Business Continuity and Disaster Recovery
Content
Business Continuity And Disaster Disas ter Recov ecovery ery
Gabriel Castro and Tiffany Bennett 6/6/2014 IT 486-Critical Issues in Information Technology echnology,, Analytical Paper Prepared for Terrance Linkletter, Central Washington University
Table of Conte Contents nts
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 2
Abstract The purpose of this paper is to discuss discuss the importance of business continuity and disaster recovery recove ry.. With the advancement and lower cost of technology these days, businesses are relying on more and more on technology for critical Data management and storage needs. needs. There isn't a business today that does not utilize servers, workstations or cloud services at one point or another in their daily workflow. workflow. Unfortunately, Unfortunately, regardless of o f so much reliance in technology, technology, Businesses are not prepared to continue doing business in the event of a disaster that indefinitely suspends core technology operations. A thoroughly planned and documented business continuity and disaster recovery plan can prepare any business to continue operations with minimum downtime and minimum loss of revenue and and profit.
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 3
An Introduction There is no doubt that we live in a technologically advanced world these days. A quick glance at Google's news site or any major news website is sure to feature some sort of new software, hardware or technological advancement that is in the works or soon to be released. Not only is the cost of technology going down year-after-year year-after-year,, businesses and enterprises are increasing their IT budgets every year as well. More and more investment is being made in servers, workstations workstations and mobile technology in order for businesses to stay competitive and work as efficiently as possible. In fact, Forrester Research Research released it's annual IT spend report for 2013, which predicted that globally we would be spending $2.06 trillion across software, hardware, and IT services by the end of 2013 (See Image 1 below) (Lunden, Ingrid 2013).
Image 1: Global business and government spending on IT products and services (US$ billions)
No one would argue that technology technology isn't a necessary part of a growing and competitive business. However However,, the problem lies in the belief that basic precautions and various backup
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 4
solutions are enough to protect against any kind of failure. While researching researching this topic, for the purpose of this paper, paper, we discover the reasons why businesses choose to not prepare a business continuity and disaster recov recovery ery plan. With the results from Central Washington University IT students’ surveys, surveys, we come up with solutions on how we can improve these statistics and encourage more businesses to better prepare themselves against all odds.
Why Create a BC/DR Plan In November 2009, A power failure failure disrupted service to both Halifax and Bank of Scotland (HBOS) which left customers unable to access their online banking services and aTMs (Computer Weekly Weekly,, 2009). Although power and services were restored the next morning, it left a lot of people wondering just how prepared corporations and enterprises are in the face of both pre-meditated and natural disasters. Someone could argue that the restoration restoration of services the next morning is not necessarily a slow response, nor did it display a lack of preparation. However, However, I believe Neil Stephenson, CEO of Onyx Group, Group, said it best in the following quote: “The power failure that affected HBOS could have been avoided avoided if its contracted supplier had provided not only back-up b ack-up power generators, but also insured that secondary or tertiary sites at which to to store back-ups of data were made available.” availa ble.” (Stephenson, Neil 2009) 20 09) The HBOS incident is not being used as an example of a business without a BC/DR plan, but instead as an example of how important it is to have one made and tested. Neal points out that HBOS could tighten its BC/DR plan even more by securing data access to its customers even in the midst of an outage or disaster. disaster. Merely having a plan is not sufficient in most cases. A BC/
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 5
DR plan must be tested and improv improved ed on through-out the creation process and then audited several times a year to ensure its still the most efficient plan available.
Understanding the Whole Picture According to the American Red Cross, Cross, 40% of small-business that suffer a disaster will never we open for business. business. Of the 60% that do, another 30% will close their doors doo rs within two years (American Red Red Cross, PDF). PDF). Hopefully the point that is being driven home is an obvious obvious one: the best way for any business of any size to be best prepared for a disaster is to prepare a thoroughly documented business continuity and disaster recovery (BC/DR) plan. One must wonder then, why don’t most businesses have have a BC/DR plan? The answer lies in two areas, lack of understanding and the lack of dedicated resources. resources. A BC/DR plan is broken down into two different dif ferent sections, Business continuity and disaster recovery (Slater, (Slater, Derek 2012). Business continuity refers to a business being able to continue operations in the event event of a disruption. Normally, Normally, the type of disruption that a business continuity plan prepares for is any type that would cause a substantial negative effect to the business. Each business business must determine the amount of “outage” hours that would qualify for a business continuity plan to kick into effect before it begins to hurt the business financially. financially. The business continuity portion of the plan would then describe how employees employees and clients will continue business operations, whether that be switching over to backup systems, moving employees to off-site offices (“ Disaster Recovery Hot, Warm, Warm, Cold Sites ”) or other similar preparations of the same affect. affect. The disaster recovery portion of a BC/DR plan refers to a disaster which would destroy or damage any assets that a business relies on substantially. That could be buildings, technology,
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 6
paperwork and other similar assets. Disasters can come from natural weather or pre-planned attacks and network hacks from from malicious people. The disaster recovery portion of the plan would describe the steps that the business should take to begin the recovery of lost assets.
Returning back to our original point in this section, the lack of understanding what a complete business continuity and disaster recovery plan is ultimately the reason why many businesses are not prepared. prepared. Directors and managers of critical departments in an organization believe they have have a complete BC/DR plan in place where in fact they only have certain portions of the plan. Their understanding of what a BC/DR plan plan is does not equal what a complete BC/ DR plan actually is. Of course, there are those businesses with managers managers and directors who understand what a complete BC/RR plan is but prefer not to invest time, resources resources and people to put one together.
