Preserving Email Through Hosted Archiving

Related Articles

• Two Schools of Thought on Archiving
• The All-Knowing, All-Seeing Eye
• Text Message Policies: Privacy Expectations and Employees

Subscription Options

Subscribe Magazine

Subscribe Newswire

Widgets & RSS Feeds

When message archiving came on the scene, most thought of it as a concern for only the most regulated vertical, like financial services. In December 2006, however, when the Federal Rules of Civil Procedure (FRCP) were amended to include the discovery of electronically stored information, archiving took on a whole new importance to a much wider audience. For organizations, it meant re-thinking and changing the way electronic communications were collected, reviewed and made available in response to a discovery request. Many sought out on-premises archiving solutions to meet electronic discovery and regulation compliance, but others felt archiving, while important, ranked low on the priority list for precious IT budget dollars.

Today, according to The Radicati Group, “On-premises archiving products continue to be the most popular way to deploy an archiving solution, with 75 percent of all archiving solutions sold as on-premises products, compared to 25 percent of archiving solutions sold as hosted services.” This may not remain the case. Radicati research also shows that, “The deployment of hosted archiving solutions is growing at a faster rate than the deployment of on-premises products. Hosted services are much more affordable in the short run, which helps many companies to give them a try particularly in a slow economy.”

With the rise in acceptance of other software-as-a-service (SaaS) offerings, it makes sense that archiving in this model will also enjoy a spike in popularity. “I think for companies that are not in financial services, it may be perceived as a little riskier,” observes Stephen Marsh, CEO and founder of Smarsh. “We saw the exact same behavior in financial services several years ago. Everyone was hesitant early on, but companies ultimately started realizing that they were wasting their own time and money. Service providers, in many cases, are more secure and have better measures to protect data, because their businesses depend on it. In-house IT staffs have a million other projects completely unrelated to data protection. The reality is the service provider has the better infrastructure.”

Benefits of SaaS Archiving

Cost savings is often seen as a primary reason for going the hosted route. “Osterman Research’s recent analysis of the cost of email archiving solutions showed that SaaS email archiving can offer dramatic cost savings versus an on-premises approach,” confirms Michael Osterman, CEO of Osterman Research. “These savings can be realized even for very large organizations and regardless of required retention periods, compliance requirements or redundancy requirements.”

Most industry experts will point to cost being a prime benefit of the cloud model. But there are other benefits too. Mary Kay Roberto, senior vice president and general manager for Mimecast, says a top customer mention is that: “The streamlining of email administration is significant—since the admin no longer has to be concerned about the hardware and software maintenance, the cost reduction associated with hardware and software to support the archive, and the elimination of the costs of upgrading hardware and software and eliminating the need for storage additions. This saves significant time and enables the administrator to focus on proper policy management for the archive and operational management for the email system.” (Of course this also brings in the cost-savings benefit again too, Roberto says the cost of upgrades is particularly burdensome as is the cost and management of storage. She says it is common to see cost savings in the 30 to 60 percent range over on-premises systems.)

That cost benefit is especially attractive in our current economy. “We have seen a big, big shift over the last year and a half, as a function of what is happening in the economy,” observes Marsh. “A lot of larger organizations are less certain about what their organization might look like in the next six to twelve months. If there is any risk of downsizing, they do not want to make the capital investment to buy a large on-premises solution or to build a solution that today might accommodate 10,000 users and in six months may need to only accommodate 5,000 users.”

Another benefit often cited, says Roberto, is the continuity aspects of a cloud archive, which gives an organization significantly better access to data when there are issues in the data center without the extensive cost of having second data center location. “As a foundation of all of this, is the fact that IT will contribute to their corporate ‘green initiatives’ by reducing the number of servers required to provide email management. In our cloud solution, we typical see a reduction of 30 on-premises servers for one of Mimecast’s.” Roberto notes that the reduction statistic incorporates the organization utilizing the Mimecast Unified Email Management, which includes inbound and outbound perimeter security, email continuity, and archiving.

With these benefits, one wonders why the hosted model hasn’t been embraced sooner. “We have seen, going back to financial services in the early days, many of the medium to larger firms that have their own IT staff initially gravitate toward on-premises solutions,” says Marsh. “The perception is that it is more secure, that there is more control, and that they can produce data quicker. In fact, all of those things are counter-intuitively not true.”

According to Marsh, he has seen a lot of customers move from on-premises to the hosted platform for a variety of reasons. “A lot of times companies get fed up with the whole process of upgrading their software, their systems, add additional storage, etc. The IT departments, who initially wanted control, get fed up with having to support their legal department, their HR department, and their end-users, when it comes to email archiving. In many of these organizations, the legal department is asking for data on a weekly basis. I think the legal or compliance departments struggle with getting the data quickly, it is like pulling teeth in some occasions.” Marsh points out that Smarsh provides a service whereby a dedicated customer service department does nothing but help produce data when needed.

