Welcome! Twitter: zimmerhds Harry Zimmer Senior Director, Global Competitive & Market Intelligence Hitachi Data Systems Email: harry.zimmer@hds.com Twitter: zimmerhds Phone: 1-905-738-7903 Cell: 1-416-704-0293

Hype vs Reality: CLOUD Storage Harry Zimmer November 20, 2012

Technology Hype Cycle

Technology Hype Cycle Cloud Storage

IDC Storage Cloud Forecast December 2011 Consumer SaaS STaaS APaaS Backup Archive BPaaS Next update of this forecast from IDC Is planned for April 2013. STaaS (Storage as a Service) is only a subcomponent in the total number shown in the above IDC chart.

Gartner CLOUD Storage Observation September 2012 “Well-managed, in-house storage solutions nearly always have better availability, performance, throughput and security, compared with public cloud storage solutions, so IT managers must perform a risk/benefit analysis before moving application data to the cloud.” Gartner – September 2012

Should you use Public Cloud storage?

Cloud Storage: reasons why ‘YES’ Save Money Don’t have to buy / manage storage infrastructure. Don’t have to have extra capacity as service provider ‘eats’ this cost. Move from Capex to Opex Spending Model For some companies move from Capex to Opex may be very appealing Cost to grow storage farm may be cheaper Storage Functions Move to Cloud Storage Provider Allows you to either redeploy or eliminate staff. Rapid Deployment Equipment is waiting  fast time to value (deployment) Innovate / incubate

Why No? Some Considerations Public (and hybrid) have at least 6 Key issues to consider: Data Privacy: Legislation may limit where you can put specific data in the public storage cloud. Business Model: Not a win/win for customers and service providers. Not sustainable long term. Expect Cloud provider failures. Workload/Architecture? What can you put into the cloud? File Archive = Yes, Backup = Maybe, Database = ?, OLTP = No Cost versus Financial Benefit? If goal to save money, be careful – study various cloud pricing models. Risk / Protection? Contractual terms with public or hybrid providers are weak on responsibility & damages. Availability – SLA’s: Can you live with the Public Storage Cloud model?

Why No? Some Considerations Public (and hybrid) have at least 6 Key issues to consider: Data Privacy: Legislation may limit where you can put specific data in the public storage cloud. Business Model: Not a win/win for customers and service providers. Not sustainable long term. Expect Cloud provider failures. Workload/Architecture? What can you put into the cloud? File Archive = Yes, Backup = Maybe, Database = ?, OLTP = No Cost versus Financial Benefit? If goal to save money, be careful – study various cloud pricing models. Risk / Protection? Contractual terms with public or hybrid providers are weak on responsibility & damages. Availability – SLA’s: Can you live with the Public Storage Cloud model?

Data privacy: A Primer Movement of specific kinds of data may be prohibited by law. Most of the laws currently in force focus on customer or citizen data especially as it relates to Healthcare, Banking, and Tax records. Overall EEA is a leader in this space having first enacted legislation in 1995. Within the EEA two countries (Germany and the Netherlands) stand out as having some of the strictest laws. Before using public cloud storage get legal advice on whether or not any of your data has any restrictions on it on where it can physically / geographically reside.

Data Privacy: EMEA Legal Considerations Directive 95/46/EC is the reference text, in Europe, on the protection of personal data. “Transfers of personal data from a Member State to a third country with an adequate level of protection are authorised. However, they may not be made to a third country which does not ensure this level of protection, except in the cases of the derogations listed.” Principle: no transfer of data to countries outside the EU that do not offer an “adequate level of protection” http://www.ico.gov.uk/for_organisations/data_protection/the_guide/principle_8.aspx http://europa.eu/legislation_summaries/information_society/data_protection/l14012_en.htm http://ec.europa.eu/justice/data-protection/index_en.htm EU rules are substantially more restrictive than rules from other countries.