Collaborating Across the Organization A BC/DR plan must be put together together by directors of every critical department in an organization. That includes the financial department, the engineering department, the technology department, the legal department, the sales department and others as well. Critical staff from every department must must be able to give detailed input of what it takes to operate operate their department. It is only then that a proper BC/DR plan can be put together to ensure that every department is able to operate efficiently in the face of a disaster. disaster. As humans, we know that tackling a project this big can be overwhelming and does require collaborating with a lot of people. Some of the people that are required to deliver deliver their feedback would rather be doing other work instead of putting together a plan to prepare for a disaster they feel “may not even
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 7
occur occur.” .” That is why executive executive level management must fully back and support project leaders that are in charge of developing a business continuity and disaster disaster recovery plan for the organization. Without upper-level upper-level support, it can be near impossible to get all of the necessary feedback, resources and support that is required to accomplish the task. Lastly,, a well-developed plan must be delivered to every employee in order for it to be a Lastly successful plan. In the face of a disaster, disaster, every employee employee must be prepared to put the BC/ DR plan into action, which usually means teaching them how to find the plan and subsequently deploying the procedures. Building a disaster recovery plan but failing to test it with employees causes the plan to lack validity. validity. Small to large scale drills should be prepared and initiated to test employees’’ ability to deploy the BC/DR plan. The feedback from those drills will also assist in employees putting any holes that the plan may have and preparing additional employee trainings necessary so that all questions are answered.
Improving Impro ving BC/DR Plan Adoptions How can we make sure that every business puts forth the effort to create a BC/DR plan? The first step is to get the information out there. there. Inform people of the benefits of having a plan in place, or better yet, yet, inform them of the consequences that will take place if a disaster happens and they are not prepared. The topic of BC/DR plans should be mentioned on every business website, every every text book about business, and so forth. The more people are informed, infor med, the better chance we have have of incorporating a uniformed standard in business. One suggestion of achieving such a standard is to create government government regulations that require businesses to have a proper BC/DR plan in place. Such a regulation should exist much like the already deployed OSHA laws and regulations which require businesses to be “responsible
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 8
for providing a safe and healthful workplace. OSHA's mission is to assure safe and healthful workplaces by setting and enforcing standards, and by providing training, outreach, education and assistance” (Osha). If there are regulations in place to keep people safe, there should be regulations to ensure business continuity. continuity. Not only will the assurance of such plans in place benefit the business, but it will benefit the community too, because the community is affected by the downtime of businesses too. too. Businesses not following such regulations should have consequences. That way we are sure that all businesses will adhere to the rules. Getting such laws in place may be a challenge, but it is a challenge that needs needs to be addressed for the benefit of us all.
Conclusion Carlos Ruiz Ruiz Zazon, author of The Angel’s Game, Game, once said, “Don't be afraid of being scared. To To be afraid of the sign of commonsense. Only complete idiot are not afraid of anything.” anything .” Carlos helps me drive the point home: there are many things that can disrupt business operations. Wise IT and businessmen will recognize the value in awareness and preparation for their business. Yes, Yes, a business continuity and disaster recovery plan does take a lot of effort, planning, collaboration, and resources. However, However, any effort and cost that occurs in preparing a business to tackle outages and disasters will always be less than the cost of a business shutting down or going bankrupt due to lack of preparation. With disasters disasters and tragedies like September 11 and Hurricane Katrina, it is safe to say we live in a world full of uncalled-for chaos. We'll We'll wait to our employees, customers and stakeholders to be prepared for any chaos that comes our ou r way. way.
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 9
References "Disaster Recovery Hot, Warm, Cold Sites: Key Differences." Disaster Recovery Hot, Warm, Cold Sites: Key Differences. Zayo, n.d. Web. 05 June 2014.
Feinglass, David. "Top 10 Mistakes Businesses Make with Disaster Recovery Planning." Top 10 Mistakes Businesses Make with Disaster Recovery Planning. Latisys, 23 Nov. 2013. Web. 05 June 2014. Lunden, Ingrid. "F "Forrester: orrester: $2.1 Trillion Will Go Into IT Spend In 2013; Apps And The U.S. Lead The Charge | TechCrunch." TechCrunch. N.p., 15 July 2013. Web. 05 June 2014. "OSHA Law & Regula Regulations." tions." OSHA Law & Regula Regulations. tions. Occupational Safety & Health Administration, n.d. Web. 05 June 2014. "Plan Now, Worry Less After: Make a Post-Emergency Punch List." Disaster Recovery 101. Iron Mountain, n.d. Web. 06 June 2014. "Power Failure at HBOS Disrupts Banking Services." Power Failure at HBOS Disrupts Banking Services. Computer Weekly, 19 Nov. 2009. Web. 05 June 2014. Preparing Your Business For the Unthinkable. N.p.: American Red Cross, n.d. PDF. Slater,, Derek. "Business Continuity and Disaster Recovery Slater Recovery Planning: The Basics." CSO Online. N.p., 13 Dec. 2012. Web. 04 June 2014. Stephenson, Neil. "HBOS Power Failure Failure Highlights Importance of Business Continuity Planning." Planning ." HBOS Power Failure Highlights Importance of Business Continuity Planning. Computer Weekly, Nov. 2009. Web. 05 June 2014.
BUSINESS CONTINUITY AND DISASTER RECO RECOVER VERY Y
PAGE | 10
