Stop Reacting; Start Anticipating Disasters BEFORE They Occur Using Predictive Analytics

Transcription

1 Source: IBM CIO s are struggling to address board level requirements that are vastly different from what they were responsible for just 5 years ago. Stop Reacting; Start Anticipating Disasters BEFORE They Occur Using Predictive Analytics I need to manage complexity of compliance across my organization and silos -- and be audit-ready all the time. I need to provide access to and recoverability of data at any time. I need to protect against threats even the ones I m not prepared for. Richard Cocchiara: IBM Distinguished Engineer; CTO IBM Business Continuity & Resiliency Services (BCRS); Managing Partner IBM Resiliency Consulting Services; Member of the IBM Academy of Technology Leadership Team Lack of resources, expertise and tools to cost effectively manage multi-vendor environments How do you? Increase regulatory compliance without increasing capital expenses Block potential incoming threats without inhibiting traffic flow, data availability and uptime Prepare for the unexpected outage or disaster 2 Companies face a growing number of growing risks to their IT that continuously stress their ability to deliver service to their customers. AC failure Acid leak Asbestos Bomb threat Bomb blast Brown out Burst pipe Cable cut Capacity failure Chemical spill CO fire Coffee machine Condensation Construction Coolant leak Cooling tower leak Corrupted data Denial of Service Attack Diesel generator failure Earthquake Electrical short Epidemic Evacuation Explosion Fire Flood Fraud Frozen pipes Hacker Hail storm Halon discharge Human error Humidity Hurricane HVAC failure Hardware failure Ice storm Insects Lightning Logic bomb Lost data Low voltage Microwave fade Network failure Pandemic PCB contamination Plane crash Power grid outage Power outage Power spike Power surge Programmer error Raw sewage Relocation delay Rodents Roof cave-in Sabotage Sprinkler static Frequent Infrequent Frequency of occurrences per year 1, /10 1/100 1/1,000 1/10,000 1/100,000 US$1,000 US$10,000 US$100,000 US$1,000,000 US$10,000,000 US$100,000,000 Low Viruses Worms Shotgun blast Shredded data Sick building Smoke damage Smoke from restaurant Programmer error Regulatory Compliance Raw sewage Snow storm Data growth System availability failures Data corruption Network problems Data driven Disk failures Regulatory compliance Long term preservation Application outages Audits New products Marketing campaigns Workplace inaccessibility Business driven Governance Failure to meet industry standards Regional power failures Building fires Consequences (single occurrence loss) in dollars per occurrence Software error Electricity Strike action Swimming pool leak S/W ransom Terrorism Theft Tornado Terrorism/civil unrest Pandemics Event driven Natural disasters Mergers and acquisitions High Train derailment Transformer fire UPS failure Vandalism Vehicle crash Virus Water (various) Wind storm Volcano or volcano ash As budgets shrink and service level requirements increase, a company s business becomes even more vulnerable to IT outages. The impact of lost data or unplanned downtime can be catastrophic, leading to lost revenue, reputation, and competitive position. Finances Loss of reputation Revenue Lost deals Disruption of cash flow Lost discounts Missed payments Drop in stock price Miscellaneous costs Temporary staff needed Travel expenses incurred Equipment rental costs incurred Company reputation Damaged relationships with: a. Customers b. Suppliers c. Partners d. Lenders e. Investors Productivity Employees who cannot perform their jobs Missed deadlines Loss of direct revenue Loss of future revenues Losses due to invoices that cannot be completed Losses due to investments not made Regulatory Inability to meet compliance requirements 3 Source: Contingency Planning Research, Inc. and IBM 4

