Using an online data backup service for offsite data protection storage is an attractive alternative to tape and/or disk backup. Your company can save money and manpower on management overhead, physical maintenance and protection of equipment, and trade capital outlays for operating expenses.
But, as with other SaaS options, there are important security questions to address before you trust your critical data to an offsite service provider, such as access controls, encryption and mutual alignment of security policies.
Online backup access control and availability
Online backup access control policies should be similar to on-premise policies, with some new wrinkles. In both scenarios, there will generally be an overall admin, who, in turn, assigns access roles and authorization privileges to other users, such as IT staff responsible for backups and help desk personnel handling requests for data restoration.
Online backups give you more flexibility because you can give anyone access through the online portal, if you choose. Database administrator may be given authority to restore data, or even allow end users to restore their data without putting in a help desk ticket. This takes a lot of the day-to-day workload off your IT staff. But, it also means more complex access control rules and, therefore, a greater risk of users getting too much access.
"Some organizations would rather manage the environment themselves to avoid the risk of accidently providing access from one user's machine to another's," said Darren Niller, group product manager for Cupertino, Calif.-based Symantec Corp., which offers both online and onsite backup.
Generally, all this means that your data is more readily available than with onsite backup. IT staff can find, access and restore online data quickly. If your policy allows, lower level users have quick and easy availability too. On-premise backups can be prone to failure and tapes can get lost, overwritten too soon or simply wear out.
The one caveat is cases in which you have to restore large amounts of data, such as a complete restoration of a failed server.
In these cases, downloading hundreds of gigabytes -- or more -- simply may not be feasible given bandwidth constraints and your tolerance for downtime, depending on the criticality of the server.
"If you need to get your Exchange server back up as quickly as possible," said Lauren Whitehouse, a senior analyst specializing in data protection for Milford, Mass.-based Enterprise Strategy Group (ESG), "the bad news is that all your data is on other end of a wire. It's impractical to recover a whole server."
In these cases, online backup vendor will generally overnight a backup drive, but that may be too long.
Make sure backup data is encrypted
Think about encryption in terms of on-premise backups, especially if you ship copies of backup tapes offsite for disaster recovery protection. Tapes get lost or stolen. Disk-based backups might be hacked or viewed by employees who intentionally or inadvertently gain unauthorized access.
Encryption becomes even more important, for security and compliance, when you ship data offsite, where you can't be sure -- vendor assurances notwithstanding -- who can get access to it.
Make sure your data is encrypted as it is backed up, preferably using 256 bit AES, transmitted over SSL using digital certificates, and remains encrypted at the backup facility.
As with any encryption, key management is a consideration. This can get a little more complex with online backup, since, as discussed above, it is easy to delegate access, meaning more people with more keys. Unless you are investing in a commercial key management system, which is probably overkill for most midmarket companies, this generally means manually maintaining key logs and securing them so only high-level admins have access.
Alternatively, a few online backup companies offer escrow accounts for keys, either themselves or via third-party specialists.
Check into vendor security
The information resting in remote data centers is by definition, essential to your business. That's why you are backing it up in the first place. Make sure the service provider's facilities and procedures are not only as secure as, but significantly more secure than yours. One of the reasons to opt for online backup is that you don't have the resources or expertise to invest in top-grade enterprise data security.
"For many midmarket organizations, third-party service providers often have better, more secure environments for physical and digital security than at the primary site," said ESG's Whitehouse.
Questions to address include:
- Is there redundant backup/storage? Service providers' are subject to system failures like everyone else. Make sure your provider has mirrored data systems that take over transparently.
- Is there geographic redundancy? If an entire site goes down, it's good to know that another picks up without a hiccup.
- Do they run their own data centers, or do they outsource?
- Do they conduct regular pen testing of their applications and their systems?
- One good measure of a company's security is SAS 70 audit, especially Level II, in which the auditor attests to the effectiveness of the controls that are in place.
