Five key points about cloud vs in-house disaster recovery

The case for cloud DR

“The pendulum has swung towards disaster recovery in the cloud, and DRaaS,” says Phil Goodwin, a research director at IDC.

“Cloud has changed the economics of disaster recovery. Some years back, only the biggest organisations could fully implement DR because it was so expensive to duplicate infrastructure and systems, even if it was through a third-party provider,” he adds.

The most appealing feature of cloud-based data storage is its on-demand model. There is no need to buy, and maintain, hardware and other assets in case of emergency.

But using the cloud for disaster recovery comes with its own costs and drawbacks. Specialist DR suppliers exist to fill the gap between a fully replicated IT environment and the cloud, with the bulk of fees only payable if the business has to invoke the DR plan. But for IT managers, the decision is rarely as simple as copying all data to the cloud.

Cloud vs in-house DR

The market for dedicated, cloud-based DR is already large and maturing.

According to IDC’s Goodwin, there are now thousands of firms that offer at least some cloud-based disaster recovery. These range from full-service, “white glove” approaches to those where the customer does most of the design and provisioning.

Most CIOs, however, aim for a middle ground and do some work themselves. “It’s due to cost, as well as a desire for an element of control over the data,” he says.

These are the key considerations for choosing between the cloud, and on-site DR.

Cloud vs on-site DR: Costs

The cloud removes two significant costs for disaster recovery: hardware and premises. However, these costs are replaced by service and usage fees. Businesses might prefer ongoing costs to upfront expenditure, but savings are not guaranteed.

“As with all things cloud vs on-premise, it’s the decision between fixed costs/capex [capital expenditure] and recurring costs/opex [operating expenditure] for cloud or managed DR services,” says Richard Blanford, CEO of IT consultant Fordway.

“However, one of cloud’s major advantages over in-house self-provision for DR is pay-for-use,” he adds.

DRaaS providers will typically have a monthly or annual service fee, based on the number of servers or virtual machines (VMs). Some price according to applications, but cost can vary dependent on performance and potentially on the DR site’s location.

Most DR services will charge an invocation fee, and may also charge for testing.

DIY solutions can appear cheaper, but there can be hidden costs. Cloud storage providers’ monthly fees look low, but data Egress charges – to copy data to an operational cloud or to on-premise systems – can be high. This is especially the case for “cold” storage operators.

Cloud vs on-site DR: Moving data to the cloud

Copying data to a backup facility is a challenge for DR service providers and for the cloud. Unless a business is new and has little data, or it can afford real-time mirroring and high-availability systems, the initial data copy is likely to be to disk or tape.

“Whether you are moving data to a managed service facility, the cloud or a third party, it’s about comms,” says Tony Lock, an analyst at Freeform Dynamics. “It’s about how much bandwidth you have, and how much it changes.”

Managed DR providers use disk to move initial batches of data, he says. CIOs may have to follow that route for the cloud: there is little to choose between the two platforms here.

Cloud DR: RPO and RTO

Businesses need to set their recovery point objective (RPO) – how much data they can afford to lose; and their recovery time objective (RTO) – how long they can wait for data to be recovered.

Only a minority of organisations can afford near real-time replication or high-availability systems. Most will opt for point-in-time backups, copied to the cloud directly or more likely via a staging server, network-attached storage (NAS) or dedicated appliance.

The speed of copying data depends on the public internet. Companies replicating to their own datacentres, or to a conventional DR provider, might have more control over bandwidth, but the limitation is still the speed of light.

“Having your data in the cloud or a DR specialist doesn’t make any difference,” says Lock.

Cloud DR providers can, however, charge different rates for a quicker data restore, and a smaller RPO will likely incur more storage and data transfer costs, through more frequent copies. At Fordway, Blanford points out that a sub-two-hour RPO/RTO is likely to be unaffordable in the cloud, because the cloud environment needs to run constantly.

Data and business recovery

Full-service DR provides more than just data restoration. It includes providing new servers, storage and networks and even new PCs and desk space.

Firms can recover data from the cloud to new hardware, and some will. But the cloud can provide new VMs and even bare metal servers. One of the key attractions of cloud DR is that a business can quickly spin up new capacity when needed.

Using the same cloud service provider to host backups and production systems is the most seamless option and removes delays from moving data between cloud hosts or to a new site.

The downside is application latency. If this is not acceptable, DR providers with dedicated hardware or a failover datacentre might be more suitable.

The business will also need to provide endpoints for staff. If they already have a remote or mobile workforce, this will be less of a barrier. But CIOs will need to consider user equipment as part of the long-term recovery plan, even if enterprise apps stay in the cloud.

Geographical, regulatory and contractual risks

Some businesses are unable or unwilling to use the public cloud to run applications or store data, in the medium term or at all. In those cases, cloud-to-cloud recovery might not be appropriate.

More cloud providers now support classified data, and there is more choice when it comes to data location. Nonetheless, Freeform Dynamics’ Lock warns that businesses have few protections if a cloud provider goes out of business, is sold or is legally prevented from operating in a territory.

Careful sourcing reduces these risks, but CIOs need to consider where their data is and whether they have full control of all business information. Ultimately, this might mean keeping physical copies on disk or tape even if the primary backup is the cloud.

Speak to the business to protect the business

Cloud disaster recovery is a powerful tool for CIOs. It gives them options and can reduce costs – especially up-front capex.

But it is not the solution for every organisation. IDC’s Phil Goodwin advises talking to the business first. “Input from the business is critical,” he says.

Ultimately, only the business knows which data to protect – and how much they will pay to do so – whether the technical solution is the cloud, a secondary site or a managed DR service.