{"id":8231,"date":"2019-07-06T10:13:58","date_gmt":"2019-07-06T00:13:58","guid":{"rendered":"https:\/\/nsrd.info\/blog\/?p=8231"},"modified":"2019-07-06T10:14:03","modified_gmt":"2019-07-06T00:14:03","slug":"the-perfect-cloud-environment-is-the-perfect-headache-for-data-protection","status":"publish","type":"post","link":"https:\/\/nsrd.info\/blog\/2019\/07\/06\/the-perfect-cloud-environment-is-the-perfect-headache-for-data-protection\/","title":{"rendered":"The Perfect Cloud Environment is the Perfect Headache for Data Protection"},"content":{"rendered":"\n<p>It practically goes without saying that the smartest way to move workloads to a public cloud is to have them completely refactored to run as a SaaS based application. At that point you&#8217;re paying for the application and its data services, nothing more and nothing less.<\/p>\n\n\n\n<p>Yes, you can lift-and-shift your virtual infrastructure. Taking an application running on a virtual machine that&#8217;s designed to basically soak resources (because you&#8217;ve already purchased the server, right?) and plonking it into IaaS is the fastest and most efficient way to blow a yearly IT budget in a quarter or less. <em>It&#8217;s been done.<\/em><\/p>\n\n\n\n<p>There&#8217;s a variety of different Cloud operating models of course, but the pinnacle in terms of simplicity, the alpha and the omega of the Cloud world, is Software as a Service. And it&#8217;s a looming headache of gargantuan proportions.<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img loading=\"lazy\" decoding=\"async\" width=\"900\" height=\"600\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/bigStock-Headache.jpg\" alt=\"\" class=\"wp-image-8234\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/bigStock-Headache.jpg 900w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/bigStock-Headache-300x200.jpg 300w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/bigStock-Headache-768x512.jpg 768w\" sizes=\"auto, (max-width: 900px) 100vw, 900px\" \/><figcaption>The Growth of SaaS is Not Without Its Challenges<\/figcaption><\/figure>\n\n\n\n<p>Simon Sharwood at CRN Australia reports:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>Australia&#8217;s &#8220;cloud&#8221; market is mostly software-as-a-service, says analyst house IDC.<\/p><p>The firm&#8217;s new tracker of Australian cloud services revenue from 2016 to 2018 found that revenue in [sic] reached $4.01 billion in 2018, 30.6 percent year-on-year growth.<\/p><cite><strong><a href=\"https:\/\/www.crn.com.au\/news\/australian-cloud-is-66-percent-saas-idc-527689\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"&quot;Australian cloud is 66 percent SaaS: IDC&quot; (opens in a new tab)\">&#8220;Australian cloud is 66 percent SaaS: IDC&#8221;<\/a><\/strong>, Simon Sharwood, July 4 2019, CRN Australia<\/cite><\/blockquote>\n\n\n\n<p>Simon goes on to describe that SaaS represented 65.8% of that spend &#8211; rounded to 66% for the headline.<\/p>\n\n\n\n<p>Blissfully, which bills itself as providing tools to track and manage SaaS usage within organisations, provides reports on adoption rates (<a rel=\"noreferrer noopener\" aria-label=\"2018 Q1 (opens in a new tab)\" href=\"https:\/\/www.blissfully.com\/saas-trends\/saas-trends-report-q1-2018\/\" target=\"_blank\">2018 Q1<\/a>, <a rel=\"noreferrer noopener\" aria-label=\"2019 (opens in a new tab)\" href=\"https:\/\/www.blissfully.com\/saas-trends\/2019-annual\/\" target=\"_blank\">2019<\/a>), which provide some interesting insights into SaaS utilisation. Nuggets from the <a href=\"https:\/\/www.blissfully.com\/saas-trends\/2019-annual\/\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"2019 annual report include (opens in a new tab)\">2019 annual report include<\/a>:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li><em>&#8220;In 2018, the average company spent $343,000 on SaaS, a 78% increase from the previous year&#8221;<\/em><\/li><li>SaaS spend had increased year on year, every year over 5 years, for all tracked company sizes (0-50 employees, 51-100 employees, 101-200 employees, 201-500 employees, 501-1000 employees, 1000+ employees).<\/li><li>The <em>average<\/em> cost per employee of SaaS subscriptions was $2,884 (presumably USD).<\/li><li>On average almost regardless of numbers of employees, each employee used around 8 SaaS applications.<\/li><\/ul>\n\n\n\n<p>In their 2018 State of Enterprise Cloud Computing, Forbes noted (reporting data from an IDG study):<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>30% of all IT budgets are allocated to cloud computing this year, with the majority being SaaS (48%) &#8230; the average investment is soaring in cloud computing apps and platforms, with the average reaching $2.2M this year, up from $1.62M in 2016.