Posts

Evaulating SaaS Backup Solutions

Data protection icon

You have many choices when choosing your SaaS backup solution for Google Workspace (G Suite), Microsoft 365, Salesforce.com, and other cloud services.

When picking your solution, look for the data protection capabilities you need. At a minimum, a SaaS backup solution should offer the following.

Comprehensive Protection

Some SaaS backup solutions only protect email, files, and folders. Look for solutions that offer protection for contacts, shared drives, collaboration and chat tools, and calendars. Solutions with these features are far more effective at maintaining business continuity. And, the cost is often comparable.

Frequent Backups

More frequent backups let you to restore to a more recent point in time, minimizing data loss. Restores are faster and easier with less manual effort to perform restores. Services that backup multiple times per day will provide better results than those that only backup daily.

Access During Outages

Look for and choose a SaaS backup service that lets you export and access your data in the event of an outage. While limited in scope, the ability to use data should Google Workspace or Microsoft 365 be unavailable can help you keep essential work on-track.

Security & Compliance

The SaaS backup service you choose should be secure, with data encrypted at rest and in motion.  Additionally, services that meet SOC1/SSAE-16 and SOC 2 Type II reporting standards will help you meet HIPAA, GDPR, CCPA, SEC, and other regulatory compliance requirements.

Your Next Step:

We recommend you protect all data in Google Workspace or Microsoft 365 with a secure and robust backup/recovery solution.  Protecting your cloud-resident data is no different than protecting data hosted on servers and systems in your office. We can help you make the right choice.

For more information, view and download our eBook, SaaS Protection Buyers Guide.

Learn more about Cumulus Global’s data protection and security solutions, contact us to discuss you needs and options, or schedule a complimentary cloud advisor appointment.

3 Reasons for SaaS Data Protection

Data protection iconSaaS data is not immune to permanent data loss. Microsoft and Google make no guarantees when it comes to restoring deleted data, whether from human error or a malicious act. While Microsoft 365 and Google Workspace (formerly G Suite) may make collaboration more efficient, data protection and management is a shared responsibility. Both Google and Microsoft include some basic recovery capabilities, but they not enough to protect your business.

Here are 3 major reasons to add SaaS data protection to your Microsoft 365 or Google Workspace solution.

1: Data Loss Due to Permanent Deletion

If an employee accidentally deletes a critical spreadsheet from OneDrive or Google Drive, or a deleted folder of important emails passes the retention period in Trash, neither Microsoft nor Google will be able to recover your data.

Even if those files are within your retention period, locating and restoring lost data can cost you more time than you can afford.

2: Data Loss Due to a Ransomware Attack

If your business suffers a ransomware attack, you cannot roll-back your data to a point-in-time before the attack without a backup solution. Your data is likely gone forever.

More than losing valuable business data, you will face potentially crippling costs.  You may choose to pay the ransom (without any guarantee your files will be unlocked). You may work to rebuild your lost data. Either way, you will spend significant money, time, and lost productivity trying to save your business.

3. Time and Money Lost in Recovering Files

Retaining critical user data when employees leave your company is costly without a backup solution in place. The time spent to recover data might be more than what your business can afford. SaaS Data Protection lets you retain past employee data without the need to keep their Microsoft 365 or Google Workspace account active. You save time and money.

Whether you lose data or time, the impact to your bottom line can be significant. To address this challenge, you need a secure solution for this growing reliance on the cloud.

Learn more about Cumulus Global’s data protection and security solutions. To ensure your business continues to run smoothly, schedule a complimentary cloud advisor appointment.

Service Update: Datto SaaS Protection

Service Update: Datto SaaS Protection. The latest Datto SaaS Protection platform is now available to all of our costumers. For more recent customers, you are already on the newest platform.  For our longer term SaaS Protection (aka Backupify) customers, the transition process will begin as early as February 1, 2021. The process will complete before May 31, 2021.

