The Business Case for Managed Hosting
- 1. The Business Case for Managed Hosting Managed Hosting Services: Fully or Semi-managed April 28th, 2009
- 2. Introduction Web hosting has never been more affordable—or more complicated. Rich media, social networking, sophisticated eCommerce platforms are all making the Internet experience incredibly dynamic and profitable. Still, security threats are greater: last year alone, the number of viruses, worms and trojans in circulation topped the one million mark—that’s in addition to ever-growing levels of spam, phishing scams and malware. The Open Security Foundation added more than 11,000 new vulnerabilities to its database in 2008. Critical OS patches and software updates never seem to end. Data loss? That’s on the rise as well, due primarily to hardware or system malfunctions or human error, but also corrupted software, power outages and malicious programs. And messaging, always critically important to organizations, carries a huge and mounting cost due to email downtime resulting from system failures. Managed hosting services as a concept promises a coordinated, comprehensive solution to address many of the time-consuming tasks facing small- and medium-sized businesses (SMBs) looking for a web presence—particularly those without the necessary expertise or in-house resources to maintain and optimize their own web servers. Semi-managed plans offer a less expensive option compared to traditional, fully-managed services. Yet in terms of scalability, flexibility and the ability to deploy services quickly, both approaches present a viable alternative for server management in meeting today’s web hosting challenges. Overview of Managed Hosting Why Use Managed Hosting? The cost and complexity of web hosting keeps rising: domain management, expanding server loads, ongoing software updates, and security monitoring, along with increasing demands for messaging encryption, archiving and reliability. In addition, site owners must address the critical nature of backups and data protection/restoration in the event of power outages and other disruptions, natural or man-made. In short, it’s becoming more complex and more confusing than ever for SMBs to efficiently maintain a stable, secure web presence. The biggest challenges site owners face today include: • Increased messaging is more difficult to manage: maintaining email functionality, data retention, and protection against spam, phishing, viruses, worms, spyware and other threats. • DNS services are increasingly complex: DNS records configuration and management, administering multiple domains, vulnerabilities from DNS-based buffer overflow attacks. • Server and software patch management is time consuming: consistent, regular OS patching to minimize exposure/vulnerabilities, controlling and managing software and security updates. • Storage, data backup and data recovery requirements are growing: continuous data protection, incremental backup, and off-site data management (SQL, Exchange, SharePoint, CRM). • Network and security management will continue to command more attention—and resources: firewall configuration, scanning for malware, check sum changes in software on the server, bandwidth and port monitoring to assess ongoing risks. • Disaster recovery and business continuity are essential, but rarely planned out thoroughly in advance: protecting against loss of sensitive data and network connectivity, downtime, reboots, service failures, power outages and other disruptions. Copyright © 1996–2009 Aplus.net Internet Services. All rights reserved.
- 3. Server Hosting Defined To understand further the merits of managed—fully or semi—services as an option for SMBs, it’s important first to understand more closely how they compare to other available types of hosting (beyond shared hosting). Co-Located Hosting involves the purchase of a server from a hardware vendor; the server is then delivered to a web host and connected to the host’s network and redundant power systems. The host is responsible for the network, while site owners are responsible for server support, maintenance and software updates. The biggest issue with co-location? If hardware fails, the customer must ship new hardware to the data center—potential long periods of downtime outside of the Service Level Agreement (SLA). Unmanaged Dedicated Hosting is similar to co-location except the host owns the hardware, while it is the customer’s responsibility to manage and administer its operation. Support contracts may be available, but it generally falls to the customer, not the host, to install and update server software and OS patches, data backups, monitor security, manage email, etc. In this scenario, the web host is responsible for failed/defective hardware, network, and power systems. Managed Services involves leasing one or more servers from a host, who then proactively provides support and maintenance on that equipment, usually backed by quality guarantees. Additional services provided by experienced system administrators on staff commonly include server uptime monitoring, OS patching, operating system restores, security monitoring, and more. Market Trends Tier1 Research: “Managed Hosting: Market Overview Spring 2008” (April 15, 2008) “…the managed hosting sector has experienced tremendous growth in the past 12 months—in excess of 30%—driven by several trends. These trends include virtualization, business continuity services and security technologies, driven both by enterprise demand and regulatory compliance. Despite the dipping economy in the US, there has been increased managed hosting adoption by SMBs and mid-tier enterprises in both the US and Europe.” Forrester.com: “Look To Managed Hosting As An ITO And Colocation Alternative” by Bill Martorelli, et. al. (February 2, 2009) “Managed hosting has evolved significantly since its initial focus on managed Web storefronts, to a more general-purpose delivery mechanism, including a form of IT outsourcing ideally suited for the midmarket. While it still pales in comparison to the IT outsourcing industry in size, this multibillion dollar segment is growing at a healthy rate for its diverse group of constituent suppliers, who represent a broad mixture of supplier types. Since the eBusiness era began, managed hosting has been a principal alternative to colocation for customers without a “do-it-yourself” bias and appears likely to grow in popularity based on expressed buyers’ preference. Emerging virtual solutions including cloud-based services will likely reinforce this. Sourcing and vendor management professionals should view hosting as a useful alternative to IT outsourcing and colocation in sourcing opportunities including applications management and in smaller opportunities where a building-block-oriented approach works well.” Copyright © 1996–2009 Aplus.net Internet Services. All rights reserved.
