Using data backup and restore services to achieve compliance.There has been a great deal of discussion concerning government regulations of business continuance The adjournment or postponement of an action pending in a court to a later date of the same or another session of the court, granted by a court in response to a motion made by a party to a lawsuit. in the event of a disaster or widespread disruption. While government regulation of business continuance has primarily focused on the financial services The examples and perspective in this article or section may not represent a worldwide view of the subject. Please [ improve this article] or discuss the issue on the talk page. industry, public and privately held companies privately held company A firm whose shares are held within a relatively small circle of owners and are not traded publicly. alike are also using these regulations for guidance in developing their own sound business continuance strategies. The most significant of these government guidelines guidelines, n.pl a set of standards, criteria, or specifications to be used or followed in the performance of certain tasks. is the Interagency in·ter·a·gen·cy adj. Involving or representing two or more agencies, especially government agencies. Paper on Sound Practices to Strengthen the Resilience of the U.S. Financial System (interagency paper) issued in April, 2003 by the Federal Reserve Board, the Office of the Comptroller of the Currency The Office of the Comptroller of the Currency (or OCC) was established by the National Currency Act of 1863 and serves to charter, regulate, and supervise all national banks and the federal branches and agencies of foreign banks in the United States. , the Securities and Exchange Commission and the Federal Reserve Bank of New York The Bank of New York, abbrieviated to BNY, was a global financial services company that existed until its merger with the Mellon Financial Corporation on July 2, 2007.[1] The bank now continues under the new name of The Bank of New York Mellon Corporation. . The challenge for all companies interpreting these guidelines is to recognize the variety of solutions available and to allocate the appropriate resources needed to comply with sound business continuance practices. The challenge for solution providers is to go beyond compliance and demonstrate the return on investment of technologies that add value to business operations Business operations are those activities involved in the running of a business for the purpose of producing value for the stakeholders. Compare business processes. The outcome of business operations is the harvesting of value from assets immediately. Business Continuance Objectives The foundation of the interagency paper is based on the general acceptance of three critical objectives for business continuance: * Rapid recovery and timely resumption RESUMPTION. To reassume; to promise again; as, the resumption of payment of specie by the banks is general. It also signifies to take things back; as the government has resumed the possession of all the lands which have not been paid for according to the requisitions of the law, and the of critical operations following a wide-scale disruption * Rapid recovery and timely resumption of critical operations following the loss or inaccessibility of staff in at least one major operating location * A high level of confidence through ongoing use or robust testing, that critical internal and external continuity arrangements are effective and compatible. An important distinction needs to be made between business continuance practices and routine data backup and recovery processes. Business continuance focuses on the timely resumption of business operations, which is dependent on access to critical data and applications within a reasonable timeframe. Most businesses routinely backup their data to a portable medium periodically (such as tape) and store it off site. While this is a reasonable practice to guard against isolated disruptions (such as a server crash), business continuance practices guard against broader disruptions that may render both personnel and the backup medium inaccessible inaccessible Surgery adjective Unreachable; referring to a lesion that unmanageable by standard surgical techniques–eg, lesions deep in the brain or adjacent to vital structures–ie, not accessible. See Accessible. for a period of time. Business continuance planning must include technologies that accomplish routine backup duties (with general storage management) and remote offsite replication/mirroring of critical data outside of the primary region. Sound Practices for Business Continuance * Based on the interagency paper, the structure for a sound business continuance practice is founded on four principles: * Identifying critical operations and thoroughly evaluating the activities and support structure for those operations * Determining appropriate recovery and resumption objectives * Maintaining sufficient geographically dispersed dis·perse v. dis·persed, dis·pers·ing, dis·pers·es v.tr. 1. a. To drive off or scatter in different directions: The police dispersed the crowd. b. resources to effectively meet recovery and resumption activities * Routinely using or testing recovery and resumption arrangements. * These principles are critical when evaluating technology solutions that address business continuance objectives. Identifying Critical Operations The interagency paper specifically addresses what operations are critical for financial markets (core clearing and settlement organizations) but other organizations must evaluate their own risk profile to determine what operations and activities are the most critical--and which need to be restored quickly--in the event of a disruption. It is impossible to evaluate technology solutions without a clear understanding of recovery requirements. Determining Appropriate Recovery and Resumption Objectives Determining appropriate recovery and resumption objectives involves more than just identifying the essential components of a business. Some organizations may differentiate multiple levels of critical operations by establishing separate tiers, each with separate definitions for timely recovery. The solution then must also cater to these different levels of need. For example, enterprise resource software may need to be recovered within hours, while e-mail functionality may not be an immediate requirement. Maintaining Sufficient Geographically Dispersed Resources that Meet Recovery and Resumption Activities The most common theme in the interagency paper is the need to maintain separate facilities for primary and backup facilities. While the interagency paper