Is Your Vendor Really Giving You What You Need in WORM Storage?

WORM (Write Once Read Many) technology is often viewed by users as a ubiquitous technology. Though WORM is available on many types of storage systems today (whether they use disk, tape or optical), a company may fail to fully recognize or comprehend that about the only aspect of WORM that these storage system vendors agree upon is the words that comprise the acronym WORM. Beyond that, how WORM is implemented and managed long term on each storage system can vary significantly. As a result, a company can not and should not assume that a specific vendor's implementation of WORM will meet all of a company's application needs.

A typical motivation for implementing WORM in the first place is usually satisfying some legal or statutory requirement. Court systems and/or prosecuting attorneys want proof that electronically stored corporate data requested as part of legal eDiscovery request or hold was kept in an unaltered, original state. Defense attorneys also need similar levels of assurance that the documents they produce to meet these legal eDiscovery requests or holds are not compromised in any way lest some questions arise later on about the authenticity of the data that the company produces.

To address these types of scenarios, a company will procure a storage system that supports WORM on the presumption that it can satisfy all of these legal requirements. However this storage system then tends to become the logical choice to serve as the target for all of a company's archiving requirements - compliance-related or otherwise. Since WORM-based disk storage systems generally have a low cost per GB (assuming they use SATA disk drives), it also makes financial sense to move other infrequently accessed data from production storage systems to the WORM-based disk storage system.

While this lowers storage costs, an aspect that companies may overlook is how does the WORM-based storage system ingest the data and manage it once it is stored on the system? This is where WORM-based storage systems diverge. Some like the EMC Centera require that applications use proprietary APIs to access and store data on it. Data stored on it may meet specific compliance requirements but the system is not easily accessible by other applications and retrieving data from it has become notoriously problematic. Other systems are designed to meet internal corporate retention requirements but do not store data in a state such that it satisfies rules like SEC 17a-4. As a final alternative, some few WORM-based storage systems provide a company the flexibility to set policies so it can store data either way.

The inherent advantages of a policy-based WORM storage system like Permabit's Enterprise Archive merit a company putting this type of storage system at the top of its list. Policy-based WORM storage systems meet whatever type of data retention requirements that a company may have, whether that is "Compliance WORM" (not even an administrator can delete a volume), "Enterprise WORM" (an administrator can delete all files on a volume except for those files under retention within the volume), or even turning WORM "off" on that volume so the storage system is just used as a target for archived files. In these circumstances, a company can use a single storage system for any and all of its archiving needs by setting WORM policies on volumes according to individual application requirements.

However, maybe the largest benefit that policy-based WORM storage systems provides is that companies often tend to first bring in a system like this to solve a specific need in their company. Only after that need is met do companies take a step back and begin to understand all of the ways they can potentially use it for other applications. Often companies don't know what data they have or how archiving can potentially benefit them. Policy-based WORM storage systems like the Permabit Enterprise Archive can first appear as a file server to these applications so companies can first store data as a normal file (read/write mode) and then change it to a WORM format later on as their needs change or the policies and/or regulatory criteria change.

WORM is not the ubiquitous feature on storage systems that companies may believe it is. There are subtle but important differences in how each storage system vendor implements WORM which ultimately impacts the integrity of the data stored on the storage system and what other ways the company can internally use that storage system for their application requirements. Companies that have these more diversified archiving needs (and what company doesn't?) need to look beyond whether or not a storage system simply supports WORM and works with an application. Rather companies need to verify what options the storage system provides to archive corporate data (WORM or otherwise) and if it provides sufficient WORM options to meet all of a company's application archiving needs.