- 4. What is Managed Hosting? Managed hosting is a step beyond dedicated server hosting—providing more value than co-location or unmanaged servers because it frees a company’s IT staff from mundane hosting-related tasks; instead, in-house personnel can focus on the day-to-day needs of internal OS, infrastructure and applications to support business processes more effectively. The decision to purchase managed hosting services—fully or semi— is generally driven by three factors: cost savings, simplified hosting operations, and improved uptime and availability. Managed hosting can also provide greater responsiveness in the event of disruptions or troubleshooting scenarios than fully outsourced solutions. In addition, this approach delivers a comprehensive set of services designed to keep in-house applications secure, stable and responsive to a company’s rapidly changing business needs. This includes equipment procurement, provisioning and installation, and network monitoring and management backed by SLAs. In a managed hosting environment, the provider is responsible for the data center, network, devices, operating system and infrastructure components—providing a stable operating environment for each client’s applications. Managed hosting is most ideal for companies without the necessary in-house resources to handle server administration. Semi-managed hosting solutions typically provide a dedicated service group for technical support and administrative control, as well as choice of OS and network connectivity. In a fully managed services scenario, hosts offer additional features and services that might include application and database management, high-availability services and load balancing. As a result, prices will vary greatly. Most managed plans—whether they are fully or semi-managed—follow a tiered schedule according to hardware, network and support configurations. Popular sets of services are sometimes packaged under one fixed price, and site owners may be able to negotiate pricing for a few additional services. The Benefits of Managed Hosting Within the broad spectrum of hosting options—between co-location and dedicated servers, all the way to enterprise hosting and fully outsourced IT—managed services offer a viable alternative for companies interested in enhanced support/maintenance to keep their servers fully optimized. The levels of management and server support will differ, sometimes widely, from host to host. For those companies without server administration resources or expertise, or those without a significant amount of time to maintain servers, managed solutions can free up the time and resources of an in-house IT organization to maintain full control over the operating system and manage applications. Managed services do cost more than unmanaged. However, when you factor in the personnel costs to perform updates, security monitoring, etc., fully or semi-managed services may actually cost less. Advantages of Manged Server Hosting include: Technology upgrades: There’s no need to invest up front in OS, management software, dedicated staff, installation of high-speed connectivity, etc. The managed hosting service provides this infrastructure and charges only a monthly fee. Support: Hosts manage all support functions for servers and control panel updates. This includes server monitoring, hardware repairs, troubleshooting network issues, and backup power supplies for servers. Hosts also provide bandwidth and connectivity to the internet. Most web hosts also offer performance guarantees and SLAs. Security: The managed services provider completes security updates and is responsible for installing necessary firewalls and server monitoring equipment to help protect against viruses, denial of service attacks, and unauthorized access. Copyright © 1996–2009 Aplus.net Internet Services. All rights reserved.
- 5. The Business Case for Managed Services The difference between fully- and semi-managed hosting solutions is really just a matter of degree and cost. Software installation and updates, hosting reliability/uptime, data security, access to IT expertise all comprise the fundamental building blocks of any good managed hosting service. Ultimately, both of these approaches share many of the same benefits: Focus on business, not IT Managed hosting allows SMBs to concentrate on running their core processes, rather than devoting a large percentage of time and resources to IT management. Server monitoring, software patches, reporting, backups, and load balancing require some measure of technical expertise to properly manage a dedicated hosting arrangement—all tasks better left to specialists. Reduce costs, increase profitability Research by Gartner, Forrester and others show that companies can potentially lower the total cost of infrastructure ownership by up to 60 percent while improving efficiency through managed services. It’s not uncommon for organizations to miscalculate the true costs of adequately managing email and web hosting: personnel to administer a system, capital expenditures, service disruptions, etc. Managed services also make the total costs of messaging and hosting more predictable through clearly-defined licensing arrangements, depreciation, maintenance/support contracts, backups, and more. More efficient use of resources It’s not easy finding and retaining qualified IT personnel. Instead, managed hosting can free IT staff from relatively routine tasks and troubleshooting so they can be more efficiently deployed on initiatives that deliver the greatest value to their organizations. Most providers also offer 24/7/365 coverage of customer service and support. Access to IT industry best practices Managed hosting service providers can often tap broader markets to attract top talent as part of their support staff. In addition, most hardware, software and network capabilities are updated on a near real-time basis. Typically, service providers also deploy a broader range of leading technologies and expertise that may not be economically feasible for smaller companies to obtain on their own. Rapid deployment/flexibility of services Speed, flexibility and scalability represent distinct advantages of a managed hosting scenario. New users, even business units, may be added quickly and efficiently into an existing messaging/ hosting infrastructure. Managed hosting also allows users to exercise greater flexibility in how they deploy services, enabling a ‘granular approach’ to supplement or replace capabilities (spam filtering, targeted backups, upgrade or downgrade bandwidth) as needed. In essence, this lets the business owner tap the hosting provider’s staff and resources, rather than hiring their own, additional staff. Secure infrastructure Web hosting companies offer high standards of physical security, utilizing facilities that incorporate state-of-the-art environmental control systems, fire and flood protection, backup power generators, multi-homed redundant backbone connections, and security card access. Managed hosting providers take this a step further by relying on data centers featuring intrusion detection systems, redundant power systems, additional tracking and monitoring tools, and measures such as SAS 70 audits, and WebTrust certification. Copyright © 1996–2009 Aplus.net Internet Services. All rights reserved.
