typical benefits include:

• Avoid upfront investing capital into hardware and software.
• Avoid building Data Centre(s) in your firm’s premises.
• Access to computing resources when your need it – e.g., you may have very spikey/seasonal traffic, such as ticket sales.
• Ability to reduce total computing power, as the multi-tenanted servers will be better utilised than the traditional model of one server=one role.

AaaS (Application-as-a-Service) services include Google Docs, Gmail, Google Calendar, Xero Accounting, Microsoft’s Cloud-based Office365 and Dynamics CRM. Typical benefits include:

• Avoid an upfront investment of capital into hardware and application software.
• Avoid installing bespoke technology for just one system and avoid training technical staff.
• Geographic coverage due to the providers coverage.

You can see from just these two short examples that there are far more benefits to be had from Cloud computing services, than the traditional outsourcing of IT services.

So, getting back to the question….

…. is Cloud Computing just another selling opportunity dreamt-up by the marketing team in a bid to repackage and sell outsourcing services?  The answer is ‘no’ – Cloud computing is far more than that.

There is no doubt that utilising Cloud services is a form of outsourcing, however Cloud computing is a paradigm shift from the traditional hosting model. Don’t dismiss Cloud computing as ‘the latest fad’ or just a ‘passing trend’. Whichever Cloud model is used, there can be many benefits derived when compared with the more traditional outsourcing of IT services.

It’s a a common occurrence – a server is needed very quickly and a virtualized environment allows for the fast deployment.  In fact, some organisations are decentralising the deployment and management of virtual servers out of the IT function and in some cases to ‘super users’.

Beware – although this may speed-up the deployment of a platform, it will come back and bite you if you don’t manage it effectively.

A virtualized server may not need its own racked hardware, power and cooling, but it needs all the other maintenance, management and TLC that physical servers need.

Deployment

Virtualized servers are much quicker to deploy that a physical, but make sure you have a process that is followed by everyone that is able to do it.  This will ensure standards are kept to such as naming, licensing, anti-virus software and updating of the inventory.

Management and control

Aside from the physical aspects, a virtual server needs just as much management as a physical server. Make sure you maintain an inventory of all virtual servers as you would with all physicals. Perform a regular reconciliation between the inventory and the actual VMs that exist.

Do not allow yourself to get into VM-sprawl, otherwise you will have a headache in trying to get on top of the situation.

Backup

It’s all too easy to roll-out a new VM and forget about backing it up. You may have a replicated SAN for your storage – but replication isn’t a backup. Make sure that arranging backups is part of the deployment process.

Patching, Anti-virus and Protection

Here’s another reason why you need to manage your virtual servers. Don’t create a VM and handover management and control to someone who won’t keep it up to date with software updates (WSUS if Microsoft), anti-virus, application software patches etc.

If you don’t ensure VMs are patched, they will rapidly become a significant gap in your infrastructure security and protection.

Licensing

Don’t get caught out by software licensing. If you are only running open source software you may be covered, but you will find that other licensable product licence terms sometimes don’t fit well with a virtualized world.

Microsoft’s Data Centre licence, although expensive, is a method of ‘buying your way out of a problem’, as it allows you to run multiple instances of their Server operating systems on a virtualized server.  Take specialist licensing advice to ensure you understand how you need to be licence with regard to the number of processors and multiple physical VM hosts.

Don’t forget other software that is installed on the server. Even though a non-IT member may have installed it, you may be responsible for licensing in your firm.

Also, make sure you understand the licensing implications of software on a VM that is copied ‘for testing’ or for ‘safe keeping’. Different software vendors have very different views and many software contracts were written before the days of VMs.

And finally ….

Don’t get me wrong – I am fully supportive of virtualized environments. The message here is to manage them as thoroughly as if they were physicals. A virtual server that isn’t managed properly could become a chink in your security armour or a legal liability if not licensed.

Manage those VMs !

Application-as-a-service (AaaS)

This is typically a specific and often specialised business system that is delivered over the Internet to a user, typically accessing the application through a browser. While many people associate Application-as-a-service with ‘vertical’ enterprise applications such as Salesforce, office automation applications are also Applications-as-a-service, such as Google Docs, Gmail, Google Calendar and Microsoft’s Cloud-based Office365 or Dynamics CRM.

