Offsite Backup and Disaster Recovery Systems: Sending Data to the Cloud!

by Doug Hafford, Afinety+ 25th Anniversary Edition, Fall 2011

In the last year, and especially in recent months, there have been a host of new offerings for both offsite backup and disaster recovery systems.  When considering these highly desirable options, it is extremely valuable to truly understand what you are getting.  Many offerings appear to be similar, yet have wildly different cost structures, so a bit of education on what questions to ask and how to evaluate can help you make a wise recommendation for your firm.

Is Your Data Safe in the Cloud?

Without getting too deeply into terms like SAS70 and the various security certifications, the answer is generally a whole hearted yes!  Assuming you are considering a major name brand supplier, the data centers which store your data are far more secure than your own internal network is, can be or ever will be.  These companies spend vast amounts of money on hardware, software and security engineering to achieve the proper certifications they need to allow them to service highly demanding corporate clients.  Far more than you will ever spend, or need to spend on your local Sonicwall or other firewall.  Often we find smaller firms with only rudimentary firewall capabilities enabled on their Internet router so this should not be a major concern for you – again if you are using a trusted name brand.  In addition, your data is encrypted by these suppliers before it ever leaves your site so that even during transmission to the offsite facility, the data is safe and secure.  In fact, many of these suppliers -- while they can verify backups and ensure the integrity of your backup--cannot actually see the data itself. 

What about MozyPro, Carbonite and other low cost solutions?

Both MozyPro and Carbonite offer “small business backup systems.”  The “small business” part of this refers to basic application support – usually Exchange (email), SQL (database) and Active Directory (Windows Server objects).  Evaluation point number one should be “does the backup solution support my applications?”  The examples above are light duty backups that offer a very low cost however there are some rather significant disadvantages to systems like this.  First, these are only Offsite Backup and not Disaster Recovery Systems (in the opinion of this humble reporter).  Meaning, you can backup to the cloud, but they cannot host you or even provide a backup device to restore from in a major disaster situation.  That however, would be okay if it were not for the most significant issue, which is the speed at which these systems perform backups.  Let’s imagine that you have 200GB of data on your server(s).  Let’s further imagine that you have a full T1 line running at 1.5mbps which is a common connection speed today.  Your initial backup is sent over the Internet connection with these products so in this scenario, it might take two to three weeks (yes, you read that right) for the initial backup to complete.  Until it is completed, you have NO backup at all.  So, is that something you are willing to risk?  With this in mind, let’s imagine a disaster where you have to restore that 200GB.  Guess what?  Data comes down at the same speed it went up so; can your firm go 3 weeks without computers, data or applications?  I’m sure I know your answer.  Thus, these solutions don’t really work unless you have a very small amount of data and a very fast connection speed.  Please remember that any Internet connection has both an UP and a DOWN speed.  Cable connections for example often have very fast DOWN speeds, sometimes near 20mbps or more, but the UP speed – which is used by your backup solution – might be less than 1mbps.   So while web surfing is fast, pushing data UP to the web can be quite slow.

We have now arrived at evaluation point number two:  Does the backup solution allow “seeding?”   This means that an initial backup is run – usually to a large USB drive – and shipped off to the data center.  The initial backup time is shortened to a day or so and recovery can be done in the same way.  In a disaster, a USB drive or other device is shipped to your recovery location and your system can be quickly restored to its full operational capabilities.  This is a highly desirable feature and most would call it an essential feature to any offsite backup system.

What is the difference between Offsite Backup and Disaster Recovery?

Certainly a good backup system is part of any disaster recovery plan, whether it is a tape, USB drive, Offsite Backup or a full DR product.   However there are systems which allow not only backup and restore once your system is rebuilt, but can also host your network in the event of a significant disaster.  In most of the offsite backup solutions we see in the field, a full disaster, meaning that your office is unavailable for some reason, is handled by the backup hosting company sending a large storage device to a NEW site and allow you to use that to restore your data.  When you consider a solution like this, keep in mind that realistically, you are about one week away from being back in business.  Often this is good enough, but your partners and staff should be aware of this time frame (known as Return to Operation).  One week comes about from the following timeline:

1. Locate a suitable facility that offers power, AC, Internet etc. – 2 days.
2. Order and receive the necessary hardware to run your system – 2 days.
3. Restore from the backup device – 1 day.

This IS of course if you are very, very lucky.  Imagine a regional disaster where everyone is trying to do the same thing you are!  It is entirely possible that it might be two or even three weeks.
A full disaster recovery solution will offer hosting.  This means that your servers can be quickly loaded at the hosting facility and accessed remotely (usually via Terminal Services or Citrix) right away.  Providers like this can cut your Return to Operation to 48 hours or even less, depending on what you want to spend.  Thus, our next evaluation criterion is “Does the system offer hosting in a disaster?”

Now the Tricky Part!

Quality Backup and Disaster Recovery systems can take two forms.  Image based and File based.  Image based backup systems have some nice features however they have one fairly significant problem.  A backup “Image” can quickly be restored and handled quite easily by the backup system however, an image can become corrupt.  A corrupt image may behave exactly like a good one, but be useless in a disaster.  So an image based backup might report that its completing backups, be able to restore a single file or folder without difficulty but when the “stuff” hits the fan, a client can find that they have no restorable image because of corruption that was never detected.  These types of backup systems generally recommend testing on a periodic basis, either semi-annually – say twice a year – or annually.  However, when we encounter these systems at a potential client site and ask, “How often do you test?” the response is almost uniformly “Test?”  Now I don’t want to be too harsh on image based backup.  Most of these work just fine and corruption is fairly rare however, there IS a very good reason the vendors want you to test every 6 months and if you have this type of backup, you MUST test.  The price of these backup solutions can be higher than stated because generally, the testing has a cost over and above the normal monthly storage based charges.

File based backup systems do not have this issue and can be routinely tested and verified for integrity as part of the normal backup procedure.  Since each file is verified as identical at the block level (that’s a real low level, trust me on this!) testing is normally NOT required.  Clients may however wish to test things like a failover scenario to ensure that they can be hosted in a disaster.  That’s simply thinking ahead, but it’s not about data integrity but rather the supplier’s ability to perform.  This brings us to our next evaluation point, “Is the backup system File or Image based?”

What’s next?

All of these solutions are falling in price month by month.  At the same time the price of high speed bandwidth to accommodate an offsite backup or disaster recovery solution is also falling.  These solutions, once reserved only for larger firms, are becoming more and more accessible for smaller firms with more limited budgets.  It is a very good time to contact your trusted advisor and examine some of the offerings that are available now.  If you have something in place, it might be time to look around and make sure you have the best available price to performance solution for your firm.  At the same time, look at your bandwidth and see if you can improve that as well.  Me?  I’m looking forward to writing a similar article next year with even better backup solutions!