Five rules for disaster recovery. (Security News and Products).

Whereas many companies have invested in routine data backup, most firms still lack comprehensive disaster recovery strategies. The specialists at the storage software manufacturer Legato Systems arrived at this finding from an analysis of consulting inquiries after September 11, 2001. Yet it is precisely detailed planning for all possible events that helps make it possible to quickly resume business activities after a crash. That's why Legato Systems advises that you follow five primary rules for disaster recovery planning to avoid the most common planning gaps that have emerged in the wake of the catastrophic events of September 11.

Comment: The biggest problem in resuming business activities after a crash do not occur in companies during the process of reading the stored data from tapes, but because of planning gaps. These may involve a lack of or insufficiently documented recovery plans and procedures, for example, or the configuration of substitute hardware with no documentation of the original system preferences and setups. Other planning gaps include a lack of documentation, archiving and tracking of the tapes or the improper handling of tape archives. On top of all that is the insufficient protection of departmental servers.

The following rules help prevent these planning gaps:

Ist rule: You must document and archive system configurations.

The successful backup of applications and data begins with the printing out and recording of system configurations. Part of this involves the continuous documentation of changes to the system configurations. A further copy of these documents must in any case be stored at a secure location. A time- saving alternative is offered by bare metal recovery solutions, that save system configurations and enable automatic recovery. The prerequisite for this is the availability of identical or compatible hardware.

2nd rule: You must document, archive and train disaster recovery procedures.

Companies that want to guarantee speedy recovery should have in place disaster recovery procedures that can be implemented at any time and should regularly train their staff in these procedures. In doing this, a carefully written sequence of events should be stored at an external location together with the business-critical data In this way, firms can avoid the "trial-and-error" process that is otherwise necessary.

3rd rule: You must store, document and track taped media.

A professional disaster recovery plan must include rules for storing tapes off the company's premises, including the documentation on the contents of the tapes. If there are no recordings of the most recently stored tapes, then these must first be indexed and read in order to determine where the important data are stored. This causes unnecessary delays in system and data recovery. The tapes themselves must be able to be located quickly.

4th rule: You must identify and back up all business-critical servers. A quick resumption of operations requires that both the data center infrastructure as well as each departmental server containing business- critical applications be recovered. These may be email servers, small database servers or other specialized application servers. In many cases, companies don't back up these systems at all.

But they must be included in the plan just like the data center itself and therefore require their own documented procedures and plan of action. Each server used and practically every desktop and laptop system is worth being backed protected. Thorough data backup of all of these systems is the sine qua non for being able to conduct a recovery at all.

5th rule: You must simplify your recovery with online data backup.

Online data backup is an important supplement to storing data on tapes. It safeguards business activities during the time when data recovery is needed. A recovery is easiest to conduct after a crash if an online, offsite copy of the production data is available. This second or third copy is kept up to date using replication technologies that are either embedded in the storage hardware itself or that run on servers connected to the memory. With an online connection, the data are compared with an alternative storage location in real time.

Since these data are always up-to-the-minute online, they are immediately available for the recovery of essential business operations. This approach secures business processes to a certain level from every type of disaster and enables the recovery of data center data and applications without the otherwise usual time pressure. Decisive here are tools used in automating the process that ensure the continuous monitoring of both the coherency and the usability of the data at all times.

www.legato.com