Benefit:

With this move, all Datto SaaS Protection customers will have access to the latest features. These include protection for Microsoft Teams and Google Shared Drives, and the Daily Backup Success Report.

Process:

To ensure a smooth transition, any data on the legacy platform will be archived in one of Datto’s secure Microsoft Azure instances. A fresh backup set will initiate on the new platform. We can assist you in exporting your legacy backup data if you prefer to not have it stored by Datto on Microsoft Azure.

There are some unique aspects of the transition for some of our customers, our Service Team will contact you as needed to discuss your transition.

Please contact us with any questions or concerns.

SaaS Backup – 4 Dangerous Misconceptions

SaaS Backup is just as important, and necessary, as backups for data hosted on in-house servers and systems.

Data protection iconWith more remote work, our reliance on SaaS applications and services such as Microsoft 365 and Google Workspace has become more critical to our success. Easy access to files and folders from anywhere and the integrated collaboration tools keep our teams connected and productive.

Here are 4 common, but dangerous, myths and misconceptions about SaaS applications and services that will put your data and your business at risk.

Myth 1: SaaS Applications do not Require Backup

While SaaS applications protect against data loss in their cloud servers, this does not protect against user error, accidental and malicious deletion, or ransomware attacks. And while accidental deletion of files is by far the most
common form of data loss in SaaS apps, ransomware can be the most damaging. Ransomware is designed to spread across networks and into SaaS applications, impacting many users.

Ransomware isn’t only an on-premises problem. It can and does spread into the cloud, especially when using the OneDrive and/or Drive File Sync clients.

You need a way to quickly revert files, folders, settings, and permissions in the event of an attack.

Myth 2: File Sync is a Backup

While file sync tools like Microsoft OneDrive or Google Drive File Sync do create a second copy of files and folders, they do not replace backup. File sync automatically copies changes to synchronized files. If a file or folder is infected with ransomware, the malware will automatically be copied to all synced versions of that file.

File sync services do offer some restore capabilities via versioning, but they fall short of a true SaaS backup solution.

  • If a file is deleted, older versions of the file are also deleted
  • End users control backup and recovery, so you have no control over coverage or process
  • Large restores are a time-consuming, manual process.

Beyond simply lacking the restore capabilities of a backup solution, file sync and share can introduce ransomware to Microsoft 365 or Google Drive. File sync and backup are not competitive solutions, rather they can and should be used together.

File sync and share tools are for productivity; backup is for data protection and fast restore.

Myth 3: SaaS Applications are Always Available

While SaaS apps are highly reliable, outages do occur. In 2020 alone, Microsoft 365 suffered five significant outages in the space of six weeks. Last year, Google Workspace suffered a global outage, leaving users with no access to for several hours.

Outages and slow restore times are not just an inconvenience. When you cannot access important business data, productivity falls and revenue suffers. Creating backups that are independent of a SaaS provider’s cloud servers is the only way to ensure access to essential files in the event of an extended outage.

Myth 4: Microsoft and Google are Responsible for Backup

Microsoft and Google ensure they will not lose your cloud data. However, they do not take responsibility for restoring data if you lose it. This is why Microsoft recommends third party backups for Microsoft 365 data, having defined the concept of the Shared Responsibility Model.

In the Shared Responsibility Model:

  • Microsoft and Google protect your data against:
    • Service interruptions due to hardware or software failure
    • Loss of service due to natural disaster or power outage
  • You must protect your data against:
    • Accidental deletion and damage
    • Hackers, ransomware attacks, other malware
    • Malicious insiders

The Shared Responsibility Model places the onus of data protection squarely on you. Google and Microsoft are responsible for keeping their systems up and running; you are responsible for preserving and securing your data.

To review your data protections, and your ability to recover from accidental or malicious loss, contact us or schedule an appointment with our Cloud Advisors.

9 Cyber Security Tips

Since the start of the COVID-19 pandemic, cyber threats and ransomware attacks have accelerated, exceeding 30,000 attacks per day in the US. Cybersecurity measures have never been more important. The move to remote working environments as well as the vulnerability of global economies in crisis has created an open-season for cybercriminals. No business—big or small—is safe.

