IT execs rethinking disaster recovery
|
|||
 | |||
|
ORLANDO - Last month's destruction of the World Trade Center has pushed the topic of disaster-recovery planning to the forefront, and nowhere was that more obvious than at last week's Gartner ITExpo, where IT executives made it clear they're rethinking how to protect their companies' resources.
Gartner - which hurriedly added sessions on disaster recovery to the conference agenda that originally was more focused on Web services and PDAs - estimates it will cost a company 2% of its annual IT budget to fully prepare for business recovery after a disaster.
The principles of emergency readiness have been clear to security professionals for decades (see graphic). But growing dependence on the Internet and e-commerce is making the job more complex, requiring managers to account for Web-based interactions with trading partners in addition to finding alternate means to run critical data center operations during a disaster.
Gartner consultants recommend businesses prepare for disaster by establishing a recovery "hot site" to run critical applications. If limitations such as staffing demand that this alternate site be near the original data operations center, the hot site should be 30 to 50 miles away to avoid the consequences of damage or network disruptions that might come with a catastrophe.
Many companies have chosen closer locations.
"We're at 53 State St. in Boston, and our disaster-recovery center is on the other side of Boston," says Eric Bloom, senior vice president of systems at Independence Investment, a subsidiary of John Hancock.
The World Trade Center's destruction and the consequent network communications problems have Independence Investment rethinking this location, says Bloom, who is a member of the company's disaster-recovery team. "We're taking it to heart." It would probably be better to move the data-recovery center 30 miles from Boston, he says.
In his presentation last week on the "How-to's of business recovery planning," Gartner consultant Fred Luevano emphasized the need to set up a disaster-recovery team composed of IT and business management to document a detailed strategy down to each application and employee.
"You've got to get senior management involved in the testing, too, so they know what it costs," Luevano said.
Because it costs more to get applications up and running in minutes as opposed to days or even a week, corporations usually prioritize what's most important to keep the business running. Money and time is dedicated to ensuring those appli-cations are running in recovery facilities first.
Each corporation has to choose whether to use one of its own locations for disaster recovery or choose a service provider such as IBM, Comdisco or SunGard, Luevano said. "I encourage you to do a competitive bid with them on how much it will cost each day" during the recovery, he said. "These vendors are usually willing to negotiate."
In either case, it's important to "not forget the network," he added. Back-up services such as Switched Multimegabit Data Service, ISDN, Frame Relay, private lines and dial-up should be negotiated in advance. These lines connect with the rest of the corporate intranet, but sometimes planners forget to order back-up lines for factories or critical customers.
Gartner analyst Donna Scott said corporations might have to negotiate separate software licenses for applications to make use of them during a disaster recovery at an alternate site. Mainframe vendors typically haven't charged extra for this, but many vendors will, she noted. "It adds cost," and is a subject of contention with vendors, she said.
With the growing importance of the Internet and e-commerce, Gartner officials said, there has to be a closer look at corporate business partner disaster-recovery plans. Financial services firms are required under federal law to have emergency backup, and that's one reason many companies in the Wall Street area were able to get back in business fairly quickly after the Sept. 11 disaster.
But most companies are not nearly as ready for the type of disaster that occurred last month.
"Nobody was the least bit prepared for anything like this," says Richard Reichgut, vice president of AuthentiDate, which had an office with 28 employees at 2 World Financial Center on the 43rd floor, near the now-destroyed World Trade Center.
Still in grief for the people he knew who died, Reichgut relates how four days after the terrorist attack, staff from AuthentiDate were given permission to climb up the 43 floors of the building in the disaster area - the electricity was out - to retrieve servers where software developers had been working. The company does backup by sending data to a firm in Germany, but not on a daily basis.
AuthentiDate, which is in the business of electronically time-stamping documents, keeps its servers for this function at AT&T's collocation facility at 53rd Street in Manhattan, so the time-stamping operation wasn't wiped out. AT&T has allowed AuthentiDate to work there until the firm re-establishes in permanent quarters.
"We're looking to build in redundancy now, but it will be expensive," Reichgut says.
RELATED LINKS
