Zetta Scalabytes Blog

This blog is focused on sharing best practices for enterprise online backup and disaster recovery from Zetta's founders and leaders.

Archive for the ‘Compliance’ Category

nmueller

May 09, 2012

11 Features to Look for in an Online Server Backup Solution

Nick is Zetta's Corporate Reporter, and has been writing and telling stories about technology with blogs and social media since the days when the BBS reigned.

Security Breach
Here’s the situation many SMB IT directors are facing when they come to us — their business has critical data that needs to be backed up offsite but the existing server backup solution has technical limitations or cost restrictions. Usually they have about 2TB of data — a mix of files with important IP, and data from SQL, Exchange, and web servers.
 
Their goal is to add functionality and simplify the tasks around backup, so IT staff can concentrate on building and supporting services that forward business goals.
 
They know that investing in tape backup isn’t the right choice and that “hybrid cloud” solutions based on appliance hardware just mask terrible data transfer performance.
 
Depending on the environment & budget, Zetta Data Protect may be the right choice. Even when we’re not, this is the advice we give to IT Directors on what features to look for when selecting a cloud backup service:
 
1. Ease of Set Up
 
The backup agents should install in minutes and then require only a few clicks to establish the appropriate policies.
 
2. Multiple OS Support
 
Most online backup services support Windows laptops and servers. A more complete service also supports Linux and Apple’s Mac OSX.
 
3. Lightweight Agents
 
To minimize the disk and CPU load on servers and laptops the software backup agent should be very light. To reduce the amount of network traffic, there should be agents for each device that can detect any changed files or blocks and send only those changes to the backup site.
 
4. Automatic Validation
 
The service should include immediate verification of all backups when they occur and regular bit-by-bit checks on the backed up data to ensure it will restore properly. Any restores also need to be validated for accuracy.
 
5. Data Deduplication
 
The backup vendor should provide data deduplication so you are not paying to have multiple copies of a file backed up.
 
6. Multiple Backup Instances
 
The backup service should create multiple copies of the data and offer to store it at more than one data center so that whether a disk, a rack or a whole data center goes offline, you still have instant access to your data.
 
7. Ease of Restoration
 
Single files and folders should be able to be restored by just dragging them from backup onto the server or laptop. Restoring entire servers should be as simple as mounting the drive from backup.
 
8. Browser Access
 
Both administrators and users should be able to access the backup through a browser rather than having to load and learn a specialized backup interface.
 
9. Self-Service Restoration
 
There is no reason for IT to get involved when a user accidentally deletes a file. End users should have permission to see and restore their own files from the remote location but not be able to view, access or alter any other files.
 
10. Multi-Platform Support
 
The files should restore to any platform, not just a duplicate of the server that created it. This gives the customer greater flexibility in upgrading systems or using alternate equipment at a DR location.
 
11. Reporting
 
The backup vendor should provide daily reports of all backups as well as regular SSAE-16 service audits to maintain compliance with existing standards.
 
This is the list of features to look for in a online server backup provider. Beyond these, you also want to make sure that the vendor is one that focuses on providing complete business-level backup services, not just a bunch of disk space, and has the expertise needed to optimize a solution that meets all your current and future needs.

nmueller

May 01, 2012

Security Practices All Cloud Backup Vendors Should Follow But Don’t

Nick is Zetta's Corporate Reporter, and has been writing and telling stories about technology with blogs and social media since the days when the BBS reigned.

Security Breach
Companies that want to add cloud backup services to their data protection strategy sometimes hold off because of concerns about security. These concerns take the form of questions like:
 
• Once data leaves my premises, can someone unauthorized see it?
 
• Can someone change my data?
 
• Can I meet my compliance requirements if my data is stored in an online service?

 
If cloud backup vendors can’t answer these questions in the right way, an IT director is compelled to go through the expense of purchasing and maintaining their own backup servers, disk arrays, tape libraries and appliances, along with all the security software, protocols and audits needed to keep everything secure.
 
Unfortunately, keeping data onsite is not necessarily any more secure than having it in an offsite data center. Every week there are news reports of data being stolen from a bank, credit card company or retailer, not to mention breaches of secure government servers.
 
