|
Implementing DR and BCP
Should you go for a hosted DR site or an inhouse one? What's the best DR strategy for maximum system uptime? Which are some of the good tools for implementing DR? We answer all these questions and more in this story
Anindya Roy, Jasmine Desai and Swapnil Arora
Saturday, April 05, 2008
After incidents like 9/11, Tsunami and Mumbai Floods-people have understood
in no uncertain terms, the catastrophic consequences of disasters, either man
made or natural. However, to prevent losses from compounding, CXOs have to
figure out ways and means of keeping their core businesses intact in such
situations. So, today if you go for any compliance certification, one of the
pre-requisites is the kind of disaster recovery measures you have in place for
your business. And just because of this reason, most businesses are opting for
DR and BCP policies without even completely understanding the complexities
involved. And still there are lots of misconceptions and myths surrounding DR
and BCP deployments. In this article we try to demystify DR and BCP with some
live case studies and implementation scenarios. But before we begin let's try to
understand why we really need DR and BCP.
Preparing for disasters
Disasters could be natural, in the form of earthquakes, tornados, floods,
etc or they could be manmade such as wars, militant attacks, accidents, etc.
Plus, there is one more category of disasters which occur frequently-biological
pandemics such as Bird Flu, Chicken Gunia, Plague, etc. Now all these disasters
have different characteristics and affect one or more of the four pillars of
Business Continuity-Workplace, Infrastructure, Data, and People. But today most
of us understand DR as just Data Recovery, ie, if your data is corrupted or
lost, you can recover it from some remote storage device. But that's not the
only thing in DR. The consequences of a disaster could be more than just data
loss. So, whenever disaster strikes, it can take away any or all of the four
pillars of your business and your core business could come to a stand still.
Nobody would even want to imagine facing such unfortunate events, but that
doesn't mean they can't occur. A DR and BCP deployment is like a medical policy,
where you keep investing certain amount of money, and you only see the benefits
of the policy when you fall ill. Otherwise, you don't see anything, except money
going out of your pocket as premium. As we don't mind spending money for our
medical insurance and plan for future, we should do the same for our core
business. In a nut shell, a DR and BCP strategy is a medical insurance for your
business. We'll now use a few examples to explain how disasters attack the
various pillars of your business and how you can take effective precautions.
Some of these may sound completely illogical or impossible, but then a disaster
warn you before striking. So do take these examples with that
in mind.
  |
Let's assume that a large banking company runs its core business from a major
city in India. One fine afternoon its network is attacked by cyber terrorists or
there's a virus outbreak. In such a situation, the data integrity is lost. The
easiest way to maneuver this disaster would be to immediately isolate the cyber
attack on the branch and transfer the core job to a DR datacenter hosted at some
other location. This would help users to immediately connect to remote DR
servers and get back to work.
Take another scenario. One day the same city where the bank was operating
from, encounters an epidemic. The Bird Flu virus hits the city, and being an
airborne virus, infects anybody walking out in the open. So a city wide red
alert is sounded, a curfew is enforced, and nobody can come out in the open. In
such a scenario, all your pillars that constitute Business Continuity remain
intact except human resources. So your data, equipment and workplace are intact
but no one can come to the office and operate from there. So, the strategy to
overcome such a problem should be different. Here you must have a DR site with
not only data, but also with a backup of employees who can take over the charge
of the center and finish the tasks from some other city.
Now let's take another example where an earth quake destroys the entire
building, with the data center and all the equipment. Here, even though peoples'
lives might be saved, everything else would get destroyed. In such a situation,
a remote DR site is required where you have all the necessary equipment, seating
arrangements, data and even a recreation zone, where you can fly in your staff
and let them get back to work in as less a time as possible. Such a DR site
should not be in the same geographical location as the site in question, so that
the calamity does not affect both sites at the same time. On the other hand, it
should not be too far away so that it takes a lot of time to fly out people.
Outsourced or In-house?
After reading all these you must be wondering whether you should have a DR
site with redundancy of all for all four pillars of BCP? The answer here should
ideally be yes, for at least the first three pillars of BCP. Human resource is
the only component for which a 100% redundancy is not feasible. There are
ideally two ways in which you can get your DR and BCP site ready. The first and
the traditional one is the in-house model where you have your own premises,
equipment, and data kept offsite, so that in case a disaster strikes, you get
back to that offsite center for DR.
