Disaster recovery is evolving with virtualisation
technology becoming a mass market solution that is available to clients who
previously could not afford it. Companies should do a health check to make sure
that their disaster recovery solution still meets their needs, advise Garry
Southway and Chris Eaton from MCS.
A lot of organisations put in disaster recovery
solutions some time ago and typically this would not have been tested since
Hurricane Ivan in 2004. The question is whether it is still fit for purpose,
says Garry Southway, VP Core Technologies at MCS.
An investigation and design put together several years
ago will have captured what an organisation had in applications and addressed
the recovery point and time objectives, how much data will be recovered and how
quickly, at the time.
“There might be a whole plethora of applications that
are not in the disaster recovery plan and not in the disaster recovery solution
simply because they have been installed recently or forgotten about,” he says.
Or the recovery time or recovery point objectives for
the previously installed applications may have changed. In some cases the
system may have been tested regularly, as it is best practice, but that is not
necessarily always the case.
It is important to ensure that these are still
appropriate and a health check of one’s disaster recovery environment can
achieve this, Southway advises.
Such a disaster recovery health check does not have to
be extensive. “It does not have to be a three week engagement testing every
application; it is more of a sanity check of the environment that a client has
to make sure it still works.”
This would include testing one or more single
applications to determine whether they are able to perform in the way they
Barriers of entry are coming down
In addition to new applications or new objectives that
may be part of the disaster recovery plan, the virtualisation technologies used
for disaster recovery have also evolved and are in many cases much cheaper and
therefore more accessible than they were just 12 or 18 months ago, says Chris
Eaton, VP sales and marketing at MCS.
The trend in Cayman for some of the smaller clients
that maybe did not have the budget or the appetite for disaster recovery is
that nowadays there is a solution for everyone, adds Southway.
This may not be on the same scale as for the
enterprise clients, who might be using storage area network or what they call
SAN to SAN replication.
But there is a cheaper solution using a host-based
application that might be useful for some of the smaller clients in Cayman. And
Cayman has a lot of small clients that have no disaster recovery that become
more reliant technology, he says.
Doubletake is one example of a product that can be
“The model is that in your live environment, you can
have multiple physical servers and you replicate them to your DR site to one
physical server that has virtualised instances on it,” Southway explains. “It is
a many to one relationship and because of that you only have to buy one server,
which is obviously cheaper than what you have got in your production
As even the smallest offices in Cayman with only 20 or
30 people might have five or six physical servers in their production
environment for everything from the security system to email and any line of
business applications, the idea of having to spend the same money again on a DR
solution was off-putting in the past. Many businesses may not be aware that it
is actually no longer needed.
Southway says one can “get away these days with buying
a fairly decent physical server, on which you can virtualise multiple instances
of logical servers. For quite a small investment you can have a DR solution.”
This means that while in the past the barrier to entry
may have been $75,000 this has more than halved because the like-for-like
duplication of the production environment and the disaster recovery environment
is not the only solution, Eaton says.
“Virtualisation technologies were considered leading
edge not that long ago whereas today you have mass market adoption. More people
are familiar with it and realise they can use it for DR.”
Prices have also come down because vendors have caught
on to virtualisation as a mass market product, while they were previously
solely targeting enterprise clients, adds Southway. They now realise there is a
whole new market that previously they have been pricing themselves out of. This
removes the cost objection for a large number of small and medium businesses as
the price point for putting an effective DR solution in place has halved in 12
to 18 months.
Even in the physical storage area network space prices
are coming down and larger capacities in terms of disk space are available for
the same price.
The same applies to communications costs, where there
has been some reduction in the cost of bandwidth, mainly as a result of more
But despite this, the rate of development is not as
fast and certain limitations remain, which means that solutions like Riverbed
for compressing and maximising bandwidth still have their uses.
One of the challenges is that it is difficult in
practice to swap Internet service providers. The other factor is that
off-island bandwidth in Cayman is still limited, while data is growing at an
exponential rate and so are people’s bandwidth requirements, notes Southway.
“That is the challenge for us. If you do SAN to SAN
replication you have to use technologies like Riverbed to trick the SANs into
thinking that they have got more bandwidth than they actually do.”
The result is a less elegant, asynchronous solution.
While a synchronous solution would write data to the production site and the DR
site, it will only show the user that the write to the DR site has been
successful after it has been executed.
In an asynchronous solution the fact that there is a
cue or time lag for data to be written to the DR site has to be accepted to get
a sharper response.
“Everyone is now moving to asynchronous because it is
an accepted risk,” says Southway.
On-island solutions may still be viable
Yet on-island DR solutions are still viable and many
MCS clients have both.
“You have to ask yourself what you are mitigating
against? Where are your people and how do you react to an event?” asks Eaton.
While we are understandably fixated on hurricanes,
there are other disasters – like a fire in a server room – that still need to
be part of the business continuity and DR plan.
“Local solutions can make perfect sense for things
like that and local solutions can also make sense for some organisations as
part of their hurricane planning,” he says. “One of the lessons that we all
learned in Ivan is that is that it was the human assets and the human capital
in the business that acted in unexpected ways. If your staff is going somewhere
else anyway, does it make sense for your systems to still be in Cayman in the
event of a hurricane?”
Your plan needs to think about where your people and
your systems are, he advises.
Access to data
Access to the data and the system is something that is
often forgotten, adds Southway. It is also an area that has seen some
developments in the past 18 months.
“There are a lot more elegant solutions that allow
accessibility of both the applications and the data,” he points out. “It used
to be just CITRIX and that was the only game in town. CITRIX had to improve and
evolve because there are other vendors fighting for that virtual desktop
The other development is that new devices such as
smartphones have become more common.
“The days of having a pre-built laptop with all your
applications are over. All you need is a smartphone and an SSL based VPN, which
means I could use my sister’s computer to access the network in a secure
manner,” says Southway.
What follows from this evolution is that there is no
longer a reason financial services organisations should not have a DR solution
nowadays, he concludes.
“If you are an organisation in retail, you may not
need a DR solution because if your inventory is gone the data is the least of
your worries. But as a financial services organisation, your clients may be
sympathetic for a day but then on the following day they want their NAV return
or their statements updated.”
Southway says reputation is another good reason why
organisations should adopt a DR solution.
Even the ones that have a DR solution in place need to
ensure that it is still passes the laughter test, adds Eaton. “Taking a tape
back-up on a plane and hoping that it is going to work when you have gone off
island, may have been appropriate a few years ago, but it no longer is today.”