ibm global technology services time to rethink our … · 2018. 4. 18. · ibm business continuity...

© 2012 IBM Corporation

Time to Rethink our Assumptions about Risk and Resiliency Approaches

IACA 35th Annual Conference Williamsburg, VA

May 21, 2012

Patrick Corcoran, Global Business Development Executives IBM Business Continuity & Resiliency Services

IBM Global Technology Services

© 2012 IBM Corporation

© 2012 IBM Corporation© 2012 IBM Corporation

IBM Business Continuityand Resiliency Services

2

Evolution of the “resilience” industry started with reactive IT- centric disaster recovery and has transitioned to proactive business-centric business resilience.

Business Recovery

Business Continuity

Business Resilience

Disaster Recovery

Smart Business Resilience

Pre-1990 Today2000’s1990’s Future

Tried and true IT Systems Management disciplines include protocols to resume IT in the event of a disaster.

Disaster Recovery programs include assurance that end-users have access to IT systems in the event of a disaster.

Orientation shifts in recognition of the relative importance of certain business functions requiring more expeditious resumption time intervals. Orientation shifts

again in recognition of Information Risk Management as a convergence point for disaster recovery, high availability, business continuity, information security and crisis management

Predictive engine detects emerging threat conditions, calculates probability and business impact, and preemptively initiates cloud based migration of client workload.

IT Centric Business Centric



3

Headline events often mobilize our clients to pause and reflect on their current IT resilience standing. . .

http://www.time.com/time/covers/0,16641,20100125,00.html



4

2011 World Wide Disasters – One of the Costliest Years on Record

Wildfires, Canada14-22 May

Hurricane Irene, USA, Caribbean22 Aug – 2 Sep

Flash Floods, Italy, Spain, France4-9 Nov

Winter Storm Joachim, France,Switzerland, German

15-17 December

Cyclone Yasi, Australia2-7 Feb

Floods, PakistanAug - Sep

Drought, SomaliaOct 2010 –Sep 2011

Source: Munich RE

Climatalogical Events – extreme temperatures, drought, wildfires

Meterologic Events - storms

Hydrological Events – floods, mass movement

Geophysical Events – earthquake, tsunami, volcanic activity



5

5

Personal information leaks have cost millions of dollars, led to class action

law suits, and damaged corporate reputation

The Iceland volcanic eruption cost airlines $1.7 billion with more than

10 million people affected

Hosting provider service outages affect PaaS and SaaS for other vendors

90% of WW BT resin supply stopped

Visitors to Japan dropped 60% in April

The increasingly connected world has magnified the impact on every aspect of life, including its disruptions.

BT Resin Shortage Mobile Circuit Production Issue

Decreasing Tourism

Airlines Discontinuation

WW impact to Car Production

Personal Information Stolen Class Action Lawsuit

Downstream Service Provider Disruption

Car Parts Shortage

Nuclear Plant Explosion

Platform Outage

Flight Cancellation

Earthquake and Tsunami

Game site attacked by hacker

Servers shut down by human error

Volcano

WW car production was down20-30% for some major auto

manufactures during April and May



6

We see both risks and opportunities affecting clients’ business resilience needs

Frequency ofoccurrences

per year

1,000

100

10

1

1/10

1/100

1/1,000

1/10,000

1/100,000 US$1,000 US$10,000 US$100,000 US$1,000,000 US$10,000,000 US$100,000,000

Freq

uent

Infre

quen

t

Consequences (single occurrence loss) in dollars per occurrenceLow High

Viruses

WormsDisk failures

System availability failures

Pandemics

Natural disasters

Application outages

Data corruption

Network problems

Building fires

Terrorism/civil unrest

Data driven

Event driven

Business driven

Regulatory compliance

Workplace inaccessibility

Failure to meet industry standards

Regional power failures

Governance

Source: IBM

Data growthLong term preservation

Mergers and acquisitions

New products

Marketing campaigns

Audits



7

A/C FailureAcid LeakAsbestosBomb ThreatBomb BlastBrown OutBurst PipeCable CutChemical SpillCO FireCoffee MachineCondensationConstructionCoolant LeakCooling Tower LeakCorrupted DataDiesel GeneratorEarthquakeElectrical ShortEpidemic

