Preparing for disaster with an effective business continuity strategy: overcoming potential dangers to your information infrastructure.

Like many technology-dependent businesses, you are most likely aware of the vulnerabilities of your critical information and communication systems--but how well prepared are you? Can you be absolutely certain that, should disaster strike, your IT infrastructure will be fully backed up? And just how quickly will you be able to resume operations? This article presents the need for airtight Business Continuity Planning (BCP) and Disaster Recovery Services (DRS), and discusses a number of considerations that need to be addressed when choosing a Business Continuity strategy, as well as the right solutions for the job.

Disastrous events in recent years have made it very clear that enterprises that do not have comprehensive business continuance management programs in place are putting themselves in an extremely vulnerable position. Serious disasters may completely paralyze an organization by bringing down information infrastructure and communication lines or, even worse, physically damaging entire data sites beyond repair. Traditional disaster recovery and availability systems (which essentially rely on backup of critical data onto tape or disk arrays) may prove ineffective, and may turn out to be not just costly, but down-right fatal to some 24X7 operations.

To properly face the challenges of IT downtime, enterprises need to seriously take inventory of their investment in business continuity. Companies that have pursued business continuity in earnest have proven more nimble at dealing with and recovering from unexpected outages. The bottom line: It would be wise to regard business continuance programs as a crucial investment.

What are the Risks? What Should My Objectives Be?

First, you must be fully aware of the possible risks to your information infrastructure, and the business processes it supports. These include:

* Hardware, software and human error-related failures

* Data corruption 

* Network outages, power failures and physical site disasters

Traditionally, these risks would be dealt with by backing up data onto tape or disk arrays, then waiting as long as required for data resource restoration to complete. For real-time organizations committed to 24X7 service availability, this is obviously unacceptable.

To implement a business continuance plan that will enable you to maintain your desired level of availability, you must define the acceptable amount of time it would take for your organization to resume operations following a disaster. For some, a day would be good enough. Many real-time enterprises, however, would find damages from a site outage as short as 4 to 24 hours absolutely unbearable. Also bear in mind that more than 40% of companies that experience an information-related disaster never reopen.

[FIGURE 1 OMITTED]

Additionally, you must define the accuracy with which specific data states can be recovered from backups, journals or transaction logs. Is an application checkpoint good enough? Or do you require a higher degree of granularity? Finally, you should also realize that as essential as IT services are to your organization's business continuity, they are but a single factor in the scheme of things. To effectively recover from disasters and resume business operations, you will need to create a plan that focuses on all critical resources including IT, employees, facilities and equipment.

What is the Evaluation Criteria?

A business continuance program may entail a complete reworking of your IT architecture, as well as integration of supporting technologies such as mirroring, replication and clustering. You will need to choose the level of preparedness and availability you require from the following typical options:

Basic backup and restore: Provides minimal protection against site outages, with recovery lasting as long as several days and requiring either hardware replacement or tape restore operations.

Business recovery: Based on shared data infrastructure, with improved recovery speeds ranging from 8 to 72 hours.

Disaster tolerance: Requires infrastructure that employs real-time data replication to ensure either limited data loss or no data loss at all, with recovery times ranging from nearly 0 to 8 hours. Even medium-sized companies on a budget can afford effective disaster-tolerance.

What Are the Available Technologies? What Benefits Do They Provide?

Data Replication: Options for securing data are constantly growing. While replication has traditionally been reserved for very large businesses, a number of vendors with low-cost offerings are now bringing this technology to the mainstream. If you are truly concerned about seamless data availability, it's probably a good idea to consider strengthening traditional backup systems with real-time, replication-based data availability and disaster recovery solutions.

Some replication systems will allow you to maintain duplicates of your business-critical servers--not only locally, but also globally--over WAN, with continuous, real-time replication keeping replicas up-to-date at all times. When disaster strikes, your users may easily be switched to a remote replica, which will provide them with seamless access to the data and applications they require (see Figure 1).

[FIGURE 2 OMITTED]

Better solutions will offer flexible replication scheduling, multiple replication scenarios (one-to-one, one-to-many, many-to-one and many-to-many), and advanced management and notification facilities. The ideal solution should also provide you with automatic failover (for instantaneous data and application availability), as well as safeguards against both malicious and inadvertent data corruption, in the form of snapshot-based undo, book-marks, or full-fledged data rewind capabilities.

When reviewing replication solutions, note that there are numerous technologies to choose from. Synchronous replication, for example, mirrors data from a primary server to a server hosted at a secondary site, with processing on the primary server delayed until acknowledgement is received that data has been replicated to the secondary server. Businesses requiring very short recovery times will most likely prefer this type of replication, as it is highly reliable and ensures that primary and secondary servers are always identical. However, synchronous replication also tends to be fairly expensive. Delays in processing until replication acknowledgements arrive translate directly to reduced performance. To avoid this, organizations must invest in very expensive high-bandwidth links. Another way around this is to ensure that primary and secondary sites aren't very far apart, though this may put both sites at risk if a very large-scale disaster occurs.