Also read this article.

Data as a service

It could be argued that this service has been with us for some time now – for example Interactive Data’s pricing services.  Data/Information-as-a-service provides data on-demand using well defined interfaces such as an API.

Data-as-a-service is typically provided to a company by an external service provider. However, large corporations can benefit from scales of economy by aggregating data and disseminating it within it’s ‘child’ companies.

There are two types of Data-as-a-Service; private data and public data.

• Private data is typically paid-for access to valuable data that isn’t readily available in the public domain. Examples include live stock price information, address and post code/zip code validation, and credit reporting. This type of service is not new and has been provided for years by companies such as Interactive Data.
• Public data is a newer service and is typically formatted data in the public domain. For example, the Google Public Data Explorer allows you to incorporate demographic data with your company’s sales figures to perform powerful statistical analysis.

Data Centre-as-a-service

Refer to Infrastructure-as-a-service.

Database-as-a-service

This provides the ability to use the services of a remotely hosted database, sharing it with other users, and having it logically function as if the database were local. Different providers have different models, but the advantage of this service is to be able to use database technology that would typically be a significant cost in hardware and software licenses if hosted in-house.

Desktop-as-a-service (DaaS)

Also referred to as ‘virtualized desktops’. A large cost for firms is the purchase, deployment and subsequent management of desktop PC devices – especially in remote offices. Desktop-as-a-service can help alleviate these costs and headaches, by offering a virtualized desktop that runs ‘in the Cloud’.

There are operational considerations, such as the fact that the users need physical devices to access the Cloud-delivered desktop. However, these can be low-cost, low-maintenance locked-down thin clients.

Also read this article.

Governance-as-a-service

Refer to Management-as-a-service.

Hardware-as-a-Service

This term seems to have faded out of use now. It referred to the ability for companies to avoid purchasing hardware when they could ‘rent’ services from cloud platforms such as Amazon’s EC2.

Identity-Management-as-a-service (IMaaS)

This is an area that has the potential to grow significantly. It covers the identification of users and ensuring they receive only the access levels that they should have. That sounds easy, but how do you know that a remote user is really who they say they are?

This service  provides access control and audit capability for multiple SaaS, Public Clouds and Private Clouds, whilst at the same time giving users the benefit of single-sign-on (SSO).

An example of a service in this area is Symplified.

Information-as-a-service

Refer to Data-as-a-service.

Infrastructure-as-a-service (IaaS)

This is also referred to as Data Centre-as-a-service, this is the ability to remotely access computing resources. In essence, you lease a physical server that’s yours to do with as you will, and for all practical purposes it is your data centre, or at least part of a data centre. The difference with this approach versus more mainstream cloud computing is that instead of using an interface and a metered service, you’re getting access to the entire machine and the software on that machine.

In short, it’s less a packaged solution and more akin to ‘traditional’  hosting.

Also read this article.

Management-as-a-service and Governance-as-a-service

This is an on-demand service from a Cloud service provider that allows the management of one or more Cloud services.  Typically, these are simple things such as systems topology, resource utilisation, virtualization management and up-time management.

management/governance systems are now becoming available, such as the ability to enforce defined policies on data and services and report on SLA and service metric compliance.

Platform-as-a-service (PaaS)

This is a complete platform that is delivered through a remotely hosted (Cloud) platform to subscribers. It can include application development, interface development, database development, storage and testing.  It is based on the traditional timesharing model and modern Cloud Platform-as-service providers provide the ability to create enterprise-class applications for use locally or on-demand for a subscription price or free that is typically less than hosting it in-house yourself. An example of this is Microsoft’s Azure platform.

Also read this article.

Process-as-a-service

This refers to a remote resource that can aggregate many resources together, such as services and data, whether hosted within the same cloud computing resource or from separate providers, to create business processes.

You can think of a business process as a Meta application that spans different systems, leveraging key services and information that are combined into the correct business sequence to form a process. These processes are usually easier to change than applications, and thus provide agility to those who use these process engines that are delivered on-demand.

