Move It or Lose It: Cloud-Based Data Storage

The vulnerability and inefficiency of backing up data on-site is prompting school districts to switch to more secure, less troublesome cloud-based options.

• By John K. Waters
• 09/01/10

When most K-12 school districts consider the risks to their data, chances are they're not worried about their proximity to a nuclear power plant, or that they're located directly in the eye of the escape route from a major metropolitan area. But for the Hendrick Hudson School District, located in Montrose, NY, just 40 minutes outside the Big Apple, both concerns spurred district auditors to push for a better way to back up their data than the on-site, tape-based system the district had been using for years.

"Both of these factors essentially increase our vulnerability to a regional or local power disruption," says Mathew Swerdloff, the district's director of technology. "We needed to make sure that if the district were ever shut down, our data was safely backed up. And the unreliability and inefficiency of tape just wasn't cutting it."

About three years ago, Hendrick Hudson replaced its old data-backup structure with an off-site, Web-based system, referred to by some as storage as a service, or StaaS--an offshoot of software as a service (SaaS)--but more commonly known as cloud storage. The district, which numbers nearly 2,800 students, is one of many school districts taking first, albeit tentative, steps toward moving their data into the cloud.

"I have my reservations about cloud storage in general," Swerdloff says, "but there's no doubt about the effectiveness for us of cloud-based backup. The system has saved us a ton of time, and the hassle factor, compared to tape, is zero."

Send in the Cloud
There was a time, not that long ago, when school districts showed little interest in storing or backing up their data to remote servers. Nothing seemed less secure than handing off data to someone else. But in the last few years the buzz around cloud storage has grown louder, and the idea that data backup could be provided as a service has begun to gain traction in K-12 environments.

"Think of cloud storage as a giant Web site," says Steve Lesem, founder and CEO of Mezeo, maker of the Mezeo Cloud Storage Platform. "It's designed and architected exactly the way you would a giant Web site, but instead of serving Web pages, it's serving files."

The concept is straightforward, but the terminology can be bewildering. The software-as-a-service model is about delivering software over the Internet on a subscription or pay-as-you-go basis. It initially proved itself in sales-force automation and customer relationship management, and now is widely used by organizations for things like computerized billing, invoicing, human resource management, and service desk management. The success of SaaS spawned other "as a service" models, including platform as a service, infrastructure as a service, identity as a service, security as a service, the hard-to-believe hardware as a service, and the inevitable anything as a service. Each comes with its own tidy acronym; anything as a service goes by, fittingly, XaaS.

"The jargon in this space is always evolving," says Michael Coté, IT industry analyst for RedMonk. "While the stack of SaaS, PaaS, and IaaS has a nice clarity to it, 'cloud' is a much more powerful marketing word, and people seem to prefer it. At the end of the day, what we're talking about is secure access to metered but cheap, and virtually unlimited, data storage over the Internet."

In the long run, the benefits of cloud storage are likely to overcome any current reservations some school districts have about the model, says Adam Couture, principal research analyst at Gartner. Until then, districts are getting a toe in the cloud through cloud backup.

"I get calls from school districts all the time about cloud storage," Couture says."I see some increasing interest in cloud storage in general--the software-agnostic IaaS [infrastructure as a service] offerings, such as Amazon's EC2, that provide compute and storage capacity you pay for on a usage basis. But mostly, it's about backup services."

In fact, what you might call "backup as a service" seems to offer the clearest business case for cloud storage. In a report published in January by Forrester Research ("Business Users Are Not Ready for Cloud Storage"), analyst Andrew Reichman writes that, although companies are not currently clamoring for general-purpose storage-as-a-service solutions, they are more interested in cloud backup. Why? Because it soothes a near-universal pain point: "the pain of bringing a costly and error-prone, but very necessary, IT function under control," Reichman writes, while the more general storage-as-a-service offerings require the districts "to figure out how to put it all together."

