Using TapeTrack as a companion product to Iron Mountain SecureSync GazillaByte LLC September 2012

ABSTRACT: The majority of computer backup tapes stored commercially around the world are managed by Iron Mountain. SecureSync is Iron Mountains web based software which allows their customers to view their offsite inventory and perform day-to-day interactions. This white paper explains the benefits of using GazillaBytes TapeTrack Tape Management Software as a companion product to Iron Mountains SecureSync to provide a comprehensive compliance and disaster recovery strategy.

Introduction
Iron Mountain (NYSE:IRM) is the worlds largest information management corporation, and, among other services, provide secure tape transport and storage services to many of the worlds largest enterprises. SecureSync is Iron Mountains proprietary software, which provides a secure web based user interface to their customers who use Microsoft Internet Explorer or Mozilla Firefox1.

SecureSync also provides an optional FTP or Secure FTP file transfer mechanism that allows their customers to upload electronic picking and distribution lists and download inventory reports. The primary purpose of SecureSync, is to provide a customer interface to Iron Mountains back end software SecureBase. SecureBase is used by Iron Mountain staff to run reports, billing and day to day operations. SecureSync may not provide a comprehensive solution to every customers tape management needs, and in most cases it is necessary for companies to have their own tape management solution to ensure that all of their tape management requirements are addressed.

SecureSync does not support Google Chrome or Apple Safari.

TapeTrack provides a bidirectional interface with SecureSync, allowing TapeTrack users to perform all tape management functions using TapeTrack, while still retaining a backend link with SecureSync. This white paper provides a gap analysis between Iron Mountains SecureSync and GazillaBytes TapeTrack software, with a view to demonstrating the importance of using TapeTrack as a companion product to SecureSync. As a framework for this gap analysis, the white paper will use GazillaBytes 5 Pillars of Tape Management. The 5 Pillars of Tape Management are: Pillar Asset Management Chain of Custody Library Management Disaster Recovery Quality Control Question What do we have? Who has been in touch with it? Where does it go? Are we in a position to recover? How are we doing?

Disclaimer
This white paper does not pass judgment on the quality of any Iron Mountain product, or the products or services of any other party. GazillaByte LLC provides its TapeTrack Software to Iron Mountain, Iron Mountains customers, Iron Mountains competitors, those serviced by Iron Mountains competitors and those who choose not to use Iron Mountain or their competitors. This white paper was compiled using publically available data, such as the SecureSync User (sic) Guide2 and does not claim or imply any knowledge of confidential information related to SecureSync, SecureBase or any other Iron Mountain product. SecureSync and SecureBase are the trademarks of Iron Mountain. TapeTrack, Simple Management, TapeTrack LibraryHealth are trademarks of GazillaByte LLC.

http://learning.ironmountain.com/securesync/docs/SecureSyncHelp.pdf

Asset Management
Computer backup tapes, like all computer storage media, were once considered a consumable, which could be ordered, used and destroyed with very little consideration. Today, with enterprises better understanding the value of data, and governments enacting data protection legislation, information owners are increasingly treating computer backup tapes as a company asset. In a nutshell; you need to know how many tapes you have and where they are.

Gap Analysis
Comprehensiveness

1. SecureSync only incorporates libraries, and individual tape volumes which have been sent offsite to an Iron Mointain facility. 2. Iron Mountain does not allow SecureSync to be used by its sub-contractors, so where Iron Mountain provides service via a sub-contractor, asset management for tapes which are sent offsite is incomplete. 3. When interfacing with SecureSync manually via the web interface, it is common for users to provide incomplete data which results not only in errant tapes, but an incomplete asset management dataset. 4. When using the SecureSync file transfer mechanism (FTP or SecureFTP), SecureSync requires a file containing only incremental changes (a picking and distribution list) and cannot process a full inventory report to automatically perform a daily comparison between yesterdays and todays full inventory; which in effect is todays picking and distribution list, but in the event of any anomaly does not provide any mechanism to rebalance the asset management database.

