Organisations that use cloud IT or cloud-based applications often do so in the belief they can spend less time managing IT and more time running the business.
Partly, this is because customers see cloud technology as more robust and resilient than in-house IT. But when it comes to backup and data protection, the opposite can often be the case.
In fact, the basic protections for files and applications provided to customers by cloud and software-as-a-service (SaaS) suppliers can be very limited. This means CIOs need to make their own arrangements to back up data in the cloud.
According to research by analyst house Omdia, the uptake of SaaS applications continues to grow at a steady pace, and that potentially leaves a backup and recovery gap.
“The recent announcement by Microsoft that its SaaS apps need to be protected, or backed up, means that alone affects circa 300 million to 400 million users,” says Roy Illsley, chief analyst at Omdia. “Only around 50 million [of those] use some form of backup today.”
Shortcomings of native cloud data protection
Public cloud and SaaS providers go to great lengths to ensure they have resilient, secure infrastructure.
With their scale, cloud suppliers can invest in the best technology and the most skilled people to keep their infrastructure running. Cloud providers offer service-level guarantees, often with “five nines” of availability. But they do not automatically provide backup and recovery for their customers’ data.
This means customers are usually only protected against failure in the cloud provider’s own infrastructure. They do not provide protection against risks that include accidental file deletion or a ransomware attack.
In addition, backing up SaaS applications can be more complex than backing up data in on-premise infrastructure. Also, an enterprise may run dozens or hundreds of SaaS applications.
Relying on a cloud provider’s native backup does not protect against common risks, especially user error
As Christophe Bertrand, practice director of Enterprise Strategy Group (ESG), points out, around a third of firms rely on SaaS suppliers for backup. Nor is the issue restricted to SaaS applications.
Organisations that use cloud infrastructure, including cloud storage, might wrongly assume that supplier service-level guarantees mean they will recover lost customer data. That means customers run the risk of permanent data loss unless they invest in cloud-specific backup and recovery tools, or build that functionality into their cloud environments.
A further issue is the complexity of cloud-based storage invoicing. This includes multiple price points, performance tiers, recovery point objectives and egress charges. Even IT departments with experience of managing cloud workloads can find storage costs hard to calculate with accuracy, and backups are no exception.
As cloud suppliers have moved to add more “native” backup options, that complexity has grown even further. Amazon Web Services (AWS), for example, has separate charges for backup storage, restoring data, restore testing, cross-region data transfers, and its Backup Audit Manager. Pricing then varies further by whether data is in warm or cold storage, with options that vary depending on the type of storage and backup targets in use.
Microsoft Azure calculates backup charges based on workload, region and storage tier. Azure does not, however, charge for restore operations or data egress associated with them.
Google Cloud levies a backup storage charge and a backup usage charge, as well as charges for backup appliances. Charges vary (widely) according to workload and location.
For SaaS applications, the picture is more complex still. Salesforce, for example, publishes no backup pricing. For some other suppliers, it is hard to see which (if any) native backup services they offer.
The cost and complexity around cloud-native backups raise the risk that organisations fail to back up critical data and potentially miss some SaaS applications or cloud storage from backup plans. Or they might find backups are hard to manage and test and cost more than they expect.
The bottom line is that relying on a cloud provider’s native backup does not protect against common risks, especially user error.
What is cloud-to-cloud backup?
The main alternative in the market is cloud-to-cloud backup. Several suppliers specialise in backups specifically for SaaS applications, or more generally for cloud-based workloads.
Most backup providers support multiple cloud environments in which customers keep redundant copies of data with more than one provider.
Some cloud-based backup tools can also backup on-premise applications, and though it might appear a contradiction, there are even options to back up cloud data to on-premise hardware. Ideally, backup tools are platform agnostic and will work with hybrid as well as pure cloud architectures.
Cloud-to-cloud, or C2C, backup is not the same as backup as a service (BaaS). Cloud-to-cloud services focus on protecting data that is already in the cloud, including SaaS data. BaaS is more focused on backup for on-premise systems, although there is an overlap and some tools perform both tasks.
How does cloud-to-cloud backup work?
Cloud-to-cloud backup services aim to take away the complexity in protecting multiple SaaS applications and cloud environments.
Typically, they aim for faster and easier recovery, as well as the ability to back up to and recover from multiple geographies. A good provider should also be flexible about where users can restore data, such as to another cloud provider, or potentially to local on-premise infrastructure.
Although customers need to research the features offered by C2C backup suppliers in detail, it should be possible to slim down the number of candidate backup systems to a handful, if not a single tool. Using a cloud-to-cloud service should also provide more transparent and possibly lower pricing.
The trend is for backup services to use simpler, subscription-based pricing. Ideally, this will be all-in because the last thing a CIO wants to face during a disaster recovery scenario is a large bill for egress fees. And by having a single service, firms are less likely to overlook data protection for critical workloads.
Cloud-to-cloud backup providers
Cloud-to-cloud backup providers include well-established backup tool suppliers and more recent cloud-focused entrants.
Barracuda, Acronis and Veritas are well-known backup product providers with cloud and on-premise businesses.
Asigra backs up platform-as-a-service (PaaS) and SaaS cloud environments, while OwnBackup offers backup for Salesforce, ServiceNow and Slack.
Druva offers data protection for Amazon Web Services, Microsoft Office 365, Google Workspace and Salesforce.
Veeam provides backup for Office 365, either to another cloud instance or on-premise.
Datto recently bought specialist Backupify; Cohesity and Commvault also have C2C offerings.
Established storage supplier Seagate offers cloud backup and disaster recovery through its Lyve Cloud service.