European Union Approved cloud storage Countries There are no restrictions on the transfer of personal data to EEA countries. These are currently: The European Commission has decided that certain countries have an adequate level of protection for personal data. Currently, the following countries are considered as having adequate protection (as of June 2012): Not on the list? BRIC Countries: Brazil, Russia, India, China Austria Estonia Iceland Luxembourg Romania Belgium Finland Ireland Malta Slovakia Bulgaria France Italy Netherlands Slovenia Cyprus Germany Latvia Norway Spain Czech Republic Greece Liechtenstein Poland Sweden Denmark Hungary Lithuania Portugal Andorra Australia Faroe Islands Isle of Man Jersey US (air passenger names) Argentina Canada Guernsey Israel Switzerland US (entities that adhere to EU-US Safe Harbour Principles)

EU + US Safe Harbour agreement No restrictions on the transfer of personal data from the EU to the US if the specific US Cloud Storage company has adhered to the “Safe Harbour” principles. “Safe Harbour” is a set of voluntary rules on privacy and data protection elaborated and decided by the US Department of Commerce (DoC). Organizations in the US can notify the DoC that they adhere to these rules. The EU Commission has assessed that the rules (including accompanying questions and answers) constitute an adequate level of protection. It is permitted to transfer personal data from EU/EEA to organisations in the US who have adhered to the rules. US DoC maintains a list of companies and organizations that adhere to the Safe Harbor principles. Here is a link to see the list: http://safeharbor.export.gov/list.aspx European Union has new legislation coming into force in 2014 that replaces Directive 95/46/EC. This link describes the proposed new law which is to be adopted by all EU members countries: http://www.statewatch.org/news/2011/dec/eu-com-draft-dp-reg-inter-service-consultation.pdf

Data Ownership & Data Security Once in the public cloud who owns the data? The hoster? The user? It seems the answer is currently not 100% clear. Ensure any contracts signed with a Cloud Storage service provider has very tight/clear wording around data ownership. Data Security in the Storage Cloud: Users Need Robust Protection Mechanisms Define data object access permissions through Access Control Lists Implement encryption and firewalls to block unauthorized data center access (internal and external) Extend encryption to the transport level Ensure server level security Ensure physical security Have ongoing audits to ensure compliance/effectiveness What happens if the physical disk is shared by multiple companies? Is there adequate multi-tenancy protection?

Why No? Some Considerations Public (and hybrid) have at least 6 Key issues to consider: Data Privacy: Legislation may limit where you can put specific data in the public storage cloud. Business Model: Not a win/win for customers and service providers. Not sustainable long term. Expect Cloud provider failures. Workload/Architecture? What can you put into the cloud? File Archive = Yes, Backup = Maybe, Database = ?, OLTP = No Cost versus Financial Benefit? If goal to save money, be careful – study various cloud pricing models. Risk / Protection? Contractual terms with public or hybrid providers are weak on responsibility & damages. Availability – SLA’s: Can you live with the Public Storage Cloud model?

Cloud business model Current cloud storage business model favors customers Current cloud business model that allows elastic-burstable usage without penalty favors customers. (Fixed term commitments with min/max usage levels are creeping back into ‘cloud’ deals.) Cloud Storage service provider may or may not be profitable on a customer by customer basis. Is it good business to have a win/lose scenario? Long term sustainability? Fixed term commitments are creeping back into ‘cloud’ deals now. Pricing erosion and pricing wars are already happening. Competitive marketplace is setting street price.

CLOUD business model Before Cloud Era Cloud Era Profit Zone Bookable Cost Performance Capacity Cost Performance Capacity Installed Capacity Installed Capacity Profit Zone Bookable Baseline Deal Not Bookable Time Time Time Sharing (1970’s-80’s) Service Bureau (1980’s-90’s) Outsourcing (1990’s onward) Cloud (2010 onward) New terminology for Cloud Model: “Burstable” “Elastic”

CLOUD Business Model Cloud providers strive for a manageable churn/Attrition rate Service Provider “A” # of customers = Use of Installed Infrastructure Service Provider “B” Service Provider “C”

Why No? Some Considerations Public (and hybrid) have at least 6 Key issues to consider: Data Privacy: Legislation may limit where you can put specific data in the public storage cloud. Business Model: Not a win/win for customers and service providers. Not sustainable long term. Expect Cloud provider failures. Workload/Architecture? What can you put into the cloud? File Archive = Yes, Backup = Maybe, Database = ?, OLTP = No Cost versus Financial Benefit? If goal to save money, be careful – study various cloud pricing models. Risk / Protection? Contractual terms with public or hybrid providers are weak on responsibility & damages. Availability – SLA’s: Can you live with the Public Storage Cloud model?

