Storage at your service

Remember eStorage? It was for eBusiness during the eEconomy. Ten years ago, a bunch of storage service providers (SSPs) popped up, ready to store dot-com data. Not long afterward, most first-generation SSPs closed their doors when their new-age business customers went belly-up and more established businesses couldn't adjust to the idea of handing crucial data to firms just a year or two old. StorageNetworks Inc., perhaps the best known SSP at the time, finally gave up the ghost after its stock price dropped from $154 per share to less than $1.50. When the dust settled, most storage managers never wanted to hear from an SSP again.

Today, sporting a new moniker, storage-as-a-service (SaaS) companies have learned from the mistakes of their SSP predecessors. And a handful of well-established storage heavyweights, EMC Corp. and IBM Corp. to name just two, have made key SaaS acquisitions in recent years. SaaS is being driven by economic factors and IT realities that didn't exist a few years ago: an explosion of electronic data, compliance requirements, a tight rein on capital spending and stringent disaster recovery (DR) mandates, all of which are making storage services more appealing to small and large businesses.

"We're seeing an increased level of sophistication on the supplier and customer side," says Doug Chandler, research director, infrastructure services at IDC, Framingham, MA. "[SaaS is] a very dynamic market right now."

So what's changed? The following broad trends are making SaaS more attractive to small- and medium-sized businesses (SMBs) and enterprise companies:

• Big, well-known storage companies, such as IBM and EMC, have established SaaS offerings



• Remote-office data protection fits nicely into the SaaS model



• New data encryption transfer technology



• Different SaaS tiering offerings



• Increasing difficulties in companies finding and retaining storage staff



• Growing importance of laptop data protection services

Today's SaaS offerings differ from their first-generation predecessors in that many companies are now focused strictly on online backup business, and aren't trying to expand too quickly into providing suites of offerings, says Mike Riegel, CEO at Arsenal Digital Solutions USA Inc., an IBM company, and VP of information protection services at IBM. Also, today's SaaS competitors have "expertise on how to run and service and architect a complex data center ... I think a lot of the xSPs underestimated what it takes," adds Riegel.

John Lewis is the director of IS at Geokinetics Inc., a Houston-based geophysical services company that has more than 3,000 employees around the globe. He was looking into products from CommVault for data management last year when someone suggested SaaS.

"For us, it was a compliance crunch," says Lewis. Fifteen months after a company merger, "I had to get all these diverse locations unified under a single strategy--with no capital investment--and I had to do it pretty rapidly," he says.

Lewis decided on Iron Mountain Inc.'s LiveVault, and now ships approximately 750GB of data, from applications such as SharePoint and accounting, daily to Iron Mountain. It's collected first on local appliances at headquarters and remote offices, and then delivered via the Internet to the Iron Mountain Underground storage site. "You have to think outside the box to understand the advantages of the platform," says Lewis.

Much of Lewis' environment is virtualized, which helps him with quick restores. "Right now, if I've got a Bogota, Columbia, site that goes down and I need to restore their backup, I can take that image from Iron Mountain, restore it on my hardware and make it available over the VPN to them," he says. Before Lewis started using Iron Mountain, if a server in Bogota crashed, staffers there would normally have to wait for a pre-loaded server to be shipped to them. "If you're doing international business and waiting on shipping, that's something tough to figure in an ROI," he says.

				Beyond features: What to ask a SaaS vendor
				Don't forget what happened to all those storage service providers of yesteryear. Is the storage-as-a-service provider financially viable? What if you stop using them? What happens to your data? What happens if you break the contract in mid-stream? Which backup infrastructure do they rely on? Can they provide customer references with restore requirements and storage environments similar to your infrastructure?

Is SaaS a good fit?
Two good starting points when considering a SaaS strategy are looking at your current backup costs and getting a true picture of whether or not there are gaps in your system, says Stephanie Balaouras, principal analyst at Cambridge, MA-based Forrester Research Inc.

When considering costs, there's almost always no investment in hardware or software needed to start doing business with a SaaS provider, says Balaouras. The average pricing for online server backup today is approximately $7.50 per gigabyte per month, according to a recent Forrester report on backup software as a service, although some companies are offering lower prices to lure new business. Capacity pricing, where a vendor charges a fee for each gigabyte of capacity per machine per month, has the advantage of being predictable; however, a pricing model based on vault capacity is probably a less-expensive option for users, says Balaouras. For example, under the vault capacity pricing model, if you have a file server that has 100GB of capacity and you achieve at least a two times compression ratio, you would be charged for only 50GB in the first full backup (see "SaaS negotiating tips," below).

