Small Businesses, Big Advances In Backup And Recovery 2Small Businesses, Big Advances In Backup And Recovery 2

Small businesses have an almost alarming array of business continuity and disaster recovery options, from on-site tape to sometimes pricey disk-based appliances to managed services to fully in-the-cloud offerings. With the stakes--and costs--so high, making this call can be intimidating at best, paralyzing at worst. When companies don't have a BC/DR plan, complexity is the most-cited reason, finds our recent information Analytics SMB Business Continuity/Disaster Recovery Survey. Constrained resources runs a close second.

Small-business IT teams need to treat this rich choice of technologies as an asset, a way to meet their often unique needs despite scant resources to devote to business continuity and disaster recovery. We've worked with companies where backup systems languish without upkeep and disaster recovery plans sit on the shelf, untested and out of date. One answer: Integrated data protection plans that combine backup, system imaging, replication, and other features.

After all, SMB IT pros are all about multitasking.

Not only is it is easier to maintain a single system compared with multiple independent products, but Norm Davis, IT director for Chapel Hill, N.C., retirement community Carolina Meadows, sees data protection as a critical component of IT automation--another hot topic for small businesses, especially in healthcare. "We have made a commitment to automate our medical records as part of an overall IT modernization project," says Davis. And because Carolina Meadows is an accredited continuing care retirement community, it's subject to an audit that covers all aspects of running the facility, including data protection. There's little margin for error or downtime.

For Davis, the answer is an integrated backup and disaster recovery system from Zenith Infotech, a service provider that specializes in business continuity. The Zenith system includes server virtualization, data replication, and monitoring to ensure that everything is functioning properly, and it runs in a single server. Although the device doesn't have the horsepower of the community's primary systems, it would allow a vital system--Carolina Meadows' Answers On Demand integrated healthcare application--to be brought back up quickly and completely. As a bonus, Davis says he could pick up the Zenith server and transport it to a business continuity site in the event of disaster.

Many small businesses are similarly reliant on a few major, often highly specialized, applications. Todd Kenworthy, IT manager for the Phoenix Group, a supply chain services and construction logistics company, faced a "fickle application" that didn't tolerate conventional backups, so he got creative. Leveraging a disk imaging application from Acronis to create whole-system backups that could be saved and moved off site, Kenworthy built his own integrated backup and disaster recovery system. These disk images can serve many functions, from daily rebuilding of failed servers to site-wide disaster recovery.

The Phoenix Group is now evaluating service providers to handle the daily operation of the system. "I'm solely responsible to support over 100 users, so I expect a lot from outside services," says Kenworthy. "We experienced a communications outage previously and are adamant that it not happen again. We changed service providers, redesigned the network, and began investing in disaster recovery at that time."

In our survey, most--66%--of respondents have less than 10% of their storage capacity outside their main data centers. However, we expect increased adoption of fully cloud-based and hybrid storage systems to increase as more SMBs adopt technologies, such as deduplication and WAN optimization, that improve the bandwidth picture.

Flexible Fliers

Smaller companies have an edge over larger organizations, which are challenged by the inertia inherent in managing many terabytes and even petabytes of data, expensive deployed equipment, massive data center footprints, and rigid processes that restrict creativity. Small shops like Kenworthy's can improvise and adapt on the fly. Most SMB IT leaders we talk to enjoy having the freedom to work with innovative providers, or even create from scratch systems that precisely match their needs.

"We talked to a lot of vendors and looked at a lot of products," says Carolina Meadows' Davis. "We finally brainstormed ideas with a consultant and jointly came up with a plan. He had installed the product with other clients and was able to modify the solution to fit our needs."

In fact, seeking outside help was the top piece of advice from the small-shop IT managers we spoke with. "That's the only way to approach it for a small business," says Paul Ozburn of Colorado's Boulder Outlook Hotel, which markets itself as a zero-waste hotel. Ozburn's title--revenue ranger and Web wiz--reflects the many hats that SMB IT pros wear.

There are many places to look for advice, but make sure it's unbiased. Resellers often have product preferences of their own, and seemingly helpful voices sometimes have axes to grind. One survey respondent, a physician in a small practice struggling to protect e-medical record data on two servers, relates an all-too-typical experience. "The EMR company supplies the hardware and software, but they are not 'aggressive' on backup strategies," he says. "I suspect there are many small businesses in the same boat. I can't afford a dedicated IT staff. The EMR company is there to service what they sell to us, but are not my advocates."

The IT managers we spoke to also suggest seeking multiple viewpoints and ideas, including peers, resellers, and reviews. For more on the peer perspective, check out our information Analytics SMB Business Continuity/Disaster Recovery research report. We first deployed this survey in January 2008, and followed up in May. While 62% of our 484 current respondents have disaster recovery plans, up from 55% of our 470 2008 respondents, most are based on tape backups. And, if their primary data centers were destroyed, just one in three could bring their mission-critical applications back on line in less than four hours. Even fewer, just 23%, say they could bring their overall IT operations to 95% of normal in that timeframe.

We blame that on one thing: We're still stuck on tape.

Now, we realize that pundits have been predicting tape's death for years, and yet backing up to tape that's then taken off site still clings stubbornly to the title of No. 1 data protection method for our survey respondents; 61% cite this as their primary (40%) or secondary (21%) strategy for data protection.

