SaaS Backup

Challenges & Best

Practices
In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
In this e-guide:
SaaS apps, like Salesforce, Microsoft Office 365, and G Suite, are now widely rolled out
across organizations of all sizes. However, despite this adoption, organizations are still
navigating the backup and data protection needs of these apps.
For example, when moving data to the cloud, many don’t give a second thought to backups.
This stems from a misconception that SaaS data created in the cloud is somehow more
protected because it was stored there, which, unfortunately, is not true: SaaS data is still
susceptible to accidental deletion and malicious activity.
This professional guide from TechTarget offers a closer look at what SaaS vendors are
actually responsible for versus what backup and data protection precautions organizations
themselves need to have in place, as well as what to look for when it comes to choosing a
SaaS backup solution.
▼
Next Article
Page 1 of 13
In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
Keep SaaS backup at the front of your data
protection plan
Paul Crocetti, Senior Site Editor
https://searchdatabackup.techtarget.com/ehandbook/SaaS-data-backup-challenges-and-best-
practices
Organizations are turning to cloud-based software-as-a-service platforms as a way to 'SaaS-
ify' their workloads. In fact, it would be hard to find many businesses that aren't using at least
one major SaaS platform -- such as Salesforce, G Suite, Box and Microsoft Office 365 -- for
their data. But how are managers protecting that data?
Some organizations may think SaaS data backup isn't worth the trouble, while others may not
realize that it's needed. For example, an IT manager at a recent conference admitted in a
public breakout session that he's not backing up his organization's Gmail. And a recent survey
of 1,000 IT professionals and business executives conducted by security and backup vendor
Barracuda found that only 16% of companies back up the data in their SaaS applications.
But if you back up all your on-premises data, you should ensure that the data generated by
your SaaS platforms is adequately backed up as well.
It's still an emerging technology, but there are a number of SaaS data backup products
available. This handbook explores the trends complicating SaaS data backup, implementation
challenges and best practices when dealing with this crucial process.
▼ Next Article
Page 2 of 13
In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
2 trends that complicate SaaS data
protection
Alan Earls, Contributor
https://searchdatabackup.techtarget.com/tip/2-trends-that-complicate-SaaS-data-protection
The popularity of SaaS options has been growing rapidly. Software as a service is usually
easier to implement and typically less expensive than on-premises alternatives or managing
your own software in a cloud. However, SaaS data protection is not bulletproof and data can
still be vulnerable.
For a long time, there was a general impression that SaaS data created in the cloud was
inherently more protected because it was also stored there. "There is a big disconnect when it
comes to SaaS backup and recovery," Enterprise Strategy Group analyst Christophe Bertrand
said. "A large number of users believe they don't need a backup" as they would for on-
premises workloads or that the vendor has tools that suffice for this purpose. The big gap in
perception "also creates a high level of noncompliance exposures," he said.
Gartner analyst Nik Simpson called SaaS backup and recovery an unrecognized problem that
is often driven by business units selecting SaaS applications. "They don't think about this
[recovery issue] -- or at least not until after they've lost data," he said.
SaaS data protection has only recently begun to be recognized as a need-to-have for
businesses of every size, though there have been some vendors who have offered it for
years, said Steven Hill, analyst at 451 Research. However, he said, most licensing
agreements specifically state that a SaaS vendor is not responsible for data protection.
Page 3 of 13
In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
Ransomware protection depends on mix of local,
cloud infrastructure
When it comes to resilience, most public cloud platforms far exceed the capabilities of any but
the largest IT environments. But for SaaS, or any other shared data environment, the most
common challenge is protecting against accidental deletion or malicious activity like
ransomware.
Ransomware is no joke, and there's little if anything companies can do other than pay if their
data protection isn't up to the task, Hill said. And there's no guarantee you'll get data back
even if you do pay. These common dangers reinforce the need for the age-old model of
"having multiple backup copies of your data and at different locations, whether in the cloud or
on premises," he said.
Unfortunately, according to Hill, there haven't been any real innovations from SaaS
companies that can address these challenges. "The recent innovation in SaaS backup lies in
the fact that it's actually becoming table stakes for data protection vendors," he said. Backup
is the oldest model for data protection, and "it's hard to improve on the basic premise of
having a second copy of your important business data that's kept at a different location."
The cloud does change the model a bit, he added. That's because in the case of SaaS, the
cloud is both a source and a potential destination for backup data. It often becomes a
question whether you should use the same cloud for both primary and backup copies of SaaS
data.
"The resilience of data is really quite good in the cloud, so it comes down to greater
availability or industry-specific compliance policies," Hill said. The real innovation is happening
after the fact, where the industry is moving toward simplifying long-term unstructured data
Page 4 of 13

