The SMB users guide to data protection

Computer Technology Review, Feb, 2005 by Steven Pofcher

All businesses, regardless of size, run on information. When that information is lost or access is interrupted, the impact on a business can be critical or even fatal. According to Gartner, 40% of businesses suffering a business interruption fail within 5 years.

The extreme impact of data loss on a business puts a premium on protecting and securing critical business information. Small and mid-size businesses (SMBs) are often at a disadvantage when trying to adequately protect valuable business information, as they typically do not have the budgets and internal IT expertise of large corporate enterprises. As a result, SMBs are especially vulnerable to data loss, since they often lack the policies, procedures and equipment for proper data protection. Gartner estimates that less than half of all mid-size businesses and only 25% of small businesses have disaster recovery plans in place.

Smaller businesses face the same fundamental backup and data protection concerns as large businesses: What is the most cost-effective method to reliably protect and recover business-critical information? For many small businesses, the problem is even more difficult because they do not have an IT staff to design, deploy and manage data storage backup and recovery systems.

What Are the Risks?

There are many. Natural disasters such as earthquakes, hurricanes and floods; equipment failure and theft; and external threats such as viruses, worms, hackers and unauthorized users can destroy, corrupt or deny access to critical business information. However, human error is the most common problem, which occurs when computer users inadvertently delete files and/or re-format hard disks.

The Compliance Factor

Ensuring that critical company information is securely stored and protected is not only a good business policy for SMBs but, in some cases, it is now a legal requirement. A focus on records retention to comply with new federal laws has caused many businesses to re-evaluate their data storage infrastructure and data protection, backup and archiving methodologies. The challenge to comply with government regulations such as HIPAA and Sarbanes-Oxley can impact small, privately held businesses as well as large publicly traded companies. Business owners should check with legal counsel as to which regulations apply and the liabilities that could be incurred.

A Data Protection Plan

The traditional focus on backing up critical information was to minimize the cost of recreating the information from original paper documents. That model is mostly irrelevant today, as much information exists only in digital form; there is no paper copy. Therefore a proper data protection plan is even more critical for smaller businesses.

A backup and data protection plan needs to encompass desktop and laptop PCs, in addition to network servers. Many businesses may do an effective job of backing up data stored on company servers, but ignore information stored on company desktop PCs and laptop computers, placing a huge amount of critical data at risk. According to a report from International Data Corp. (IDC), more than 300 million business PCs have a combined 109 petabytes of data--about half of all the corporate data residing on PCs and laptops--that is not backed up regularly. Companies with a highly mobile workforce (such as field sales staff) also need to recognize the vulnerability of not backing up information on laptops, which account for 25% of all computer sales, according to Gartner.

As a backup and data protection plan is developed, organizations must include policies and procedures that include regular backups of non-server data. Good software tools can automate this process, utilizing software that recognizes when specific laptops and PCs have missed a scheduled backup operation and then gives backup priority to those computers the next time they attach to the network.

Technology Options

The lack of IT resources, budget constraints and capacity requirements of small- to midsize business backup bring the technology options into focus. Removability is a key requirement in data protection to physically isolate the information from threats. To satisfy the removable media requirement, the technology options for a smaller business are backup to CD and DVD optical disc and entry-level tape.

CD-R/RW

Recordable CD technology is an appealing backup choice for small business based on its universal availability, low media cost and the popularity of the technology. This ensures data interchange across platforms for easy data recovery. Recordable CD technology has replaced the floppy disk as the standard removable media storage among PCs and entry-level servers. Wired magazine estimated the installed base in 2004 would be more than 140 million CD recorders, while the International Recording Media Association projected world-wide demand for blank CD-R and CD-RW media to reach 10.48 billion.

CD recording speeds have reached up to 48X and above, enabling a full 700-MB disc to be written in less than three minutes. While faster CD recorders are available, Maxell recommends 48X as the maximum safe recording speed because of physical limitations of the disc at higher speeds. The minimal speed advantage offered by 52X drives is outweighed by the performance and safety issues of operating CD-R media in excess of 10,000rpm. Research has shown that minute defects or cracks in CD-R discs that are inconsequential at 48X speeds can quickly increase, making discs unreadable or cause them to break apart at 52X, destroying not only critical data stored on the CD-R media, but potentially damaging or destroying the CD drive.