Security-as-a-service

As the incidence of viruses, malware, attacks and email phishing increases day-by-day, the job for the IT team to protect a firm gets more and more complex. Security-as-a-service is starting to become an attractive proposition, as it’s a method of outsourcing a headache for management by experts.

For this to work, all Internet connectivity for the firm needs to be routed through the service provider. Failure to do this could result in an unmanaged ‘unlocked back door’ into your firm.

Examples of Security-as-a-Service providers are McAfee, Zscaler and Symantec’s MessageLabs who have been providing this service for some years.  Click here for a high-level review of service offerings.

Software-as-a-service (SaaS)

Refer to Application-as-a-service.

Also read this article.

Storage-as-a-service

Also known as ‘storage on demand’ or ‘disk space on demand’.

This is the ability to use storage that physically exists at the remote Cloud service provider but logically appears as local storage resource to any application that requires storage. Apple’s MobileMe iDisk service is an example of Storage-as-a-service..

Testing-as-a-service

This is a service that allows the testing of local or Cloud-delivered systems using testing software and services that are remotely hosted by the Cloud services provider. Note that while a Cloud service requires testing itself, Testing-as-a-service services can test other Cloud applications, Web sites and even internal enterprise systems.  They do not require a capital investment  in hardware or software within the enterprise, for something that may only be used for a limited period of time.

• Caller: “Hello, I am calling on behalf of XXXX. Are you using Cloud technology or do you plan to ?”.
• Me: “Well that depends on what you define Cloud technology”.
• Caller: “That’s a good question. Are you using it then ?”.
• Me: “Well, if you mean virtualized infrastructure, then yes”.
• Caller: “What software are you using?”.
• Me: “VMWare”.
• Caller: “So you are using Cloud. Do you intend to increase your usage ….”

And the call pretty much ended there, with the caller not really getting any leads for his sponsor.  This, and several other posts, had me thinking about the definition of ‘Cloud’.

There’s a lot of discussion going on about what exactly ‘Cloud Computing’ means. It seems that every vendor’s Marketing department is tagging their product or service with the ‘Cloud’ tag to make it trendy and hip.

One problem is that there is no clear de-facto definition of what ‘Cloud computing’ means. For me, the definition that covers it is ….

“Shared computing resources that can be dynamically scaled according to business requirements, faster than traditional computing environments.”

Gartner’s definition

Many people take comfort in the words of Gartner. Their Cloud definition is ….

“A style of Computing where scalable and elastic IT capabilities are provided as a service to multiple customers using Internet technologies“.

Gartner also list the five key attributes that Cloud computing has:

• service-based
• scalable and elastic
• shared
• metered by use
• uses Internet technologies

What’s getting the purists agitated?

Many ‘purists’ only consider a service to be a Cloud service if it has some of the following features :

• Internet hosted.
• Hosted and/or managed by a third-party service provider.
• Uses virtualization technology.

Here are some examples of services being dubbed as ‘Cloud’ Services, but not fitting their Cloud definition :

• Private Cloud – a company using virtualisation technology ‘internally’.
• Webmail – these services have been with us for years before the term ‘Cloud’.
• Office-in-a-box type solutions that offer a Citrix desktop with e-mail and other desktop services.
• Web-based services like LinkedIn, FaceBook, FlickR and Salesforce.

So where does that leave us?

Unfortunately, there is no definitive definition of Cloud Computing. Even using the Gartner definition, the previous list fits the criteria. Remember that the Gartner definition does not mention ….

• virtualization
• specific technologies
• hosting
• or that it has to be Internet based (using Internet technologies isn’t the same thing)

Until another term comes into the mainstream, we need to accept that the term ‘Cloud’ is going to get more airtime, become even more pervasive and be ‘tagged’ with other products and services – although I did have a laugh at the chap who said he had a Cloud on his laptop – I think that really is pushing the boundary !

The good news, is that the ‘Cloud thing’ is driving forward the development of technology and services, which we can all benefit from.