[FIGURE 3 OMITTED]

Another technology, asynchronous replication, avoids processing delays by doing away with replication acknowledgements. This allows data to be mirrored to replicas over greater distances using low-cost connections, while hardly affecting primary site performance (see Figure 2). While this is a far more viable solution for companies on a budget, there is again a price to pay. With asynchronous replication, data updates will lag between primary and secondary sites, and any transactions in transit between the two sites (when disaster strikes) may be irretrievably lost.

A third option involves a combination of synchronous and asynchronous replication. This combination allows companies to perform synchronous replication of data between primary and secondary sites within a limited geographical area, for example, then replicate the secondary sites to additional sites located much further away (albeit with lags in data updates), using low-cost links.

Continuous Backup: Users interested in the highest data integrity and recovery speeds are probably best served by boosting their backup strategy with emerging continuous backup solutions. These may be added to your existing backup infrastructure to monitor your application servers. Continuous backup will ensure that all data operations (writes, deletes, copies, etc.) are captured and recorded to a journal at all times. No data is moved around, as only the operations applied to the data are actually logged.

Should data corruption occur, affected servers may simply be "rewound" by playing back an opposite operation (or "counter-event") for each operation previously logged in the journal. Not only does this carry the benefit of allowing you to back up vast amounts of data accumulated over a long period of time (remember, it's not the data itself that gets backed up, but the actions taken to create or modify it), but it also means that recovery will be practically instantaneous.

Continuous backup may be added and configured to monitor every update made to your servers either all the time or, if you prefer, in between two recent snapshots (Figure 3). Should your data be corrupted, you will be able to choose between virtually unlimited restore points. As the duration of restore operations only depends on the volume of changes applied since the most recently journaled consistent state, and no actual data is moved, you will be able to simply "rewind" either single-megabyte or multi-terabyte servers in seconds.

Which Solution Should I Choose?

Before choosing the technology that is right for you, be sure to evaluate competing solutions on the basis of a few key factors.

Reliability: All high-end file system-based replication solutions may be effective in backing up server files. However, many will also likely replicate corrupted data, offering no way to easily back out of corrupted replicas. The ideal solution would allow you to either schedule deferred replication (preventing replication of corrupted servers) or easily wind data back to a previous state of complete integrity.

Performance: How quickly can your organization regain operations? Does reviving a damaged server or bringing a standby replica online require a significant amount of time and manual intervention, or can users instantaneously and effortlessly be switched to a standby replica halfway around the globe? Also, does everyday replication affect the performance of your information infrastructure or is it completely transparent? Choosing the "wrong" solution here may mean that users will suffer the impact of additional bandwidth consumption caused by on-going replication.

Cost: Clearly, the ideal business continuity solution should strike a reasonable balance between price and performance, and many considerations fall into play here. Is the solution generic, or is it tailored to the specific application servers being secured? Better solutions will recognize industry-standard servers (Exchange, SQL, Oracle), providing auto-discovery of entire platform-specific database structures and log files, and allowing easy recovery through application-specific restore points.

Does deployment require specialized hardware? Do replicas need to have additional database or application server licenses installed? If you're on a budget, being able to replicate Exchange, SQL and Oracle servers without having to purchase additional licenses of these application servers for replicas will come in handy.

Do installation and configuration require costly server shutdowns or reboots? Superior solutions will enable almost instantaneous soft-installation of business continuity services, and will allow you to make periodic configuration changes even as database and application servers are being updated. The ability to avoid downtime altogether carries a significant financial benefit.

Final Thoughts

Business continuity provides enterprises with flexibility and resilience in the face of unexpected interruptions. With the growing variety of solutions offered, and their increasing ubiquity, business continuance programs are no longer solely the domain of large global corporations. When the next disaster hits, they will ensure that any company, big or small, will be better equipped to defend its critical information resources and business processes.

For the best results, consider implementing a backup strategy that combines real-time replication and continuous backup technologies. Need the highest possible availability? Be sure to check out optional automatic failover, which will switch users to live replicas instantaneously in case of disaster, and help you achieve the most important benefit--true 24X7 service availability.

Equipped with a strong business continuity strategy, you will be able to provide your users with what they need most: The ability to work uninterrupted. You can be sure they'll appreciate it when--should disaster strike--you'll have them up and running again in a matter of seconds.

www.xosoft.com

Gil Rapaport is vice president of marketing at XOsoft (Burlington, MA)