The Need for Email Resilience

By Tom Schmidt

The rapid growth of electronic mail threatens to overwhelm today's enterprises. While email plays an essential role in improving workforce productivity, it also creates a glut of information for most organizations and a storage nightmare for IT departments. This article looks at why enterprises should consider establishing a resilient framework for the efficient retention and retrieval of email.

Today's pain points

The ubiquity of email has created three pressing problems that affect organizations of all sizes:

• Storage requirements are escalating  According to a 2004 survey conducted by Osterman Research, 62% of organizations consider growth in messaging storage alone to be a "serious" or "very serious" problem, second only to the problem of spam. That's consistent with the findings of a 2004 survey by Horison Information Strategies, a consulting firm that researches the storage market, which found that the amount of corporate data is increasing at an average rate of 50 percent to 70 percent every year.
• Data types continue to expand  Systems that contain structured, semi-structured, and unstructured data types continue to grow, generating more business-critical information than ever before. This data must also be indexed and easily retrievable.
• Regulations, legal discovery complicate matters  More stringent statutory requirements for data retention and increasing requirements to extract data for the purpose of supporting legal discovery efforts are having a direct impact on IT departments. Records must be retained in a manner that will prevent them from being damaged or intentionally modified, and that will make them available for inspection whenever regulators require them to be available. A recent law such as the Sarbanes-Oxley Act, enacted in 2002, doesn't specify new data retention requirements, but it does make the penalties for non-compliance much more severe and potentially more burdensome.

In light of these developments, it's no surprise that researcher Gartner Inc. recently called on companies to address their email retention and management needs immediately. From a recent report:

"Waiting until the company defines a plan for electronic records retention or for email active-archiving technology to mature could place your business at risk, given the regulatory requirements and escalating demands for electronic discovery."

That risk has been underscored rather dramatically in recent years thanks to several high-profile court cases:

• In March, a Florida judge hearing a $2.7 billion lawsuit against Morgan Stanley issued an "adverse inference order" against the company for "willful and gross abuse of its discovery obligations." The judge cited Morgan Stanley for repeatedly finding misplaced tapes of email messages long after the company had claimed that it had turned over all such tapes to the court.
• In early 2004, a U.S. bank was fined $10 million for taking too much time to comply with SEC requests for information and for failing to maintain certain email records.
• An investment banker at a large international bank was convicted and sentenced to prison for instructing his staff to delete email and instant messages shortly after his firm received a grand jury subpoena.

Key capabilities for retention and retrieval

As an organization's data storage continues to swell, and as access to that data becomes more critical, it therefore becomes essential to establish a resilient retention and retrieval framework. The goal is to securely retain data in such a way that it can be both fully exploited and "expired" when it is no longer required.

Such a framework calls for an organization to create record retention policies (including protection, archiving, retrieval, and deletion) and implement a data management solution that adheres to these policies. It requires an organization to track retained information through its entire lifecycle, and to assign differing levels of access to this data for different users, while maintaining an audit trail of all changes to the archived data.

In addition, an organization needs to establish and monitor IT controls around backup and archiving, as well as demonstrate compliance by generating reports on backup and archiving activity.

Implementing a resilient retention and retrieval framework also involves migrating from tape backup to disk-based backup to archiving as business needs require. Backing up to disk-based storage is a better option that allows faster backups, faster access to information, and more timely data extraction. (Also, disk-based backup can be migrated to tape after a certain length of time for long-term archival.)

Such a framework should also maintain flexibility as laws and regulations are added or amended.

On a practical level, organizations should be able to rely on the framework to:

• Flexibly store archived content
• Reduce storage via compression and "single-instancing" of identical items
• Automatically index content for rapid and targeted retrieval
• Search across multiple data types and data stores
• Secure future accessibility regardless of application by rendering an HTML copy of all archived content
• Utilize user authentication security controls

Conclusion

In today's networked world, the free flow of information is essential to success. Information has become the currency of our age, and unlike a disk or laptop, it cannot be easily replaced. And as the pace of business evolution continues to accelerate, organizations will face new challenges in securing, managing, and making available this irreplaceable asset.

To prepare for and address these evolving challenges, organizations must build an IT infrastructure that seamlessly bridges the divide between security, storage, data, and application service management.

Seen in this context, the rapid growth of electronically generated and stored information presents organizations with significant challenges. As storage requirements grow, data types proliferate, regulatory pressures increase, and demands for electronic discovery escalate, organizations should consider the benefits of a resilient email retention and retrieval framework. Such a framework makes access to information easier and more straightforward, and can have a positive impact on user productivity as well. After all, IT managers, as well as legal counsel and compliance officers, to name just a few, must have ready access to information from all parts of the organization. Ultimately, such a framework is the best bet for protecting an enterprise's critical information.

Tom Schmidt writes frequently about information security topics. He has more than 15 years' experience as a writer and editor in high-tech publishing.