What is a ‘private cloud’ ? There are many definitions, but here I am referring to the use of virtualised processing and storage technology for your companys use. This can be hosted on your site, or hosted with a service provider for your own use. Many of the points mentioned are also relevant to public cloud services.

Here is some advice about adopting the technology, based on real-life experience.

To anticipate one question up-front, I am not affiliated in any way to any product or service provider. My (day) job is to manage IT resources and services for a very large financial services company. My comments here are based on my real-life experiences.

.

Real-life advice and lessons learnt

• Get the design right up-front. This technology will be the core of your business’ infrastructure – if you skimp at this stage, you will regret it later on and it will be very difficult to correct it.
• Work with experts. The skills needed for this technology are very different to previous technologies. Don’t assume your team can ‘pick-up’ the skills ‘as they go’.
• If you don’t have a preference for the product set, try and use a supplier with no bias. This will ensure you get the right product, rather than one that they sell.
• Meet the technical consultants who will actually be doing the work before signing with a supplier. Interview them to understand their skills and previous site references. It is really important that you can work with them on such an important project.
• Make sure the skilled technical consultants work alongside your team to ensure knowledge transfer.
• Send your staff on the necessary technical training courses to be able to support the hardware and software. These courses can be expensive, so beware and budget for them as part of the project. Don’t go live before this – doing so is a risk to the business.
• Use proven software and hardware. It will be very tempting to use the latest version of something, but remember that this technology will be at the heart of your infrastructure, so make sure it is stable.
• Make sure you have contractual support for all the elements, such as hardware and software support. This is one system where you are likely to have 365*24 support.
• Don’t be persuaded to virtualise everything. There is strong technical opinion that the primary domain controller (PDC), Citrix servers and SQL Servers should not be virtualised – of course everyone has their own opinion on this !.
• Go live with low-risk systems first, such as test systems. If you make a mistake, it won’t be public and you can resolve any issues in a less-rushed and less-stressed manner.
• Order more disk space than you think you need. You will soon use it with unplanned backups, snapshots and data that ‘slipped through the net’ when you did your sizing estimate.
• Configure and test the contingency aspects of your installation before ‘going live’. If you discover that you need to make significant changes (for whatever reason), it is much easier to make them on a system that isn’t yet live, than on a live system when you need to plan it around the availability for business use.
• As with all projects, don’t be tempted to jump-in and start straight away. Regardless of special deals, supplier end-of–month special deals and so on, it is far more important to make sure you are comfortable with the supplier’s terms and conditions. Once you get started, you have far less room for negotiation.

.

Also read ….

• Real-life benefits of private Cloud technology
• Cloud Computing – what is everyone so excited ?

.

.

Make sure to visit CIOCOO.com

© 2010 CIOCOO. All rights reserved. Please refer to http://ciocoo.com/small-print/ for further details.

Before signing-up to use a Cloud hosting or backup services provider, it is really important to determine who is the best supplier for your needs. Here are some suggested questions to ask to help you decide if they are the best supplier for your needs.

Please note that this is not an exhaustive list – it is to help get you started – make sure you tailor it to your organisation’s requirements.

.

Data location

1. Where will my data be located?
2. Do you distribute your systems or load balance in such a way that my data could reside in a different jurisdiction? If so, where are these jurisdictions?
3. If you perform backups, where is the location of the backup storage site?

For more information about data jurisdiction and why it matters, click here.

.

Security of your data

You must ensure that the service provider will protect your data. The security of your backups needs to at least match the security you place around your client data. Imagine you want to steal a company’s data – targeting the backup media would be so much easier that trying to hack into individual systems and copy data from them.

As a real-life reminder of this, In August 2010, the UK’s Financial Services Authority (FSA) hit the UK arm of Zurich Insurance with a record £2.275 million fine for the loss of a backup data tape containing the details of 46,000 clients.