2 At the same time the cost of downtime increases, company s are inundated with disjointed information. The changing risk landscape will require a shift to a new paradigm that anticipates and integrates daily operations, emergency management & business continuity The amount of information managed by enterprise data centers is expected to increase by at least 50 times over the next decade x Zettabytes* *Zettabytes equals 1 trillion gigabytes 1. Source: IDC Digital Universe Study, June 2011 The average cost per hour of system downtime is increasing as more business operations become automated 2 $110K $182K Average cost of one hour of downtime 2. Source: Aberdeen Group: Datacenter Downtime: How Much Does it Really Cost?, March 2012 Handle both emergency and non-emergency events, tests and alerts. Organize response teams, enabling fast and clear communications between team members. Define and provide standard operating procedures for varying situations, with proper assignments, based on legal requirements or historical experience. Track the progress and performance of procedures, including the results of the actions for rehearsals and events. Locate and manage resources with the required capabilities and skills to handle the events. Enable the continuous improvement of the organization s services and responses. Manage Prevent Recover 5 6 IBM has seen this shift coming for a while and understands that this is part of the evolution from disaster recovery, business continuity and business resilience into the era of Intelligent IT Risk. IT: reactive Business: none Recovery time: days or weeks IBM BCRS founded in 1989 IT: proactive Business: reactive Recovery time: minutes or hours Disaster recovery Syndicated hardware IT: proactive Business: proactive Recovery time: minutes or seconds Business continuity Dedicated hardware Shared recovery model IT: anticipative Business: anticipative Recovery time: seconds or always up Business resiliency Intelligent IT Risk Management Cloud computing Virtualized model Dedicated recovery model IBM BCRS in the future Predictive Analytics The definition of IT risk is drawn from several synergistic points. The priority now is to connect the top-down and bottom-up views so that our risk management framework will be a truly holistic business resilience strategy. Jean-Pierre Bourbonnais, CIO and Vice President of Information Technologies, Bombardier Aerospace 1. Business results are inextricably reliant on IT service thus IT must support critical business processes and key initiatives by being reliable, predictable, available and secure. 2. IT is much broader than infrastructure (boxes and network) and includes process, people, data and applications, facilities, and business and IT strategies. 3. IT is under intense pressure to execute thus must be: flexible and appropriate, available and recoverable, scalable and ready to perform, secure and protected, accurate and timely. Thus, IT Risk is The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise

3 Intelligent IT Risk will use predictive risk analytics tied to response capabilities designed to ensure continuous operations. Predictive risk analysis integrated within the business daily operations helps to filter business critical information so they may anticipate problems and opportunities to make the right response faster. IBM has created a framework for identifying the risks associated with the use of IT that takes a broad and integrated view starting with an understanding of the core business requirements. Anticipating problems to resolve them proactively Monitor multiple, diverse inputs Manage key risk indicators Prepare earlier to cut response time Leveraging information to make better decisions Large scale situational awareness Mitigate risk across wider risk spectrum Respond to risk and opportunities Coordinating resources and processes to operate effectively Intelligent response Integrated with the fabric of the business Continual involvement versus one time training 9 10 IT risk management requires the analysis of a broadly linked IT Risk Spectrum that goes beyond the traditional view of business continuity. The IBM Risk Spectrum is applied against the company s business resilience delivery framework and can be decomposed for both dependency and parallel analysis. IT Risk Spectrum Agility & Appropriateness Scalability & Performance Security & Data Protection Accuracy & Timeliness Availability & Recoverability respond in a timely manner with the correct new or modified IT Service in support of changes in business requirements maintain acceptable performance based on business needs and appropriately accommodate changes in business service volume provide the appropriate access controls while protecting the business information and resources provide accurate data, to the right people, at the right time to make informed business decisions. keep systems running and, if necessary, recover from interruptions in line with business expectations. Suppliers People Process Technology Infrastructure Exo-Structure Businesses and government agencies that provide the critical materials, services and information Human resources with assigned responsibilities within the company and the processes to maintain How company conducts its core business through business process modeling and IT governance Equipment and tools that support the company s business processes Components under company control that enable operations Ecosystem components outside company control (power, water, food, roads, communications and governance 11 12