The other and more contemporary way is to outsource Business Continuity to third
party DR and BCP sites. This approach has some real benefits and can save you
huge money and hassles, but both trends have positives as well as negatives. In
the following section we try to discuss the pros and cons of both approaches.
|
OmniCenter: Managed DR Site Solution |
Omnitech is an eighteen year
old company based out of Mumbai. Its competencies include Managed Services
(IT Infrastructure Management Services/ Remote Management Services, Business
Continuity Planning / Disaster Recovery Services), Software Development Lab
(Application Management and Maintenance Services) and Independent Software
Test Lab (Software Testing Services).
In IT there are four layers where Disaster Recovery (DR) is required to be
managed. The first and foremost is data, then comes equipment, site and last
is people. DR is a part of Business Continuity Planning (BCP) and Omnitech's
Managed DR Center, 'Omnicenter' is a part of BCP.
Most organizations in India do not have a
corporate-wide BCM plan in place, and they store entire data backups at
onsite locations only. So, why should an organization opt for a third party
DR center? The most important reason is that by doing so they can
concentrate on their core competency. Moreover, looking at the high rate of
attrition in IT, you are assured of support in case an important employee in
your IT team decides to leave the organization. Presently, BFSI and ITES
sectors are increasingly getting more and more focused on DR/BCP.
Omnicenter is located at Mahape, Mumbai. It
is a satellite DR for main hubs like Mumbai. It delivers end-to-end DR
services in accordance with global standards and processes like SOX and
Basel II. So, whenever disaster strikes at a client site, the team can
directly come to the Omnicenter and start their operations. It has a fully
operational facility with desktops that contain replica of the software at
client side, along with other necessary peripherals such as scanners and
printers.
Confidentiality is of utmost importance when
it comes to data. Client data is either at their IDC or at Omnicenter's
server, which is operated and managed by the client. Thus, the access rights
are with the client. BS7799 and BS 25999 are observed at the center. There
is high level of security, for eg, a particular location, say location 1
allocated to a customer would not be given access to another customer. There
are cards programs where various levels of access rights are defined. Each
customer operating in an environment is logically separated. Moving to data
equipment, the workplace recovery available could be dedicated or
syndicated. One seat could be claimed by more than one customer or the same
seat could be dedicated to a particular customer. Dedicated seats ensure
that workplace recovery is available to a particular customer throughout the
year. They have an in-house product called Omnimonitor, which helps to
monitor servers, networking systems, operating systems and databases in the
center. It works without an agent and wherever there are threshold
parameters set, and if those are achieved, the software would send an alert
by mail or an SMS.
Omnitech has also proposed a chain of centers
which will serve multiple purposes. One of those would be take care of
operations in the vicinity. For eg, if a disaster strikes in Mumbai it does
not make sense to have the DR center in Hyderabad; it is more viable to have
a DR center in Nashik or Pune. However, such a center would not help if
disaster were to strike regionally.
Awareness programs are also held for people,
through certified professionals. A dry-run is done regularly. Clients are
assisted in doing risk assessment services and business impact analysis, ie
to figure which of the businesses are most critical, so that they need to be
always available. Based on mission critical applications, the desired plan
is defined based on recovery time objectives (RTO) and recovery point
objectives (RPO). Based on these analysis, customers are advised to
shortlist the services they should outsource. Then you have something called
as disaster recovery consulting services. Once the customer gets into the
practice of implementing a DR solution they are required to be managed. And
once it is managed, they need to be audited. They follow APDIMA (assess,
plan, design, implement, manage and audit) methodology. |
In-house DR
The biggest problem with an in-House model is that if you plan to build a DR
site with 100% redundancy of equipment, data and seats, then it's like having
investing double the capital for the same task. And in case you don't encounter
any disaster for years at a stretch, the ROI for the investment comes out to be
zero. And then, it's not only about building a DR site initially and forgetting
about it completely. You have to regularly monitor, manage and test equipment,
and data kept at the site, so that in case of an emergency you know everything
is working fine. Such a kind of monitoring and management and the associated
drills require a huge amount of investment. So in a nut shell, it's like buying
your own hospital instead of getting a medical insurance done.
There are some good things about an in-house DR site though. For instance, if
security and data theft is a major concern, then you might not even think of
opting for an outsourced solution as you might have reservations in sending your
data regularly to places that are not under your complete control. For
businesses such as stock exchanges, BFSI, etc an in-house model alone can work.
Page(s) 1 2
|
