The Difference Between Disaster Recovery and Business Continuance

Transcription

1 The Difference Between Disaster Recovery and Business Continuance In high school geometry we learned that a square is a rectangle, but a rectangle is not a square. The same analogy applies to business continuance (BC) and disaster recovery (DR), respectively. Understanding the difference between the two terms will help you create processes, procedures and policies that effectively govern and protect your IT infrastructure and other critical business assets. This white paper will address: Key differences between disaster recovery and business continuance Different levels of disaster recovery, from a local backup system to a full business continuance service Factors that play a role in determining the level of backup, recovery and restoration Available technology and strategies that can create disaster recovery and business continuance programs Key reasons to outsource your DR and BC program infrastructure Distinguishing the Difference Between DR and BC Simply put, disaster recovery and business continuance are differentiated by the time it takes to restore your data. This timeline is determined by two factors; recovery point objective (RPO) and recovery time objective (RTO). The key to an effective recovery plan is defining the timeline and setting the right expectations when it comes to limiting factors. Disaster recovery procedures can require a day or more to restore an organization s data when its primary environment suffers an unplanned outage or disruption, without guaranteed automatic failover. Time-torecover based on a disaster recovery strategy relies upon passive components and resources, a manually staged secondary environment, and an experienced and trained team. Business continuance strategies speed up recovery time from days to minutes or hours. Systems and data can become quickly available at a secondary location that is at-the-ready to deftly manage the transfer of data resources during an unplanned event. Configuration changes on the client side may be required to connect to a new virtual environment and from a secondary facility provided to end users.

2 The Importance of Preparation, Timeline and Process: 1. Preparation: Preparation includes 1) identifying a secure repository for your data, 2) defining your RPO and 3) detailing the restoration process from the repository to a stand-by environment. Define your RPO what point in time pre-event would you need to recover to measured in minutes, hours, days and/or weeks. RPO may differ per system depending on how critical it is to your organization s business process. More critical files and systems may be backed up more often and retain more revisions for a longer period of time. A comprehensive disaster recovery plan would detail the restoration process to spare machines within a secondary environment. 2. Timeline: Define your RTO maximum amount of time you can go until your systems need to be back up. Prioritize the recovery response by most critical systems. How long can your organization function without ? Can your invoicing system stand a two-day outage? The RTO of identified systems will inform a succinct process for data restoration and replication during an outage. 3. Process: Don t forget about the people. When contending with a localized incident specific to your physical location, such as fire or flood, where will your staff work while the organization recovers? Are employees equipped to work remotely? In the case of a natural disaster affecting a region it s very possible that employees are also in recovery mode, caring for their family and negotiating the day-today without phones, Internet, power, water etc. How will they know where to report if phones and are down? A complete disaster recovery plan would address personnel management in time of crisis to ensure continuation of processes and procedures critical to your organization.

3 Solutions for Disaster Recovery and Business Continuance, at-a-glance: Incident Level Solution Preparation Timeline Process 1 Onsite Backup Solution Storage device at primary location equipped with backup software DR component allowing for faster onsite restores Backup administrator can recover and restore files and systems upon request 2 Offsite Backup Solution Storage device at secondary location equipped with backup software DR component allowing for timely restore from offsite repository Staff contacts backup admin to recover and restore files and systems upon request 3 Colocated Backup Solution Data replicated at secondary location DR strategy component managed by your staff Staff connects to secondary location via Internet to access files during an unplanned outage at primary site 4 Cold Site Virtual Machine Resources reserved at secondary site to stage virtual platforms needed to support data restoration DR strategy component typically allowing for restore within 12 to 24 hours depending on volume After event declaration, facility staff can prepare virtual environment, restores data and verify client connectivity 5 Hot Site Virtual Machine Secondary virtual environment consistently synchronized with primary site BC solution allowing for failover within minutes or hours depending on solution design Systems automatically failover to secondary site. Facility staff manages necessary configuration changes to ensure

4 Onsite Backup solutions provide a practical element in comprehensive disaster recovery procedures and utilize either a spinning storage or solid state storage option. These solutions are capable of imaging servers and storing data locally so you can recover quickly from incidents such as server hardware failure, isolated water damage and other minor events. Offsite Backup enables businesses to move critical data offsite. Once daily backups means your recovery is only as good as yesterday s data. An effective program requires a well thought out restoration process. Offsite backup then becomes an important component to a comprehensive disaster recovery plan, and is often implemented in direct response to regulatory compliance mandates. Colocation solutions are the first step to a modular recovery strategy backed by an enterprise-level facility with high bandwidth, backup services and an infrastructure designed to endure via redundant power, air conditioning and Internet access. Colocation is an ideal solution for organizations that need to leverage third-party facilities while using their staff to maintain and manage collocated assets and systems. Solution options include replication to secondary facilities as require. Cold Site Virtual Machine solutions provide critical application availability via virtual private servers (VPS) at a secondary facility. In the event that your primary environment suffers an unplanned outage, remotely stored data can be restored to a virtual environment within 24 hours. Employees can access systems hosted at the secondary site seamlessly and remotely while your IT team works to rebuild your primary infrastructure. This disaster recovery procedure depends on a reliable offsite backup solution running concurrently as well as coordination between onsite employees and disaster recovery partner experts. Hot Site Virtual Machine solutions allow for virtual environments to be available at the very moment a disaster strikes. There is no need to ship tapes to a recovery facility to rebuild your environment. This solution is engineered to ensure that your virtual environment is consistently replicated from your virtual infrastructure based on flexible and customizable RPO and RTO. In the event of a failure, virtual machines can be up and running in minutes and users can access servers and applications via any web browser. Business continuance is a required approach for organizations that demand maximum uptime and operational continuity. Popular virtualization technologies supported by this solution include those from VMware and Citrix, each of which employ hypervisor and/or storage-based replication to enable flexible recovery timelines. How do you know what level of recovery you need? What factors play a role in determining the level of backup, recovery and restoration (BURR) an organization needs? Uptime. Maximum uptime. No business can afford to ignore data backup, recovery and restoration as a cost of doing business. That being said, depending on what industry you re in will determine how much downtime your organization can absorb before it affects your bottom-line to its detriment. Viewing a comprehensive solution set as a services program that s sustainable can help to identify the right-fit strategy for your organization. Developing a strategy starts by taking stock of key systems and tools that are critical to the operation of your business such as , contracts, billing systems, client records, phone systems etc. What must be recovered for our business to operate? How long can I be without each of these business functions? Each function must

