IBM Global Technology Services How to integrate cloud-based disaster recovery into your existing business continuity plans Richard Cocchiara: IBM Distinguished Engineer; CTO IBM Business Continuity & Resiliency Services (BCRS); Executive IBM Resiliency Consulting Services downtime, regardless of the type of interruption. IT budgets are flat, however there is increased business need for shorter recovery times Cloud is being adopted for DR because it offers faster recovery than traditional approaches. Most IT departments do not have the skills required to integrate cloud into their DR plans. A systematic approach is required to transition applications to cloud-based DR and to integrate cloud and traditional approaches. 2 2 IT departments are facing pressures due to increasing volumes of data, intensifying regulatory requirements and expectations for continuous business operations. And external threats are increasing globally, with economic losses from all types of disasters escalating rapidly. 2012 Natural Catastrophes The amount of information managed by enterprise data centers is expected to increase by at least 50 times over the next decade 1 2010 50x 2020 40 Zettabytes* The average cost per hour of system downtime is increasing as more business operations become automated 2 $110K $182K *Zettabytes equals 1 trillion gigabytes 2010 2012 Average cost of one hour of downtime 1. Source: IDC Digital Universe Study, June 2011 2. Source: Source: Münchener Rückversicherungs-Gesellschaft, Geo Risks Research, NatCatSERVICE, January 2013 3 4
Protecting business-critical data, applications and operations against downtime and disruptions is crucial for every organization. reputation its most valuable corporate asset at risk. Would your company survive a major outage? Why you are increasingly vulnerable: Increasingly high volumes of data, applications Geographically-dispersed facilities Evolving industry and government regulations Expectations and demands from stakeholders Why a robust resilience solution: Support continuous data and operational availability Improve your competitive position and reputation Improve operational efficiency Reduce risk Download the full study report ibm.com/services/riskstudy IT risks* have a major impact reputation Companies have rising IT risk concerns related to emerging technology trends Companies are integrating IT risk and reputational risk management, with strongest focus on threats to data and systems business and must be given due C-level executive, Malaysian agriculture and agribusiness company *IT Risk Source: ISACA Information Systems Audit & Control Association, June 2011 5 6 6 The study shows a clear mismatch between how well companies rate their reputation and how well they are protecting it. 80 % rate reputation as excellent or very good Business resiliency is directly related to the top IT risk factors to an 17 % manage IT risk as very strong There is room for improvement in almost every organization Source: 2012 Reputational Risk and IT Study, a report by the Economist Intelligence Unit commissioned by IBM Source: 2012 Reputational Risk and IT Study, a report by the Economist Intelligence Unit commissioned by IBM 7 8
IT risk management planning and cloud-based managed services can help organizations mitigate and respond to these IT risks. fluctuating business needs with innovative technology solutions Planning, Design & Implementation Cloud-based Managed Services How Important Was Improved Disaster Recovery And Business Continuity Data Protection Services IT Risk Assessment Services Business Continuity Assessment Services Cloud Resiliency Planning, Design & Implementation Services Disaster Recovery Services Source: Cloud-Based Disaster Recovery Barriers And Drivers In The Enterprise, A Custom Technology Adoption Profile Commissioned By IBM (Mar 2012) 9 10 With flat IT budgets, increasing pressures to minimize downtime are causing a need to solve gaps with new technologies. Cloud-based business resilience is designed to help you economically and securely meet changing business needs for recovery, continuity and availability. Cloud solutions can economically fill this gap Differentiators Increased security and privacy Flexibility Availability Agility Proof points Helps identify physical assets as a delivery model for added security and privacy Business model not focused on data mining or advertising World-class delivery from IBM helping to improve resiliency and security Delivery models tailored to your business Scalability Pay-as-you-go pricing model Workloads that can evolve with the needs of the business Integration with traditional environments and other cloud environments Portability your data is your data; your workloads are your workloads IBM enterprise-class data center experience IBM data center networking and configuration to help provide connectivity Rapid provisioning of new services Service management automation to help enable more effective self-service Source: Transitioning business continuity to the cloud Choice of Delivery models Operating systems Software environment Enabled by open standards 11 12 12
Certain challenges are slowing the adoption of cloud-based resilience by a broader community. IT skills gap: the transition to cloud-based DR requires knowledge and application of many different technologies Virtualization Cloud Networking (this is a critical skill in order to properly define bandwidth requirements) Application- should be moved to cloud-based DR (aka application tiering) Changes to management and legacy recovery processes must be documented IT, business, and recovery teams must be educated on new processes The type of cloud deployment (public, private, hybrid) must be defined Concerns about security, compliance, and control issues in the cloud must be addressed To learn more, visit the IBM booth to see the results of a recent study conducted by Forrester Research: Cloud-Based Disaster Recovery Barriers And Drivers Identify the resilience tiers with the greatest affinity for cloud resilience Adapt your business continuity management program to govern cloud and noncloud environments Adjust your business continuity procedures for cloud technology recovery Update or create documented IT disaster recovery plans Integrate your existing plans with the new cloud environment Define you network requirements Plan for no connectivity It is common to see a false sense of security among cloud consumers regarding disaster recovery planning. Just because businesses are outsourcing the infrastructure (IaaS), applications (SaaS), or platforms (PaaS) to the cloud does not absolve them of the need for serious disaster planning. Reference: Practical Guide to Cloud Service Level Agreements, 2012 Cloud Standards Customer Council 13 14 A systematic approach to adopting cloud-based resilience reduces transition and adoption time and helps you realize benefits faster. Transition to cloud-based disaster recovery starts with data discovery and requirements definition. Step 1: Strategy Collect key business resilience requirements data on application and data dependencies. Profile existing applications, governing policies, strategies and plans. Understand the business direction, and identify and document the resilience requirements. Analyze workloads to determine which applications and data have the greatest affinity to cloud recovery. Determine the most appropriate cloud resiliency delivery model. Understand the potential network latency, and define the cloud architecture that will support the resiliency requirements. Ascertain legacy resiliency processes that may need to change, including plans, policies and procedures such as training and communication. 15 16