“-¼” “-1” “0” “1” “2” “-½” Storage Architecture Server Array Cloud Storage should be viewed as ‘another tier’ “-¼” PCIe SSD’s “3 or 4” “Archive” Tape Server Array DRAM “-1” PCIe SSD Cache “0” Flash SSD “1” SAS “2” SATA Cloud Storage Gateway Hot Data Cold Data “-½” Flash Array “2 or 3” “Virtualization”

Storage Gateways Cloud storage gateway types: Software Virtual Appliances Physical Appliances Bridge on-premises and cloud storage environments in hybrid storage models. Use cases: Providing additional storage capacity, Enabling backup services, Retention of long term data, Gateway provides “efficiency” including data reduction techniques such as data deduplication Cloud storage gateways can also differ in storage interfaces supported (i.e., block versus file). Cloud Storage Gateway

451 Research Storage wave 16 Study - October 2012

“-1” Storage Architecture Server Cloud Storage Gateway DRAM PCIe SSD Amazon Google Microsoft Nirvanix Rackspace Cloud Storage Gateway File Data Archive Backup Server DRAM “-1” PCIe SSD Block Data Relational Database Amazon Rackspace

Tech Target: Customer Survey 2012: Cloud Storage USES http://searchcloudstorage.techtarget.com/news/2240169517/Cloud-data-storage-services-in-wide-use-among-companies-of-all-sizes

Tech Target: Customer Survey 2012 what are you backing up to the cloud? http://searchcloudstorage.techtarget.com/news/2240169517/Cloud-data-storage-services-in-wide-use-among-companies-of-all-sizes

Tech Target: Customer Survey 2012 %’age of your biz apps using cloud storage http://searchcloudstorage.techtarget.com/news/2240169517/Cloud-data-storage-services-in-wide-use-among-companies-of-all-sizes

Why No? Some Considerations Public (and hybrid) have at least 6 Key issues to consider: Data Privacy: Legislation may limit where you can put specific data in the public storage cloud. Business Model: Not a win/win for customers and service providers. Not sustainable long term. Expect Cloud provider failures. Workload/Architecture? What can you put into the cloud? File Archive = Yes, Backup = Maybe, Database = ?, OLTP = No Cost versus Financial Benefit? If goal to save money, be careful – study various cloud pricing models. Risk / Protection? Contractual terms with public or hybrid providers are weak on responsibility & damages. Availability – SLA’s: Can you live with the Public Storage Cloud model?

“Enterprise class” Storage CLOUD companies Are there Too Many players in the Market? Expect Consolidation

Enterprise Class CLOUD Storage companies: Sorted into 3 Buckets Cloud Storage Software: Virtual Gateway / Tiering / Copy / Bkup Sync/Drop Box-like File Sharing Cloud Storage Gateway Filer/Appliance: Data Cached / Sent to cloud data hoster Cloud Storage Hosters Infrastructure: Data is physically stored here. Baseline business is archive and backup hosting.

CLOUD storage Vendors “30% of Cloud Service providers will go out of business by 2015. This includes established companies, not just startups.” IDC, August 2012 What happens to your files when a storage cloud service dies? What protections has the cloud storage provider put in place to mitigate against bankruptcy or being shut?

What is the cost of ENTERPRISE CLASS public cloud storage? how much will you pay for cloud storage? There is no standard cost model/structure between cloud storage vendors. Very difficult to do apples to apples cost comparisons. Remember: All are in the game to make money – so margin is built into their pricing. Storage Cloud vendors have multiple line items that they will charge you on. It is not easy to create a comparison financial model.