Off-site backup is gaining popularity among districts primarily as a replacement for inefficient on-site backup solutions, says Couture, but also in response to tightening budgets and growing concerns about the security of storing data on-site.

"It's common these days for a K-12 school district to maintain a lean IT staff," he says. "These backup services can be automated, so there's very little administration required. There are also some aging tape-based, local backup systems out there that are inefficient and insecure. But people also understand now that on-site backup itself is insecure. If something takes out your PCs or servers--something like a flood or a fire--it's likely to take out your backup devices, too. Getting the data off-site in redundant systems is actually the most secure thing they can do."

Swerdloff says that Hendrick Hudson's decision to replace its tape-based backup system with i365's EVault cloud-based service was driven initially by security concerns. But he adds that cloud backup quickly proved itself to be a much more efficient solution.

"With the tape backup there were always problems," he says. "The tape restores were terrible--and time-consuming. It would take a while to find the right tape and fast-forward to the right spot. The backups and restores with the i365 system are both much faster, which has been a surprisingly important benefit."

With an IT crew of two computer techs and one audiovisual tech responsible for covering five schools and 1,000 workstations--and more than a terabyte of data--faster is a welcome improvement at Hendrick Hudson. The district's use of the i365 system includes agent plug-ins for Microsoft Exchange and SQL Servers in an Open File Manager configuration. The implementation supports 11 Microsoft Windows 2003 Servers running Microsoft Exchange 2003 and SQL Server 2003, as well as a number of educational applications and shared files.

Web-Based Lockers
When Conestoga Valley School District in Lancaster, PA, took its first step into cloud storage, it did so with a smaller-scale niche offering: School Web Lockers, a cloud-based computing service that combines online storage, backup, collaboration, and file sharing in a single system. Designed specifically for K-12 education, the system allows students to create work on one computer and then store files in their personal, password-protected Web locker. They can access those files later to complete their work on the same computer, or on another one at home or another location.

The Conestoga Valley district serves nearly 4,200 students in four elementary schools, one middle school, and one high school. It supports 2,500 computers, including desktop and laptop devices, all of which are networked with Internet services. The district prides itself on its ongoing effort to implement new devices in the classroom, including handhelds, interactive whiteboards, classroom performance systems, and wireless tablet PCs. This lively technology infrastructure is maintained by just nine full-time employees serving about 5,000 users.

The district adopted the Web Lockers service for its middle and high school students earlier this year, says Doug Stoner, Conestoga Valley's manager of computer services. He expects the service to save costs on hardware and data management, but also to improve security. The system allows users to exclude certain types of files, such as executables. "We can't do that with thumb drives, CDs, or DVDs," Stoner says. "It gives us an extra layer of security."

Stoner is cautious about cloud storage solutions and isn't about to load one of them with anything too precious. "These are student files," he says. "They're important to students, but this isn't mission-critical data for the school district. Right now we rely on an in-house storage area network (SAN), with duplicates backed up in another building. We may, however, be forced to move [our data] outside at one point. Most schools are understaffed in the tech department, and it's pretty much impossible to get it all done."

Although he's also a big fan of cloud storage, Swerdloff has some of his own misgivings about it, noting that it has a way to go before it's ready for K-12 environments.

"Maybe for smaller organizations it's okay," he says. "But in a big organization like a school district, where you have 3,000 to 3,500 users, with lots of turnover--we have the 12th grade graduating and kindergartners coming in every year--I'm not convinced all the bugs have been worked out."

But Stoner likes the concept of storing data locally in what's called a private cloud. A public cloud exists in off-site servers and is operated by a service provider; Microsoft's Azure, Amazon's S3, and Nirvanix are examples. A private cloud is typically a cloud-type system running on-site in the local data center and managed by the user's own IT staff. (Another type of private cloud is a single-tenant system running on a service provider's servers, but on machines that are reserved for that tenant's data.)

