Elements of a Sound Business Continuity Plan and the Role of the Cloud. An NTT Communications White Paper

Transcription

1 Elements of a Sound Business Continuity Plan and the Role of the Cloud An NTT Communications White Paper

2 Table of Contents Introduction... 2 Elements of a Business Continuity Plan... 2 Identify Critical Systems and Functions... 3 Define RTO/RPO... 3 Establish a Personnel Plan... 4 Virtualize to Survive... 4 Account for Security Breaches... 4 Document the Plan... 4 Test, Test, Test... 5 Role of the Cloud... 5 Archiving... 5 Backup and Recovery... 6 Cloud-based Failover... 6 A New Era... 7 Introduction From weather-related disruptions to the continuing onslaught of security breaches, there is no shortage of threats to the operation of business networks and data centers. To cope, companies know they need to have contingency plans in place for various sorts of disruptions. Yet too often disaster recovery and business continuity planning gets put off, pushed to the back burner where plans tend to remain half-baked. In some cases, companies may have started to come up with a plan, but found the kind of solution they required was too expensive. Whether you have a fully baked DR/BC plan or not, now may be a good time to revisit it. New cloudbased disaster recovery options are emerging that may offer a better level of protection at the same or lower price than what was previously possible. In the pages that follow, we ll outline what a sound business continuity plan should look like and how new cloud-based offerings may be able to play a role. Elements of a Business Continuity Plan Let s start with identifying the various elements of a sound business continuity plan. As you ll see, the plan is about far more than technology, as it delves into crucial business requirements, the needs of various employee constituencies and more.

3 Identify Critical Systems and Functions The first step in establishing a business continuity plan is determining what applications and functions are critical to your business. This may well be the most difficult part of the planning process, as it s doubtless than many department managers will consider their functions critical. But keep in mind that the more functions and applications that are deemed critical, the more your final plan will cost, and the longer it will take to execute. A good way to think about what is truly critical is to assess what its loss will mean in terms of revenue, brand damage and regulatory compliance. Put another way, consider what kind of damage will result if the application is not available for a period of time. Define RTO/RPO The above assessment will naturally lead to a determination of your recovery time objective (RTO). RTO defines how quickly an application or system needs to be back online after a disaster. Put another way, it s the amount of time that the company agrees the system can be down without causing too much damage to the company. RTO will obviously differ for all of your applications, which is why the first exercise is so important. If you assign an RTO of zero or even 30 minutes to too many applications, you will be getting into an expensive disaster recovery plan. It s better to be realistic about which applications you need right away and which you can live without for a few hours or even days. Closely related to RTO is the recovery point objective (RPO), which is essentially the amount of data loss the company can withstand. If it s determined that the company can survive the loss of an hour s worth of data, then that says it must perform data backups at least every hour. Here again, the RTO will be different for varying data sets, as they are clearly not all of equal importance. What this analysis all comes down to is determining a service level agreement (SLA) for each business application and function. Note: this is not an exercise that IT can conduct on its own. Representatives from all business groups are required. Larger companies typically have a business continuity planning team to handle the function and to consistently review their assessments to keep up with changing business requirements. Establish a Personnel Plan When disaster strikes, it s important that key employees know what their role is in implementing the disaster recovery plan. The last thing you want is to be assigning roles in the midst of the disaster - a sure recipe for chaos.

4 The personnel plan should clearly spell out the roles and expectations for each person who has responsibility for executing the plan. You ll also need to assign alternates in case the employee with primary responsibility for any given task can t be reached, which is common during a disaster. Consider also the needs of employees who are not involved in the business continuity plan but who still need to do their jobs. In the event of a power outage, for example, how will you reach them? Is there an alternate location where they can work, such as their homes? During weather-related disasters such as major snowstorms, hurricanes and the like, it s not uncommon that employees won t be able to get to the workplace. Or perhaps you have workers in different regions who can compensate for those affected by the disaster. Just be sure you have a way to reach them wherever they may be, such as an accurate list of cell phone numbers. Virtualize to Survive Virtualization technology can help you survive a disaster in several ways. Desktop virtualization, for example, will make it simple for employees to work from home. The technology enables employees to access the same applications they use at work from any Internet-connected desktop, so long as the corporate servers hosting the desktop images are functioning. Similarly, server virtualization makes it far easier to survive a disaster because you can take snapshots of the servers and routinely back them up elsewhere, where they ll be ready to go into service when needed. Account for Security Breaches A security breach can be every bit as damaging as a hurricane, so a breach response plan should be part of your overall disaster recovery/business continuity plan. As with the overall plan, you ll need a list of employees who should be contacted, although it may be a somewhat different group. The list should include executives from the business unit whose systems were breached, the IT staff responsible for those systems and the security team. The IT team should shut down whatever systems were breached and ensure evidence is saved for later analysis. That could be as simple as taking a snapshot of a virtual server or may mean removing the disk to preserve it. Document the Plan Once you ve got a disaster recovery/business continuity plan in place, document it and distribute it to all employees who have a role in it. It s a good idea to print out lots of hard copies and distribute them as well. In the middle of a disaster, you may not be able to access online versions.