EvacuationExplosionFireFloodFraudFrozen PipesHackerHail StormHalon DischargeHuman ErrorHumidityHurricaneHVAC FailureH/W ErrorIce StormInsectsLightningLogic BombLost DataLow Voltage

Microwave FadeNetwork FailurePandemicPCB ContaminationPlane CrashPower Grid OutagePower OutagePower SpikePower SurgeProgrammer ErrorRaw SewageRelocation DelayRodentsRoof Cave InSabotageShotgun BlastShredded DataSick buildingSmoke DamageSmoke from Restaurant

Snow StromSprinkler Discharge Static ElectricityStrike ActionSwimming Pool LeakS/W ErrorS/W RansomTerrorismTheftToilet OverflowTornadoTrain DerailmentTransformer FireUPS FailureVandalismVehicle CrashVirusWater (Various)Wind StormVolcano / Volcano Ash

Source: Contingency Planning Research, Inc. and IBM

But there are many other events that have caused business disruptions/outages that don’t make headlines, but can be just as costly.



8

Japan: March 11, 2011 – Earthquake and Tsunami



9

Concerns

• Aftershocks

• Nuclear reactors down

• Planned Power outage

3/11 14:46 The earthquake of magnitude 9.0 occurs at 24km in Miyagi Prefecture offing 130km depth.

Tsunami exceeded 10m as a result of the earthquake had a big influence on Iwate Prefecture, Miyagi Prefecture, Fukushima Prefecture, and Ibaraki Prefecture. 13,392 dead, 15,133 missing, and 150,000 or more victim as of April 14.

The Fukushima nuclear plant lost cooling function due to Tsunami, then generated core meltdown, and the government declares INES level 7.

A wide-ranging power failure occurs and it influences the society's infrastructure and the information technology operation greatly.

Since 3/11, 400 times or more aftershock with magnitude 5.0 or more occurred.

Damage is assumed to become 100 trillion yen scale according to the report of CNN.

Outline of East Japan huge earthquake

Huge loss of infrastructure due to earthquake and Tsunami.

①

②Fukushima nuclear plant #1 radiation leak

Even the metropolitan areaBig confusion by rolling blackout

③

①

①

①

①:Affected area by earthquake and Tsunami②:Affected area by nuclear plant accident③:Affected area by earthquake



10

Key areas to consider when creating or updating your business continuity plans.

people

communications

travel / transportation

plan currency

insurance

infrastructure

power

hardware replacement

data availability



11

people

communications


plan currency

insurance

infrastructure

power


data availability

Availability of employee

Conflicts with families and spouse conflicts

How people respond to different disaster scenarios

Who and where are decision makers during disaster

Employees safety

Emergency loans / funds for employees

Problems encountered…

Consider employees prior, during and after event– Roles during and after disaster, safety, trauma, transportation,

housing and funding– Consider addressing employees’ families in BCP

Include IT, lines of business, HR and auditors in BCP

Consider having alternate teams available

Actions to Consider…




12

people

communications


plan currency

insurance

infrastructure

power


data availability

No centralized number for employees/customers/partners

Cell phones didn’t work

No power for cordless phones

Limited access to internet for email

No or limited plans to address media

No or limited communications with public sector agencies


Create centralized number, email address and/or web site

Consider alternate communication tools: satellite phones, cell phones outside of affected region, common email address, wireless cards for laptops, text messaging

Create an external communications plan

Actions to consider…




13

people

communications


plan currency

insurance

infrastructure

power


data availability

People did not follow local agencies directions

Limited or no availability of fuel

Limited or no air transportation

Limited or no availability of rental vehicles

Heavy traffic, long delays

Vehicles disabled due to high temperatures


Work with local government agencies

Understand and follow evacuations guidelines

Anticipate, move key employees (and families) and data out of the affected area

Consider availability of hotel and car rental

Have extra supply of fuel for travel





14

people

communications


plan currency

insurance

infrastructure

power


data availability

Outdated or non-existent plan

Plans were not available

Plans were not linked to change management

No Crisis Management Team

Problems Encountered…

Keep plan current

Integrate plan with IT and business change management

Keep DR vendor contract current

Test plan annually or more often

Create crisis team to manage crisis





15

people

communications


plan currency

insurance

infrastructure

power


data availability

Unknown, poor and/or inadequate coverage

Did not know what disaster scenarios were covered

No inventory or documentation of activities for claims adjuster


Understand your risks and ensure adequate insurance coverage

Understand and test different disaster scenarios

Keep an inventory of all assets

Document all activities throughout the disaster event

Obtain independent review of insurance coverage





16

people

communications


plan currency

insurance

infrastructure

power


data availability

Location in high risk areas

Mold, contaminants

Structural damage

Storage / location of critical assets (i.e., Basement)