<\/p><cite><strong><a href=\"https:\/\/www.forbes.com\/sites\/louiscolumbus\/2018\/08\/30\/state-of-enterprise-cloud-computing-2018\/#2b713106265e\" target=\"_blank\" rel=\"noreferrer noopener\" aria-label=\"&quot;State of Enterprise Cloud Computing, 2018&quot; (opens in a new tab)\">&#8220;State of Enterprise Cloud Computing, 2018&#8221;<\/a><\/strong>, Louis Columbus, 30 August 2018, Forbes<\/cite><\/blockquote>\n\n\n\n<p>A listing of the biggest SaaS companies is like a who&#8217;s who of tech darlings, including Salesforce, Workday, ServiceNow, Tableau (now purchased by Salesforce), Zendesk, Mulesoft and of course, Office 365 services these days represent a huge SaaS footprint, and a common starting point for businesses as they look towards handing the back-end administration of email over to <em>someone else<\/em>.<\/p>\n\n\n\n<p>Yet here&#8217;s the rub: every SaaS application you deploy adds to the complexity you&#8217;ll have when it comes to tracking and managing your data protection. <strong>There is no escaping this<\/strong>.<\/p>\n\n\n\n<p>Whenever something is running on-premises, there&#8217;s always a way to provide data protection services for it. Somehow. For a start, you might accept for the fast RTO and short RPO the risk of crash-consistency and do snapshots and replication. For backups, even if there&#8217;s a database involved you&#8217;ll find a way to achieve that backup: if it&#8217;s a traditional big-name database vendor, there&#8217;s probably a database module or plugin for it, and if not, there&#8217;s other ways to deal with it such as pre\/post processing, data dumps, and so on.<\/p>\n\n\n\n<p>SaaS of course changes that picture. Your classic service model diagram looks like this:<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/Service-Models-1024x626.jpg\" alt=\"\" class=\"wp-image-8232\" width=\"1024\" height=\"626\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/Service-Models-1024x626.jpg 1024w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/Service-Models-300x183.jpg 300w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/Service-Models-768x470.jpg 768w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/Service-Models.jpg 1158w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><figcaption>On-Premises vs In-Cloud Access Levels &#8211; Highlighted Blocks are &#8216;out of your control&#8217;<\/figcaption><\/figure>\n\n\n\n<p>I liken SaaS to NAS. NAS is practically ubiquitous within IT Infrastructure circles, making it easy to present enterprise grade storage and services, but coming with a data protection headache.  In fact, SaaS is sticky like NAS, too. Returning to the CRN article, Simon Sharwood quoted IDC as saying:<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\"><p>&#8220;Organisations are also aware that deployed SaaS solutions can become sticky. SaaS applications often require complex integrations with on-premise <em>[sic] <\/em>software to avoid information silos across the cloud and on-premise <em>[sic]<\/em>. This means the organisation cannot quickly or cheaply switch even if a more innovative SaaS application appears.&#8221;<\/p><cite> <strong><a rel=\"noreferrer noopener\" href=\"https:\/\/www.crn.com.au\/news\/australian-cloud-is-66-percent-saas-idc-527689\" target=\"_blank\">&#8220;Australian cloud is 66 percent SaaS: IDC&#8221;<\/a><\/strong>, Simon Sharwood, July 4 2019, CRN Australia <\/cite><\/blockquote>\n\n\n\n<p>In short: SaaS makes things really simple, but there&#8217;s a high chance of you becoming a bit of a data hostage once you&#8217;ve got your workload converted to running in a SaaS.<\/p>\n\n\n\n<p>There aren&#8217;t just hundreds of SaaS applications out there, there aren&#8217;t just thousands of SaaS applications out there &#8212; you&#8217;re looking at a minimum of tens of thousands, probably more again. <\/p>\n\n\n\n<p>The old chestnut in on-premises IT would be that a new system or workload could be fully deployed and dropped into production before someone would say &#8220;What are you doing for backups?&#8221; To a degree, frameworks like ITIL managed to exert some control over this problem by inserting gates and controls &#8212; a requirement for instance that system and workload builders demonstrate they&#8217;ve met all the necessary considerations to migrate out of a build\/development cycle into a production cycle.<\/p>\n\n\n\n<p>But of course, ITIL-style controls were exactly what the business needed to <em>prevent <\/em>chaotic data risks within their environments, and they undoubtedly contributed to businesses seeking public cloud services because &#8220;IT makes it too hard to get things running&#8221;.<\/p>\n\n\n\n<figure><iframe loading=\"lazy\" src=\"https:\/\/giphy.com\/embed\/116a8zosxwA0SI\" width=\"480\" height=\"480\" allowfullscreen=\"\"><\/iframe><\/figure>\n\n\n\n<p>So here we are, on the raggedy edge (with a wink at Firefly). SaaS is cool, SaaS is popular, SaaS is the ultimate desirable state for a workload running in public Cloud and &#8230; SaaS has no common mechanism to allow a business to protect its data &#8211; to backup and recover, or extract. <em>There&#8217;s no NDMP for SaaS<\/em>.