how to integrate cloud-based disaster recovery into your ... · adapt your business continuity...

© 2013 IBM Corporation

How to integrate cloud-based disaster recovery into your existing business continuity plans

Richard Cocchiara: IBM Distinguished Engineer; CTO – IBM Business Continuity & Resiliency Services (BCRS); Executive – IBM Resiliency Consulting Services

IBM Global Technology Services

© 2012 IBM Corporation© 2013 IBM Corporation

IBM Business Continuityand Resiliency Services

22

Summary of today’s session.

� Today’s business environment does not allow

downtime, regardless of the type of interruption.

� IT budgets are flat, however there is increased

business need for shorter recovery times

� Cloud is being adopted for DR because it offers

faster recovery than traditional approaches.

� Most IT departments do not have the skills required

to integrate cloud into their DR plans.

� A systematic approach is required to transition

applications to cloud-based DR and to integrate

cloud and traditional approaches.



3

IT departments are facing pressures due to increasing volumes of data, intensifying regulatory requirements and expectations for continuous business operations.

*Zettabytes equals 1 trillion gigabytes

The amount of information managed by enterprise data centers is expected to increase by at least 50 times over the next decade1

2010

2020

40 Zettabytes*

50x

2. Source: Aberdeen Group: “Datacenter Downtime: How Much Does it Really Cost?,” March 2012

$110K

2010 2012

$182K

The average cost per hour of system downtime is increasing as more business operations become automated 2

1. Source: IDC Digital Universe Study, June 2011

Average cost of one hour of downtime


© 2012 IBM Corporation© 2013 IBM Corporation4

And external threats are increasing globally, with economic losses from all types of disasters escalating rapidly.

Source: Münchener Rückversicherungs-Gesellschaft, Geo Risks Research, NatCatSERVICE, January 2013

2012 Natural Catastrophes



55

Protecting business-critical data, applications and operations against downtime and disruptions is crucial for every organization.

Would your company survive a major outage?

� Increasingly high volumes of data, applications

� Geographically-dispersed facilities

� Evolving industry and government regulations

� Expectations and demands from stakeholders

� Support continuous data and operational availability

� Improve your competitive position and reputation

� Improve operational efficiency

� Reduce risk

Why you are increasingly vulnerable: Why a robust resilience solution:



IT risks like system outages and data loss can put an organization’s reputation – its most valuable corporate asset – at risk.

“IT and reputational risk management and mitigation are… key success factors of our business and must be given due emphasis.” C-level executive,

Malaysian agriculture and agribusiness company

IT risks* have a major impact on a company’s

reputation

Companies have rising IT risk concerns related to

emerging technology trends

Companies are integrating IT risk and reputational risk management, with strongest

focus on threats to data and systems

Download the full study report ibm.com/services/riskstudy

*IT Risk is “The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise.” Source: ISACA – Information Systems Audit & Control Association, June 2011



The study shows a clear mismatch between how well companies rate their reputation and how well they are protecting it.

80%rate reputation as excellent or very good

rate their company’s overall ability to manage IT risk as very strong

There is room for improvement in almost every organization

Source: 2012 Reputational Risk and IT Study, a report by the Economist Intelligence Unit commissioned by IBM

17%

7



8

Business resiliency is directly related to the top IT risk factors to an organization’s reputation.

Source: 2012 Reputational Risk and IT Study, a report by the Economist Intelligence Unit commissioned by IBM



Planning, Design & Implementation

� IT Risk Assessment Services

� Business Continuity Assessment Services

� Cloud Resiliency Planning, Design &

Implementation Services

IT risk management planning and cloud-based managed services can help organizations mitigate and respond to these IT risks.

Cloud-based Managed Services

� Data Protection Services

� Disaster Recovery Services



10

Pressures to do ‘more with less’ drive IT decisions to meet fluctuating business needs with innovative technology solutions

How Important Was Improved Disaster Recovery And Business Continuity In Your Firm’s Decision To Adopt The Following?

Source: Cloud-Based Disaster Recovery Barriers And Drivers In The Enterprise, A Custom Technology Adoption Profile Commissioned By IBM (Mar 2012)



11

With flat IT budgets, increasing pressures to minimize downtime are causing a need to solve gaps with new technologies.