4 Our methodology helps a company to understand their strategic business goals and risks to create a real-time IT risk management system. A effective IT Risk strategy includes defining and measuring Key Risk Indicators (KRI) customized to each company s unique requirements. Scalability and performance Agility and appropriateness Security and data protection Availability and recoverability Accuracy and timeliness 1 ASCERTAIN and align strategic business goals with value of IT services 1. Identify Strategic Initiatives against which to manage and exploit IT capabilities 2. Map strategic initiatives to Organization and IT support processes and services with measurable indicators and estimated impact to initiatives 3. Categorize IT performance metrics against the IT Risk Spectrum. ACT to create an ongoing IT ASSESS IT risks and risk management capabilities 2 3 governance system 1. Quantify IT risk to organization as the gap between required vs. actual business performance metrics 2. Conduct an IT service all capabilities analysis to identify measurable IT risk and performance metrics 3. Define and prioritize the appropriate IT service risk treatment and roadmap 1. Define or integrate IT Risk management principles into an ongoing IT risk management program 2. Recommend organization structure, roles & responsibilities, and policies to help you continuously monitor and respond to changes in IT risk 3. Define communication and awareness programs People Processes Technology Infrastructure Suppliers Exo-structure defined at each intersection Exploit IT Services to Support Organizational goals Improve response to IT Risk Create a Risk Aware Organization But KRI s are only useful if you can combine real-time monitoring and predictive analytics with robust response capabilities. Companies must have access to flexible and dynamic information readily available that can be used to assess the current situation and take appropriate corrective rec tivea action. Analytics Predictive Systems Modeling & Simulation Archives Standards Based Interfaces Domain Specific Interfaces Event Rules Portal Access Expert System Semantic Models Workflows Alerts KPI s Directives Service Bus Response Capabilities Incident Management Reporting Rapid Recovery Resources Data Integration Active Workflows Communication Management Social interaction i Event correlation detection Command Center Executive Dashboard Role basedv views Data drill down Video Analytics Security IT Operations Compliance Event Feeds for : Weather Geological Traffic Employees Health Financial Integrated System Click to Action Progressress Reporting 3d Modeling What,When, Where, Why and How 15 16

5 The use of predictive analytics and a robust command center allows for improved efficiency, management, collaboration and response to events. Example scenario Weather prediction Deep Thunder Global Operations Operational Efficiency Mega Centers Work Area GOAL: Ensure that the managed environments maintain operational efficiencies. Collaboration GOAL: Get the right information to the right people at the right time for rapid problem resolution Daily Operations Predictive analytics Intelligent Operations Incident Identification / Warning Incident / Event Management GOAL: Effectively manage events and return to a steady state. Plans Workflows Intelligent Response Business Rules Available Resources GOAL: Anticipate to provide real-time response using best practice SOPs, workflows, and resources Emergency And Crisis Mngt Business Continuity Rapidly respond to emergencies Standard Operating Procedures (SOP) Extreme Weather Event Preparation Flash Flood Preparation Flash Flood Evacuation Example Scenario: Heavy rains are predicted to cause large scale flooding in the city where the business main processing center is located. The center monitors sources that predict the magnitude of the storm and possible outcomes. This will allow the center to start the SOPs that are needed for extreme weather preparation. As the weather incident continues to affect the city, additional SOPs can be activated to send people home, begin critical backup, move operations, or mobilize additional resources. As these predetermined SOPs execute, constant situational awareness events from the center can be used to ensure the most appropriate response is delivered. 1. Predicted extreme weather 2. Situational awareness engines monitor weather feeds in the center 3. Rules engines will start automated responses via standard procedures (SOPs) 4. The center will manage the most appropriate response based on the situational awareness information and the incident in hand News feeds Traffic flow Combining predictive analytics and business continuity capabilities into an intelligent command center provides near and long term cost efficiencies. The right business resilience strategy can help you: Mitigate risk Avoid the costs of downtime, brand damage and market share lost to competitors, and reduce the financial impact from business disruptions Protect brand and revenue Properly assessing the dynamic threats to your IT infrastructure, their potential business impact and your tolerance for risk can help you plan a realistic strategy Protect capital Analyzing cost tradeoffs can help you avoid unnecessary investments Reduce costs Creating proactive SOP s with tested response capabilities can help protect you from costs associated with failed recovery and lost data Improve service You can better align a resilient infrastructure to the needs of your business to maintain service level agreements based on your tolerance for risk Thank you Richard Cocchiara IBM Distinguished Engineer rmcocch@us.ibm.com ibm.com/services/continuity 19 20

6 Copyright information Copyright IBM Corporation 2014 IBM Global Services Route 100 Somers, NY U.S.A. Produced in the United States of America February, 2014 All Rights Reserved IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at Copyright and trademark information. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Other company, product and service names may be trademarks or service marks of others. Use of the information herein is at the recipient's own risk. Information herein may be changed or updated without notice. IBM may also make improvements and/or changes in the products and/or the programs described herein at any time without notice. References in this publication to IBM products or services do not imply that IBM intends to make them available in all countries in which IBM operates. 21