What is the cost of ENTERPRISE CLASS public cloud storage: Line items how much will you pay for cloud storage? All cloud vendors charge a $/gigabyte/month fee (some sliding based on volume / some fixed. Length of contract (longer) you commit to may reduce monthly fee. Bandwidth used – based on the actual amount of data transferred You may be charged each month based on the number of times you use the commands: PUT, COPY, POST, LIST and GET PUT, COPY, POST and LIST are cheaper to do versus GET If offered, vendor will charge premium for high availability (# of 9’s) If offered, vendor will charge premium for BLOCK (hot data) usage.

Cloud Storage price erosion Price from Cloud vs Internal IT Monthly $/GB fee continues to drop Assume $ per gigabyte erodes at 25-30% per year Both cloud storage & internal IT departments will benefit. Cloud Storage providers may or may not match this! So far (as of February 2012) Amazon S3 has dropped their pricing up to 13.5%. Complexity of the Cloud Storage provider pricing models makes ongoing budget / spending impossible User pay model will only look good (or bad) over time.

Amazon’s glacier (CLOUD Archive) Offering Extremely low-cost ‘archive’ storage service – priced as low as US$0.01/gigabyte/month Amazon Glacier provides secure and durable storage for data archiving and backup. In order to keep costs low, Amazon Glacier is optimized for data that is infrequently accessed and for which retrieval times of several hours are suitable. Pay for only what you use. Pay for each access.

Amazon AWS GLACiER VS HDS hCP

Amazon AWS GLACiER VS HDS UCP Conclusions If data is not to be accessed frequently, and has low RTO (recovery time objective), then cloud offerings such as Glacier will have a good total cost story Legal and compliance requirements can turn these kinds of calculations upside-down; make sure your inactive data can be really off-site Read the fine print; make sure you understand all life-cycle costs There can be economic surprises over time, like migration costs or maintenance bubbles. Make sure that your time horizon is appropriate. There will be real performance and availability differences with some of these kinds of services. Make sure the data classification and catalog definitions are commensurate with the service you are purchasing Low cost, inactive data possibly for long-term storage like compliance

Block data in the storage Cloud? Rackspace Cloud block storage “CHOICE BETWEEN STANDARD VOLUMES OR SSD VOLUMES FOR HIGHER PERFORMANCE” “SIMPLE PRICING MEANS NEVER HAVING TO PAY FOR I/O” http://www.rackspace.com/blog/cloud-block-storage/

Block data in the storage Cloud? Amazon elastic block storage (EBS) EBS is based on Amazon installed SSD storage It is aimed at database users. Volume storage for Standard volumes is charged by the amount you provision in GB per month until you release it. Volume I/O for Standard volumes is charged by the number of requests you make to your volume. Programs like IOSTAT can be used to measure the exact I/O usage of your system at any time. However, applications and operating systems often do different levels of caching, so for Standard volumes, you will likely see a lower number of I/O requests on your bill than is seen by your application unless you sync all of your I/Os to disk. As with Standard volumes, volume storage for Provisioned IOPS volumes is charged by the amount you provision in GB per month. With Provisioned IOPS volumes, you are also charged by the amount you provision in IOPS (input/output operations per second) X the percentage of days you provision for the month. For example, if you provision a volume with 1000 IOPS, and keep this volume for 15 days in a 30 day month, then in the Virginia Region, you would be charged $50 for the IOPS that you provision ($0.10 per provisioned IOPS-Month * 1000 IOPS Provisioned * 15 days/30). Snapshot storage is based on the amount of space your data consumes in Amazon S3. Because data is compressed before being saved to Amazon S3, and Amazon EBS does not save empty blocks, it is likely that the size of a snapshot will be considerably less than the size of your volume. For the first snapshot of a volume, Amazon EBS will save a full copy of your data to Amazon S3. However for each incremental snapshot, only the part of your Amazon EBS volume that has been changed will be saved to Amazon S3.

Why No? Some Considerations Public (and hybrid) have at least 6 Key issues to consider: Data Privacy: Legislation may limit where you can put specific data in the public storage cloud. Business Model: Not a win/win for customers and service providers. Not sustainable long term. Expect Cloud provider failures. Workload/Architecture? What can you put into the cloud? File Archive = Yes, Backup = Maybe, Database = ?, OLTP = No Cost versus Financial Benefit? If goal to save money, be careful – study various cloud pricing models. Risk / Protection? Contractual terms with public or hybrid providers are weak on responsibility & damages. Availability – SLA’s: Can you live with the Public Storage Cloud model?