Mobile solution didn’t work in affected area


Understand risk and vulnerabilities of facility location(s)

Consider security and accessibility of facility

Conduct a vulnerability assessment of facility

Have vendor contacts ahead of time to fix or clean facility if required





17

people

communications


plan currency

insurance

infrastructure

power


data availability

No power or fluctuating time estimates for restoration

No/limited redundant power supplies (i.e diesel generators)

Poor location of generators / UPS (basement, roof)

No inadequate supply of fuel


Ensure redundant power supplies are tested

Consider location of redundant power supplies

Have contacts for acquisition of generators

Ensure adequate fuel supply





18

people

communications


plan currency

insurance

infrastructure

power


data availability

Hardware was damaged

No power for equipment to repair

No plans to relocate equipment to alternate location

No plans to dispose of damaged equipment

Incomplete coverage on service contracts


Consider a contract for equipment acquisition

Have vendor(s) lined up for equipment relocation

Understand methods and procedures for removing and moving equipment

Understand methods and procedures for disposing of damaged equipment.





19

people

communications


plan currency

insurance

infrastructure

power


data availability

Tapes were stored in affected areas or at office

Tapes/DASD/documents were destroyed or damaged

Tapes were lost in transport

Tapes could not be shipped because of travel restrictions

Restoration processes were unknown or untested


Utilize electronic media

Set up multiple locations for backups, one set near your recovery location

Store critical documents on electronic media in remote locations

Ensure restoration procedures are part of your BCP and tested





2020

Business resilience refers to the ability of enterprises to adapt to a continuously changing business environment.

Business resilience helps organizations maintain continuous operations and protect their market share

in the face of disruptions such as natural or man-made disasters. It requires the engagement

of everyone in the organization and often means a change in corporate culture to instill awareness

of risk.

Business resilience planning is distinguished fromenterprise risk management (ERM) in that it is more likely

to build capacity to seize opportunities created by unexpected events.



21

A resilient framework helps identify areas of risks and vulnerabilities, and allows a company or organization to develop a enterprise resiliency roadmap.

Risk mitigation strategiesBusiness driven Data driven Event driven

Strategy

Organization

Processes

Applications and Data

Technology

Facilities

Bus

ines

s re

silie

nce



22

A business resilience program should utilize a methodology that encourages a continuous monitoring and improvement.

Improve the efficiencyand cost effectiveness of

our program

Develop solutions to increaseResiliency objectives

Understand the organization requirements and risks

ProgramManagement

Awareness, Regular Validation, Change Management, Executive Reporting

StrategyDesign

ProgramAssessment

Program Design

Crisis team

Business Resumption

Disaster Recovery

InformationSecurity

Program Validation

Develop &

Implement

People

Procedures

Infrastructure

Facilities

PolicyFormulation /

Committee

Business Impact

AnalysisRisk

Assessment

ManageImplementPlanAssess

RisksVulnerabilitiesThreats

Organization objectivesTangible (financial) Intangible (brand image)

Current capabilities

DocumentedActionableMeasureable



23

IBM delivers unsurpassed geographic scope combined with a thorough knowledge of local, regional and global regulations.

23

Over 160 data centers globally

100 percent recovery for IBM clients who have declared a disaster (over 800)

More than 1,875 professionals dedicated to business continuity and resiliency

More than 9,000 disaster recovery clients

More than 10,000 client rehearsals per year

More than 50 years experience helping clients with their backup and disaster recovery needs

Over 800 client declarations supported since 1989

Scalable, end-to-end, cloud-based data backup and recovery solutions

Five million square feet of floor space for disaster recovery, with 40,000 seats



2424

Any questions, contact mePatrick Corcoran

[email protected]

Thank You!

mailto:[email protected]

ibm global technology services time to rethink our … · 2018. 4. 18. · ibm business continuity...

Documents