"An IT department generally thinks of itself as a service-provider organization," Mezeo's Lesem says. "So this is a pretty natural implementation of this model. There are companies and institutions--the US government, for example--that want private clouds. They want a bit more control of the data, but they also want the unique advantages [the cloud model] provides."

"Ultimately we'll be using a combination of private and public clouds," Stoner says. "I'm convinced that this is going to be a winning strategy for our students and faculty going forward. Our ultimate goal is to provide students with 24/7 access to the technology that they need."

Too Many Choices
But even if their interest in cloud-based data services is limited to backup systems, K-12 districts face a daunting challenge: deciding which one to adopt. Recent years have brought a veritable stampede from storage vendors to provide cloud services. Forrester's Reichman notes in his report that "almost every storage vendor has deployed a new storage system or repositioned an existing storage system as part of [its] 'cloud strategy' in anticipation of future demand."

"There are literally hundreds of them out there," Couture says, "and that's part of the problem: too many choices."

Swerdloff agrees. His district's current cloud storage provider isn't its first. "They're definitely not all the same," he says. "The first time, I was a little hasty and I didn't check out the service thoroughly, and the results were disappointing." Swerdloff advises districts looking into cloud-based storage solutions to avoid such pitfalls by insisting that the vendors allow a live test of their products.

"That was my mistake the first time around," he says. "The second time, I evaluated three products, and I required them all to give me a full license for 30 days. We installed all three products on a few of our servers and ran them for a month each. We got to see the interface and really see how the backups were working. We simply picked the one that worked best. I'd recommend running any system you're considering for 30 days and actually backing up a couple of your servers--in particular, your database servers, because those seem to be the trickiest."

The key to narrowing your vendor list, says former storage industry analyst Curtis Breville, now a technology consultant with data storage services provider EMC, is to ask the right questions. You'll want to know, for example, how your data is protected once it's in the backup service's hands. "Your data may now be stored elsewhere for safekeeping, but can you report back to your compliance officers or auditors that this new place is secure with no liability risks?" Breville asks.

You'll also want to know what steps you will need to take to re-create your data at another location if some disaster renders your data center servers and storage unusable. "Backups are meaningless; restores mean everything," Breville says. "Before anybody helps you with backups, make sure they can deliver the restore in every example you can come up with."

Also, find out what happens if your data does not come back. "Online backup services have technology and human errors just like your environment," Breville says. "Can something go wrong that keeps you from getting all or some of your data back? Sure it can--and don't let anybody tell you that it's impossible. In the event of a legal action that requires older data to be produced, if your online provider cannot produce it and your district gets fined, is your provider responsible for the fine? This is something you should know."

While you're at it, ask how you go about changing online-backup service providers if you find a better one. "If you want to switch your service to another online business and still need your older data, how do you cut bait with one and go to another?" he says. "Make sure you know your exit strategy."

Both Coté and Couture agree that redundant storage--copies of all your data stored on different servers located in different locations--is another essential feature to look for in a service provider's solution. "You don't want students using the excuse 'The cloud ate my homework,'" Coté says.

Couture warns that not all backup services support all operating systems. If you're running Windows, chances are you're covered, but fewer vendors support Linux, so it's worth asking. The viability of the vendor is yet another factor that Couture says should give prospective users pause. Your data's fate could be tied to that of the company housing it. "The big vendors--the EMCs and the Iron Mountains--are going to be there, but with some of the smaller companies, you wonder."

There's good news here. Reichman writes that "many of the providers offering backup as a service ... are quite mature and have built strong reputations over time." And later in his report: "If the storage-as-a-service offerings currently available today mature and overcome the key objections of buyers, the demand seems to be there for rapid growth."

For his part, Lesem has little doubt about the future of cloud storage. "Twenty years from now," he says, "you'll look at storing a file on your notebook computer the way people today look at getting into a horse-and-buggy: 'Why would you store your file on one little computer? It could get lost, it could get dropped, it could get stolen. That's a silly place to store something.'"