In-Depth

Tech Trends: The Rapid Move to Cloud E-Mail Archiving

While security is still a concern for some companies, more and more businesses are outsourcing e-mail archiving to cloud vendors. And the vendors themselves are proliferating.

• By Paul Korzeniowski
• 02/06/2012

Despite some predictions of the demise of e-mail, it's still on the rise and with that growth comes continued management challenges.

In 2010, businesses worldwide supported 725 million e-mail accounts, each generating 110 messages a day, according to market research firm The Radicati Group Inc. Those numbers are expected to increase to 950 million accounts generating 119 messages a day in 2014. While helping corporations exchange information more effectively, the continued rise in e-mail volume is also creating management challenges. "With compliance and e-discovery regulations increasing, companies need to manage their e-mail interactions in a proactive manner," says Forrester Research Inc. Senior Analyst Brian Hill.

E-mail archiving solutions have emerged as a way to fill that void. These products help companies trail e-mail transactions, restore inadvertently deleted messages and generate reports outlining who sent what to whom. As it is with other market segments, cloud computing is starting to have an impact on this space because it has the potential to offload processing chores to third parties and reduce costs. In fact, market research firm Osterman Research Inc. expects that worldwide revenue from cloud e-mail archiving services will rise from $191 million in 2011 to $336 million in 2013. The high growth has attracted vendors from startups to industry behemoths (see "A Bevy of E-Mail Archiving Options Emerges").

Yet, cloud computing introduces more complexity into employee interactions and therefore raises new security concerns. "Companies are leery of putting their information in the cloud because they're not sure vendors can protect it," notes Michael Osterman, president of Osterman Research. Consequently, many firms find themselves trying to strike a balance between the putting the proper checks in place to secure their e-mail information while still maintaining it in a cost-effective manner.

Oops, I Didn't Mean To Do That
Archiving solutions were designed to help businesses address various compliance concerns. For instance, an employee may accidentally delete a message or two. If questions arise during an e-discovery hearing, the corporation must be able to retrieve the deleted messages -- and do so quickly. Without an e-mail archiving system, the item could be lost. If not, the process of retrieving the message can often take a few days compared to just a few quick clicks of a mouse with an e-mail archiving system.

Also, if corporations don't have such a solution in place, they can face court-imposed sanctions. In 2002, the U.S. Securities and Exchange Commission fined five firms a total of $8.25 million for not properly monitoring and capturing their e-mail traffic.

Cloud computing has become a viable alternative to on-premises-based e-mail archiving solutions for avoiding such problems. In fact, a Forrester survey found that 22 percent of corporations that planned to evaluate e-mail archiving solutions in 2011 expected to select a cloud solution. The top three drivers behind the interest are perceptions of lower total cost of ownership, more rapid deployment capabilities and superior pricing structures.

The Kenmar Group Moves up to the Cloud
One early adopter is The Kenmar Group, an investment firm that has 50 employees scattered in offices from Rye Brook, N.Y., to the United Kingdom to Singapore. The company's datacenter runs Microsoft Windows Servers with virtualization software from VMware Inc., and the Microsoft Exchange e-mail system. For a few years, the financial-services company relied on a Compliance Vault Inc. archiving solution. "We were having some problems with the system's reliability," explains Frank Coloccia, senior vice president and CTO at The Kenmar Group.

So, in early 2008, the corporation contacted a handful of vendors, including Iron Mountain Inc., Symantec Corp. and Smarsh Inc. "We were interested in a cloud-based solution," notes Coloccia. The Kenmar Group ultimately chose a cloud-based archiving offering from Smarsh. This approach didn't require a significant up-front investment for hardware and software licenses. Also, the financial-services company's IT department wouldn't have to perform routine tasks such as allocating storage.

Migrating seven years of e-mail messages to the new system took about three months. In addition to reducing its maintenance requirements, the business improved its reporting capabilities. The organization has to send the Securities and Exchange Commission (SEC) a report every three months. "Generating the SEC report used to require several steps; now, it's completed with the press of a button," explains Coloccia. However, there was one area where The Kenmar Group would like to see improvement: more comprehensive management tools.

It's quite typical for management -- as well as security tools -- to lack sophistication whenever a new technology emerges. Consequently, resistance to moving to the cloud has been evident. "Many corporations are leery of moving their sensitive information into the cloud," states Osterman. Corporations in areas like financial services and health care fear that cloud computing's security checks will fall short of various industry statutes.

Morgan Keegan & Co. Inc., a regional investment firm, is one such company. Founded in 1969, the Memphis, Tenn., company has more than 300 offices in 20 states and more than 4,000 employees. The financial-services corporation has been using Microsoft Exchange since 2003 when it replaced a Lotus Notes system. In 2010, the company decided to move to Microsoft Exchange Server 2010 for a couple of reasons. The product's Role-Based Access Control feature limits data connectivity to individuals with various job titles, and the system simplified the setup and administration of remote mailboxes.

However, the investment enterprise opted for an on-premises rather than cloud-based e-mail archiving solution. "We are concerned about the level of security available in cloud services," says Dan Evans, senior vice president of messaging and collaboration at Morgan Keegan.

Indeed, cloud computing introduces new potential security weak points. The first area of concern is the connection from the customer's site to the cloud provider's datacenter. When information travels along the Internet, it's open to interlopers at various points. Rather than an Internet link, a corporation would be better served with a private network connection, a closed link between its systems and the cloud archiving solution.

Also, as the information travels, it must be protected. "E-mail archiving suppliers should encrypt information as it travels from point to point," notes Osterman. In addition, the customer has to be sure that the data is protected after it arrives. The best way to reach that goal is to encrypt the data while it's at rest, a feature available in some, but not all, e-mail archiving solutions.

As a result, when evaluating a cloud e-mail archiving solution, a corporation needs to check its vendor's security procedures very closely. Third-party validation via certifications, such as SAS-70 Type II audits, helps to ensure that the vendor's security controls are strong enough to protect the firm's information.

In sum, customer interest in cloud e-mail archiving is growing. However, the various solutions are still in a nascent stage of development, so corporations need to examine them closely to be sure that they meet their compliance, management and security criteria. Nevertheless, the burgeoning sector of technology might be worth investigating.

"Cloud e-mail archiving is an emerging area, one that will continue to get stronger in the future," concludes Forrester's Hill.