Small and medium businesses (SMBs) seemingly have a target on their backs, so strengthening your security posture is essential right now. The good news: There are ways to protect your business against ransomware attacks.

Here are nine tips you that boost your business’ resilience to cyber attacks:

Communicate & Educate

1. Conduct a security risk assessment. Understand potential security threats (e.g., downtime from ransomware) and the impact they may have on your business (lost revenue). Use this information to shape a security strategy that meets your specific needs.

2. Create straightforward cybersecurity policies. Write and distribute a clear set of rules and instructions on cybersecurity practices for employees. This will vary from business to business but may include policies on social media use, bring your own device, authentication requirements, etc.

3. Train your employees. Because cybersecurity threats are constantly evolving, an ongoing training plan should be implemented for all employees. This should include examples of threats, as well as instruction on security best practices, and periodic testing.

Prevent & Protect

4. Protect your network and devices. Implement a password policy that requires strong passwords and monitor your employee accounts for breach intel through dark web monitoring. Deploy firewall, VPN, and next-gen antivirus technologies with advanced threat protection. Ensure your network and endpoints are not vulnerable to attacks. Implement mandatory multi-factor authentication. Ongoing network monitoring is essential, as is encrypting hard drives.

5. Keep software up to date. Be vigilant about patch management. Cyber criminals exploit software vulnerabilities using a variety of tactics to gain access to computers and data. Your IT provider should automate this for your businesses with a remote monitoring and management. Keep your mobile phones up to date as well.

6. Back up your data. Daily (or more frequent) backups are a requirement to recover from data corruption or loss resulting from security breaches. Consider using a data protection tools that take incremental backups of data periodically throughout the day to prevent data loss. Remember that you need to protect your data in the cloud as well as you protect your data on local servers and workstations.

7. Know where your data resides. The more places data exists, the more likely it is that unauthorized individuals will be able to access it. Use data discovery tools to find and appropriately secure data along with business-class Software-as-a-Service (SaaS) applications that allow for corporate control of data. Eliminate redundant and “Shadow IT” services.

8. Control access to computers. Use key cards or similar security measures to control access to facilities. Ensure that employees use strong passwords for laptops and desktops. Give administrative privileges only to trusted staff as needed.

Respond & Recover

9. Enable uptime. Choose a powerful data protection solution that enables “instant recovery” of data and applications. In fact, 92% of managed IT service providers report that companies with business continuity disaster recovery (BCDR) products in place are less likely to experience significant downtime from ransomware and are back up and running quickly. Application downtime can significantly impact a business’ ability to generate revenue. Can your business afford downtime costs that are 23X greater (up by 200% year-over-year) than the average ransom requested in 2019?

The best defense is a good offense. A robust, multi-layered cybersecurity strategy can save your business. Contact us to learn more and for a free Cyber Security Assessment.

Be Careful with your COVID-19 Cuts

Almost all of our businesses are feeling the impact of COVID-19.  Revenues and cash flows are down and some costs are rising.  We are all looking for ways to cut expenses. Information technology and services can be a good place to find savings.

As you look to reduce costs, be careful about what services you cut.  Cutting services seen as ancillary or support can save you money in the short term.  Looking forward, cutting any of these services creates real risks that larger problems with bigger costs will impact your business.

Cloud Backup Services

It is tempting to drop your cloud backup service, particularly if you have rarely had to restore, the likelihood you will need to recover lost or damaged content is increasing.  The increased use of home computers and “shadow IT” services, along with an increase in cyber attacks, leads to more accidental and intentional damage and loss. And with more work being done remotely, the reliance on your electronic files, and cloud-resident data in particular, is higher than ever.