The next step is to build a transformation strategy and develop a design. The third step is to understand migration, standardization and registration issues. Design and construct the transition plan, being mindful to manage the different application-specific SLA's. Help manage quality, security and compliance. Integrate resilience cloud solution and legacy recovery into one cohesive picture determined by which of the traditional processes in the organization needs to be preserved. Update policies and procedures, and identify and document changes to management and legacy recovery processes. Run a pilot program in which the initial installation or instance is convened at a test center and subsets are tested. Educate all personnel so that they are well versed in the new environment, including how to use the cloud-based services, what changes have been made to recovery procedures and the use of the recovery and testing portal. Hands-on supported transition provides education through example rather than by trial and error. Step 2: Design proposed resilience tiers placement, architectural diagrams, and executable transition plan Deploy the new solution. The move begins, validating each new service until the enterprise is confident that it can manage it. Step 3: Transition Provision target resilience environment. Using methods and tools, we automate, virtual or physical servers for recovery and configure the workload for resilience testing. 17 18 The final step is remediation, testing and workload transition to cloud-based disaster recovery. There are many cloud options to evaluate that can be leveraged effectively to meet your business resilience needs. The solution team supporting the transformation should help manage the either as a dedicated or shared resource Monitoring key performance indexes (KPIs) allows the organization to optimize system response time or other performance attributes. The network, servers, storage capacity and productivity are tweaked to exploit their full potential. Testing is a critical aspect of the transformation phase. The cloud-based solution must be able to be integrated with the existing resilience testing program. Step 4: Transformation Test the resilience strategy, gain customer acceptance, and perform transfer to ongoing management. Cloud computing has unique attributes that drive value, flexibility, and scalability: ever-present, convenient, on-demand network accessibility shared pool of configurable computing resources rapid provisioning and release of computing resources minimal management effort or service provider interaction Manage it Yourself Create virtualized, scalable cloud environment to backup and recover your traditional data center services across several service tiers. Three types of cloud resiliency scenarios Hybrid Cloud Blend private and public cloud services to meet your business demands for agility as well as risk appetite for sensitive applications and data. Resilience as a Service Subscribe to cloud environment that you buy on -per- varying rates based upon resilience requirements for appropriate data services. 19 20
The result is a cloud based resilience solution customized to your unique needs for recovery, continuity and availability. Observations and recommendations. Resilience Tiers including technical requirements for: Security Data latency tolerance Network bandwidth optimization Testing requirements Architectural drawings and work products that describe the solution Recommended actions to integrate your program with legacy recovery solutions and changes required to policies, plans and procedures Transition Plan describing the implementation steps and changes needed to support resilient cloud Recovery Test Plan describing the test goals and use cases to validate the resilience cloud File Plan (optional) that describes data and hardware that can be re-provisioned or retired Transformation services to help you transition to your customized resilience cloud Cloud is here to stay and is a viable option for disaster recovery Not all platforms or applications will be in the cloud, so you need to integrate traditional DR and cloud-based DR A structured approach is needed to understand the company architecture and the best way to integrate Identification of appropriate workloads for cloud is key Create a workable implementation plan that provides adequate time for adoption Experience matters when choosing a consulting or cloud managed services partner most of the DR fundamentals still apply (i.e. testing) 21 22 Here are three steps you can take to start to improve your recovery times. Hot off the press! Findings from the 2013 Reputational Risk Study. Learn about cloudbased disaster recovery. Understand how cloud-based disaster recovery can offer significant benefits over traditional disaster-recovery methods. Consider an IBM SmartCloud Resilience Consulting engagement to begin to transition to the cloud. Increasingly, the Chief Digital Officer will own reputational risk X As cybercrime escalates, so will reputational risk Social media is the best tool you have to minimize reputational damage Reputational risk will become a primary justification for IT investment Watch the video Download the following: The case for cloud-based disaster recovery Q&A with SmartCloud VSR experts SmartCloud VSR white paper Download the paper Transitioning business continuity to the cloud Your with your security and continuity standards will be mandated 23 24
Copyright information Thank you ibm.com/services/continuity Richard Cocchiara IBM Distinguished Engineer rmcocch@us.ibm.com 1-845-496-1478 Copyright IBM Corporation 2013 IBM Global Services Route 100 Somers, NY 10589 U.S.A. Produced in the United States of America February, 2013 All Rights Reserved IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in owned by IBM at the time this information was published. Such trademarks may also be registered or common law Copyright and trademark information Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Other company, product and service names may be trademarks or service marks of others. Use of the information herein is at the recipient's own risk. Information herein may be changed or updated without notice. IBM may also make improvements and/or changes in the products and/or the programs described herein at any time without notice. References in this publication to IBM products or services do not imply that IBM intends to make them available in all countries in which IBM operates. 25 26