Garrett Brown,
CEO of Mantra Computing

⟵  Back to Blog

Guest Blog: In a Cloud world, does backup still matter?

This guest blog was written by Garrett Brown, CEO of Mantra Computing

If your business is in the Cloud, don’t let ignorance be bliss. You may regret it!
I recently worked with a client, a law firm, on their Business Continuity plan. A Business Continuity plan is simply a document that spells out how a business will respond to different kinds of business interruptions including systems failures or catastrophic events.

Like many businesses, they’ve been working to migrate many of their systems to the Cloud. As I reviewed the different failure scenarios (ie, fire/natural disaster, hardware failures in the office, Office 365 becoming unavailable, Cloud app becoming unavailable, etc.) we realized that unlike the in-house systems where we have multiple backups, online back up and failover, we really had no way of recovering if the Cloud solutions became unavailable or lost their data. The only option was to wait for the service to become available again and hope to recover the data.


A Cloud Provider Perspective: Trust us, our availability and retention systems are enough!
Several years ago I sat in a seminar put on by Microsoft for its Partners designed to educate and promote their evolving Cloud solutions including Office 365. One of the Partner participants asked “how are we supposed to backup the client data in Office 365.” The Microsoft representative seemed totally puzzled and annoyed. He simply said the systems will be available and offered an additional MS solution to enable mailbox archiving for an additional cost. For Microsoft Partners, this was a shocking perspective since MS has been promoting backup best practices through their certification programs for years. This kind of laissez faire response about backup is typical among Cloud providers. The Cloud is supposed to be simple, secure and easy, like turning on the switch from a utility. It turns out that backing up your data offline from a Cloud solution is difficult and is often an unbudgeted cost. So these questions are often swept under the rug by the providers and ignored by the subscribers.


Availability and retention, how does it differ from Backup?
Most Cloud solutions rely on availability and retention solutions to protect your data. This means they have sophisticated systems and redundant infrastructure so that if their system suffers a failure, their systems will remain available. They also keep multiple versions, changes and deletions for a certain amount of days. But it’s important to remember that availability and retention are not a backup strategy. A backup strategy employs unique copies of data in disparate systems, physically separated from production systems. They employ good retention policies that can keep copies of data for at least several months, a year or possibly longer. A good backup strategy also takes into account recovery of data to production or backup system and how long that recovery will take (Time to Recovery).


So how secure is my data on the Cloud? The truth is cloudy.

I looked at the Service Level Agreement (SLAs) and Master Service Agreements (MSAs) of several of the big Cloud providers to see what they actually do to protect your data.

Salesforce
Salesforce’s seems to be one of the most limited I’ve seen on the market. Their MSA says they will “…use commercially reasonable efforts to make the online Services available 24 hours a day, 7 days a week, except for:… (List of exceptions)” There is no statement ensuring backup of data or change retention. They also clearly spell out that the most they can be liable for under any circumstance is 12 months of services paid. If they lost all of your Salesforce data or couldn’t recover your account for 1-2 weeks, is that enough for you to stay in business?

Microsoft Office 365
MS’s SLA is a bit more confusing as they provide a financially guaranteed uptime formula for compensation called Service Credits. Service Credits “…are your sole and exclusive remedy for any performance or availability issues…” The financially guaranteed uptime guarantees makes no guarantees of data integrity specifically but they do spell out all the efforts they make to protect your data. Like Salesforce, they also make no claims of backups. They do indicate they replicate data between 2 or more geographically disparate data centers and make other specific efforts to prevent data loss. If MS lost some or all your data or couldn’t recover your account for 1-2 weeks, would receiving the financial benefits described in the Service Credits be enough for you to stay in business?

G Suite/Google
Google provides their Terms of Service as well as a SLA, but provides very little detail in terms of data protections or guarantees. They do offer an additional document on security here, which outlines some of their technologies and systems to protect customer data. The TOS and SLA specifically address “down time,” the period for which their service are unavailable. They offer similar language as Microsoft and offer Service Credits as a customer’s “…exclusive remedy for any failure by Google to meet the G Suite SLA.” If critical GoogleDocs become corrupt or unavailable for an extended period of time, how resilient would your business be?


What is the risk, is Google/Salesforce/MS likely to lose my data or go offline for an extended period of time?
The short answer is no, it is unlikely and the risk is low that any of these large Cloud solutions providers will lose your data or will remain offline for an extended period of time. These providers are heavily invested in the protections of your data and the availability of their systems. For their own credibility and future of their business, there is a heavy burden to make sure their systems meet the expectations and needs of their users. One major loss of data or extended down time could significantly hurt their credibility and possibly put them out of business. It may be the case that some of the smaller and niche Cloud providers represent a higher risk though, as they likely don’t have the same systems and resources that MS, Google and Salesforce do. But hope and ignorance are not a plan and there is always some risk. These Cloud businesses work on large scales, so the loss of 100 Google Docs, while important to you, is likely not going to rock the Google ship! Getting resolution to 1 or 2 missing or corrupt Google Docs is not going to get a fast and personalized response even if they are critical to your $1M contract.


Betting on the Cloud is like going on a cruise
When I think about the question of risk with Cloud services, I always think of going on a cruise. Cruise ships are sophisticated giants, like floating cities, that roam the World’s oceans. They rarely have problems and have so much girth and sophistication that they can manage most challenges (Weather, systems failure, medical emergencies, food, etc.) But when things do go wrong, the outcomes can be disastrous. You do not want to be stuck on a cruise ship during a major storm, system failure, Norovirus outbreak, etc. And we still do keep lifeboats on board for a reason.


What should I do, I love what the Cloud does for me and my business?
No one is arguing for not using Cloud solutions. In fact, leaving Cloud solutions out of your businesses technology arsenal will limit your competitiveness. But business owners and managers must treat Cloud solutions as a critical business relationships rather than the as a “utility” as is promoted by the Cloud industry.

To make sure your business is strong, you must make sure these relationships are strong. Business owners and managers should do the following:

Evaluate what Cloud solutions are in use and what functions they play within your operations

Determine risks to your business should Cloud service or data become unavailable

Evaluate existing contracts and determine what can be changed or enhanced to limit risk

Implement backup and recovery solutions to mitigate identified risks

Evaluate business continuity and cyber insurance to ensure your risks are properly covered

Review Cloud relationships regularly to make sure your plans are still adequate for identified risks and newly identified risks

Ultimately, managing a Cloud solution is no different than what we’ve been doing for years to manage internal in-house infrastructure. Going to the Cloud has not eliminated the risks of technology failure, it has only shifted the operational burden. The risks still need to be identified and managed.