Customers being disillusioned with on-premises solutions are something that Andres Kohn, vice president of technology and product management for Proofpoint has seen too. The reason for that, he says is partly due to the maturation of archiving. “The first generation of archiving solutions were all on-premises—where you had to build up infrastructure to keep email,” explains Kohn. “In fact, the original archives were all about storage management. Taking email out of Microsoft Exchange and putting it somewhere else that was a lower cost, yet could still be accessed somehow. But once we got into more of the eDiscovery, it becomes a lot harder, and more expensive to manage that scale. We have customers that routinely come to us and say, ‘I run a search on my on-premises archive and it may take hours or days or weeks even to get the search results back.’”

Security

When weighing between on-premises and SaaS, security is a concern that can tip the favor toward on-premises. It is perceived that the data is more secure onsite. Not true says Kirk Averett, director of product for the Email & Apps division of Rackspace, “The cloud is more secure than on-premises systems for our email archives. Why? Real data centers have true physical and logical security, generally far more than even some of the world’s biggest and best enterprise companies. Combined with our DoD and PCI-DSS level encryption and separate storage silos for customers we have a high degree of confidence that the data is secure.”

Roberto believes that a vendor should be able to demonstrate the encryption strategy for data, describe and validate the physical security, and demonstrate the interface to the customer’s LDAP. “Often with these three elements, the data is more secure in the cloud than it is on premise,” she asserts.

For Proofpoint, the company saw the security issue as one of the biggest concerns people think of with SaaS. Kohn describes it this way: “I am now sending a copy of every email that I send and receive to somebody else. People got over that with inbound scanning, because they figured it was coming from the Internet anyway, but when you talk about all your internal email correspondence, that gets scarier. So people were really looking for a high-level of security, and that is where we have stepped into the fray.”

Proofpoint ARCHIVE is a hybrid model, where it is neither all on-premises, nor all in the cloud. “We decided to put what we thought were the right components in the right places,” explains Kohn. “Most of the infrastructure lives in our data centers. We also place a lightweight appliance that sits at the client site. What happens is that the appliance talks to the mail server; it grabs copies of all the messages, and encrypts it with a key that only the appliance has, and sends it to us encrypted. We have no way of ever being able to read any of the content, because the only key sits at the customer site. When a customer wants to do a search, they go to the appliance and the appliance encrypts the search terms and sends that to us. We get the results, but we do not even know what they are searching for.”

This concept of the third-party vendor not snooping through an organization’s email records is important. “Sometimes the security question might be a smokescreen over a different concern around who controls the customer’s data: the hosting company or the customer,” says Averett. “Rackspace, as well as every other responsible email archiving provider, has strong policies and protections in place to make sure that data remains private and in the control of the customer.”

Disaster Recovery

For some, the fact that the data is located at another site is a benefit of the SaaS approach. “We have found the disaster recovery (DR) aspect interesting,” says Kohn. “People are doing back ups, but they do view the archive as a little bit of a DR solution. If there is a gap in a back up or somebody wants something they deleted from their mailbox, they know there is a copy in the archive. So even though it is not meant to be a back up and restore, it does provide a second-layer of protection beyond a backup, and it is offsite.”

Marsh acknowledges that Smarsh customers also like the DR angle. “Organizations can use the storage at a third-party as a disaster recovery solution as well,” he agrees. “Inherently to get the data to a service provider, you have a copy securely stored somewhere else. Many of our customers will use that to rebuild email servers if they have problems, to re-populate an email server, or they use our service to restore even individual messages that in the past required the IT department to reload tapes and find a single message. It is an entirely overlooked benefit to using a service provider.”

While no one believes that a company should consider SaaS archiving to be the same as a true DR solution, it can be of help in a truly unusual circumstance. “Email archiving offsite, particularly at the low price point that we offer of $3 USD per mailbox, is the fastest and least expensive way to make email data available through a second service and location, in the unlikely event that something catastrophic happens at a primary data center,” states Averett. “Keep in mind that people using a hosted email solution almost always have live copies of all of their data, so only the most disastrous of circumstances would make the continuity features necessary.”

Reducing eDiscovery Costs

While DR may be an unexpected bonus of archiving, an expected benefit is the reduction of litigation costs. Deployment of an email archiving solution will save organizations both time and money in their early case assessment programs, contends the Smarsh paper, Reduce Litigation Costs Using Email Archiving for Early Case Assessment. “As we talked to more and more fortune 500 companies, and others that have a general counsel, a theme lately has been reducing eDiscovery costs,” reveals Marsh. “It was bound to happen sooner or later, but the economy has really accelerated that. Firms do not want to take all their email and hand it over to outside attorneys and say: ‘Here, find anything that is relevant.’ They want to do more themselves, but currently do not have the tools to do even a cursory search of their archive to find out what might be lurking out there in their emails or what an eDiscovery might find.”

