Total cost of survival: the new metric for business continuity.

Data protection, disaster recovery, and security are possibly the three most critical issues facing the IT industry today. Clearly the impact of terrorist activity and economic failures has highlighted the value of data to survival of the global economy. The Cost of Downtime Survey published by Eagle Rock Alliance, LTD. indicates that 24% of businesses surveyed believe that their business survival is at risk if the computer downtime exceeds 8 hours. Hourly costs of computer downtime can cost a business from $50,000 to over $5 million depending on the business and application. As business valuation plans and measures such as TCO (Total Cost of Ownership), EVA (Economic Value Added), TEI (Total Economic Impact), REJ (Rapid Economic Justification), ROI (Return on Investment) and others gain momentum, we search for more clarity in what we can actually implement and control to give the IT function maximum availability. Though tools are getting much better at determining the total cost of ownership and the impact o f computer outages, no widely accepted metric yet exists for determining the TCS (Total Cost of Survival) though work on a definition is beginning. The sum of these two values however does get us closer to realizing what the TCS actually is or what it will become in the future.

Today's Methodology

Most traditional efforts at high availability and business continuity have been focused on storage-centric disaster recovery planning that enabled data to be available if the hardware failed. Those techniques include:

Backup/restore--the most traditional disaster recovery method writing data from disk to tape for backup and from tape to disk for recovery. Application specific backup modules allow open files and data bases to be backed up without stopping the application. Restore times can be a factor.

Mirroring--writes data in two places (normally disks) simultaneously creating identical copies and data can be restored from either place. Mirroring is also called RAID 1. Restore operations can occur in a few seconds by switching over to a mirrored copy.

Replication--like mirroring, replication creates two copies of the data except the write operations are asynchronous (slightly out of synch) reducing bandwidth and contention.

Snapshot--creates a point-in-time copy on disk of data. Snapshot eliminates the need to shut down an application for backup and enables a continuous mode of providing data protection. Gaining popularity, this is the best method to protect from human errors.

Bare metal recovery--provides the capability to reinitialize the operating system from "bare metal" after a system crash. Restores are fast and can occur from media (tape, disks) or from the network.

Server failure--clustering and hardware redundancy by providing access to "failover peers are the most common methods. Require multiple paths to storage and network topologies. A higher availability version of clustering called SMP (Symmetrical Multi-processing) allows memory/cache to be shared as each system monitors the health of the other.

Intrusion detection system--IDS is the capability of a system or network to determine when it is being used inappropriately or without authorization. The IDS monitors network and system resources to notify authorities when an intrusion occurs. IDS apply where a firewall stops. Firewalls work only at the point of entry to the network and only with packets as they move in and out of the network. Once an attacker has passed the firewall, he can travel anywhere throughout the network. This is where IDS becomes important.

What to Expect

Traditional infrastructure protection is becoming a more well-defined discipline than ever before. The new enemy for data survival may no longer be from technology such as a disk crash, a tape that won't read, or a blank screen from a system or server crash. The biggest challenge is coming from people. Viruses, hackers, piracy, insider threats, foreign countries, business competitors, modified accounting records, and stolen files are intentional and malicious acts by people. The TSC metric will build on existing TCO methods and add a component(s) for a wide variety of business-wide security measures. The global business impact from recent viruses and code attacks is staggering.

The annual costs to businesses of all malicious code attacks were $1.8B in 1996, soared to $12.1B in 1999, $17.1B in 2000 and $13.2B in 2001 worldwide. This cost includes additional elements for the TCS metric such as lost business revenues, cleanup costs, productivity losses and overtime costs. The total Security Services market worldwide totaled $6.7B in 2000 and is expected to grow to $21B by 2005. The annual cost of malicious attacks in 2000 to businesses nearly tripled the size of the security services industry. Note that the entire global spending for magnetic disk storage totaled $25B in 2001. The IT security business (the cost of data insurance) may become the single biggest IT expense inside of ten years at current annual growth rates.

Some New Security Technologies: High-resolution digital cameras--these offer a wider field of view and much more detail than current surveillance cameras. Cost $1395 per camera.

Face Scanners and databases--Cameras scan crowd and a computer compares faces to a database of fugitives and terrorists. Distances between facial landmarks such as, eyes, nose, and mouth are used. Cost $30,000.

Low-dose X-ray body scanners--For use at airports, jails and secure buildings finding explosives, metal and non-metal objects under clothing that would pass through normal metal detectors. This requires a person to stand in front of a scanning machine for about 5 seconds with the amount of radiation exposure similar to that of watching television for about 10 minutes.

Biometrics-biometrics use biological characteristics to establish an individual's identity. Biometrics will make passwords and photo ID's obsolete. Biometric technologies include face recognition, finger scanning, palm scanning, hand geometry, iris scanning, retina scanning, thermal face recognition, voice prints, and signature recognition. Costs range from $50 to $50,000 per biometric device.

Conclusion

The security measures above are all added expense and are becoming the basis for the new "IT insurance policies" that we are beginning to require in order to survive. The resulting digital storage demand, performance and networking impact from the emerging TCS technologies will be the subject of future articles. Just as the business metrics of TCO and ROI are becoming accepted and more commonly used, we see that future business assessments will need to expand to answer the final question, what does it cost for my business to survive?

Virus     Year  Cost

Love Bug  2000  $8.7B
Code Red  2001  $2.6B
SirCam    2001  $1.15B
Melissa   1999  $1.1B
Explorer  1999  $1.02B
Nimda     2001  $635M

Source: Computer Economics, 2002