5 Test, Test, Test All elements of your disaster recovery plan should be tested periodically, at least once per year, so employees aren t running through it for the first time while they re in the middle of a real disaster. That s especially important for data backups to ensure you re actually backing up what you think you are. The same goes for failing over data center operations to a backup facility; you need to test the plan to make sure it will work as expected if need be. Role of the Cloud The results of your RTO/RPO analysis will go a long way toward dictating what kind of backup and recovery strategy you ll need. It will likely include various types of backups, each tailored to meet the RTO/RPO goals for different types of data. Archiving At the lowest level is data archiving for data that you need to store for long periods of time but that users are not likely to need access to. Examples include financial and health organizations that must store records for compliance reasons, or media and entertainment companies that need to store video files. Traditionally, tape backup was the mode of choice for such data because it is relatively inexpensive. But tape libraries can quickly grow unwieldy and, while individual tapes don t cost all that much, when you add up the cost over time and include the costs to manage them, it all adds up. Additionally, some regulations require the tapes be stored off-site, adding to the expense. The cloud provides a viable alternative to tape for long-term data archiving. Companies can periodically stream data to the cloud archive provider rather than writing it to tape. Gone are the tape libraries that take up valuable space in-house. And for those with compliance issues, the cloud provider fulfills the requirement for off-site storage. What s more, cloud offerings typically work with any type of storage system. NTT Communications is focused on providing a cloud-based archiving service that meets the most stringent compliance requirements, including the ability to generate a chain of custody document for all data. Chain of custody enables customers to prove: Where a piece of data came from That the data hasn t been changed Compliance with legal and regulatory guidelines and good practices That the record of data handling can be certified

6 In addition to guaranteeing the integrity of customer data, the NTT Communications offering will also ensure its security and availability, even under emergency circumstances. Backup and Recovery Companies can also turn to cloud services to back up data they may need more immediate access to. For companies that want the security of off-site backup without the expense of owning and operating a backup site, the cloud makes sense. Companies can backup files into the cloud and recover them on a file basis as needed. It s an ideal option for companies that have geographically dispersed locations, all with data from desktops, laptops and servers that needs to be backed up each day, or even each hour. Rather than install backup systems at each site and provide staff to manage it, data can be streamed to a cloud provider such as NTT Communications, where it is stored and managed in hardened data centers. In the event of a disaster at any one site, employees at another location, or any number of other locations, can access the data. What s more, some providers offer data deduplication services, which will reduce the amount of data that needs to be stored. Companies may be concerned about the security of data stored off-site by a third party cloud provider. But some providers also offer encryption for cloud-based backups. NTT Communications, for example, uses technology from Asigra that complies with Federal Information Processing Standard (FIPS) 140-2, the most current federal standard for encryption. Cloud-based Failover Perhaps the most exciting use of cloud technology is for failover. At one time, companies had essentially one of two choices when providing for a backup data center. One was to use a disaster recovery service provider, which provides backup data centers that customers could use in the event of a disaster at their own data center. This option entails having a backup configuration ready to go in the event of a disaster and getting current data loaded on the infrastructure, which generally takes valuable time. The other alternative is to build, own and operate your own backup data center. For large companies, this may be a viable alternative, especially if both data centers are used day to day, each with enough spare capacity to back up the other in the event of a disaster. But that essentially means that both data centers are larger than they really need to be, which makes them expensive to own and operate. In essence, the company is paying not only inflated up front capital costs for the building and equipment, but higher recurring costs for power, HVAC and maintenance as well.

7 NTT Communications believes cloud-based failover is a better option. The idea is to continuously replicate critical servers, operating systems and applications to an NTT Communications secure-hosted cloud environment. Replication takes place in real time over secure, bandwidth-efficient VPN tunnels. In the event of a server failure, scheduled downtime or a full-blown disaster, customers can initiate an auto-failover routine that redirects data and users to the cloud-hosted servers. Alternatively, customers can program the routine to kick in automatically when certain thresholds are met. Either way, end users can securely access the backup environment via the Internet from wherever they may be, including the original site if it is still available. Once the primary environment is functional again, customers can fail back the load quickly and transparently. Changed data is synchronized and users are redirected back to the original production environment, once again continuing to work without disruption, no matter their location. Customers can also initiate their own failovers and failback at their own discretion. A big advantage of such a cloud-based failover solution is it requires no up front capital investment. Instead, customers pay a monthly fee based on how many servers they want to replicate. That is a far more economical approach than building and operating a physical data center that is consistently underutilized. Using cloud-based backup services from NTT Communications multinational firms can also engineer a global disaster recovery solution. That s because NTT Communication can leverage its partner data centers in Europe, Asia and elsewhere to provide disaster recovery services virtually anywhere on the planet, backing up data from one region to another in the event of a regional disaster or keeping it all local - whatever the customer requires. A New Era The basics of an effective disaster recovery and business continuity plan haven t changed a whole lot in the last few years. Companies have always had to identify their most critical systems, establish RTO/RPO goals, make a plan for who will do what in the event of a disaster and document the plan so everybody is on the same page. But virtualization and cloud technology have changed the game in terms of the technical aspects of surviving a disaster. Virtualization dramatically simplifies the task of creating mirror images of critical servers and data, and replicating them elsewhere. Marry that with cloud technology that simplifies the process of archiving, backup and recovery, and even failover of downed servers. Suddenly, top-notch

8 disaster recovery that was once available to only to the largest companies is within reach of virtually any customer. To learn more about how to re-architect your disaster recovery and business continuity plan to take advantage of cloud technology, contact NTT America. NTT, NTT Communications, and the NTT Communications logo are registered trademarks or trademarks of NIPPON TELEGRAPH AND TELEPHONE CORPORATION and/or its affiliates. All other referenced product names are trademarks of their respective owners NTT Communications