Vendor Accent

The need for e-mail resilience

Marcus Loh on why enterprises should consider establishing a resilient framework for retention and retrieval of e-mail

The rapid growth of e-mail threatens to overwhelm today’s enterprises. While e-mail plays an essential part in improving workforce productivity, it also creates an excess of information for most organisations and a storage nightmare for IT departments. This article looks at why enterprises should consider establishing a resilient framework for the efficient retention and retrieval of e-mail.

Today’s pain points

The immense popularity of e-mail has created three pressing problems that affect organisations of all sizes.

• Storage requirements are escalating. According to a 2004 survey conducted by Osterman Research, 62 percent of organisations consider growth in messaging storage alone to be a ‘serious’ or ‘very serious’ problem, second only to the problem of spam. That’s consistent with the findings of a 2004 survey by Horison Information Strategies, a consulting firm that researches the storage market, which found that the amount of corporate data is increasing at an average rate of 50 to 70 percent every year.
• Data types continue to expand. Systems that contain structured, semi-structured and unstructured data types continue to grow, generating more business-critical information than ever before. This data must also be indexed and easily retrievable.
• Regulations, legal discovery complicate matters. More stringent statutory requirements for data retention and increasing requirements to extract data for the purpose of supporting legal discovery efforts are having a direct impact on IT departments. Records must be retained in a manner that will prevent them from being damaged or intentionally modified, and that will make them available for inspection whenever regulators require them to be available. A recent law such as the Sarbanes-Oxley Act, enacted in 2002, doesn’t specify new data retention requirements, but it does make the penalties for non-compliance much more severe and potentially more burdensome.

In the light of these developments, it’s no surprise that researcher Gartner Inc. recently called on companies to address their e-mail retention and management needs immediately. “Waiting until the company defines a plan for electronic records retention or for e-mail active-archiving technology to mature could place your business at risk, given the regulatory requirements and escalating demands for electronic discovery.” (Magic Quadrant for E-mail Active-Archiving Market, April 2005)

That risk has been underscored rather dramatically in recent years thanks to several high-profile court cases:

(i) In March, a Florida judge hearing a $2.7 billion lawsuit against Morgan Stanley issued an “adverse inference order” against the company for “willful and gross abuse of its discovery obligations.” The judge cited Morgan Stanley for repeatedly finding misplaced tapes of e-mail messages long after the company had claimed that it had turned over all such tapes to the court.

(ii) In early 2004, a US bank was fined $10 million for taking too much time to comply with SEC requests for information and for failing to maintain certain e-mail records.

(iii) An investment banker at a large international bank was convicted and sentenced to prison for instructing his staff to delete e-mail and instant messages shortly after his firm received a grand jury subpoena.

Key capabilities for retention and retrieval

As an organisation’s data stores continue to swell, and as access to that data becomes more critical, it therefore becomes essential to establish a resilient retention and retrieval framework. The goal is to securely retain data in such a way that it can be both fully exploited and ‘expired’ when it is no longer required.

Such a framework calls for an organisation to create record retention policies (including protection, archiving, retrieval and deletion), and implement a data management solution that adheres to these policies. It requires an organisation to track retained information through its entire lifecycle, and to assign differing levels of access to this data for different users while maintaining an audit trail of all changes to the archived data.

In addition, an organisation needs to establish and monitor IT controls around backup and archiving, as well as demonstrate compliance by generating reports on backup and archiving activity.

Implementing a resilient retention and retrieval framework also involves migrating from tape backup to disc-based backup to archiving as business needs require. Backing up to disc-based storage is a better option that allows faster backups, faster access to information, and more timely data extraction. (Also, disc-based backup can be migrated to tape after a certain length of time for long-term archival.)

Such a framework should also maintain flexibility as laws and regulations are added or amended.

On a practical level, organisations should be able to rely on the framework to:

• Flexibly store archived content.
• Reduce storage via compression and ‘single- instancing’ of identical items.
• Automatically index content for rapid and targeted retrieval.
• Search across multiple data types and data stores.
• Secure future accessibility regardless of application by rendering an HTML copy of all archived content.
• Utilise user authentication security controls.

Conclusion

In today’s networked world, the free flow of information is essential to success. Information has become the currency of our age, and unlike a disc or laptop, it cannot be easily replaced. As the pace of business evolution continues to accelerate, organisations will face new challenges in securing, managing, and making available this irreplaceable asset.

To prepare for and address these evolving challenges, organisations must build an IT infrastructure that seamlessly bridges the divide between security, storage, data and application service management.

Seen in this context, the rapid growth of electronically generated and stored information presents organisations with significant challenges. As storage requirements grow, data types proliferate, regulatory pressures increase, and demands for electronic discovery escalate, organisations should consider the benefits of a resilient e-mail retention and retrieval framework. Such a framework makes access to information easier and more straightforward, and can have a positive impact on user productivity as well. After all, IT managers, as well as legal counsel and compliance officers, to name just a few, must have ready access to information from all parts of the organisation. Ultimately, such a framework is the best bet for protecting an enterprise’s critical information.

The author is Regional Business Manager Asia South Enterprise Vault Symantec.
He can be reached at marcus_loh@symantec.com