TapeTrack provides a single interface, which can aggregate information from SecureSync, Iron Mountain sub-contractors and non-Iron Mountain vendors. In addition TapeTrack is designed to connect with all customer tape management systems and perform complete asset management reconciliation.

Conciseness
1. When Iron Mountain provide service in multiple locations, and where Iron Mountain provide service to discrete customer business units, Iron Mountain assign an account number to each of these tape libraries. When logging into SecureSync one must first select the account that one wants to report on and interact with. If one wishes to then interact with another account one must switch account context. 2. In addition to only being able to report on an individual account at one time, SecureSync does not allow you to divide your tape libraries into individual media types, such as 3590 and LTO and does not support duplicate volume serials (or barcodes) between media types within a given account. This means that, one either has to assign a second barcode or further sub-divide ones tape library into another account if one has barcode duplication between tape libraries. 3. Even when displaying an individual account, SecureSync does not initially display the totals of tapes at each location and their transit or request status. To display these totals it is necessary to run reports and look at the totals from these reports. TapeTrack allows tape libraries to be divided by media type and also allows separate accounts to be nested and displayed hierarchically. When using TapeTrack a user does not have to select the account they wish to work with; they are immediately shown all of the accounts they are authorized to work with, and they are shown totals of all tape volumes, along with the total number of tapes which are moving from one location to another. For all volumes which are moving between locations, TapeTrack also shows the amount of time the tape has been moving along with any alerts relating to the tape being overdue at its location.

Chain of Custody
Corporate governance laws, such as Sarbanes Oxley, privacy legislation such as HIPPA, the protection of corporate intellectual property, customer and community expectations and the prevalence of litigation all require that a complete chain of custody be applied to each and every tape volume in your tape library. In a nut shell; you need to know who has handled each and every tape volume along with where and when they handled it.

Gap Analysis
Comprehensiveness
1. SecureSync only shows tape volumes which Iron Mountain have processed and does not show tape volumes which are moved internally within the enterprise. 2. SecureSync is not made available to Iron Mountain sub-contractors, and nonIron Mountain vendors. 3. SecureSync does not display important chain of custody such as accessing IP address and time zone of a party adding to the chain of custody. TapeTrack is a commercial software product which is sold without restriction to end user enterprises, data protection companies and Iron Mountain themselves.

Portability
1. You may not be able to take the SecureSync chain of custody record with you should you leave Iron Mountain. SecureSync is a proprietary product of Iron Mountain, there is no data protection industry standard to exchanging chain of custody information and Iron Mountain does not provide a mass export mechanism for chain of custody information.

2. In the event that you change vendors and discontinue service with Iron Mountain it is quite possible that your new vendor may not have a system capable of importing historical chain of custody data.
TapeTrack supports the ability to export all chain of custody data. As an end user who has their own TapeTrack system one can also have complete vendor portability while retaining a complete chain of custody.

Integrity
1. In the event that you enter into litigation with Iron Mountain, the chain of custody record will be owned and controlled by your opposing litigant. 2. In the event that you enter into litigation with a 3rd Party, Iron Mountains ability to manipulate the chain of custody may erode some of your ability to rely on the chain of custody record. TapeTrack is provided by an independent third party who does not provide information management services and can provide a credible independent chain of custody record. The TapeTrack database can be completely locked to ensure that no update or deletion to the database can occur outside the TapeTrack software, and TapeTrack software is deposited regularly into legal escrow with a reputable escrow agent.

Library Management
It is estimated, that at any point in time two-thirds of an enterprises tape library is managed in-house. These tapes may be stored, near-line in Automated Tape Libraries (ATLs) , may be stored in racking systems, may be involved in offsite Disaster Recovery activities or may be segregated in a Legal Hold status. As tapes move from one location to another, it is not only important to know where they have been, but it is equally important to know where they are headed. In a nutshell; you need to have a codified process of where your tapes are headed and where they belong when they get there.

