Disaster Recovery

In a post-9/11 world it is amazing how few businesses have DRPs, BCPs, or COOPs, or even know what they are. Success or failure is dependent on an increasingly complex series of electronic devices that are hyper sensitive to temperature, moisture, and the people who rely on them—all subject to natural and man-made disasters. Disaster Recovery Plans (DRPs) are an integral part of wider Business Continuity Plans (BCPs) or Continuity of Operations Plans (COOPs).

All too often these are formulated after disaster has struck—and if the data loss is severe, statistics show that affected businesses close their doors within a year. Since it costs, on average, 4% of the IT budget to design and develop BCPs, wisdom dictates closing the barn door before the horse gets out.

An audit of all assets is a good first step, along with determining the scope of the BCP. Computers and routers are only part of business continuity—there are human roles to consider as well as site requirements. In the 1990s a seven tier scale was developed to help IT departments better understand disaster recovery and risk versus costs.

Unfortunately, most businesses are somewhere between tier zero and one without even knowing it. Moving to the next level requires another location, duplicate hardware and relatively recent backups of all your data—not an inexpensive proposition. This is where RTO and RPO come in. One discussion point to be brought up with ownership or senior management is to ask how long can the organization be down before revenues suffer? (Recovery Time Objective). How much data is the business willing to recreate if there is a disaster? (Recovery Point Objective). If the answer is none and none, it may be time to discuss a tier-seven solution.

If lives are at stake, tier seven may be the only choice. For the rest of us there are ways to make tier one smarter without breaking the bank. Start with the basics—what sort of measures are in place to prevent disaster? Firewalls, battery backups, and anti virus are the minimum. A robust backup system and data disks or tapes that are taken offsite can be had for relatively cheap, even if it is to another office or safety deposit box. A backup generator is expensive, but well worth it. Testing the generator and backups is tedious, but important.

Environmental factors are key as well. APC, a company that manufactures an entire line of power conditioners and UPS products, also makes appliances that can monitor temperature, humidity, water levels, and access to your data center, with automated emails to report on status. One of the hardest issues for small to medium-sized businesses to get a handle on is cooling. HVAC has to keep up with hardware that gets smaller, faster, (and therefore hotter) every year. When it breaks, fixing it is a long and expensive proposition.

With the advent of virtualization, products like VMware have created opportunities to create versatile, centralized, multi-role servers that allow for efficiency and economies of scale that were out of reach of most businesses even five years ago. Along with virtual servers, SAN/NAS storage vendors like EMC, NetApp and Equallogic offer solutions to synch data in real time or on a scheduled basis over WAN connections. Symantec continues to lead in the backup arena with products like NetBackup and Backup Exec System Recovery, which can make a snapshot of a running server and, if it fails, restore it to different hardware in a short period of time.

Finally, no amount of equipment and facilities will compensate for an unprepared IT staff that doesn't know what to do or have the proper information available in the event of an emergency. Common failure scenarios need to be identified and practiced – you will be surprised at what you took for granted.

Regardless of your choices, there is always the possibility of down time and the potential for lost data, unless you can provide multiple levels of redundancy for all your hardware. A second complete datacenter waiting for the next disaster may not be in your budget, but planning for it and lots of practice should be.