Cloud computing gives organisations the opportunity to rethink many traditional IT practices, but it may be a particularly good fit for disaster recovery and business continuity. Network World’s John Dix caught up with IBM distinguished engineer Richard Cocchiara, who is CTO (chief technology officer) and the managing partner of Consulting for IBM’s Business Continuity and Resiliency Services, for his perspective on the subject. Cocchiara leads a worldwide team who work with clients on systems availability, disaster recovery planning, business continuity management and IT governance.
What are the different roles cloud can play in disaster recovery and business continuity?
Probably the most basic thing is backing up data off-site. Most large companies have some sort of a backup strategy, but more often than you might think we find companies that are not sending their data off-site or not sending it far enough offsite. When we ask if they have checked to see what potential regional issues they might have, sometimes they find some geological or weather or some other type of potential risk that would affect their ability to recover locally. Cloud gives them the ability to store data some place remote, store it online and to typically recover faster than from tape.
Then there are services that allow clients to fail-over servers. The cloud is very good now for Wintel servers, where you can replicate your data and fail-over relatively quickly. So in addition doing replication of data to another server, we still recommend backup because you can recover individual files to a point in time. With server replication you will fail over, but you may not be able to go back as far as you want unless you’ve got a facility such as our Virtualised Server Recovery, which allows you to take snapshots.
So the cloud gives companies backup of data, fail-over of servers and the ability to have a secondary centre far enough away to allow for regional disaster recovery. And one other thing I should mention, the cloud also gives companies the ability to store their business continuity plans off-site. I know it seems like a nit, but you’d be surprised how often business continuity plans are lost in a disaster. Those plans are critical and if they’re stored on a system in the primary centre, how are you going to run the recovery if you can’t get to that system? The cloud gives them the ability to store those plans and the notification scripts on a server they can access from their laptop anywhere they can access the cloud, like a Starbucks. And for a business continuity manager that’s critical to their success.
Larger companies take business continuity seriously and have comprehensive plans in place, but for companies that could do more, does cloud offer enough advantages to get them off the dime?
The cloud gives small and medium-sized business the same capabilities that larger companies have had for years. Many larger companies have secondary data centres they can use for data backup and recovery, whereas most smaller companies don’t. Smaller companies – with, say, 25 to 100 servers – very often back up to tape. Maybe they store the tapes locally and they may not have a sophisticated disaster recovery plan and strategy. Now, the cloud gives them same capabilities as large companies. They can back up data or replicate servers to a remote site, and then fail-over the servers and network to the remote site in the event of a disaster. So it’s giving small and medium-sized businesses much more sophistication.
How about for the higher-end folks that do have sophisticated plans in place, are they looking to the cloud as well?
For companies that have sophisticated disaster recovery architectures and strategies, introducing the cloud can be beneficial from a financial perspective and from a control perspective, because with cloud disaster recovery you get to test it more often. But larger companies are asking, ‘How do I integrate this into what I already have? I test twice a year. I take those tests and I give them to my auditors. How am I going to do this now with the cloud? And, by the way, I might have some technology that can’t be recovered into the cloud. So how do I do that?’
The larger companies need to create an integrated strategy of processes, architecture and the reporting necessary to demonstrate to auditors they have this capability. One of the benefits of having a consulting group like ours, is that we, unlike some other cloud providers where you’re on your own, can consult and create that strategy to enable cloud to work with what you have.
When you’re talking to larger companies, where do you get started?
It depends upon what they have. Some organisations are do-it-yourselfers. They have a sophisticated plan and they know how to implement it. They may say, ‘All we want from you, IBM, is your SmartCloud Managed Backup, or your SmartCloud Virtualised Server Recovery or your SmartCloud Content Manager. Just give us the cloud services and we’ll do it.’ Then we have other customers that want some help setting it up. First thing we say is, show us what plans you already have and we can work together to create the strategy, architecture, processes and procedures necessary to ensure success with integrating cloud into the disaster recovery capabilities of your company.
What are the expectations of cloud? Is it easier to set up, faster to implement, less expensive?
There are some cost implications because, remember, we’re using a cloud in a shared environment, as opposed to a customer having a dedicated technology sitting on their floor. So for some it’s a matter of OPEX versus CAPEX, and OPEX being may be a little more attractive to the customer. But, frankly, cost is only a small part of it. Companies are looking at flexibility. The flexibility to test more frequently and the ability to scale up or to scale down if needed. Those are the kinds of reasons clients are trying to introduce cloud into their environment.
Mostly we’ve been talking about backing up on-premise resources, but what if I’m already using a bunch of cloud services? Is there a role for a centralised cloud-based service to back up both premise and other cloud services?
We have been approached by companies who are using other cloud providers and they’ve asked if we can be the backup provider for that cloud data because they want to be assured they have their data in a safe and secure location regardless of what should happen. They look at us and say, ‘OK. You are BCRS. You’ve been around 50 years. You have over 160 resiliency centres around the world. You’re in 70-odd countries. I need a company that’s where I am, because data may not be able to leave the borders of certain countries. You’ve got the knowledge. You’ve done this before. Can you help me do it?’ If possible, we try to help to meet their needs.
OK, so a company that wants to start evaluating the options here, where do they start? What questions should they ask themselves?
We actually have a consulting service we provide called SmartCloud Resiliency Transformation, where we sit down with the customer and say – OK, what have you done so far? Do you have any kind of a backup and recovery service today? What’s the current strategy and architecture look like? Have you evaluated your applications? What are your processes? What are your applications? What is your technology? We start there and then start to look at the potential cloud capabilities they could harness.
Are there many instances where cloud doesn’t make sense?
There are times when it may not make sense. If you’ve got some high transaction oriented applications that are not going to respond well to being in a cloud, it may not work. However, it still makes sense for, say, backing up data. Because all you’re doing is backing up the data and recovering it. So I’m hesitant to say there are specific examples that it won’t work until we take a look at it.
OK, anything in closing?
Cloud is here to stay and more and more of our customers are going towards it. I think the adoption rate is increasing continually, and I think that cloud for disaster recovery is a viable option for a lot of clients now.
by John Dix, Networkworld