- 6. Disaster recovery/business continuity Likewise, disaster recovery and business continuity capabilities are de facto elements of managed hosting services, allowing a company to recover quickly in the event of a power outage or natural disaster. Email archiving, database and site backup, in particular, allow messaging and hosting activities to remain active should a disruption occur at a customer’s location. Recovery and business continuity services typically incur an additional charge. Key Features/Elements of Semi-Managed Hosting The primary elements of a semi-managed hosting solution—support, maintenance and troubleshooting tasks—include: Managed Email/Messaging Managed email is designed to assist companies in maintaining fast, secure messaging capabilities and offload functionality from a dedicated server. Typically, managed email solutions are built in a cloud computing environment with measures to maintain high availability and redundancy, ensuring an un- interrupted communications presence. Managed email is also designed to lower server loads, lessen exposure to potential abuse and spam, and reduce in-house IT administration and churn. Common key features include: • Managed spam filtering • Calendaring functionality • Groupware/collaboration productivity • High availability and redundancy DNS Hosting DNS services are essential to the smooth operation of any web service. Managing DNS records proactively helps to promote timely mail delivery. Key features include: • Domain name management • DNS-based buffer overflow attacks protection • Simplified configuration assists in the proper creation of DNS records to optimize mail exchange • Round robin DNS and/or “heartbeat” DNS, both help with basic load distribution and or basic failover functionality. Software Updates/OS Patching Insecure software is often the ‘Achilles Heal’ of a server environment. Managed OS patching is designed to build and maintain repositories of mirrored data allowing for controlled, stable updating of software. Key features include: • Host maintained repositories for participating operating systems • Proactive revisioning and application of security/software patches • Verifying and correcting successful updates • Closing security gaps to minimize vulnerabilities for any subscribed server Copyright © 1996–2009 Aplus.net Internet Services. All rights reserved.
- 7. Managed Security A critical element in managed hosting services is consistent, differential monitoring and review of patterns in logs to deter hackers, spammers and other intruders before any damage is done. Key features include: • Security audits and third party audits for PCI, Visa CISP, and SAS 70 • Customized firewall configuration and proactive updating of firewall rules • Log review to block negative Internet traffic • Monitoring check sums of binaries on servers and removal of known vulnerabilities via root kit checkers, malware scanners, and other methods of intrusion • Server-side virus scanning • Proactively monitoring bandwidth trends and ports • Intrusion detection system and security threat analysis scripts Server/Services Monitoring Proactive monitoring of connectivity and daemons, along with rapid response to downed servers/services, is essential to maintaining uptime for any web environment. Key features include: • Monitoring and proactive intervention of requested daemons or services • Monitoring network connectivity with proactive reboots and troubleshooting • Service reports demonstrating monthly loads, events and trending • Reports with results and recommended courses of action in the event of service failures or expansion requirements Managed Data Backups Managed backups have one purpose: to protect and secure the website, servers and data against catastrophic failure. Key features of managed backups include: • Daily, weekly and incremental backups of specified content (database, site) to ensure data integrity • Validating backup/restoration capabilities • Encrypting data within a backup environment to ensure that sensitive/critical data remains private • Quick and reliable restore processes Optional Services Managed—fully and semi—hosting plans may also include a range of optional or extended services sometimes referred to as ‘à la carte’ services allowing companies to maintain and customize their server configurations and improve website performance. As a benefit to site owners, this menu of service, support and installation items offers added flexibility for hosting designed especially for smaller businesses. Features vary widely but commonly include the following: • Managed hardware firewalls • Load balancing • Enterprise storage solutions • Custom software/application installs (discounted) Copyright © 1996–2009 Aplus.net Internet Services. All rights reserved.
