Disaster recovery is evolving with virtualisation technology becoming a mass market solution that is available to clients who previously could not afford it. Companies should do a health check to make sure that their disaster recovery solution still meets their needs, advise Garry Southway and Chris Eaton from MCS. 

 A lot of organisations put in disaster recovery solutions some time ago and typically this would not have been tested since Hurricane Ivan in 2004. The question is whether it is still fit for purpose, says Garry Southway, VP Core Technologies at MCS. 

 An investigation and design put together several years ago will have captured what an organisation had in applications and addressed the recovery point and time objectives, how much data will be recovered and how quickly, at the time. 

 “There might be a whole plethora of applications that are not in the disaster recovery plan and not in the disaster recovery solution simply because they have been installed recently or forgotten about,” he says.  

 Or the recovery time or recovery point objectives for the previously installed applications may have changed. In some cases the system may have been tested regularly, as it is best practice, but that is not necessarily always the case.  

 It is important to ensure that these are still appropriate and a health check of one’s disaster recovery environment can achieve this, Southway advises.  

 Such a disaster recovery health check does not have to be extensive. “It does not have to be a three week engagement testing every application; it is more of a sanity check of the environment that a client has to make sure it still works.”  

 This would include testing one or more single applications to determine whether they are able to perform in the way they should. 

 Barriers of entry are coming down 

 In addition to new applications or new objectives that may be part of the disaster recovery plan, the virtualisation technologies used for disaster recovery have also evolved and are in many cases much cheaper and therefore more accessible than they were just 12 or 18 months ago, says Chris Eaton, VP sales and marketing at MCS. 

 The trend in Cayman for some of the smaller clients that maybe did not have the budget or the appetite for disaster recovery is that nowadays there is a solution for everyone, adds Southway.  

 This may not be on the same scale as for the enterprise clients, who might be using storage area network or what they call SAN to SAN replication.  

 But there is a cheaper solution using a host-based application that might be useful for some of the smaller clients in Cayman. And Cayman has a lot of small clients that have no disaster recovery that become more reliant technology, he says. 

 Doubletake is one example of a product that can be used.  

 “The model is that in your live environment, you can have multiple physical servers and you replicate them to your DR site to one physical server that has virtualised instances on it,” Southway explains. “It is a many to one relationship and because of that you only have to buy one server, which is obviously cheaper than what you have got in your production environment.“ 

 As even the smallest offices in Cayman with only 20 or 30 people might have five or six physical servers in their production environment for everything from the security system to email and any line of business applications, the idea of having to spend the same money again on a DR solution was off-putting in the past. Many businesses may not be aware that it is actually no longer needed. 

 Southway says one can “get away these days with buying a fairly decent physical server, on which you can virtualise multiple instances of logical servers. For quite a small investment you can have a DR solution.”  

 This means that while in the past the barrier to entry may have been $75,000 this has more than halved because the like-for-like duplication of the production environment and the disaster recovery environment is not the only solution, Eaton says. 

 “Virtualisation technologies were considered leading edge not that long ago whereas today you have mass market adoption. More people are familiar with it and realise they can use it for DR.” 

 Prices have also come down because vendors have caught on to virtualisation as a mass market product, while they were previously solely targeting enterprise clients, adds Southway. They now realise there is a whole new market that previously they have been pricing themselves out of. This removes the cost objection for a large number of small and medium businesses as the price point for putting an effective DR solution in place has halved in 12 to 18 months. 

 Even in the physical storage area network space prices are coming down and larger capacities in terms of disk space are available for the same price. 

 Communications 

 The same applies to communications costs, where there has been some reduction in the cost of bandwidth, mainly as a result of more competition. 

 But despite this, the rate of development is not as fast and certain limitations remain, which means that solutions like Riverbed for compressing and maximising bandwidth still have their uses.  

 One of the challenges is that it is difficult in practice to swap Internet service providers. The other factor is that off-island bandwidth in Cayman is still limited, while data is growing at an exponential rate and so are people’s bandwidth requirements, notes Southway. 

 “That is the challenge for us. If you do SAN to SAN replication you have to use technologies like Riverbed to trick the SANs into thinking that they have got more bandwidth than they actually do.” 

 The result is a less elegant, asynchronous solution. While a synchronous solution would write data to the production site and the DR site, it will only show the user that the write to the DR site has been successful after it has been executed.  

 In an asynchronous solution the fact that there is a cue or time lag for data to be written to the DR site has to be accepted to get a sharper response. 

 “Everyone is now moving to asynchronous because it is an accepted risk,” says Southway. 

 On-island solutions may still be viable 

 Yet on-island DR solutions are still viable and many MCS clients have both.  

 “You have to ask yourself what you are mitigating against? Where are your people and how do you react to an event?” asks Eaton. 

 While we are understandably fixated on hurricanes, there are other disasters - like a fire in a server room - that still need to be part of the business continuity and DR plan.  

 “Local solutions can make perfect sense for things like that and local solutions can also make sense for some organisations as part of their hurricane planning,” he says. “One of the lessons that we all learned in Ivan is that is that it was the human assets and the human capital in the business that acted in unexpected ways. If your staff is going somewhere else anyway, does it make sense for your systems to still be in Cayman in the event of a hurricane?” 

 Your plan needs to think about where your people and your systems are, he advises. 

 Access to data 

 Access to the data and the system is something that is often forgotten, adds Southway. It is also an area that has seen some developments in the past 18 months.  

 “There are a lot more elegant solutions that allow accessibility of both the applications and the data,” he points out. “It used to be just CITRIX and that was the only game in town. CITRIX had to improve and evolve because there are other vendors fighting for that virtual desktop space.” 

 The other development is that new devices such as smartphones have become more common. 

 “The days of having a pre-built laptop with all your applications are over. All you need is a smartphone and an SSL based VPN, which means I could use my sister’s computer to access the network in a secure manner,” says Southway. 

 Conclusion 

 What follows from this evolution is that there is no longer a reason financial services organisations should not have a DR solution nowadays, he concludes.  

 “If you are an organisation in retail, you may not need a DR solution because if your inventory is gone the data is the least of your worries. But as a financial services organisation, your clients may be sympathetic for a day but then on the following day they want their NAV return or their statements updated.” 

 Southway says reputation is another good reason why organisations should adopt a DR solution. 

 Even the ones that have a DR solution in place need to ensure that it is still passes the laughter test, adds Eaton. “Taking a tape back-up on a plane and hoping that it is going to work when you have gone off island, may have been appropriate a few years ago, but it no longer is today.”