Advanced Threat Protection

Almost all email services, including Microsoft 365 and G Suite, have sophisticated malware and virus protections built-in.  They are not, however, your best defense against rapidly changing cyber attacks.  Advanced threat protection provides the extra measure of protection against sophisticated attacks that take advantage of human nature and behaviors and new (zero-hour) attacks. By validating sources and links, and testing links and attachments in a safe sandbox, advanced threat protection can prevent the carnage of ransomware and identity theft.  With a significant spike in phishing attacks, now is not the time to lower your guard.

Service and Support Agreements

It can easy to overlook the value of service and support agreements, particularly if you do not feel that you use them often enough.  Don’t measure the value of these agreements by the cost per call or cost per hour. The value is the time, money, and aggravation saved by having resources on-call that can identify and solve problems, train and guide your users, make system changes, and manage your services. The value is not just in the 15 minutes help, it is having access to resources with the knowledge and experience to address the issue in 15 minutes instead of 15 hours.

By selecting your cuts carefully, you can save money while protecting your business.

See our companion post for more about Where to Look for IT Savings.


For help evaluating your IT environment for efficiency, please contact us to schedule a free Cloud Advisor session, or take a look at our Recovery Road Map Assessment.


 

 

“Deja Vu?” or “Have We Learned Our Lesson?”

Hurricane Matthew as of 2pm on Oct 4th

Hurricane Matthew as of 2pm on Oct 4th

As of this blog post, Hurricane Matthew is churning through the western Caribbean with a projected path eerily similar to Superstorm Sandy in 2012. In its wake, Sandy left a path of destruction up the East Coast and deep into New England with many families and businesses still in the process of rebuilding. Small and mid-size businesses (SMBs) up and down the eastern seacoast were crippled by flooding, loss of infrastructure, and extended Internet and power outages; many were unable to recover.

Could this be a devastating Deja Vu, or did we learn our lesson?

Have you ensured that your information services and data will survive the next storm? Do you know how quickly your business can recover if (more like when) the next storm hits?

Path of Superstorm Sandy in 2012

Path of Hurricane Sandy in 2012

These questions feel more pressing as our next potential big storm churns towards Florida.

Good. Better. Best.

Your “Good” strategy is Backup. Ensure that you back up all of your critical data. Backups should be off site to a service that lets you restore to new systems quickly and efficiently.

Your “Better” strategy is Recovery. In addition to backups, ensure you have the ability to recovery quickly to new systems or to a temporary data center. When your  Return to Operations (RTO) time lets you continue running your business without significant impact to you or your customers, your recovery plan is sound.

Your “Best” strategy is ResilienceYour business is resilient when you can continue running your business with minimal disruption and with little or no inconvenience to your customers, regardless of the weather outside. By placing key applications and services in the cloud, your business can continue to run whether or not your office is open. With Internet access and a browser, your team can connect and work. And while you still may have some aspects of your IT running on premise, a solid cloud strategy keeps critical systems available and operating.

Resiliency Roadmap

For most SMBs, you should consider having the following services hosted or in the cloud. Depending on your applications and needs, you can use Software-as-a-Service (SaaS) solutions or host your applications on cloud/hosted servers with virtual/remote desktops.

  • Communications
    • Email / Calendar / Contacts
    • Telephony — cloud/hosted Voice over IP (VoIP)
    • Messaging / Voice & Video Conferencing
  • Collaboration
    • File Storage & Sharing
    • Productivity Tools (document, spreadsheet, presentation editors)
  • Key Business Apps
    • Customer Relationship Management (CRM)
    • Account / Finance
    • Service / Support
    • Others …

Creating a Resilient business requires strategic thinking, advanced planning, and solid execution. This is especially true when you have integrated applications and systems that you cannot change in isolation. At a high level, the roadmap is:

  1. Identify the applications and services
  2. Prioritize all applications and services based on the impact in the event of a service outage. Look outward and inward, remembering to consider customer impact.
  3. Starting with your highest priority applications and systems, evaluate if your level or protection: Backup, Recovery, or Resilient protection.
  4. Identify and implement solutions that take you from Backup to Recovery, from Recovery to Resilience, or from Backup all the way to Resilience.
  5. Repeat as you move through your prioritized list.