Cloud solutions can economically fill this

gap

Source: Transitioning business continuity to the cloud



12

Cloud-based business resilience is designed to help you economically and securely meet changing business needs for recovery, continuity and availability.

Differentiators Proof points

Increased security and privacy

�Helps identify physical assets as a delivery model for added security

and privacy

�Business model not focused on data mining or advertising

�World-class delivery from IBM helping to improve resiliency and security

Flexibility �Delivery models tailored to your business

�Scalability

�Pay-as-you-go pricing model

�Workloads that can evolve with the needs of the business

�Integration with traditional environments and other cloud environments

�Portability—your data is your data; your workloads are your workloads

Availability �IBM enterprise-class data center experience

�IBM data center networking and configuration to help provide connectivity

Agility �Rapid provisioning of new services

�Service management automation to help enable more effective self-service

Choice of �Delivery models

�Operating systems

�Software environment

�Enabled by open standards



1313

Certain challenges are slowing the adoption of cloud-based resilience by a broader community.

� IT skills gap: the transition to cloud-based DR requires knowledge and

application of many different technologies � Virtualization

� Cloud

� Networking (this is a critical skill in order to properly define bandwidth requirements)

� Application-specific SLA’s must be defined in order to identify which applications

should be moved to cloud-based DR (aka application tiering)

� Changes to management and legacy recovery processes must be documented

� IT, business, and recovery teams must be educated on new processes

� The type of cloud deployment (public, private, hybrid) must be defined

� Concerns about security, compliance, and control issues in the cloud must be

addressed

To learn more, visit the IBM booth to see the results of a recent study conducted by Forrester Research: Cloud-Based Disaster Recovery Barriers And Drivers



14

So you’re ready to use cloud for DR. Are you ready to…

� Provide disaster recovery services for production data that’s in the Cloud

� Identify the resilience tiers with the greatest affinity for cloud resilience

� Adapt your business continuity management program to govern cloud and non-

cloud environments

� Adjust your business continuity procedures for cloud technology recovery

� Update or create documented IT disaster recovery plans

� Integrate your existing plans with the new cloud environment

� Define you network requirements

� Plan for no connectivity

It is common to see a false sense of security among cloud consumers regarding disaster recovery planning. Just because businesses are outsourcing the infrastructure (IaaS), applications (SaaS), or platforms (PaaS) to the cloud does not absolve them of the need for serious disaster planning.

Reference: Practical Guide to Cloud Service Level Agreements,2012 Cloud Standards Customer Council



15

A systematic approach to adopting cloud-based resilience reduces transition and adoption time and helps you realize benefits faster.



16

Transition to cloud-based disaster recovery starts with data discovery and requirements definition.

� Step 1: Strategy

Collect key business resilience requirements data on application and data dependencies. Profile existing applications, governing policies, strategies and plans.

� Understand the business direction, and identify and document the resilience requirements.

� Analyze workloads to determine which applications and data have the greatest affinity to cloud recovery.

� Determine the most appropriate cloud resiliency delivery model.

� Understand the potential network latency, and define the cloud architecture that will support the resiliency requirements.

� Ascertain legacy resiliency processes that may need to change, including plans, policies and procedures such as training and communication.



17

The next step is to build a transformation strategy and develop a design.

� Step 2: Design

Identify candidates with “cloud resilience affinity”. Perform financial analysis, proposed resilience tiers placement, architectural diagrams, and executable transition plan

� Design and construct the transition plan, being mindful to manage the different application-specific SLA's.

� Help manage quality, security and compliance.

� Integrate resilience cloud solution and legacy recovery into one cohesive picture determined by which of the traditional processes in the organization needs to be preserved.

� Update policies and procedures, and identify and document changes to management and legacy recovery processes.



18

The third step is to understand migration, standardization and registration issues.

� Run a pilot program in which the initial installation or instance is convened at a test center and subsets are tested.

� Educate all personnel so that they are well versed in the new environment, including how to use the cloud-based services, what changes have been made to recovery procedures and the use of the recovery and testing portal. Hands-on supported transition provides education through example rather than by trial and error.

� Deploy the new solution. The move begins, validating each new service until the enterprise is confident that it can manage it.

� Step 3: Transition

Provision target resilience environment. Using methods and tools, we automate, virtual or physical servers for recovery and configure the workload for resilience testing.



19

The final step is remediation, testing and workload transition to cloud-based disaster recovery.