- 8. What to Ask Before You Buy It is recommended that site owners review five primary factors when considering fully or semi-managed hosting services. Technical expertise Individuals and SMBs should survey their current technical abilities and/or skillsets available among in- house IT staff to manage daily/weekly/monthly server and hosting needs. This may cover some or all of the following tasks: OS patching, DNS management, data backups, security and service monitoring, etc. Web hosts usually retain expert system administrators and specialists in all of these areas. One of the biggest drawbacks to do-it-yourself server management is simply a lack of experience. Managed service providers deal with hosting-related issues all the time. In-house teams are often not as well-versed on prevention and recovery from most web/email server attacks and threats. Time constraints Based on ongoing requirements for hosting and email, how much time may be allocated in-house to server management—and all associated tasks, including security audits, etc.? How much time does this divert from administering internal networks or application installs and updates? From other critical aspects of running the business: sales, accounting, marketing, etc.? Setup time constraints are also important to consider: How long will the managed services provider require setting up a server or multiple servers initially? How long to set up software? How quickly can they get started—and how long to transfer from one hosting provider to another if necessary? True costs Just as managed servers cost more than unmanaged, semi- and fully-managed service costs will vary from provider to provider. This relates directly to the level of support and expertise required to perform each task: proactive services monitoring, data backups, software installation, etc. Likewise, several providers offer tiered levels of managed services (Basic, Premium, etc.) with different price points. It is also important to take into account the potential costs of improperly managed servers—or even the cost of inaction. Factor in potential losses should a server fail due to technical inexperience. Business owners are risking a lot when they buy their own hardware. Reliable providers test and optimize hardware for use in many (if not all) hosting scenarios. This experience comes from years of industry knowledge and even trial and error. Likewise, consider the time/cost of managing, or learning how to manage, web hosting servers versus outsourcing these tasks. Selecting a provider/plan Selecting the right managed—fully or semi—hosting plan calls for careful assessment of a company’s server management needs upfront. The definition of services varies from provider to provider. Companies should evaluate the following areas regarding their own in-house capabilities—and compare against specific support tasks available from outside managed hosting providers: • What hosting/email/security tasks need to be managed and in what priority? • Which tasks are routine and are likely to need attention only occasionally? • Can the servers be further customized—and what costs are associated with that? • What specialized tech support may be required—is it available, and when? • Will a single point of contact (concierge) be necessary as an interface with the company’s IT staff, billing, and design/marketing? Likewise, will the host provide dedicated service representatives? Copyright © 1996–2009 Aplus.net Internet Services. All rights reserved.
- 9. • What are the ongoing costs of maintaining an internal server? - Hardware replacement costs - Downtime costs (if server goes down while IT staff is out of the office) • What are the initial setup costs to configure a server or servers? - In office server: - Hardware setup - High bandwidth connectivity to server (this can be upwards of $1000 setup and hundreds per month) - IT setup time (personnel costs) - Colocation: - Setup/shipping costs - Hardware costs Site/hosting requirements The final area to survey and evaluate carefully involves technical and infrastructure requirements between a company’s website(s) and host. This is essential for optimizing bandwidth, storage, redundancy and other key parameters for effective server management and improve uptime, email reliability, etc. Consider the following points: • Network/software basics: current operating system(s), server/network interface • Connectivity: high bandwidth contract (T1, fiber optic cable), uninterruptible power supply (redundant power backup) • Network security: firewall, network-wide encryption, secure routing protocol • Physical security: alarms, limited access, cameras • Data Backup: frequency, volume, etc. Conclusion Managed hosting services can prove beneficial to many SMBs. These services provide technologies and expertise not economically feasible for smaller companies to obtain. In addition, with the rising costs and complexities of maintaining a secure web presence, managed services can be more cost effective from a personnel and operations standpoint—either eliminating in-house personnel or allowing them to focus on revenue generating projects rather than day-to-day server maintenance. Semi-managed hosting plans provide a less expensive option in comparison to fully-managed services. However, both approaches offer improved scalability, flexibility and rapid deployment. For more information about managed services please contact an Aplus.net representative or visit http://www.aplus.net/managed-hosting/. Aplus.net Contributing Authors 7500 W 110th St., Suite 400 Dave Macaulay, Corporate Writer Overland Park, KS 66210 Dennis Kittrell, Senior Product Manager Phone: 913-890-7700 Taylor Giddens, Manager, Dedicated Server Customer Care Email: marketing@aplus.net 7500 W. 110th St, Suite 400, Overland Park, KS 66210 p: 913.890.7700 f: 913.890.7701 www.aplus.net SM