In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
lifecycle management and governance and finding ongoing value from backup data through
analytics.
Doug Hazelman, vice president of technical marketing at MSP360, a managed backup and
recovery provider formerly known as CloudBerry Lab, said vendors now aim to deliver backup
and recovery through a mix of local and cloud infrastructure. He said backup vendors are
shifting from their own cloud storage platforms to using public cloud storage and offering the
ability to recover as cloud virtual instances. "That allows them to lower downtime when the on-
premises hardware is not ready or was damaged," he said.
Multi-cloud complexity looks for simplification
Another trend that complicates SaaS data protection is the increase of multi-cloud platforms.
Hill said 451 Research's Voice of The Enterprise Q1 2019 survey showed that multi-cloud
adoption is far more common than most people suspect, with 72% of the organizations polled
indicating they use two or more cloud platforms. "This can complicate things for multi-cloud
customers, so it's something that should be a consideration when it comes to choosing a
SaaS data protection vendor," he said.
"Multi-cloud is becoming the norm, and the challenge is pretty much the same for SaaS as it
is for any other cloud production environment," Hill said.
In other words, not all cloud platforms are the same. Customers should expect their SaaS
data protection vendors to help minimize the complexity of data protection that crosses
multiple cloud environments. A lot depends on the nature of and need for that data -- for
example, unstructured data like documents and media, semi-structured data like email or
proprietary data from SaaS environments where the application environment only runs on that
vendor's public cloud platform.
Page 5 of 13
In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
Seeking answers
According to Hill, most of the SaaS data growth today is unstructured data in the form of
media and other file-based content. Hill said he and his colleagues believe the next challenge
for the IT industry is to establish a better model for identifying, managing and automating the
governance of unstructured data. Along with offering a massively scalable model for data
retention, the flexible metadata capabilities offered by object storage provide a model for
granular data management. That is something that could better serve the challenges of e-
discovery, personally identifiable information-based privacy and future deep learning
initiatives, he added.
"From a disaster recovery perspective, a company should first address any industry
compliance issues that may dictate data protection," Hill said. Then it comes down to finding a
vendor that best covers your mix of SaaS applications and enterprise file synchronization and
sharing platforms in the cloud. "From a business continuity standpoint, it's often as much
about availability as protection. So having a current backup that exists in more than one place
offers both data protection and better odds for continued availability," he said.
In terms of finding the best backup approach, Enterprise Strategy Group's Bertrand said there
are competing topologies. These include backup to cloud as an extension of your on-
premises infrastructure or backup of data and applications in the cloud, which could be to the
same cloud, another cloud or even back on-premises. "In the case of SaaS, backup is
imperative to another cloud or on premises," he noted.
Best practices when choosing a SaaS vendor
Page 6 of 13

