A Tactical view of Resiliency Strategies What worked and what didn t

Transcription

1 Rodney Yip Product and Portfolio Manager, IBM Canada June 2012 A Tactical view of Resiliency Strategies What worked and what didn t Rodney Yip IBM Canada, Product and Portfolio Manager ryip@ca.ibm.com

2 Business resilience Welcome to the matrix A business is made up of many resilience layers. Risk mitigation strategies and tactics Business driven Data driven Event driven Strategy and vision Organization Processes Applications and data Technology Facilities 2

3 Examples of tactics Strategy Policies: HR, Mobility, thou shalt have BCP/DRP Organization Virtual Bench, Mobile employees, Laptop, Virtual desktop Business Processes Non-IT enablement (eg.mail), cross training, dual site operation Applications and Data Cloud Backups, Cloud Recovery, Data Replication, tape storage Technology Commercial: Hotsite Recovery, Managed Continuity, Rapid Recovery, Dropship Redundant Onsite HW Facilities Dual site, Refurbishment, Work Area Recovery, Dropship Trailers 3

4 Cost of outage Tactic selection can affect your overall performance. Cost Downtime costs versus recovery time Loss of life Litigation Lost reputation Penalties Restoration cost Idle labor Idle resources Transaction loss Lost investors Lost opportunity RTO = Minutes RPO = Last transaction Recovery time As recovery time increases, so does the cost of recovery and the requirement for higher investment in data protection. Source: A new approach to data recovery by Ferenc Gyurcsan in Disaster Recovery Journal, Spring

5 Recovery time objective One size does not fit all Hybrid recovery integrates advanced techniques, products and services to shorten the business resumption process. Spectrum of recovery services from IBM Minutes 12 hours RTO (recovery time objective) is how soon the client needs to recover after a disaster. RPO (recovery point objective) is the time at which data loss is no longer an acceptable risk to the client. Applied Disk mirroring Server mirroring 24 hours Standby operating system and recovery mgmt. services Extended availability Electronic vaulting Electronic journaling Days Hot site 5 Days 24 Hours 12 Hours Minutes Recovery point objective

6 Should you spend now? With an increased emphasis on resilience and risk, organizations have increased their spending to match. Spending over the last three years Increased significantly % 14% Increased % 39% Stayed the same % 36% Decreased % 6% Decreased significantly % 2% Source: Q3. How has your organization changed its degree of spending on initiatives to improve business resilience? 6

7 What tactics are organizations spending on? Protecting data is the overriding concern for most organizations What constitutes an organization s business resilience strategy Data and application resiliency Key strategic elements Business resilience cuts across every part of the organization Data protection / backups Separate plans for a variety of risks Infrastructure security Security governance and risk management Disaster recovery is a primary concern IT security is a primary concern Identify and access management Compliance management Regulatory compliance is a primary concern Source: Q2. Do you agree or disagree with the following statements regarding management of data risks? (Agree only.) Q1. Do you agree or disagree with the following statements regarding your organization s IT risk management. (Agree only.) 7

8 While the role of cloud may still be undetermined relative to risk and resilience, 67% of respondents now perceive its value vs 77% seeing it as moderately to extremely risky in IT execs will never give up control of data assets 5% Key strategic aspect of risk management 18% Traditional methods are best 6% Offers promise once technical and security issues have been addressed 28% Data security risks are too great 21% Benefits outweigh the risks 21% Source: Q8. How do you perceive the role of cloud computing in contributing to risk management or business resilience planning? 8

9 Canada is not immune to disasters 911 Katrina Winnipeg Flooding Ice Storm 2003 power failure G20 Summit of the Americas Quebec City, Toronto 9

10 911 What worked Communication plans Rapid communications (business) Leadership response (the Rudy effect) Succession planning Employee welfare What didn t work Asset management (safes) Offsite data storage servers / desktops / laptops Chicago Resulted in Recover Anywhere Spinning the message For RBC employees, the single biggest fear was the air quality in and around One Liberty. When they first moved in, computers and other plastic objects were burning in the pit just across the street. Mercury, dioxins and asbestos had blown in through the building's shattered windows, along with the ash and debris. RBC made exhaustive efforts to test contaminant levels in the air and clean its offices, said Paul Gottlieb, chief operating officer of RBC DS's New York operations. The timing of the company's return was dictated by the environmental issues. 10

11 Hurricane Katrina What worked Evacuation planning When in doubt RUN! Data and IT evacuation Key staff planning What didn t work We re from the government, we re here to help Traditional disaster declarations; staff running for their lives Offsite backups under water Supply chain management Creeping disaster triggers 11

12 Winnipeg flooding What worked Hotsite Recovery + Crisis Mgmt shop out of province staff communications flexible HR policies community, camaraderie customer communications On-the-fly innovation MacGyver, traps, Recover Anywhere Leadership What didn t work Plans did not include employee families Evacuation of key staff to recovery centre Bandwidth Offsite data wrong side Overconfidence 12

13 Ice Storm What worked Hotsite and Data Replication Businesses restarted out of the disaster zone Innovation Winnibago ATM Corporate support of community Government support - evacuation What didn t work Optics Bromont Staff support care for families Government support evacuation 13

14 2003 Power failure What worked Hotsite + Dual site IT and data available in commercial DR site UPS + Diesel + chillers + security Remote operations (limited) What didn t work I m outta here. Family first (4/9) Staff rotation Red team / Blue team Hidden threats computer room heat 72 hour kits not enough families had them Diesel fuel supplies 14

15 Summit of the Americas / G20 What worked Mobile workforce Plan Flexibility SA3 tear gas 500m Staff communications Staff, technology and data evacuation Recover Anywhere Decreased dependence on site Call bounce 2012 BYOD telephony Explicit HR policy What didn t work Police liaison Definition of a disaster in plans Restriction of access vs denial of access Bandwidth 15

16 Select a trusted partner with a wide range of Business Resiliency offerings People Business Continuity and Disaster Recovery consulting Global Business Services consulting (business engineering) Humanitarian aid teams / technology / Sahana Replacement staff (Virtual Bench) Hardware / Software Infrastructure Recovery Services shared cost / hosted / dedicated System i/p/x/z, SUN, HP Equipment maintenance / refurbishment / installation Hardware replacement (Trade-ins, Server/tape/disk Brands) Hardware Platform support / Research labs (fix, PPRC, flashcopy, BRMS) Software development and support (Software Group, TSM) Site design/refurbishment / Power systems (Site and Facilities) Financing services - Capitalization Services Cloud Backup Services (Managed Backup Cloud) Cloud Recovery Services (Virtualized Server Recovery Cloud) Facilities Office space and workarea recovery shared cost / dedicated / mobile Network design and implementation Voice systems implementation One size does not fit all mix and match 16

17 Summary Identify operational and financial risks then remediate Vision without action is an hallucination Mix and match tactics based on high frequency threats Work with a trusted vendor that can provide more than one tactic Be the kind of company you want to work for Plan Risk tolerant Agile Innovation from all levels Staff considerations Evolve plans as technologies and the business evolves Rodney Yip, ryip@ca.ibm.com

18 18