Cloud has been the buzzword in the IT industry for some time, but is it always the right solution for disaster recovery? Garry Southway, VP of Core Technologies at MCS explains when it makes sense.
Disaster recovery encompasses a wide range of solutions from simply backing up data on tape at one end of the spectrum to complex real time replication, where the production environment of a business is connected to and replicated with a separate set of identical servers, systems and applications at a disaster recovery site, at the other end.
Depending on an organisation’s recovery time objective (RTO), how quickly a company wants to be back online after a disaster, and recovery point objective (RPO), the age of files that must be recovered from back-up for normal operations to resume, different solutions on the scale become more or less viable.
Cloud computing, the delivery of computing and storage capacity as a service for a monthly fee, has entered the market and now provides businesses with the option to replace some of their server hardware with a cloud based solution.
Cloud with a chance of rain?
“Cloud is an excellent marketing message and everybody thinks it will be the great leveller but there are a lot of considerations that people need to take into account,” says Southway. “Basically cloud means you don’t have to buy the hardware.”
But businesses still have to buy the software and manage and maintain the systems in the cloud. In comparison to the total cost of IT, the cost of the hardware and thus the hardware savings in a cloud solution are normally quite small, he argues.
Technically the cloud allows the replication of a company’s work environment that would also lend itself to disaster recovery (DR). However, when compared with the accepted DR solution of buying and maintaining hardware and systems at a recovery site which synchronises the data from the workplace at regular intervals or in real time, the running costs of a cloud based solutions may not be attractive, says Southway.
MCS clients who want to renew or refresh their DR solution now ask for both financial options, he adds, insisting it makes no difference which option is chosen for the services his firm provides.
“But if you do a cost of ownership exercise, arguably the cloud would almost certainly end up more expensive. That’s what we found. If you do a three year cost of ownership exercise, then as things stand at the moment the cloud does not stack up as a business case for the majority of organisations.”
Given that the true cost of computing, including the licensing, managing and maintaining of systems, is three to four times higher than the cost of the hardware, cloud solutions must be cost effective to enable any savings. Yet both the cost of licences, for example Microsoft’s SPLA licences for the cloud, and the cost of bandwidth, particularly in the Cayman Islands, can still be relatively high.
“So what the cloud is addressing is the first rung on the ladder of the IT costs, which is the capital investment. There are bigger problems, which we would like the cloud to see take care of.”
Southway says the cost of monthly SPLA licenses is still high compared with owning the licence outright. In addition to the cost, cloud service providers are also not able to provide the licensing on a permanent basis for all the vendors.
The other issue that limits the use of cloud in the production environment, especially in Cayman, is the speed and the cost of the connection. “If you put your DR solution in the cloud you are definitely relying on bandwidth being available,” he says. “It needs to be fast enough and at an affordable price, so that you don’t save money in your hardware purchase but then you have to pay more on bandwidth on a monthly basis.”
Although there are technologies that help speed up bandwidth by compressing the transferred data, they are also relatively costly.
“If clients have aggressive recovery point and time objectives and want the real time replication they never pick cloud due to bandwidth costs,” says Southway, adding that this type of cloud offering needs to further mature.
But cloud still has a role to play
There are however scenarios where disaster recovery using the cloud is a viable option. Especially the middle ground of DR solutions that fall into the category of enhanced back-up can be attractive in combination with the cloud.
“Enhanced back-up has a role to play in organisations that either cannot afford the cost associated with real time replication or they have a more relaxed recovery time and recovery point objectives,” says Southway.
Instead of reinvesting in DR and replication and incurring a high capital outlay again, these clients can spend about half of the cost and will get a solution that may not be as good as real time replication but good enough for their purposes.
Companies that do not have the capital for an expansive DR solution or that want a short-term solution and delay a larger capital investment might also opt for the cloud.
MCS offers a disaster recovery solution that integrates offshore cloud services with a back-up based technology that is suitable for companies that have a more relaxed recovery time objective of two days or more. In other words these companies can still do their primary line of business after a disaster without a recovery for a couple of days.
“These clients don’t have to spend a lot of time, effort and money managing the equipment at the DR site. What happens is as and when they need it, they effectively take the back-ups and restore them,” explains Southway. “So it is not real time DR, but it is quick recovery. It might take two days to get the systems back up and running but it is a lot better than three weeks or no DR solution at all,” he says. “If two days is not a problem the cloud may be a good solution.”
Test the systems now
MCS also recommends that organisations that already have a disaster recovery solution in place need to test their DR plan and systems at least two to three times per year.
Southway says DR systems cannot be left alone in the hope that they will work when needed; the disaster recovery site need to be operated, managed and maintained. A first set of checks are required to ensure that the system has been maintained and is operational and a second series of tests should verify that the DR processes are fit for purpose.
This involves users going through a normal day, running the system as they normally would, for instance adding clients, running client reports or amending client details.
These tests often find that upgrades were made to applications in the production environment but not at the DR site or that certain applications have found their way into the business and are not yet included in the DR plan. “It can also happen that the IT team is not included in business process changes,” he says. “You might have brought in a new business or part of a business or opened a new office and that has not been covered by your DR plan.”
DR tests have not only the benefit that they will uncover areas that should have been included. They will also ensure that all the members of the IT team and different users in the business familiarise themselves with the DR procedures. Southway adds that the tests also take care of training issues. When different users are involved in a real life test scenario every time, they will be able to train the rest of their department.
MCS recommends at least one test at the beginning of hurricane season and one at the end to determine whether any improvements can be made as well as to identify and incorporate any changes that have taken place during the previous six months.