Do you need to worry about backups in the cloud?

Author Prodosh Banerjee on 24 March 2021 Prodosh Banerjee's blog

Whether you, as a customer, need to worry about backups in the cloud depends on the kind of service you are using and if the provider offers backups for their services. Even if the cloud provider offers backup solutions, you need to find out if the backups are part of the service or if they need to be setup separately. Whatever the solution, the customers need to have a plan for how they can recover from data loss, server loss or a data centre disaster and understand which part of the recovery is their own responsibility which is delegated to the service provider.

But, first let us try to understand which scenarios backups are designed to address: 

1. To restore accidentally deleted or corrupt data (e.g. files or database data). The most common use of backups is to restore files and sometimes database data, which has been deleted or is corrupted. 
2. To restore a server (VM). An example of this is, when a server refuses to boot (restart), after applying a security upgrade to the operating system. When there is no other solution, the full server would need to be restored to a state before the upgrade was made.
3. To recover from a natural or man-made disaster, which in the worst case, may rendered a whole rack, room in a data centre or a whole data centre unusable (for example due to a plane crashing into a data centre or a flood). This case is usually referred to as Disaster Recovery (DR), Business Continuity Planning (BCP) or Business Continuity Management (BCM). We cover this case in detail in a separate blog post, but suffice it to say here, that the most basic solution, is to recover all your servers and data from backups. 

Customers need to understand, that whatever technical solution they use, whether on premise hardware (in house IT) or a cloud solution, it is their responsibility to at least know and document, how they will recover from the above three cases. 

Often customers think that by going to the cloud, they don’t need to worry about making backups themselves anymore. In this blog post, we will look into when this is true and when not. It is important to emphasize that in both cases, it is still the customer’s responsibility to know how each of the cases above will be addressed.

Learn more about how Safe Swiss Cloud can help you backup your data to the cloud.

REQUEST BRIEFING

Types of Cloud Services

Broadly speaking, there are two main types of cloud services:

1. Infrastructure as a Service (IaaS). Typically this type of service is consumed by customers in self-service mode.
2. Software / Platforms as a Service (SaaS / PaaS). These services are generally “managed” by their provider and will usually include backups.

Let’s look at these in detail.

Backups for Infrastructure as a Service (IaaS)

Cloud infrastructure services (IaaS) generally are modular allowing customers to choose what they need from a menu of computing units, VMs (virtual machines), storage and networking. In this scenario, storage for backups is just another resource that the cloud infrastructure provider makes available, under the assumption that the customer will want to make their own backups with a program of their choice, as often as they want. 

Sometimes providers offer backup services (software and storage), which customers can use, while other times only backup storage is provided, leaving the choice of backup software, scheduling and resources to the customer. 

In Safe Swiss Cloud’s own Enterprise Cloud, for example a self service backup system is provided, including Veeam software and backup storage and the customer just has to select what they want backup up and the frequency. Customers can also choose their own backup software and use Safe Swiss Cloud’s S3 compatible object storage to write their backups to.

Backups for Software and Platform Clouds (SaaS – Software as a Service and PaaS – Platform as a Service)

Examples of these include Safe Swiss Cloud’s own Data Drop solution (a fully managed service), Salesforce, Gmail etc. In all these cases, the cloud provider offers a service which customers consume without having to worry about how the service is set up. In these examples, the providers offer different types of service level agreements (SLAs) which specify the terms and conditions for recovering from one of the three use cases listed at the beginning of this blog post, namely, loss of data, loss of a server and loss of a data centre. 

The customer needs to satisfy themselves, if the terms and conditions applicable to the restoration of data, servers or a complete virtual data centre, meet their business requirements. These are usually quantified in the form of the minimum return point objective (RPO) and the maximum time needed to complete a restore, the return time objective (RTO).

Important things for customers to consider about restores and recovery

Can restores happen quickly enough for the business?

If you face a situation where a restore is needed, the most important question is, how long will it take the restore to complete? If the estimated time required is longer than is acceptable for the business, then the restore strategy will need to be reconsidered. In this example, regular snapshots could be a solution, because it would allow a full VM to be restored quickly.

What if a whole data centre is affected, will the backups still be available?

You need to check with your cloud provider if the backup storage they make available to you, is in a different data centre than the one where your computing resources are. A recent event in France, in March 2021 illustrates the importance of this. A data centre of a cloud provider caught fire and burnt down. The fire spread to two neighbouring data centres and a fourth one was threatened. As a consequence, many computing and storage resources were irrevocably lost, so that many customers faced a complete loss of computing resources, data and backups. Some of the affected customers had backup data in a different room of the same data centre, others had backup data in a neighbouring data centre, which were affected by the fire. 

The most important take away is to make sure you know the details of their provider’s backup storage and disaster recovery plans and make an informed judgement about whether the provider’s practices meet theirbusiness requirements. Note that it would be a mistake to lay the blame solely at the feet of the affected cloud provider, because in many cases, some cloud providers prioritise low priced infrastructure based on customer demand.

At Safe Swiss Cloud, backups are always made to or backup storage provided in a different data centre, which is many kilometres away in a place with a different risk profile (e.g. above ground vs. in an underground nuclear bunker). Veeam backups for our Enterprise Cloud product are even mirrored across multiple data centres to ensure fast availability of the backups, even if one of the backup data centres should be unavailable. We believe that planning for all kinds of eventualities is an integral part of cloud and data centre best practices. After assuring this high level of quality, Safe Swiss Cloud is able to provide enterprise grade cloud infrastructure at competitive prices. 

What if the end users do not accept the recovery time planned by IT in case of an unexpected event?

This is where the IT management of a customer will need to be proactive in informing their end users and management about the recovery scenarios they have planned for, and get them on board with the chosen solution. For example, they may choose a single data center computing solution with backups in a different data center with the following restore/recovery times:

• Restoring a deleted file:  1 hour
• Restoring an unusable server:  4 hours
• Recovering from a catastrophic data centre problem: 1 week

The management and end users may prefer a recovery time of 1-2 hour from a catastrophic data centre event e.g. a plane crashing into the data centre. It is possible to meet such a requirement using a dual data centre solution, Management may decide that the cost is too high and accept the business risk associated with a one week outage related to a very unlikely data centre outage. If they are from an industry classified as “system relevant”, e.g. a hospital or bank, then this risk would not be acceptable and they would go for a dual data centre solution and have to accept the higher price tag. 

We will look into the details of when a dual data centre solution is appropriate in an upcoming blog post. This illustrates how a customer’s IT team can sensitise management and end users to the risks of their IT solutions without getting too technical and get their buy in for the choices made.

Conclusion

• Typically, when customers use IaaS services, they need to organise backups themselves or enter into some sort of a “managed service” agreement with their provider, which will allow them to delegate responsibility for the backups and restores. 
• In the case where customers are using a SaaS or PaaS, they need to verify that the provider is making backups inline with their business requirements and if not, organise alternative backups to cater to their specific recovery requirements. 
• Finally, customers must be aware of how long a recovery for minor data loss (e.g. unintended deletion of data), loss of a server (e.g. a server update gone wrong) or a catastrophic data centre event would take, and ensure these are acceptable to the business. 

Learn more about how Safe Swiss Cloud can help you backup your data to the cloud.

REQUEST BRIEFING