Geokinetics' Lewis figured out that over five years, the SaaS model will likely be more expensive than keeping his backup in-house. But the cost analysis doesn't take into account that new hardware investments and upgrades will be required after five years, he says. Also, there's the cost of possible human error, which is tough to nail down.

"I don't have anyone swapping tapes," says Lewis. "I don't have to monitor all those humans who [occasionally] make mistakes."

				SaaS negotiating tips
				Cash in on cheap disk. The price of storage continues to drop. Revisit your storage-as-a-service (SaaS) contract every year to renegotiate, and don't sign a contract that stretches longer than two years at current prices. Got dedupe? Ask whether the vendor has a deduplication strategy that will help you consume less storage at their site. Compare those numbers with your fees for raw storage services. Learn the limits. After determining the cost of a GB per month, find out your cost if your needs exceed a predetermined amount. (This is like going over the minutes in your cell phone plan.) Trim costs with tiers. Try to negotiate a discount based on tiered storage, as well as the different recovery time objective requirements of your various business units' data. Throw your weight around. Push for a discount if you're a large customer. All vendors are discounting large-scale environments. Sources: Forrester Research Inc.'s 2008 Market Overview: Backup Software-As-A-Service report and Gartner Inc.'s Online Server Backup Services Vie for SMBs, Remote Servers 2Q08 update

When considering the efficiency of your current backup system, find out whether backups and restores are completed within specified recovery time objective (RTO) and recovery point objective (RPO) windows, and determine whether routine testing of backups is occurring. There are also the costs of moving and tiering data, and supporting a remote DR site. In addition, you should factor in the cost of the average number of staffing errors that occur each quarter. Finally, add in the cost of personnel, hardware and software. Most of this information should be readily available for your yearly budget process, and it will serve as a good benchmark to compare a SaaS vendor's prices with what it costs to provide similar service levels in-house.

Forrester Research's Balaouras says the first question she's asked by potential SaaS clients is whether it's possible to perform backups over the Internet. "The answer is yes; with some caveats, of course," she says.

"The real challenge is the restore," writes Balaouras in a 2008 report titled Market Overview: Backup Software-As-A-Service. "For large restores, the vendor will quickly ship a DVD, removable drive or network attached storage (NAS) appliance to the customer site to conduct the restore locally." (This is what Lewis is trying to avoid if he has a server go down in Bogota.)

All SaaS players emphasize their restore capabilities; each one will tell you that their centralized Web dashboards, remote troubleshooting features, online restores to any location, continuous data protection capabilities and ability to perform delta restores to recover block changes whenever possible makes them better than the other guys. For example, according to a recent Stamford, CT-based Gartner Inc. report, Mozy Inc. (an EMC company) sends the customer a DVD or an external drive via FedEx or zip files via the Internet; IBM's Arsenal Digital Solutions offers online restores to the same site or an alternate location, and has quick-ship restores for databases, file servers and PCs.

Storage as a service is still geared primarily to the needs of SMBs, and no one is trying to convince large enterprise customers to ship hundreds of terabytes over the Internet. "If you talk about having to back up a data center and mission-critical applications, you can't back that up over the Internet," says Balaouras. "People have trouble backing [that amount of data] up over their high-speed corporate LANs."

However, SaaS companies are increasingly backing up corporate PC data over the Internet. "There's a growing realization that there's a lot of critical information stored on laptops," says Balaouras. Many companies, large and small, are using the Internet to ship data to the SaaS and a local backup appliance supplied by their SaaS vendor that's wired directly to the SaaS center's vault. Balaouras tells clients that a local appliance is sometimes preferable for clients with RTOs of less than 24 hours.

Data security
Security is still a showstopper for many companies exploring SaaS options. No matter how strong the encryption guarantees, or the type of encryption used, some potential customers simply won't be able to sleep at night knowing their data resides offsite at a location they don't own or manage, and that their data might be sitting beside some of their top competitors' data.

"It's still an objection," admits John Clancy, president at Iron Mountain Digital. "But it's much easier to overcome that objection than it has been in the past," he notes, adding that they use "the same level of encryption the federal government uses to wire funds."