1. Describe the physical security of your data centres.
2. Is my data encrypted on your systems?
3. What level of encryption is used?
4. Who can decrypt it and who has access to the decryption keys?
5. Who has access to my data?
6. Are your backups encrypted when stored on media?
7. What level of encryption is used for the backup media?
8. For the backup media, who can decrypt it and who has access to the decryption keys?
9. Is the backup media securely stored in a site other than the live hosting site?
10. Where is the location of the backup media storage?
11. Does the site used for backup media storage have the same physical and logical security as the live hosting sites?
12. If the backups are transported from one site to another (such as a courier), what physical security is used?
13. If my backups are transmitted to another site, are they encrypted during transmission?
14. What level of transport encryption is used?

.

Service continuity

1. What is your business continuity and disaster recobery strategies?
2. How many different power sources supply your hosting site?
3. Do you have UPS protection with automatic cut-in in the event of a power failure?
4. Do you have generator protection with automatic cut-in in the event of a power failure?
5. How often do you test the UPS and generator?
6. When was the last time your hosting site suffered a complete loss of power?
7. When was the last time that one of your clients suffered an outage due to the loss of power?
8. Do you have an alternative hosting site that you can automatically switch to in the event of an issue?
9. How many different and diversely routed Internet connections do you have?
10. In the event of an Internet service providers connection failing, can all your services be provided on the other Internet connection(s)?
11. When was the last time your hosting site suffered a complete loss of Internet connectivity?
12. When was the last time that one of your clients suffered an outage due to the loss of Internet connectivity?
13. Is your Internet connectivity protected from DOS or DDOS type attacks?
14. Have you experienced a DOS or DDOS type attack and how were your clients impacted?
15. If your service (including your hosted clients and applications) is attacked/hacked in any way, how quickly do you inform me and how is it reported?

.

Backup related questions

1. Are yours systems backed-up?
2. Is my data backed-up? (This may seem like a bizarre question, but if your provider suffers a major systems failure, you could lose your backups that you need for legal of regulatory purposes).
3. How often is my data backed-up?
4. What is the backup retention policy?
5. Can I determine the backup retention policy of my data?
6. What media is it backed-up to? (Remember this could be disk-to-disk).
7. If backup is to disk, is this storage on completely separate infrastructure and in a different location to the hosting service? (This question is if you are looking at using a backup service from the same hosting provider).
8. How often is testing performed of recovering your systems from backup media?
9. How often is testing performed of restoring data from backup media?
10. Can I copy my backups to an external source?
11. Can I perform an ad-hoc backup when I need to? (For example, before a significant system change).
12. Can I restore an individual object (such as a file) from a backup?
13. Are ‘open file’ backups supported?
14. Are my e-mail system(s) supported?
15. Are the database(s) that I use supported?
16. Do you support incremental backups?
17. Can I select whether I perform a full or incremental backup?
18. If a send/receive of data to/from yourselves should fail, is there a ‘transmit from failure point’ option or will it start at the beginning again?
19. Who has access to my backed-up data?

.

Accessing data

1. How do I send you my data in order to get started?
2. What level of transport encryption is used?
3. How do I access my backed-up data?
4. How quickly can I get access to my backed-up data?
5. Do you object to my company or an independent technical auditor from validating the backups on a regular basis?
6. If necessary, is it possible to transport large backups on physical media to aid a fast recovery?
7. Is it possible to perform data mining on my backup data (for example in legal data discovery), or do I need to restore it to my systems first?

.

Cost of service?

1. How do you charge for the hosting service?
2. How do you charge for the backup service? (Make sure you calculate the likely tariffed cost for the service, taking into account your data volumes, backup frequency and retention period).
3. Is there a charge for each system I backup from (such as backup agent software).
4. Is there a charge for accessing or restoring backed-up data?

.

General questions?

1. Are your services and those of your sub-contractors/partners, SAS70 compliant?
2. Do I retain exclusive ownership of my data at all times, including after the end of a contract?
3. Do you own and run your own data centres? If not, please give details of the underlying service provider.
4. What accreditations does your organisation have?
5. Has your organisation won any awards relevant to the service to be provided?
6. What type of employee/contractor/services provider screening do you perform before you hire or contract with them?

.

Also read this….

• Clouds and data jurisdiction
• Cloud-based backup services

.

And finally….

A key indicator of a providers service will be how they respond to your questions. If you have an open dialogue with them, it’s a good sign.