Gap analysis
Comprehensiveness
1. SecureSync provides no capabilities for the management of tape volumes outside that of tapes held by Iron Mountain. 2. SecureSync provides no tools for the codification and automation of tape movements. TapeTrack provides advanced library management features which allow users to fully automate the rotation of their tapes, dynamically allocate storage locations and interface with Automated Tape Libraries.

Disaster Recovery
Although most enterprises have invested heavily in High Availability (HA) solutions such as RAID Disk, data center redundancy and data replication, it must be understood that these technologies, by their very nature exist to reduce the occurrences of disastrous situations. In fact, with these safeguards in place, for a disaster recovery situation to occur, high availability mechanisms ensure a higher level of disaster. To ensure that a disaster is not a catastrophe it is imperative that enterprises, despite their investment in high availability retain a Disaster Recovery Plan, and that the components of this Disaster Recovery Plan be always ready and available. In a nutshell; your investment in high availability technology ensures you will need a disaster recovery plan which is always prepared for the worst of disasters.

Gap Analysis
Comprehensiveness
1. SecureSync allows you to add a description field to each critical tape volume. This can be done automatically using a file transfer, or it can be done manually using the web interface. SecureSync, does however not provide any tools to identify what is a critical tape volume. It may also be necessary to write additional bespoke code to format your disaster recovery information in a format which can be interpreted by Iron Mountain. 2. SecureSync does not provide any warning mechanism that tape volumes that are identified as critical are being returned for purposes other than disaster recovery, does not show the interrelationship between interdependent disaster recover volumes, and does now display or warn of which recovery points are incompletely offsite. TapeTracks Disaster Recovery Strategy Features allows enterprises to automate the process of pre-identifying recovery points, once these recover points are created

TapeTrack will monitor each of the critical volumes in real-time to ensure that these recovery points are safely offsite. In addition, these recovery points are an important consideration in the calculation of TapeTracks LibraryHealth Score, which along with over 20 other important considerations, keeps an enterprise informed of the health of their tape library. It also allows one to benchmark their distributed facilities against best practice and against each other.

Quality Control
In todays busy information processing environment it is not only important to implement process automation, but it is equally important to ensure those processes are delivering the right outcome. All too often Quality control mechanism that require staff to run and compile reports become a self-fulfilling prophesy as the same staff who created the automation are asked to measure the success of their efforts against criteria that they set themselves. In a nutshell; Quality Control mechanisms should be set against industry best standard measures, they should report on exception and they should report unconditionally.

Gap Analysis
Comprehensiveness
1. SecureSync provides a mechanism that will email a predetermined customer employee or employees with a report that tapes which were entered into SecureSync (or transmitted electronically) did not arrive as expected at the Iron Mountain facility. This mechanism, however is reliant on: a. The customer entering (or transmitting) the correct information. b. Iron Mountain processing the customers tapes. c. The person receiving the email actioning the email, or knowing how to escalate the problem. TapeTrack is designed from the ground up to independently measure and report on the quality of tape management operations. TapeTracks LibraryHealth feature constantly monitors over 20 tape library heath indicators to ensure that best practice is followed. These indicators include, the existence and success of automation, the overall health of the chain of custody, the chances of successful disaster recovery and the regularity of offsite activity.

Integrity
1. While SecureSyncs quality control mechanisms may arguably be sufficient, they are none the less, mechanisms which are controlled and designed by one of the parties of whom they measure. TapeTrack is software which is agnostic to business relationships. It is designed with the objective of ensuring that all parties, irrespective of their personal interests or agendas are managing tape assets according to best practice.

About GazillaByte GazillaByte LLC is based in Colorado USA where it develops and supports its flagship TapeTrack tape management software. Today TapeTrack is used by over 4000 enterprises around the world. These companies range from the top of the Fortune 500 through to newly created technology companies that you are yet to hear of. To learn more about TapeTrack, visit the product website at www.tapetrack.com, or call GazillaByte LLC on +1-720-583-8880 to organize a free 90 day no obligation trial of our unique technology.