Adam Couture, principal research analyst at Gartner, says industry veterans such as EMC and IBM are helping more customers rest easy when it comes to shipping data over the Internet to remote hosting facilities. "They won't send it to a Mozy, but they'll send it to an EMC Mozy," says Couture. "To me, that's the big difference--that the storage OEMs want to be service providers themselves."

Perimeter eSecurity isn't as well known in the online backup space as Seagate Technology's EVault or Iron Mountain, or even smaller competitors like Incentra Solutions Inc. or Intronis Technologies Inc., but Doug Howard, Perimeter eSecurity 's chief strategy officer, says they entered the space specifically to compete with companies for whom encryption isn't an everyday business.

"If you look at most of the online backup providers, they have an option for individual encryption on a key basis," he says. "We do a double key. It means that every encryption has two keys. You can choose to let some people have limited access to elements of information so you couldn't access all the text or Word docs, but you could see the headers or file names. That gives you some flexibility." Most SaaS vendors offer a customer the option of holding their own encryption key or putting it in escrow with the SaaS vendor.

James Cosgrove, founder and CEO of Seattle-based Computer Resource Corp. (CRC), chose the option of allowing Intronis Technologies to hold his encryption key. "The reason we don't manage the key is because if that one little key gets lost or misplaced, then I don't have that customer data," says Cosgrove. His clients are mostly dental offices in the Seattle area. Many were using Symantec's Backup Exec before they adopted an online strategy, he says. "They would say the tapes got dirty or the backups didn't run last night ... we were getting tired of these phone calls."

Making the case
For Tom Comella, VP of technology and information systems and CIO at Neighborhood Centers Inc., a 101-year-old nonprofit that operates social services from Headstart to senior centers in Houston and surrounding counties, cost wasn't a major concern. "I was more worried about the data being safe. We need to show that we are good stewards of the data," says Comella, an IBM Arsenal customer. He can easily restore a file stored on an Arsenal device at Neighborhood Centers' headquarters.

Currently, IBM Arsenal pushes Neighborhood Centers' data changes out overnight, averaging 400GB, across the Internet to a location in North Carolina. When Comella arrived at Neighborhood Centers three years ago, the organization relied on tape backups, but some of the tapes weren't rotated when the task was left to non-IT professionals at the community centers. When you add in Neighborhood Centers' hurricane-prone location, says Comella, it didn't take much convincing for him to embrace a new data protection strategy.

"The first [online] backup [to Arsenal] took quite a bit of time--a weekend," he says. "Now it's only backing up things that change. They have a nice GUI interface and if they have a problem, like they don't get a good backup, they call and let us know," says Comella. "The point is that they do check [and call]."

Jenny Lorenz is IT director at the Linn Area Credit Union in Cedar Rapids, IA, and a Seagate Technology EVault customer whose IT shop is just outside a 10 square-mile radius that was flooded following severe June rainstorms. One of her locations lost power for a few days and an ATM machine was submerged in the floodwaters. For Lorenz, the benefits of sending her data far away to a dry location are pretty obvious. In addition, her industry requirements were met without heavy lifting from her strained IT staff.

"Seagate's EVault is SAS 70 certified," which is an independent verification that the company has a stable control environment, and "that was a selling point," she says. Before negotiating her SLAs, Lorenz determined which volumes on a particular server made sense to back up and those that didn't. "They charge by the gig and we didn't want to back up everything over and over again," she says. When testing the product, Lorenz found she could schedule backups throughout the day so she didn't have to tax her Internet connection during peak hours.

With Seagate EVault, she gets 24/7 monitoring and notification, a standard offering among most SaaS vendors; however, EVault doesn't offer user trouble-ticket integration, according to the recent Gartner report. In comparison, EMC's Mozy allows tickets to be created through 24/7 customer service, while IBM's Arsenal can integrate with a customer's trouble-ticket systems.

Perhaps what draws users to a remote SaaS firm is the built-in DR that comes with the service. During the flooding in downtown Cedar Rapids, Lorenz was running her EVault product through a routine annual restore test. "It went well," she says. "We've been able to restore backups remotely, use browser technology transmissions of direct deposits and access the data we need." The credit union's servers are 10 miles away from the flood zone and a nuclear facility is also 10 miles away. Says Lorenz: "Theoretically, we could go anywhere in the country if we needed to get away from a disaster, and I could manage the data."