5 be identified, prioritized and given a maximum time to restore value and a recovery point objective. Gartner warns that organizations suffering from an outage have an average of 48 hours before many of their customers move to a competitor. Although a BURR solution employs technology, identifying and implementing the right services program is a business decision. This business decision is driven by four factors; change management, compliance, security and operational continuity. Ask yourself the following questions: Change Management: Are my systems able to revert back to a point in time in the case of operator error? Compliance: Does our organization need to comply with regulatory mandates regarding storage of information and/or exercised disaster recovery plans etc.? If my business provides SLA driven service to clients, how many hours can we be down before we re out of SLA? Security: What security regulations and mandates could be at risk of non-compliance due to our current backup process? What security vulnerabilities would be exposed in the event of an outage? Operational Continuity: What is my company s downtime threshold before it affects client trust, employee confidence, our reputation and the bottom line? To be prepared organizations must: 1. Review their processes, physical equipment and procedures; 2. Identify pain points, aging or proprietary equipment and prioritize needed data; 3. Predict possible points of failure and automate its response to enable: a. Restoration of process; b. Restoration of physical equipment; and c. Restoration of data.

6 Why subscribe vs. build? 1. No up-front capital costs: Avoid the costs of building and maintaining your own disaster recovery facility. Contrary to typical thinking, the secret to building highly available systems is planning for failure. The key to doing this is predicting the failure scenarios and have systems able to automate the required responses to continue the designed functions. If you can predict the failure potentials you can design effective actions around the event. This methodology however, inherently assumes that 100% uptime is an impossible achievement for information systems that rely on single networks, servers and even facilities. Being prepared for multiple scenarios requires significant investment in people, processes and procedures. Ask yourself if you have invested in the level of redundant equipment, procedures and facilities that will be able to automatically fail over to an alternate system including power, cooling, security and Internet access. 2. Scalable Resources: Building a secondary infrastructure to enable replication, recovery and restoration of your current configurations and data size you have today may not serve you well tomorrow. As technology needs expand and contract organizations that build out their own facilities may soon find themselves with either an over-built or under-built site sooner rather than later. Ask yourself if what you have built will scale to support what you need tomorrow, next year, and beyond. 3. Cost Effective: A pay-as-you-go subscription model allows for fixed billing that only changes when you add or remove live systems from the disaster recovery site. This keeps costs constant to avoid increased fees due to configuration changes, volumes of data, or recurring maintenance. Ask yourself if a single line item expense to cover your business in the time of disaster would help better manage your IT budget. 4. Staff Augmentation: Leveraging a third-party facility that can provide experts to engineer a disaster recovery system for your business and manage routine testing will allow your staff to concentrate on their core responsibilities. Partnering with a technology firm that can verify backups daily and manage restoration upon declaration of event frees your IT staff to focus on restoring the environment at the business s primary location. Ask yourself if you have staff trained in VMware vsphere Disaster Recovery. Do you have skill set gaps? 5. Secure SAS 70 or SSAE/16 Type II Data Center: Most organizations have contractual obligations to provide validation of good business practices in defense of their regulatory compliance requirements. When it comes to data storage in a data center fulfillment of such requirements is certified by SSAE/16 Type II SOC audits. This requires time and money in order to define standard operating processes and procedures, exercise them every six months and submit results to an independent auditor based upon SSAE/16 international standard specifications. Ask yourself if you have the systems, trained staff and capital to routinely submit to a rigorous SSAE/16 Type II SOC audit and if you can afford it.

7 Conclusion: The difference between Disaster Recovery and Business Continuance is the time and effort immediately required to restore critical business functions and applications following an unplanned and potentially catastrophic event. Business Continuity is dependent on the investment in resources in order for disaster recovery to be achieved in minutes or hours. Leveraging a third party partner is a strategic way to have best-in-class services and support that continue to scale with the needs of your organization. For most businesses this is the only practical way to have trained and knowledgeable technical team focused on your IT recovery while you are managing your business. About Fandotech: Fandotech provides business solutions from the device to the data center. We partner with our clients leveraging technology to surmount their security and compliance, change management and operational continuity challenges. Our SSAE/16 Type II (formerly SAS 70 Type II) data center facilities are supported 24/7/365 by our fully certified team, delivering cloud technology solutions to companies of every size. With on-site managed services, our three data centers provide hosting, colocation and managed network services. Currently monitoring and operating client assets globally, Fandotech is well positioned to support our clients business goals.