Remember that a supplier’s pre-sales service is nearly always better than after-sales …. so if you’re not happy before you sign-up – don’t do it !

.

.

With the adoption of cloud-based hosting services, it is all-too easy to assume that your service provider is backing-up your systems.     

.     

Surely my Cloud service provider backs-up my data?

Most Cloud service providers backup their systems and your data. However, there are some providers who don’t perform any backups or test their integrity – thankfully these are in the minority now. Even if a Cloud service provider performs backups, they may not be available for you to access.     

As an extreme example, suppose that Microsoft’s Hotmail service suffered a huge failure. You would expect Microsoft to recover it back to a specific point in time. However, suppose that you accidentally deleted all of your inbox – could you call Microsoft and ask them to restore it for you?     

The purpose of this illustration is to show that although providers perform backups, it is likely to be for their own use. If you need to access a backup of your data, you need to separately provision for it.     

Different types of Cloud service providers have different approaches to backups:

.     

Why might you need to access a backup of your system?

Here are some example scenarios:     

• You make a change to your system that causes an issue and you need to roll-back the change.
• A System Administrator accidentally deletes a program or data.
• Malicious code such as a virus of a Trojan infects your system and causes damage.
• A legal or regulatory investigation requires you to recover deleted data or recover your data to a historical position in time.

Some hosting providers will try and tell you that you don’t need backups because your data is replicated to another site. This isn’t a backup! It will provide continuity if the live site fails, but if you accidentally delete data, the ‘accident’ will be replicated to the other site before you can catch it.     

 .     

What options do you have?

Perform backups yourself

Backup your own Cloud data

If the Cloud service is a utility ‘clickwrap’ service which is low cost of even free, you will have little flexibility with backup options. The provider will perform backups for their own use, but you are unlikely to be able to access these.     

The easiest way is to perform regular backups yourself. Using something as basic as a secure FTP tool, will allow you to take copies from the provider to your own local storage.     

• For : For a low cost or free Cloud service, the quickest and easiest method of backing-up your data.
• For : You get peace of mind in having your data on your hardware.
• Against : Data volumes may prohibit this option for corporate use.
• Against : You need infrastructure on your site to securely store the data.
• Against : Depending on your data volumes, this option may require a large amount of Internet bandwidth.
• Against : Having chosen to host your data in a Cloud, it could be seen as an unusual step to backup your data on your own infrastructure.

.     

Backup provided by your Cloud service provider

Backup provided by your Cloud service provider

As Cloud services mature, they are starting to offer backups as part of the service. It is worthwhile looking at this option as it may offer the least hassle.     

Be careful to ensure that the service provider doesn’t host your Cloud service and backups on the same infrastructure, otherwise a fault with it could result in no service and no backup. See this article for suggested due-diligence questions.     

• For : This may be the easiest option, as all the services are from on supplier.
• Against : If the supplier charges by storage capacity, the data volumes and your chosen backup retention could make this an expensive option.
• Against : All your data is held with one provider. There is a potential risk of your provider having a problem, going out of business or deciding they don’t want to host you anymore (yes, this does happen).

.     

Backup provided by another Cloud service provider

Backup provided by another Cloud service provider

This option is well worth considering. You have probably chosen your primary Cloud service provider for their hosting capabilities. If their backup solution doesn’t match your requirements, use a Cloud services provider who specialises in backup services.     

Read this article for more information about Cloud backup services.     

• For : Your data is stored with an alternative provider. This mitigates against the risk of your primary Cloud services provider having a problem, going out of business or deciding they don’t want to host you anymore.
• Against : If the supplier charges by storage capacity, the data volumes and your chosen backup retention could make this an expensive option.

.     

What next?

It’s your data and only you and your organisation know how important your data is and the level of backup required. It’s a question of assessing the risk and putting in place suitable preventative measures.   

It is all too easy to forget about securing your data when it is hosted elsewhere. Unless backups are tested, you will never know if they are working until you urgently need to use them after an incident.   

Backups are a very important insurance – make sure you are properly covered!   

.   

Also read ….