Contractual Terms: Liability Is cloud storage legally enterprise ready? Read the fine Print 11. Limitations of Liability. WE AND OUR AFFILIATES OR LICENSORS WILL NOT BE LIABLE TO YOU FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL OR EXEMPLARY DAMAGES (INCLUDING DAMAGES FOR LOSS OF PROFITS, GOODWILL, USE, OR DATA), EVEN IF A PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHER, NEITHER WE NOR ANY OF OUR AFFILIATES OR LICENSORS WILL BE RESPONSIBLE FOR ANY COMPENSATION, REIMBURSEMENT, OR DAMAGES ARISING IN CONNECTION WITH: (A) YOUR INABILITY TO USE THE SERVICES, INCLUDING AS A RESULT OF ANY (I) TERMINATION OR SUSPENSION OF THIS AGREEMENT OR YOUR USE OF OR ACCESS TO THE SERVICE OFFERINGS, (II) OUR DISCONTINUATION OF ANY OR ALL OF THE SERVICE OFFERINGS, OR, (III) WITHOUT LIMITING ANY OBLIGATIONS UNDER THE SLAS, ANY UNANTICIPATED OR UNSCHEDULED DOWNTIME OF ALL OR A PORTION OF THE SERVICES FOR ANY REASON, INCLUDING AS A RESULT OF POWER OUTAGES, SYSTEM FAILURES OR OTHER INTERRUPTIONS; (B) THE COST OF PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; (c) ANY INVESTMENTS, EXPENDITURES, OR COMMITMENTS BY YOU IN CONNECTION WITH THIS AGREEMENT OR YOUR USE OF OR ACCESS TO THE SERVICE OFFERINGS; OR (D) ANY UNAUTHORIZED ACCESS TO, ALTERATION OF, OR THE DELETION, DESTRUCTION, DAMAGE, LOSS OR FAILURE TO STORE ANY OF YOUR CONTENT OR OTHER DATA. IN ANY CASE, OUR AND OUR AFFILIATES’ AND LICENSORS’ AGGREGATE LIABILITY UNDER THIS AGREEMENT WILL BE LIMITED TO THE AMOUNT YOU ACTUALLY PAY US UNDER THIS AGREEMENT FOR THE SERVICE THAT GAVE RISE TO THE CLAIM DURING THE 12 MONTHS PRECEDING THE CLAIM. Snapshot of Agreement as of: October 30th, 2012 http://aws.amazon.com/agreement/ https://developers.google.com/storage/docs/terms http://www.nirvanix.com/how-to-buy/terms.aspx http://www.storsimple.com/Portals/65157/docs/SS%20End%20User%20License%20Agreement%20Rev.%20A.pdf http://www.rackspace.com/cloud/legal/

Contractual Terms: Liability Engage a lawyer before ever signing one of these agreements. 13 Limitation of Liability 13.1 Limitation on Indirect Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY, NOR GOOGLE’S SUPPLIERS, WILL BE LIABLE UNDER THIS AGREEMENT FOR LOST REVENUES OR INDIRECT, SPECIAL, INCIDENTAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, EVEN IF THE PARTY KNEW OR SHOULD HAVE KNOWN THAT SUCH DAMAGES WERE POSSIBLE AND EVEN IF DIRECT DAMAGES DO NOT SATISFY A REMEDY. 13.2 Limitation on Amount of Liability. TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, NEITHER PARTY, NOR GOOGLE’S SUPPLIERS, MAY BE HELD LIABLE UNDER THIS AGREEMENT FOR MORE THAN THE AMOUNT PAID BY CUSTOMER TO GOOGLE DURING THE TWELVE MONTHS PRIOR TO THE EVENT GIVING RISE TO LIABILITY. Snapshot of Agreement as of: November 1st , 2012

protection: What Can you count on Contractually? What is the Cloud Storage provider on the hook for as it relates to: Data Breach? Data Loss? Data Corruption? Loss of Access to Data? Re-write the Cloud Storage Vendor Contract to Protect Your Company and Your Data Insert appropriate clauses with appropriate enterprise class penalties to ensure maximum compliance.