In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
In any event, SaaS data protection best practices should be driven by service levels, typically
recovery time objectives and recovery point objectives, Bertrand explained. These choices
are also influenced by operational efficiency aspects and costs.
"In some cases, organizations start by extending their on-premises solution to add a cloud
destination. In other cases, they will shift to a service approach, with backup-as-a-service or
disaster-recovery-as-a-service vendors," he said.
451 Research's Hill advised trying to find a SaaS vendor that can do the following:
• meet industry-based compliance requirements;
• provide comprehensive protection from ransomware and other forms of accidental or
malicious data corruption and deletion;
• integrate with existing security and data protection systems, policies and requirements;
• deliver consistent capabilities across multiple on-premises and cloud platforms and
access data in the absence of the primary SaaS platform;
• offer self-service data recovery capabilities; and
•
support e-discovery, as well as future data identification, governance and lifecycle
automation.
Service Organization Control 2, or SOC 2, certification should be table stakes for any SaaS or
cloud-based backup platform, noted Doug Barbin, principal and cybersecurity leader of
Schellman & Company, a global independent security and privacy compliance assessor. "If a
company cannot back up its commitments to security and availability, that is a significant
concern," he said. In fact, Barbin added, more comprehensive providers have International
Organization for Standardization 27001 certification, Payment Card Industry validation and a
documented process for dealing with GDPR and other privacy regulations.
Page 7 of 13
 At the end of the day, SaaS data protection is about supporting business-critical applications
In this e-guide and processes in a way that fosters compliance and, ideally, enables further data reuse,
Enterprise Strategy Group's Bertrand stressed.
• SaaS data backup
Gartner's Simpson advised that companies consider in advance what data they're putting in
challenges and best
SaaS applications and what would happen if they lost access to that data. "It's the same
practices question you ask when you put apps in the data center that you control yourself," he said. "If
you can't answer satisfactorily, then you shouldn't adopt the SaaS app."
• 2 trends that complicate
SaaS data protection
▼ Next Article
• The challenge of SaaS
protection and how to solve
it

• Why do you need backup for

Salesforce and other SaaS
apps?

Page 8 of 13
In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
The challenge of SaaS backup and
how to approach it
Nick Cavalancia, Consultant, Writer
https://searchdatabackup.techtarget.com/tip/The-challenge-of-SaaS-backup-and-how-to-
approach-it
The use of cloud-based applications, also known as software as a service, such as Office 365
and Salesforce, is now a mainstream part of most organizations' operations. The reliance on
these services as a critical part of your business means their availability is crucial to ensure
you can operate.
Service availability usually isn't an issue; every vendor has architected an environment that
provides a fair number of nines of availability. But there's the issue of the data you use within
any given SaaS platform. Corruption, deletion and loss are all real concerns around data in
any application. It's the very reason you have backups on premises and should for SaaS data
as well.
Why worry about SaaS backup?
There are a couple reasons to be concerned with SaaS backup:
1. It's your data. Just because an application is in the cloud doesn't relinquish your
organization's responsibility to back it up. If it were an on-premises application, you'd
be ensuring backups were made, so why is it different in the cloud? It isn't.
Page 9 of 13

In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
2. It's not being backed up. You should check with the application provider, but most
aren't backing up your data for the purpose of recovering it for you. Take Office 365, for
example: The only backups made are to ensure the availability of the service. If your
data were to become corrupt, Microsoft is not responsible.
The bad news is: Most application providers offer little in the way of a facility for you to back
up data on your own. But many third-party SaaS backup providers -- both on-premises and
cloud-based -- are paving the way, offering backups for some of the most important cloud
applications today.
While, normally, this means the problem is solved, the backing up of cloud application data is
anything but straightforward. There are a few challenges you need to be aware of that require
your attention when looking at SaaS backup products:
1. Backup method. There is no standard around providing access to data for backup.
Cloud providers have their own APIs to make data available. And backup vendors
sometimes take different paths to back up data, such as delegated access, migration
APIs or backup APIs. You should inquire as to exactly how backups are created and
compare their speed, efficiency and completeness of data.
2. Data included. Not every data set within a given cloud application is included in
backups. For example, with Office 365, some SaaS backup vendors today only cover
email, SharePoint and OneDrive. The reason for limited backup coverage is a mix
between the applications not having an API and backup vendors not yet caught up
when one is available. This issue will improve over time but is still one you should note.
3. Backup storage. Backing up the data is one part of the backup storage story; the
other is where you store the backups. Vendors have different platforms for this. Some
have their own storage, others connect to myriad private cloud partners and still others
use the mega-cloud vendors. In all three cases, pricing is going to vary. Ask about both
ingress and egress charges so you have a complete picture of the impact storage will
have on cost.
Page 10 of 13