While you may not have time to make your business Resilient before Hurricane Matthew works its way up the coast, you have options to improve your backups and your ability to recover that can be implemented within hours rather than days and weeks. Think about the value of keeping your business running and ensuring its survival. Act now.


Contact us immediately if you want assistance with your backup, recovery, or resiliency services.


 

Calm Before the Storm: 3 Models for Protecting Your Business

Hurricane
What began as a mild tropical storm season has suddenly become quite active, with multiple significant storms expected to impact the southeast and Atlantic coast and the Hawaiian islands. And while every storm may not be a major hurricane, your business is at risk because our infrastructure is at risk.

Power outages, local or regional flooding, and disruption of communication services continue to increase in frequency as our infrastructure ages faster than our upgrades and as our economy rewards utilities for trimming staff and services rather than trimming trees and keeping current with maintenance.

Are you protecting your business from the damage and risk of disruption?

You have seemingly infinite choices on the types and cost of protection, each with benefits and limitations. Your challenge: pick the solution that is most cost-effective, meaning the time it takes to Return to Operations (RTO) is acceptable given the cost.

To simplify your search for a solution, we propose you consider one of three models:

  • Restoration
  • Recovery
  • Continuity

Restoration

Restoration is the least expensive option.  You backup all of your data and critical systems, including full system images, off-site.  In the event of a disaster, you restore your systems once you have fixed or replaced any damaged or lost equipment.

  • Cost Structure:
    • Scales with the size of your system images and the amount of data you keep in offsite backup
  • RTO:
    • 1 to 3 days once replacement equipment arrives
  • Admin:
    • Must ensure backups include all images and data needed to recovery, including Bare Metal Restore (BMR) for key servers and systems.
    • Must periodically test restore for data integrity and to ensure the recovery process is documented and understood.

Recovery

In addition to keeping an off-site or cloud backup covering all of your data and critical systems, you have the ability to access replicas of your network and servers in a remote data center.  In the event of a disaster, you “spin up” your latest system snapshots and restore any incremental data. You access your mirror network via remote desktop, VPN client, or LAN-to-LAN VPN.

  • Cost Structure:
    • Scales with the size of your system images and the amount of data you keep in offsite backup
  • RTO:
    • 1 to 18 hours, depending on your configuration and needs.
  • Admin:
    • Must ensure backups include all images and data needed to recovery, including Bare Metal Restore (BMR) for key servers and systems.
    • Must periodically test recovery for data integrity and to ensure the recovery process is documented and understood.
    • Once primary systems are repaired or replaced, snapshot backups and recovery move your data back for normal operations.

Continuity

Continuity means your IT infrastructure keeps running, even in the face of disaster or significant local events.  You have multiple options for continuity, including: mirrored networks and systems in remote data centers, remote desktops, virtual desktop infrastructure (VDI), and Desktop-as-a-Service (DaaS) models. In each scenario, your servers, applications, and data live in a redundant, remote cloud data center. You access your environment via remote connection, using a web browser or a small local app known as a receiver.  In the event of an emergency, you only need to provide a browser and Internet connection to be up and running.

  • Cost Structure:
    • Scales with the size of your systems and networks
    • Offsets day to day costs of owning and managing on-premise hardware and software
  • RTO:
    • Immediate, based on Internet availability
  • Admin:
    • Providers typically include standard server admin and management, reducing local need for IT resources
    • Application and data management are similar to on-premise systems
    • Backup/restore capabilities are still recommended to protect against application and/or human error.

Using these models as a guide, you can select a solution that balances cost, convenience, and complexity against the operational needs of your business.


Want to setup or improve your disaster recovery/business continuity capabilities? Contact us for a free, no-obligation consultation.