All we ask here is that you be open minded. While traditional tape-based daily backups are comfortable and familiar, so are sweatpants. Neither, however, is universally appropriate. Disk-based systems using snapshots and replication can provide vastly better levels of service and offer many advantages over tape, particularly in the case of small businesses. Tape drives have proved reliable, but breakdowns still occur, and while larger organizations may have spares on hand, small shops generally need to order expensive replacement drives and miss backups while they wait for delivery. Tape media, although fairly inexpensive, is rarely filled by weekly full backups of small-business data sets, much less the daily incremental backups commonly required. This negates many cost benefits.

Disk is an increasingly popular alternative. More than half of those surveyed report using backup-to-disk or virtual tape library (VTL) technology, up sharply from our 2008 survey. Disk-based backups also enable advanced concepts, such as continuous data protection (CDP), which is becoming more popular in sites with virtual server deployments. Data on disk is easier to replicate off site, and disk is the dominant mechanism for online backup systems.

Time To Leapfrog?

We asked SMB IT pros to rate adoption of 15 data protection methods, from plain-vanilla tape to CDP. The single biggest gainer is use of online services, which jumped to 24% from 14% in 2008. These services are generally not cost-effective for enterprises with huge data sets and multiple sites, but 43% of our SMB survey respondents have less than 500 GB of mission-critical data, and two-thirds have only one main location. Under that scenario, business-class off-site storage would cost just a few hundred dollars per month.

The key words there are "business class." Although that translates to higher costs than consumer-oriented services, the premium buys you a higher level of redundancy and security. These providers also offer enhancements such as multisite storage, encrypted tunnels, and even direct network connections for higher data volumes. But it's business-class support that's often the deciding factor: Consumer-grade options rarely include service-level agreements, phone support, integration services, or customization.

Boulder Outlook Hotel's Ozburn says shopping around can pay off. "We started out looking at personal online backup, but most don't deal with businesses, " he says. "When you say 'business,' suddenly the cost goes way up." But after some searching, the hotel was able to locate an affordable business-class service.

Online backup won't solve all your problems, though. Consider the time required for initial ingestion of data, a process that can strain shared Internet connections for days or weeks without careful management. Some online backup services mitigate this issue by physically transporting storage devices to the remote site initially for quicker local copying. Another problem, as Ozburn found with his online service, is that valuable data can be missed with any server-based backup system.

"If it's not on the server, then it's not going to get off site," he says. That's a policy, not an IT, problem. Phoenix Group's Kenworthy is also looking at online backup services, drawn by the ability to access data from anywhere. Like Davis and Ozburn, though, Kenworthy would still want an on-site copy on disk--just in case. "Online backup wouldn't be a standalone solution," he says. "It has to be part of a bigger picture." Phoenix Group is currently transporting these physical copies off site manually for added peace of mind.

Beyond reassurance, there are many reasons to keep data both on and off site. Most disasters aren't of the biblical seven-day flood variety. Rather, they're local in nature--say, a single server crashing or corrupting its data. There is no need to go to an off-site copy for this kind of operational recovery if a system image is available locally. And these local disks may prove valuable even in the event of a site-wide disaster if they happen to be accessible and transportable, as with Carolina Meadows' Zenith appliance.

Shake It Loose

Although fear of data loss is primal and universal, it can still be difficult to allocate sufficient budget dollars to BC/DR, especially for resource-constrained smaller businesses. Over one-third of our survey respondents without business continuity and disaster recovery plans cite high cost as the primary reason. Phoenix Group's Kenworthy advises being forthright with management about the risk. "Don't be afraid to ask for what you think is best for the organization," he says. A common theme among IT managers is to approach data protection as a business project, not an IT project. Investigate alternatives, and lay out the risks, costs, and benefits of each. And don't forget to include in your presentation the cost of doing nothing, calculated as the financial impact that various levels of data loss would have on the business.

Even among SMBs, government regulations and industry certifications can be big drivers of data protection programs. Nearly half of our survey respondents say they're subject to one or more regulations, with HIPAA called out most often, at 24%. Carolina Meadows' Davis justified the community's data protection investment on the basis of HIPAA and HITECH requirements. "There are many restrictions and regulations relating to medical records," he says. "To protect them, we needed a good disaster recovery system."

The results of an effective plan speak for themselves: After Carolina Meadows installed its Zenith system, it passed its continuing care retirement community certification with flying colors, says Davis. Uncovering such validation points is critical to the long-term success of a data protection project. If upper managers can see the value of continued investment, they're much more likely to support upkeep of the effort financially.

Small businesses are especially vulnerable to disaster: They often depend on a compact data set and a few vital applications, the loss of which would be catastrophic. Yet they also lack the human and financial resources to tackle difficult projects like data protection and disaster recovery. As our survey shows, although modernization is coming, not all businesses have appropriate systems in place.

If that sounds like you, begin by thinking in business terms. Ask trusted partners for advice, and consider paying for outside expertise. Look to server virtualization, data deduplication, and other newer technologies. Get creative in moving beyond tape by evaluating disk-based integrated systems, managed services, and online providers.

Waiting for a crisis and then hitting the panic button may seem like a slick plan to gain funding, but it's also a fast way to lose credibility.

Stephen Foskett is an independent consultant who for a decade has helped Fortune 500 companies integrate information technology with business processes. He's led strategic consulting practices at companies including Nirvanix, Contoural, GlassHouse, and StorageNetworks. Write to us at [email protected].