In this e-guide
• SaaS data backup
challenges and best
Every backup vendor I've spoken with is focused on providing quality backups. But, as with
most every sector of tech products, vendors take different paths to get to a similar end result.
Backups of cloud application data are no different. You have lots of options, so use the
challenges outlined above as your set of criteria to better understand exactly how each SaaS
backup vendor accomplishes backups and what the impact is on your organization.

practices
▼ Next Article
• 2 trends that complicate
SaaS data protection

• The challenge of SaaS

protection and how to solve
it

• Why do you need backup for

Salesforce and other SaaS
apps?

Page 11 of 13
In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
Why do you need backup for
Salesforce and other SaaS apps?
Nick Cavalancia, Consultant, Writer
https://searchdatabackup.techtarget.com/answer/Why-do-you-need-backup-for-Salesforce-
and-other-SaaS-apps
Organizations using cloud-based SaaS applications are focused way too much on usage of
these platforms and, instead, need to also be thinking about productivity in terms of backups.
Cloud-based application platforms, like Salesforce, Office 365 and Box, are now integral parts
of modern-day business operations. With the digital transformation in full swing, customers,
partners, vendors and employees expect that operations and data will be available pretty
much always.
But, for some odd reason, IT has lost its collective mind. We would never think of putting up a
application and not backing it up. But when we move to the cloud and put our organization's
most critical data up there -- in Salesforce or otherwise -- many don't give a second thought to
backups. But why? If Salesforce was on premises, wouldn't you be backing it up every day?
Of course you would.
There are a number of reasons you need backup for Salesforce and other SaaS providers:
• They aren't responsible. Most SaaS vendors subscribe to a shared responsibility
model. In short, they are responsible for the service, but you are responsible for your
data. Salesforce, for example, says it outright. The vendor offers the most basic
backup for Salesforce.
Page 12 of 13

In this e-guide
• SaaS data backup
challenges and best
practices
• 2 trends that complicate
SaaS data protection
• The challenge of SaaS
protection and how to solve
it
• Why do you need backup for
Salesforce and other SaaS
apps?
• In-application functionality is limited. Some platforms have deleted item retention
times, data archiving or legal holds, but these are generally per-record copies. None of
these are as effective as good, old-fashioned backups that are in your control.
Salesforce offers some manual and on-demand export options, but none of them are of
the same caliber as traditional backups.
• Data is at risk of loss. Microsoft Azure, for example, has suffered multiple outages in
recent years. While most outages are merely a loss of service, as more organizations
rely on SaaS vendors, the likelihood of it happening to a customer increases by the
day. Even Salesforce keeps a copy of your data for disaster recovery (DR) as a "last
resort" (its words), acknowledging it is possible for your data to be lost.
• You need to meet the 3-2-1 backup rule. In some cases, there is only one copy in
production. (Replication for service availability doesn't count.) To meet the rule, you
need two additional copies, at least one additional medium and one copy that's off-site
-- that is, not in the SaaS vendor's hands. At best, Salesforce only maintains two
copies -- one in production and one for its admittedly expensive DR services.
• Avoid vendor lock-in. Should you (gasp!) not want to be using a given cloud vendor
or perhaps it goes out of business and you want to move to another platform, you're
going to need to have a copy of your data to do so. Some data protection vendors,
such as OwnBackup, Spanning and Odaseva, offer specific products that do backup
for Salesforce.
• It's your data. It's really that simple. Shouldn't you have at least one copy of your
data? You may need it for a number of reasons we've already mentioned, as well as for
e-discovery purposes or moving the application back on premises.

Backup for Salesforce and other cloud data applications is a serious matter, given the
importance of the data to your organization. The bottom line is SaaS applications are just the
service. You're still the backup provider. Lots of third-party vendors offer products to back up
just about every major SaaS player. It's time to start finding one that ensures all of your
organization's data -- both on premises and in the cloud -- is protected.

Page 13 of 13