Why No? Some Considerations Public (and hybrid) have at least 6 Key issues to consider: Data Privacy: Legislation may limit where you can put specific data in the public storage cloud. Business Model: Not a win/win for customers and service providers. Not sustainable long term. Expect Cloud provider failures. Workload/Architecture? What can you put into the cloud? File Archive = Yes, Backup = Maybe, Database = ?, OLTP = No Cost versus Financial Benefit? If goal to save money, be careful – study various cloud pricing models. Risk / Protection? Contractual terms with public or hybrid providers are weak on responsibility & damages. Availability – SLA’s: Can you live with the Public Storage Cloud model?

SLA’s: Storage Cloud Availability Assess What is acceptable to your organization? Amazon, Google and Nirvanix Use “Three Nines” are their definition Of quality of service with credits. Availability* % Downtime per Year 90% ("one nine") 36.5 days 99% ("two nines") 3.65 days 99.9% ("three nines") 8.76 hours 99.99% ("four nines") 52.56 minutes 99.999% ("five nines") 5.26 minutes 99.9999% ("six nines") 31.5 seconds 99.99999% ("seven nines") 3.15 seconds “Five Nines” = Industry accepted availability for Enterprise Class Storage * Availability is usually defined as a measure of unscheduled downtime. From Amazon Web Site FAQ: Q: How reliable is Amazon S3? Amazon S3 gives any developer access to the same highly scalable, reliable, fast, inexpensive data storage infrastructure that Amazon uses to run its own global network of web sites. The service was designed for 99.99% availability, and carries a service level agreement providing service credits if a customer’s availability falls below 99.9%.

SLA’s: Storage Cloud Availability Customer Must Request Financial Credit: “In order to receive any of the Financial Credits described above, Customer must notify Google within thirty days from the time Customer becomes eligible to receive a Financial Credit. Failure to comply with this requirement will forfeit Customer’s right to receive a Financial Credit. To notify Google of SLA Financial Credit eligibility, please see the Documentation.” Maximum Financial Credit: “The aggregate maximum number of Financial Credits to be issued by Google to Customer for any and all Downtime Periods that occur in a single billing month shall not exceed 50% of the amount due by Customer for the Application for the applicable month. Financial Credits will be made in the form of a monetary credit applied to future use of the Service and will be applied within 60 days after the Financial Credit was requested.”

Broadcasting CLOUD Storage Considerations Broadcasting “Ready” Storage Cloud Architecture Means high-speed, high-capacity network that can withstand the enormous amount of data being uploaded, edited and retrieved from the cloud. Broadcasting Workflow Considerations Content is shared across data centers, cities, states or countries Distributed Content Creation Production Collaboration Network is as Crucial as Storage Cloud Availability News editors and producers are in a time / production deadline situation. They edit (hours) of raw footage into a 30-second spot(s) for the next newscast. How many nines does your organization need? Network costs may be prohibitive for cloud use given broadcasting file sizes. Future Huge Growth in Storage Requirements Due to higher-frames-per-second (fps) cameras and video resolution (24fps to 48fps to perhaps 300fps in the future) Digital Video Production Resolution Increases from 2K to 4K and perhaps 8K and 16K in the future.  High-Resolution Digital Video Can quickly generate terabytes/hour of material to be stored.

Reality Check / Recommendations Do your homework: Define your organizational financial goals / objectives for going to Public Cloud Storage. If saving money is THE goal – do a realistic financial analysis comparison of in-house vs public cloud storage. Understand all the CAPEX and OPEX costs that have to be factored into a total cost comparison. If Public Cloud Storage looks favorable then consider all of the other considerations on the Why NO charts. Key consideration should be: can you accept these risks.

Thank You! Harry Zimmer Senior Director, Global Competitive & Market Intelligence Hitachi Data Systems Email: harry.zimmer@hds.com Twitter: zimmerhds Phone: 1-905-738-7903 Cell: 1-416-704-0293