By doing more in-house, organizations can reduce outside legal bills. “The cost of eDiscovery has increased over time, often because of the burden of location and restoring information, if it is not in an archive,” warns Roberto. “Archives with robust search capabilities will facilitate the eDiscovery process and help reduce the overall cost. Part of the cost is the salaries or consulting fees required to gather data, if it is not in an archive. As an example, even for a mid-sized organization who might take eight to 10 hours to retrieve data from DVD or tape for individual cases could reduce that time to an hour or less with the appropriate archive. From a risk management standpoint, being able to verify a search and show validity of data can save significant legal costs as the case proceeds. Finally, avoiding sanctions because data cannot be produced in a timely and accurate fashion is essential for a corporation’s legal department. All of this supports having an archive in place, particularly if the organization can set appropriate retention policies to different segments of the email data, thus being able to demonstrate compliance with corporate policy.”

Sometimes the reduction on eDiscovery costs, however, is hard to calculate. “There are two major components of that,” offers Kohn, “One is cost of finding the data, getting back up tapes, getting users laptops, etc. The other and biggest cost of eDiscovery comes when a company passes a ton of email to a law firm to process it. They are going to charge based on how much data is given to them. If instead, you have a solution that allows you a very flexible and powerful search capability and you are able to hold down the amount of data provided to the law firm, then they can charge only for what is given them, so there is huge savings there.”

Keeping Up With Regulations

Another area where SaaS archiving can offer unique benefits is business regulations. Understanding, and complying with an evolving list of rules is challenging, if an organization is not aware of what regulations they’re responsible for. “A service provider deals with conflicting regulations all the time,” says Marsh. “I would certainly not say that we are a consulting firm that sells advice, but we have other clients that have been through similar scenarios. We do have practical opinions and perspectives that we can provide just from our many customer relationships. That also translates into SaaS customers getting the latest technology all the time, not just from a whiz-bang perspective—because there is value in your getting the latest and greatest technology—I think it is also relevant that as regulations evolve, companies that use a service provider don’t have to change anything to be compliant or implement industry best practices. Once we hear from one customer that a court says they have to do X, we start to develop trends and can make changes to our product adding new features and functionality that benefit all our customers. For those with on-premises, they are going to have to upgrade in order to add features and functionality.”

Moving to the Cloud

If The Radicati Group is correct in its prediction that deployment of hosted archiving solutions are growing faster than on-premises, it signals that organizations are becoming more comfortable with the platform. “Many customers were initially hesitant to make the move to the cloud because their data is so important to their business operations,” states Roberto. “Once they understand the level of security, the range of functionality, and the simplicity of email management, they became comfortable with the concept. They were also reassured when they understand that they would still administer their system and set their own policies, and that they were totally in control of their data.”

Perhaps it is archiving as a whole that has become more accepted. “The trend away from archiving as a specialty need is growing more and more,” says Averett. “A year ago you could find companies beginning to think about archiving as a productivity tool, and now that seems to be the most common case. It will always be valuable for regulatory compliance, and we won’t be surprised if more industries are required to archive in the future.”

Being in the cloud does offer the ability to more easily manage what promises to be ever-growing piles of data. “For us, the power of having a SaaS solution is that we are able to spread the data out for any given customer across many, many servers. When they come to a search, on average 30 servers will light up and perform that search. So the results are able to come back really quickly, because each server is doing only a little bit of work. There is no way anyone is going to buy 30 servers to deploy an on-premises solution, but we can do that because we can share that compute power across many different customers, and that is the power of the cloud.”

With the viable options for either on-premises or SaaS, there is no reason not to archive anymore. SaaS pricing makes the cost of archiving predictable for any size organization, and archiving protects companies in the event of an electronic discovery request, and helps to comply with various rules and regulations. “In the 15 months since we acquired Fortiva, there has been a change from people saying: ‘I would love to do archiving, but it is further down on my priority list’ to people that are talking about and actively implementing archiving,” observes Kohn. “We have seen a greater shift towards SaaS, interestingly, not only from people who are for the first time saying: ‘I should do something and there is a lower cost way to do it now’, but also getting a lot of traction in organizations that already have an in-house archiving solution that are realizing after several years that with the amount of data they have, it is not usable and is hard to manage. Even they are saying: ‘I can move this to a SaaS solution, with less hardware and people, and I can save money.’”

As the benefits of having an archiving solution are better understood, attitudes toward archiving will change. The reason that has not yet happened may be that organizations are only starting to see beyond the practice as a necessary evil or as regulations that must be complied with, suggests Marsh: “There are a lot of benefits. Rarely do companies consider the IT benefit of off-loading the mail from their primary server so that they can keep that server lean and operating optimally. They may not consider the DR functionality, of being able to produce a single message for an end-user in ten seconds versus restoring back up tapes for hours down in the data center. They probably do not think about the value of retaining all of their institutional knowledge that is exchanged in email day in and day out, or consider that as employees leave, there is potential for all that data to go out the door with them.”