Monday Was Not a Good Day: Disaster Recovery Lessons from Hurricane Katrina Jordan Emerson

Transcription

1 Monday Was Not a Good Day: Disaster Recovery Lessons from Hurricane Katrina Jordan Emerson

2 "Monday was not a good day." This candidate for understatement of the decade is how Ray Johnson, the then CIO of Entergy, a major Energy Company based in New Orleans, referred to August 29, 2005 when Hurricane Katrina laid waste to the US Gulf Coast. 1 Fortunately for Johnson, despite suffering a record shattering "case of the Mondays", he and his team had a plan. As early as 72 hours before New Orleans was inundated and major infrastructure was lost, Entergy's IT team began to implement their Disaster Recovery Plan (DRP) to ensure the protection of vital data and capabilities and ultimately the least amount of disruption to the business and its clients. While it's true that Johnson had a large, highly-skilled team at his disposal due to the enormous resources of his company, you don't have to have a Fortune 500 business or millions of dollars set aside in order to setup your DRP. In fact, not having the millions of dollars in the first place probably means your business can't afford the losses associated with such a disruption to your company and clients, making a DRP arguably even more essential. If you haven't already begun to consider a DRP, the time is now. So what exactly is a Disaster Recovery Plan? As can often be the case in the wonderful world of Information Technology, there can be a fair amount of confusion regarding overlapping technologies and

3 the jargon involved. While intimately related, DRPs are often confused with other concepts such as Business Continuity Planning (BCP) or High Availability (HA) and frequently assumptions are made about technologies such as Cloud Computing (CC) being synonymous with Disaster Recovery. A BCP is the overarching plan of how an organization will respond to a disaster and touches all areas of a business from personnel to facilities to communications encompassing every aspect of company operations that could be impacted by a situation. It is the umbrella under which all recovery planning takes place. A DRP is a particular subset of Business Continuity Planning specifically focused on the recovery of hard and soft IT assets. More specifically, disasterrecovery.org defines DRP as "the Disasters can run the gamut from major weather events, such as an earthquake or flood, to minor things like spilling coffee on your PC. process an organization uses to recover access to their software, data, and/or hardware that are needed to resume the performance of normal, critical business functions after the event of either a natural or man-made disaster". 2 A key component of DR is that an event must first occur from which you must recover. This is distinct from the concept of High Availability which is essentially the use of multiple redundancies to prevent any losses in the first place. In the case of Cloud Computing, consumers often assume that because they have their data stored in "the cloud" off-site at some remote location, that they are prepared to recover when disaster strikes. While having off-site data storage can be a useful tool in the spectrum of DR practices, off-site storage alone does not guarantee you will have access to or be able to restore your system from said data. A DR plan is essential to ensure you are prepared to leverage such

4 Cloud Computing tools in the event of a major disruption of your primary systems. Not to sound like an alarmist, but "disaster" can strike anytime, anywhere. However, in the case of business and information technology, "disaster" is a relative term. Disasters can run the gamut from major weather events, such as an earthquake or flood, to minor things like spilling coffee on your PC. If you run an auto repair business and you're having issues with your internet connectivity you may experience a certain degree of frustration, but you would likely find you can continue most of your core functions, such as repairing cars, and not consider this a disaster. However, if your business depends on a high volume of real-time transactions, such as in banking and securities trading, as Of companies that had a major loss of business data, 43% never reopen, 51% close within two years, and only 6% will survive long-term little as 15 minutes of loss-ofconnectivity could have major impacts to the business, clients and your bottom line. This could very well be deemed a disaster by all accounts of those involved, especially if you are unable to resolve the problem quickly. Now ask yourself, are you and your business prepared to respond to the unexpected? Perhaps you ve never had a problem and hope to continue that streak (knock on wood). Perhaps you think that you can t afford the expenditures at this time or you re too busy to deal with developing a DR plan right now. You can tell yourself that you plan to get around to it later. But let s face it, how often does later ever come? And how often do you ever really just have extra money for things tomorrow you already don t deem a priority today?

5 The truth is you can t afford NOT to have a plan and it s up to you to prioritize resources to develop a plan today. According to Georgetown University s own DR planning site, Of companies that had a major loss of business data, 43% never reopen, 51% close within two years, and only 6% will survive long-term. 3 So while you continue to rely on hope and plan to find the time and money tomorrow, your business s existence is in jeopardy of succumbing to the whims of nature and the follies of man today. While most would prefer to avoid disastrous situations entirely, in the case of large scale natural events like monster storms, practically no amount of advanced warning would allow you to relocate your entire technological infrastructure to avoid the inevitable fallout. Planning for the inevitable is essential. So where can you begin? You and your business are unique and therefore will require a unique solution. Each business will have its own needs and no boiler-plate solution can guarantee to protect your operational integrity. Below are some questions you should be asking regarding your business when trying to determine the optimum solution for your unique business: 1. In the event of a crash, how quickly could you setup a new server? 2. What is your tolerance for downtime? 3. What are your storage needs on your server(s) and how much are you utilizing? 4. What kind of performance do you require from the solution in order to recover? 5. What is your business model (e-commerce, SaaS, etc.) and how will you utilize your solution? 6. What kind of growth are you projecting in the next 3, 6, 12 months?

6 The answers to these questions will likely lead to even more questions as you begin to define your DRP needs. You should be asking yourself these questions today, but also continue to revisit them once or twice a year or even more frequently depending on how dynamic your business environment happens to be. The more major changes to personnel, facilities, products and infrastructure you experience, the more often you ll need to ensure your DRP is equipped to handle the changing landscape of your business. Do you and your business a favor and learn from the mistakes of countless other small businesses and treat your IT infrastructure like the investment that it is. By now it should be clear that you get as much out of your IT infrastructure as you put into it. An IT provider can help you avoid hazards and make the most of your IT budget. Even in the cases where you feel your business isn t right for outsourcing to a third-party IT provider, it s still advisable to consult with one in order to ensure you reach that conclusion properly. Do you and your business a favor and learn from the mistakes of countless other small businesses and treat your IT infrastructure like the investment that it is.

7 About the author: Jordan Emerson As Director of Awesome for The IT Guys, Jordan brings his experience as a business analyst and implementation specialist to the aid of prospective IT Guys clients. His goal? Help them leverage their Information Technology Awesomeness Potential to maximize productivity and profitability. Focused on the client and dedicated to their IT success, Jordan s also cheerful, friendly, courteous, thrifty and clean. A regular Information Technology Boy Scout. When he s not helping clients, rescuing stranded kittens from trees or helping little old ladies cross the street, you can find Jordan working on his classic rock guitar licks or in the kitchen honing his culinary skills. Talk to Jordan at jordan@texasitguys.com. Who are The IT Guys? We Think Awesome! Not all IT support companies are created equal, and we re proof of that. While most focus on technology as an end in itself, The IT Guys look at IT as an essential tool that can help your business achieve maximum productivity and profitability. Or drag you down like an anchor on a rowboat. So, we don t look at ourselves only as a technology partner. Instead, we re your business partner. One that shares your goals and is in the boat with you all the way. And we put our money where our mouth is; if you re not successful, we re not either. Can we fix a broken computer? Sure. Can we make cranky software behave? Absolutely. After all, that s the minimum you d expect from anyone calling themselves an IT support company. The IT Guys take Information Technology support to the next level. Our Information Technology Awesomeness Plan will insure your IT resources are rock-solid; supporting your present and future business strategies, while enabling you to focus on growing your business. And that s thinking awesome. 1. Lessons from Hurricane Katrina: It Pays to Have a Disaster Recovery Plan in Place 2005, Stephanie Overby,