Feature: Preparing for disaster

For vendors and their partners specialising in disaster recovery planning and products, the disasters have been a severe test of their solutions. 

“The recent floods in Queensland and earthquakes in New Zealand have tested the backup strategies and disaster recovery plans of hundreds if not thousands of companies,” says Karl Sice, general manager, Pacific, for backup specialist Acronis.

What the disasters clearly show, Sice says, is that merely having an onsite backup strategy isn’t sufficient in today’s IT planning.Companies need to have a robust cloud backup solution so that when disasters happen they can still recover the critical information.

Sice says that the recently released Acronis Global Disaster Recovery Index 2011 show businesses around the world want a single backup and recovery solution for physical, virtual and cloud environments. 

In Australia, 78 percent of companies wanted this, regardless of their attitudes towards backup and disaster recovery, Sice says. This, he says, has created a golden opportunity for resellers.

“An ideal solution should be able to work across physical, virtual and cloud-based infrastructure through a single platform to reduce the complexity of data protection,” Sice says.

This is especially important for SMEs that don’t have usually have the IT resources of larger organisations. Smart resellers should look for such solutions for their customers, Sice says, as he believes that approach makes it easier for organisations to move data between different platforms.

Plans need to be tested and well-rehearsed, Sice adds. “Prepared companies run mock disaster drills. With the complex physical, virtual and cloud environments, these mock drills can help identify shortfalls in the current disaster recovery methodology and adjustments can be made to plans accordingly to improve recovery efforts before disasters strikes,” he says.

Speers says the recent devastating natural disasters in Australia and New Zealand have really hit home the critical need for IT disaster recovery plans. He notes the important points resellers need to explain to customers.

First, looking at the type of disaster they’re trying to protect their businesses from helps define the solution needed – for instance natural disasters require a different approach to human interference.

Timelines are important to establish too, Speers says. How long can the customer continue without its systems? In a disaster recovery scenario, what are the minimum immediate requirements for the first week, then the second week, and continuing onwards, he says.

“The actual data is the most critical aspect to make available immediately,” Speers says. Customers need the data first, followed by business applications. With data in hand, it can at least be manually accessed, Speers says.

While organisations are willing to spend on establishing back-up and recovery plans, the testing of these isn’t always done, Speers says.

“This is the piece we always see removed due to lack of funds and time.”Echoing Speers’ concern, Capgemini Australia’s disaster recovery test manager Anthony Woods says the recent disasters emphasise the need to test solutions and procedures. 

“Organisations tend to plan for the least likely disaster event, such as losing a data centre. A more likely scenario might be part of the data centre that is lost, or just three crucial servers,” says Woods.

Capgemini does end to end testing and assessment of organisations’ disaster recovery plans and gives customers a probability of these succeeding should disaster strike, Woods says.

The consultancy’s director of its testing services group, Shane Parkinson, explains that disaster recovery plans are like insurance policy. “Like life insurance, it’s not something that you want to draw on but if you have to, you want the policy to be in order.

”Woods points out that University of Texas research shows that only six percent of companies that suffer a major data loss survive after a disaster. Unfortunately, a disaster recovery plan may not be enough to guarantee survival after a disaster.

Parkinson and Woods explain that a range of factors must be looked at, such as the staff in charge, if documentation is up to date (usually, it won’t be) and if the systems in question have changed over time. Will the DR recovery tasks actually work as supposed to? 

“I’m always surprised when I hear of hard disk failures, which should be easy to recover from,” Parkinson says. They are, except in many cases, the backup procedure for the disk storage system may have been out of action for months at times and there’s nothing to recover from.

Hence, testing becomes vital for validating a business’ disaster recovery solution, and not when a catastrophe occurs.

Parkinson says over-reliance on cloud computing and data storage could also be dangerous. As Christchurch, Brisbane and Japanese businesses found out, having everything in the cloud when your infrastructure is inaccessible – or even disappears – makes recovery tremendously hard.

Furthermore, Parkinson says a balanced view of the IT systems in an entire organisation is required. Traditional disaster recovery has focused on backing up data on a per-system basis.

However, as today’s systems have grown large and more complicated over the years this may not be sufficient to ensure business continuity as data in one system that others depend on may become unsynchronised, not processed or simply disappear during the downtime.

“I dread to think how some large organisations with multiple complex systems will cope based on what I’ve seen of their disaster recovery planning,” Parkinson says.