What’s important is what security systems are in place, not where the data is stored. This is especially true for organizations that have compliance requirements like:
 
• The health information privacy and security rules of the Health Insurance and Accountability Act of 1996 (HIPAA)
• Financial Industry Regulatory Authority (FINRA) data security and privacy rules.
• Family Educational Rights and Privacy Act (FERPA) regulations on access to student data.
• Securities and Exchange Commission (SEC) Rule 17a-4 which “requires that the electronic storage media preserve the records exclusively in a non-rewriteable and non-erasable format.”
Sarbanes-Oxley Act of 2002 (SOX) Section 404 on auditing internal controls over financial records.
 
Old Fashioned Data Security
To keep ahead of hackers, it makes sense for small and medium sized firms that lack in-house security and compliance teams to use a secure cloud backup service like Zetta. The must-have cloud backup security features are:
 
1. The data is encrypted both in transit and at rest.
2. The data is stored using advanced RAIN-6 (Redundant Array of Independent Nodes) that ensure that even if two entire storage nodes go down, not just two disks, the data is still available.
3. File level hashing to validate that all the data is free of corruption so it can be restored when needed.
4. Storage in SAS70 Type II data centers under audited service procedures.
5. Data immutability and preservation procedures for compliance with regulations such as SEC Rule 17-4a.
6. Service Auditors to the Statements on Standards for Attestation Engagements No. 16 (SSAE-16) certified service
7. User and group level access control to limit data access.
8. Authentication and logging of all access to your data.
 
When a backup service provider offers this level of data protection, it can be safer to move backup offsite than keeping the service in house. With such a service, even small business can achieve enterprise-level security and reliability, all at a fraction of the cost of hiring in-house experts.

nmueller

April 12, 2012

Great Cloud and Online Backup Solutions are Made, Not Born

Nick is Zetta's Corporate Reporter, and has been writing and telling stories about technology with blogs and social media since the days when the BBS reigned.

Best Online Backup
It was an honor today to find Zetta included in InfoStor’s 6 Great Cloud and Online Backup Solutions. The companies featured are a mix of consumer and business solutions and we’re thrilled to be compared with a legendary product like Symantec’s Backup Exec.
 
Of course, Zetta is unique on the list for being the only true enterprise-grade solution for SMEs. What makes Zetta’s DataProtect unique?
 
1. Enterprise-grade Performance, Redundancy, Security, and Support
 
We say “enterprise-grade” performance because of the speed of both backup and recovery you’re able to achieve using Zetta’s sub-file level technology and multi-threaded data transport over the internet. If speed is an important criteria for your organization, we challenge you to sign up for a free trial and test us against any other online backup provider.
 
2. Redundancy Across Disks, Nodes, and Datacenters
 
The DataProtect solution offers RAIN-6 (Redundant Array of Independent Nodes) redundancy technology, which stripes your data across independent computers keeping it safe whether there is a network, power supply, memory, or disk failure. RAIN gives rise to greater availability of the backup service, so it’s always there for backing up or restoring your data.
 
Zetta customers also have the option for their data to live in both our West Coast and East Coast datacenters.
 
3. Real Data Security
 
All Zetta customer data is encrypted at rest in our SAS70 Type II certified and SSAE 16 certified datacenters. This means compliance with many different industry data availability standards. Consumer-grade or white-labeled backup products are nowhere close.
 
Included in your monthly fee is 24×7 live support from our friendly engineers here in Sunnyvale, CA. They tend to solve issues really quickly then go back to building epic Star Wars Lego sets.
 
4. Appliance-Free
 
As Steve Jobs famously said, “If you see an appliance, they blew it.” Well, he said it about iPad competitors, but the meaning is true for enterprise cloud backup services.
 
5. Zetta Is Made For SME
 
If your organization has 2TB to 50TB of data to backup offsite then Zetta is the best choice you can make. Since Zetta is delivered as a managed service, there’s never a charge for the number of clients or plugins like SQL, Exchange, or VMware. And absolutely no bandwidth charges. Ever.

Jeff Bell

December 16, 2011

3 Waves of SEC17a-4 Compliance — Now an Easier Route

Jeff runs corporate marketing for Zetta. Prior to Zetta, Jeff was VP of Marketing at Pivot3 and VP of Marketing at Pillar Data Systems.

