Enterprise Tape Backup is not Dead! Its use case has changed!

It is frustrating to hear or read oversimplified or misinformed views on the current status of tape backup in the enterprise as happened last Friday in the guise of a security news article that quickly devolved into tape backup bashing frenzy.

Some of the statements in this article were either unfounded or intentionally misleading. However, rather than boring you by running you through each statement and posing a rebuff, I thought it more constructive to show you how tape is a critical component in your enterprise Disaster Recovery and Business Continuity plan.

It is true that tape should no longer be considered as your only backup medium. Similarly, neither should cloud backup services like AWS Storage Gateway or Azure Backup be considered as your only backup medium.

Don't be misled by claims that the cloud backup systems are cheaper for the enterprise. For small and medium businesses with low data volume, they are the right choice (Assuming you have appropriate internet bandwidth) coupled with a weekly encrypted external HDD data dump. For the enterprise though, pure cloud solutions are still a significantly more expensive option than tape. For example, one LTO7 tape can hold 6TB uncompressed, the cost of writing data to that tape and storing it offsite with an accredited provider for the 1st month is approx. AU$296. Conversely, with AWS this same amount of data will cost you AU$430 for the 1st month (Not including transit costs). Azure is marginally better at AU$369.57. Where it becomes interesting however is the cost to store that data for the second month. For tape, the cost is a measly AU$1. For AWS it is either AU$184 or AU$32 depending on the storage tier. For Azure your looking at AU$203.99

To put it into perspective, for three months retention of 6TB of data the costs are as follows:

• Offsite Tape: AU$298
• AWS Backup: At best AU$494, at worst AU$796
• Azure Backup: AU$777.55

There is an argument however that offsite Tape takes too long to recover. Let's break it down using the 6TB volume scenario with a total service failure like a ransomware attack. With tape, most accredited storage providers offer a 1-hour emergency delivery service, add to that the 5 hours and 50 minutes to write out the 6TB of data and you have a minimum 6 hours and 50 minutes time to recovery. With cloud recovery, assuming you have a 100Mbit data pipe, the same volume of data will require 139.8 hours or 5.8 days to recover. Let's be generous and assume that you have 1Gbit of bandwidth to play with, the time to recovery will still be 13.98 hours. Cloud Backup excels protecting small volumes of Mission-Critical data, Tape backup excels protecting large volumes of all data for disaster recovery purposes.

So then what is the appropriate solution I hear you ask? Well that all depends on factors like your classes of data, the volume of your data and your data continuity requirements and expectations. Your CIO or IT Manager need to strike a balance between onsite Disk-Disk backup, Site-Site replication, Cloud Backup and Tape Backup. You should question any ICT Professional who recommends that you should use only one or two of these technologies. A good rule of thumb for different Recovery Point Objectives (RPO) would be:

• Onsite Disk-Disk backup - Sensitive (15 minute RPO) and General (24 hour RPO) data backup,
• Site-Site replication - Mission Critical (15 second RPO) and Sensitive (15 minute RPO)
• Cloud Backup - Mission Critical (15 second RPO) and potentially Sensitive (15 minute RPO)
• Tape Backup - Disaster Recovery (All data classes on either 24 hour, 7 day or 1 month RPO)

This has been just a quick overview of two critical factors businesses face when creating a DR & BC plan (Cost & Time to Recovery) and the reasons why "Just Cloud" or "Just Tape" are not appropriate solutions. Furthermore, there are many other factors to be considered like data security, data corruption, intentional deletion, monitoring, DR validation, data classes and data volume. Hit up your friendly CIO, IT Manager or MSP to learn more about these factors and ask how they are addressing these in your organisation.