 

Beyond Restore: Use Cases for Google Apps Backup

Backup Man

As we have noted several times in prior posts and webcasts, Google’s internal backup systems are designed to protect you should Google have hardware or software issues. You, however, are responsible for protecting your data in Google Apps from user deletions, user overwrites, malware, hackers, and other risks.

We have identified several use cases for backup/recovery in Google Apps that you cannot do from the Admin console.

A good Google Apps backup solution does more than restore

Preserve Data From Past Employees

  • If you want to preserve data from past employees, and need more than emails, your only option is to continue paying for the suspended Google Apps accounts.
  • With the ability to restore data to others, you can keep the backup as an archive and delete the Google Apps accounts.
  • An added benefit: the cost is less than 1/2 of a Google Apps for Work license and less than 1/4 of a Google Apps Unlimited license.

Transfer Data to New Owners

  • While you can transfer document ownership though the Admin Console and ownership of Sites data through APIs, these transfers are “all or nothing” and are destructive (they remove the data from the original account).
  • With the ability to restore data selectively and to others, you can transfer specific files, folders, sites data, emails, etc. to different people as needed.
  • An added benefit: You can transfer data between employees as they change positions and responsibilities.

Archive Documents (and other data)

  • While Google Apps Vault has eDiscovery searches for Gmail and Drive, Vault only archives Gmail.
  • A third party backup solution can preserve and archive documents, as well as email, calendars, contacts, and sites data in support of your document retention policies or regulations.
  • While a user can still delete a document and empty it from Trash before the backup, most users are unaware of the steps to take. With multiple backups per day, you are protected from losses other than those of a determined malicious actor.

Escape Hatch

  • As a “best-practice”, backups should not be stored in the systems being backed up without altering the format or content.
  • The right backup solution keeps your data in a separate location/service and restores data in its original format.
  • An added benefit: With an export feature, your backups become an easier way to extract data from Google Apps.

 

We offer multiple backup solutions for Google Apps, click here to learn more about our preferred solution.


 

Be Able to Recover

Backup Man
Accidents will happen. And while accidents that damage or destroy data are more common, malicious attacks will happen as well.  The rate of ransomware is on the rise and large companies are not the only targets. Whether by phishing attack, advanced persistent threat, or other means your company is seen as having data valuable enough to extort a ransom, you are a target.

In short, if you are reading this, you are a potential target.

While improving your endpoint protection and educating users can greatly minimize your risk, no malware solution can provide you with a guarantee against ransomware. So, if you are hit, you need to be able to recover.

For your on-premise systems, you most likely have a backup/recovery solution. In the event of ransomware, you can delete the encrypted files and restore from a point in time prior to the attack. Yes, you lose data, but a solid backup plan can minimize the loss and the impact.

Your cloud data needs the same protection. You want the same recovery process.  

Traditional and cloud backup services can be installed and connected to cloud servers in much the same way as they work for on-premise servers. For cloud file services, like Google Drive and Microsoft OneDrive, traditional backup solutions will not work as they cannot connect to the service. The same holds true for data in SaaS applications like Salesforce.com.  You need a specialized solution.

Our Recommendation

For most of our Google Apps and Microsoft Office 365 clients, we recommend Backupify as our preferred solution for several reasons:

  • Multiple backups per day for some or all users
  • Unlimited backup space
  • Unlimited backup retention
  • Multiple admin accounts with delegation
  • Powerful search
  • Fast restores
  • The ability to archive data for past users (Google Apps)

Our Offer

Try Backupify for free for 21 days. If you like what you see, we can save you money on license and support.  If not, we discontinue the service.

Interested? Let us know.

library

SaaS Protection Buyer’s Guide

eBook Source: Cumulus Global

Microsoft, Google, and other cloud providers backup their infrastructure. They ensure that their services are running and accessible. You, however, are responsible for managing, securing, and protecting your data.

This eBook guides you through common myths about cloud services, why SaaS protection is important, and selecting your SaaS protection solution.

Please confirm you information below to view and download the eBook.