Wall Street
In an uncertain economy, financial businesses have enough to worry about just protecting their customers’ money from losses. They don’t need the added burden of both protecting their customers’ data from being compromised or lost while also maintaining compliance with SEC Rule 17a-4.
 
For years, brokers and dealers have had to comply with SEC Rule 17a-4 which, among other provisions, requires the retention of certain data in an immutable format. Any communications between brokers and their customers needed to be captured and retained so that any statements, claims or guarantees could be retrieved later in the event of a lawsuit or regulatory action.
 
While the regulation is not new, companies are finding that earlier technologies and procedures for storing data no longer meet evolving business needs. To begin with, the sheer volume of data being created continues to grow. Secondly, in addition to email, there are new channels of customer communication — Twitter, chat, FaceBook and others — which may be subject to this rule.
 
Initially brokers and dealers could send the data over to a Write Once Read Many (WORM) optical drive system for storage. Once the data was on the drives, it could not be altered or deleted. But as data storage needs have continued to grow, WORM drive technology has become obsolete. WORM drives depended on proprietary technologies and the solutions were simply not scalable to the levels now needed.
 
The next generation of solution was built with specialized “compliance” storage systems such as EMC Centera storage arrays. These used hard drives, which could be erased, but by using a combination of hardware and software features, the systems were able to create the effect of immutability using hard drives. This again worked well for a while, but became too costly as the data volumes escalated, resulting in the need for ever larger disk arrays.
 
Now there is a third generation of compliance solutions that address both increasing volumes of data as well as the evolving technologies. With the emergence of the cloud, brokers and dealers can migrate their compliance archives from complex, costly, proprietary solutions to a scalable, on-demand service.
 
Zetta’s SEC17a-4 Compliance service is built upon the normal Zetta cloud data protection solution, but with added features needed for compliance, including creating a 17a-4 storage volume that is immutable. For example on any volume designated for 17a-4 compliance, the ability to delete or change files after their initial storage is disabled. All the data is on an administrator-established retention schedule, seven years by default.
 
Zetta stores the data in its native file format. Many other cloud service providers change the file properties when they store customers’ data, and then reconvert it when providing the data to the customers. Zetta maintains the original file contents and format, not changing the data in any way.
 
When the data is ingested into the Zetta storage servers, a strong crypographic hash, or fingerprint, of the file is created and stored in parallel with the the original files being stored. This strong crypographic hash allows for independent verification that the file is identical to when it was initially stored, with no modification, either intentional or unintentional. These hashes are combined with enterprise grade, durable storage including Zetta’s RAIN-6 topology and strong crc’s which further ensure that your data is protected at a block and logical level.
 
The security and operation of the system is verified in two ways. First the controls at the Zetta data center undergo a SAS 70 Type II [to be SSAE-16] annual audit. In addition, the data retention service also receives a third-party SAS 70 Type II [to be SSAE-16] compliance audit every year.
 
Using Zetta for SEC17a-4 compliance provides companies with a scalable solution to meet growing and changing needs. As storage and communications technologies change, the underlying Zetta technology changes, without impacting the customers. Brokers and dealers do not need to worry about buying and maintaining their own archival storage system, they only pay for the exact amount of storage needed and Zetta takes care of the rest. When the files need to be accessed for analytics or e-discovery, the files do not need to be restored or moved to a new volume, they are easily accessible through a web interface directly in place at Zetta.
 
For more information, see the Zetta SEC17a-4 information center.


Warning: require_once() [function.require-once]: URL file-access is disabled in the server configuration in /var/www/html/_wp/wp-content/themes/zetta/footer.php on line 95

Warning: require_once(http://info.zetta.net/wp-content/themes/zetta/scripts.php) [function.require-once]: failed to open stream: no suitable wrapper could be found in /var/www/html/_wp/wp-content/themes/zetta/footer.php on line 95

Fatal error: require_once() [function.require]: Failed opening required 'http://info.zetta.net/wp-content/themes/zetta/scripts.php' (include_path='.:/usr/share/php:/usr/share/pear') in /var/www/html/_wp/wp-content/themes/zetta/footer.php on line 95