• Cloud services and data jurisdiction
• Cloud backup services
• Cloud backup service provider due-diligence

Performing backups, checking them, testing restores, securely transporting and storing the backup media all take operational time and expense. Cloud-based backup services aim to alleviate some of the operational challenges, although not all of them.

.

What is a ‘Cloud backup service’?

Simple Cloud-based backup solution

Some people regard Cloud backup services as a ‘Software as a Service’ (SaaS). However, it can also be configured as ‘Infrastructure as a Service’ IaaS and can be implemented in a hybrid cloud model.

Cloud-based backup services have been around for some time now, albeit without the ‘Cloud’ prefix. Many of these managed services are now mature and worth considering. However, before taking the jump, here are some notes about the use of online backup services.

.

Advantages over traditional ‘in-house’ backups

• Storage capacity is highly scalable. Subject to the service provider’s capability, the upper storage limit can be very high and is unlikely to be a restrictive ‘glass-ceiling’ for most companies. This is of course, subject to your willingness to pay the increased storage charge.
• Removes the need to invest and maintain in-house backup hardware and software infrastructure. This is of particular interest to those who object to paying for the backup software agents at a cost close to the underlying operating systems itself.
• Billing of service use is normally on a ‘pay-as-you-use’ model. This means you don’t need to purchase expensive infrastructure just-in-case you need it. The ‘pay-as-you-use’ model also has its drawbacks (see disadvantages).


Cloud-based backup solution for distributed sites

• If you have the challenge of many small sites, each with their own servers and data, this can be a method of centrally controlling the backups and making sure they are performed properly from sites with no IT presence. This is a good way of reducing one of the risks of a distributed data computing model.
• Backed-up data is accessible from anywhere with an Internet connection. For example, if your primary site had a disaster that meant you couldn’t access it, you would be able to access the backed-up data from an alternate location to recover your systems.
• Avoids the need to securely transport your backup media to an alternate location for safe storage.

.

Disadvantages of Cloud-based backup services

• If you are backing-up from systems hosted at your premises, large Internet bandwidth is needed to accommodate the high volume of data being transferred. See below for more on this subject. If you use a Cloud backup service to backup a different Cloud hosted service, the data will flow between the two providers, meaning you don’t need to worry about bandwidth at your premises.
• Your company will have a view about the perceived and actual risk of your data residing on third-party infrastructure. Don’t take the decision to use Cloud-based backups yourself – involve your company’s Compliance, Risk and Legal teams with the due diligence to ensure they are comfortable with such a change.
• If the available window of time to perform backups isn’t currently enough, it’s unlikely that a Cloud-based backup service will solve this on its own.
• Most of the Cloud-based backup providers base their charging structure on a ‘pay-as-you-use’ basis. In other words, the more data you have backed-up on their systems, the more you pay. On first looks, this seems good. However, beware because a seemingly low charge can quickly mount-up.

As an example; when using tape backup media, if you needed to take a backup, it would cost you the cost of a tape – you could then keep it for as long as you required. Using a Cloud-based backup service, you will have a recurring charge for as long as you keep the backup.

.

What Cloud-based backup services won’t do for you

Before you run-out and sign-up for a Cloud backup service, remember that it won’t solve all your problems. Here are some backup related activities that you will still need to do:

• Daily checks to ensure backup processes completed normally.
• Regular restore testing to ensure backups are complete.
• Regular house-keeping of your servers and backup schedule to ensure you aren’t backing-up redundant data.
• Install and upgrade backup agent software on your servers.

.

What to look-out for

Internet bandwidth

If you are backing-up from systems hosted at your premises, large Internet bandwidth will be needed to accommodate the high volume of data being transferred.

Many providers offer software agents that perform incremental backups; this will reduce the size of your backup and the transfer time needed. You should always bear in mind however that there will be times when you need to perform a full backup, so make sure your Internet bandwidth gives you enough transfer time.

If you use a Cloud backup service to backup a different Cloud hosted service, the data will flow between the two providers, meaning you don’t need to worry about bandwidth at your premises.

.

Data storage charges

On first sight, Cloud based backup services look like a good financial option. However, here are two examples of the charges that may be incurred.