<\/p>\n\n\n\n<figure><iframe loading=\"lazy\" src=\"https:\/\/giphy.com\/embed\/Z8bHyY0EEx4qI\" width=\"480\" height=\"270\" allowfullscreen=\"\"><\/iframe><\/figure>\n\n\n\n<p>It&#8217;s maddening. And it&#8217;s not something that you can peremptorily tell data protection vendors &#8220;this is your mess now, fix it&#8221;. Here&#8217;s the uncomfortable truth: it&#8217;s <em>your<\/em> mess. <\/p>\n\n\n\n<p>Sorry to be preachy about it, but that&#8217;s the rub. Every time <em>you<\/em> adopt another SaaS application within your business without a comprehensive understanding of exactly how you&#8217;re going to protect the workload you&#8217;re moving into there, you&#8217;re <em>creating risk<\/em>. You <em>own<\/em> that risk, not your on-premises data protection vendors, <em>whoever<\/em> they might be. <\/p>\n\n\n\n<p>That&#8217;s not to say that data protection vendors don&#8217;t care, they do. If someone works in data protection it&#8217;s because they&#8217;re passionate about making sure data is protected. Trust me, this is the truth: I&#8217;ve been working with IT groups, businesses and management of all levels for the past 20+ years to help them all undersatnd the need to have comprehensive data protection services, and I still have to regularly revisit the basic &#8220;but we don&#8217;t need to&#8217;s&#8230;&#8221; that should have been put to rest 20+ years ago, too. You can&#8217;t stay in this industry unless you care.<\/p>\n\n\n\n<p>Decades ago, there was a recognition that NAS data protection would be impossible without some form of standard, and much as NDMP had its flaws, it did mean that there was at least <em>some<\/em> mechanism to backup and recover data residing in a storage appliance.<\/p>\n\n\n\n<p>Yet given the sheer number of SaaS developers out there (and let&#8217;s face it, anyone with a laptop, a basic understanding of coding and a credit-card can start a SaaS business if they can get an anchor customer), the idea of getting a consensus that &#8220;SaaS providers will provide <strong>backup <\/strong>and <strong>restore<\/strong> APIs&#8221; is probably <em>almost <\/em>as difficult as getting Donald Trump to say something that is both coherent <em>and <\/em>truthful.<\/p>\n\n\n\n<p>So here we remain, on the raggedy edge.<\/p>\n\n\n\n<figure><iframe loading=\"lazy\" src=\"https:\/\/giphy.com\/embed\/UvwI1X7XkbXq0\" width=\"480\" height=\"270\" allowfullscreen=\"\"><\/iframe><\/figure>\n\n\n\n<p>The solution isn&#8217;t going to come overnight, and it&#8217;s not going to come from data protection vendors jumping up and down and talking to every single SaaS provider in the market. <em>There&#8217;s too many<\/em>.<\/p>\n\n\n\n<p>This is something that&#8217;s going to come from two sources, <em>you<\/em>, and <em>them<\/em>.<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Them, as the company offering a SaaS product, have a responsibility to provide <em>some<\/em> documented mechanism for subscriber-initiated backup and recovery<\/li><li>You, as a subscriber of a SaaS product, have a responsibility to ensure that the SaaS products you subscribe to <em>have that functionality<\/em>, or demand it if it is not there.<\/li><\/ul>\n\n\n\n<p>If there&#8217;s a guaranteed backup and recovery mechanism there&#8217;s a solution that can be created &#8211; but again, that solution may require you to agitate for it, and educate your teams (business, IT, management) of the perils and risk that comes from choosing a SaaS product that doesn&#8217;t have backup and recovery functionality.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>It practically goes without saying that the smartest way to move workloads to a public cloud is to have them&hellip;<\/p>\n","protected":false},"author":1,"featured_media":8234,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[3,5,1229],"tags":[1524],"class_list":["post-8231","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-architecture","category-backup-theory","category-cloud","tag-saas"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2019\/07\/bigStock-Headache.jpg","jetpack_shortlink":"https:\/\/wp.me\/pKpIN-28L","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/8231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/comments?post=8231"}],"version-history":[{"count":5,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/8231\/revisions"}],"predecessor-version":[{"id":8245,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/8231\/revisions\/8245"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/media\/8234"}],"wp:attachment":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/media?parent=8231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/categories?post=8231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/tags?post=8231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}