� The solution team supporting the transformation should help manage the organization’s environment remotely—either as a dedicated or shared resource depending upon the client’s requirements.

� Monitoring key performance indexes (KPIs) allows the organization to optimize system response time or other performance attributes. The network, servers, storage capacity and productivity are tweaked to exploit their full potential.

� Testing is a critical aspect of the transformation phase. The cloud-based solution must be able to be integrated with the existing resilience testing program.

� Step 4: Transformation

Test the resilience strategy, gain customer acceptance, and perform transfer to ongoing management.



20

There are many cloud options to evaluate that can be leveraged effectively to meet your business resilience needs.

� Cloud computing has unique attributes that drive value, flexibility, and scalability:– ever-present, convenient, on-demand network accessibility

– shared pool of configurable computing resources

– rapid provisioning and release of computing resources

– minimal management effort or service provider interaction

Resilience as a Service

• Subscribe to cloud environment that you buy on a “pay-per-use” basis with varying rates based upon resilience requirements for appropriate data services.

Manage it Yourself

• Create virtualized, scalable cloud environment to backup and recover your traditional data center services across several service tiers.

Hybrid Cloud

• Blend private and public cloud services to meet your business demands for agility as well as risk appetite for sensitive applications and data.

Three types of cloud resiliency scenarios

Source: Based on National Institute for Science and Technology (NIST) definition of “cloud computing”



2121

The result is a cloud based resilience solution customized to your unique needs for recovery, continuity and availability.

� Resilience Tiers including technical requirements for:

– Security

– Data latency tolerance

– Network bandwidth optimization

– Testing requirements

� Architectural drawings and work products that describe the solution

� Recommended actions to integrate your program with legacy recovery

solutions and changes required to policies, plans and procedures

� Transition Plan describing the implementation steps and changes needed to

support resilient cloud

� Recovery Test Plan describing the test goals and use cases to validate the

resilience cloud

� File Plan (optional) that describes data and hardware that can be re-

provisioned or retired

� Transformation services to help you transition to your customized resilience

cloud



2222

Observations and recommendations.

� Cloud is here to stay and is a viable option for disaster recovery

� Not all platforms or applications will be in the cloud, so you need to integrate traditional DR and cloud-based DR

� A structured approach is needed to understand the company

architecture and the best way to integrate

� Identification of appropriate workloads for cloud is key

� Don’t forget about compliance

� Create a workable implementation plan that provides adequate time for adoption

� Experience matters when choosing a consulting or cloud managed services partner – most of the DR fundamentals

still apply (i.e. testing)



23

Here are three steps you can take to start to improve your recovery times.

Watch the video

Learn about cloud-based disaster recovery.

Understand how cloud-based disaster recovery can offer

significant benefits over traditional disaster-recovery methods.

Consider an IBM SmartCloud Resilience Consulting engagement to begin to transition to the cloud.

Download the following:

The case for cloud-based disaster recoveryQ&A with SmartCloud VSR experts

SmartCloud VSR white paper

Download the paper

Transitioning business continuity

to the cloud



24

Hot off the press! Findings from the 2013 Reputational Risk Study.

� Increasingly, the Chief Digital Officer will own

reputational risk X

� As cybercrime escalates, so will reputational

risk

� Social media is the best tool you have to

minimize reputational damage

� Reputational risk will become a primary

justification for IT investment

� Your partners’ compliance with your security

and continuity standards will be mandated



25

Visit the IBM booth and complete 7 simple questions to get your Reputational Risk score and get an iPad case.



26

Thankyou

ibm.com/services/continuity

Richard CocchiaraIBM Distinguished [email protected]



27

Copyright information© Copyright IBM Corporation 2013

IBM Global ServicesRoute 100Somers, NY 10589 U.S.A.

Produced in the United States of AmericaFebruary, 2013

All Rights Reserved

IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence inthis information with a trademark symbol (® or ™), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at “Copyright and trademark information”.

Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries.

Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both.

Other company, product and service names may be trademarks or service marks of others.

Use of the information herein is at the recipient's own risk. Information herein may be changed or updated without notice. IBM may also make improvements and/or changes in the products and/or the programs described herein at any time without notice.

References in this publication to IBM products or services do not imply that IBM intends to make them available in all countries in which IBM operates.

how to integrate cloud-based disaster recovery into your ... · adapt your business continuity...

Documents