Example one – backup your own personal important data. Let’s make some assumptions:

• Your treasured important data and photos take-up 2Tb. For calculation simplicity, this size doesn’t increase.
• You want to keep two full backups online, in case you need to go back in time to retrieve something.
• You use the ‘Mozy Home’ service, which charges USD$54.45 per annum for ‘unlimited’ storage space (the first 1Gb is free).

Your annual charge would therefore be USD$54.45 or USD$272.25 over 5 years.

Example two – backup your corporate data. Let’s make some assumptions:

• Your corporate data takes 2Tb (a modest amount). For calculation simplicity, this size doesn’t increase.
• You take a backup on each day of the month (1 full backup plus 30 incremental backups).
• For regulatory and legal reasons, you need to keep a full backup from the last working day of every month – these cannot be incremental backups. These need to be kept for a minimum period of 10 years.
• You have 10 servers to backup from
• You use the ‘Mozy Pro’ service, which charges USD$6.95 per server and USD$0.50 per Gb.

Your charge would be USD$1.6M over 5 years. If we make an assumption that the supplier can process incremental data changes, the cost would reduce to USD$174,420 (assuming 5% data change per month).

As you can see, what appears to be a reasonable cost quickly mounts-up when backing-up and retaining corporate data backups. I know that at this point, some providers will say that their incremental backup features are able to reduce space and ‘rebuild’ the required end of month positions. Some products have very sophisticated features (here is an example from Jersey-based Foreshore). If you are going to use an incremental feature, test it first (as you would with in-house backup software), to ensure it meets your needs.

Make sure you calculate the realistic charges for using the service and compare it to the cost of a traditional in-house backup solution.

.

Understand your backup requirements

This may sound obvious, but do you really understand what data you should be backing-up?

• Your business sector is likely to have specific legal and regulatory requirements. If you have a Compliance or Legal team in your company, ask them for their understanding of the requirements.
• You probably have test databases that could be recreated, so they don’t need to be backed-up.
• Different types of data may have different retention periods. For example, voice recording may not need to be retained as long as transactional data. Keep the data with different retention periods separate from each other, as this will ease the exercise of removing backups at the end of their retention period.
• Don’t retain backups for longer than you need to. Not only is there the cost, but if you need to perform a legal discovery, you may need to search all the backup copies you have. Keeping the minimum needed will shorten this process.

.

Make sure your data is securely stored

Don’t be lulled into thinking that the choice of Cloud backup service provider needs less attention than choosing a Cloud hosting provider. Both are storing your data and providing a service. You must apply the same level of detailed due diligence to ensure the provider will treat your data securely and can provide you with the service and features you need.

Remember that your backup needs to be as secure as your primary data.

.

Data jurisdiction

You must take as much care with the location of your backup data as you do if selecting a service provider for Cloud hosting. Read this article for more information on data jurisdiction.

Make sure the supplier commits to where your data and systems will be located, including any copies or online/offline backups.

Jurisdictional issues can often be circumvented by encrypting the data and encrypting the network transport. However, ensure you get legal opinion on this before committing to a service.

.

Also read this….

• Jurisdictions and Cloud data
• Cloud service provider due-diligence

Sample of Cloud backup service providers ….

• Foreshore Online Backup – aimed at companies, hosted in Jersey
• Mozy – aimed at individuals and companies. Part of EMC
• Carbonite – aimed at individuals
• Zmanda – aimed at companies. Stores your data on Amazon Z3
• IBM’s (snappily named) Information protection Services – aimed at companies

.

And finally

When choosing a Cloud backup service provider, don’t base your decision on cost alone. There are other important factors such as security, features and service. It’s generally true that the more you pay, the more tailored service and more personal service you will get.

Don’t be tempted to try-out a free or low-cost solution with your corporate data. You must ensure that any security and jurisdictional matters are understood first.

Cloud-based backup services have been around for some time now, albeit without the ‘Cloud’ prefix. Many of these managed services are mature and worth considering. Before taking the leap, make sure you fully understand the charging structure and what your bills are likely to be over a period of time given the backup retention period required.