does not qualify what the distance between the primary and backup facilities should be, it is clear that the distance between the two facilities needs to reflect the risk profile of the business to minimize the impact of a regional disruption. As mentioned earlier, many companies depend upon tape backup Using magnetic tape for storing duplicate copies of hard disk files. Users can add an internal or external tape drive to their desktop computers for backup purposes, and files are typically copied to the tapes using a backup utility that updates on a periodic schedule. for business continuance while neglecting the impact on recovery, should there be a regional disruption. An obvious consideration for business continuance planning is the cost associated with maintaining two facilities and the security concerns of using independent third parties to host alternative facilities. An often-overlooked option exists that allows businesses to utilize their existing infrastructure and resources in hosting multiple data storage locations. Many companies already maintain multiple locations for normal business operations and these facilities can be cost-effectively leveraged to manage a secondary backup site A backup site is a location where a business can easily relocate following a disaster, such as fire, flood, or terrorist threat. This is an integral part of the disaster recovery plan of a business. . Using existing facilities and human resources The fancy word for "people." The human resources department within an organization, years ago known as the "personnel department," manages the administrative aspects of the employees. can significantly reduce costs and security risks. Routine Testing Consistent testing of business continuance processes is also critical to evaluating compliance. Seemingly routine changes in essential hardware, software applications and infrastructure can have an adverse effect on business continuance practices. Therefore it is vital that organizations establish scheduled testing procedures on a regular basis. Implementation: Business Continuance Architecture Typical business continuance planning should also incorporate both disk and tape in the network architecture. Disk-based storage manages data at both the primary and secondary facilities, which can be mirrored (synchronously syn·chro·nous adj. 1. Occurring or existing at the same time. See Synonyms at contemporary. 2. Moving or operating at the same rate. 3. a. Having identical periods. b. or asynchronously) or replicated--depending on the existing infrastructure and risk profile. Synchronous Refers to events that are synchronized, or coordinated, in time. For example, the interval between transmitting A and B is the same as between B and C, and completing the current operation before the next one is started are considered synchronous operations. Contrast with asynchronous. mirroring protects against the consequences of storage device/failure across local distances, while asynchronous Refers to events that are not synchronized, or coordinated, in time. The following are considered asynchronous operations. The interval between transmitting A and B is not the same as between B and C. The ability to initiate a transmission at either end. mirroring provides fault tolerance See fault tolerant. (architecture) fault tolerance - 1. The ability of a system or component to continue normal operation despite the presence of hardware or software faults. This often involves some degree of redundancy. 2. for storage volumes over long distances between data centers in near real-time. Replication significantly lowers total cost of ownership by leveraging a company's existing communications link to allow primary and secondary sites to replicate just the delta-changes across any distance for continuous business operation in the event of a disaster--providing physical and logical protection. Integrating Disk-to-Disk Backup at Each Facility While enterprises can choose to perform only tape or disk-based backup, the optimal backup paradigm for most companies now entails using a tape-based solution in concert with a disk-based solution. Leveraging sound business continuance planning with comprehensive backup and recovery technology, disk-based backup can be integrated at both facilities as an online backup Using the Web to store copies of data for backup. There are numerous providers on the Internet that charge for storage, and fees are typically based on capacity. Online backup services provide offsite backup, which is essential for disaster recovery. See backup types. resource, which can increase the efficient use of resources and dramatically improve recovery times for minor disruptions. By integrating disk into the backup process, it essentially offloads backup services from the application servers and the LAN (Local Area Network) A communications network that serves users within a confined geographical area. The "clients" are the user's workstations typically running Windows, although Mac and Linux clients are also used. , achieving truly windowless backup. A tape library investment also requires significant planning and forecasting of backup needs. Disk-to-disk backup provides the flexibility to add disk as backup needs grows. Disk-based backups can complement tape backups and help to reduce the need to perform incremental Additional or increased growth, bulk, quantity, number, or value; enlarged. Incremental cost is additional or increased cost of an item or service apart from its actual cost. tape backups to minimize the risk of data loss between tape backups. The advent of large ATA RAID Using ATA (IDE) drives in a high-performance and/or fault tolerant configuration. See RAID. arrays renders backing up to disk an affordable and efficient option. Archiving to Tape Most enterprises perform tape backup, and will most likely continue to do so in the foreseeable future because it plays an important role in data archiving for legal and other purposes such as data warehousing See data warehouse. data warehousing - data warehouse , transporting data to a new location, and/or as a second line of defense against hard errors in addition to methods of disk-based backup, mirroring, and/or replication. Smaller, more affordable tape libraries can be used at each facility for long-term archival of data. IP-based Replication One method of reducing and leveraging existing technology is to use IP-based replication. As companies evaluate their business continuance needs, many are moving to a centralized cen·tral·ize v. cen·tral·ized, cen·tral·iz·ing, cen·tral·iz·es v.tr. 1. To draw into or toward a center; consolidate. 2. storage model that allows them to mirror, replicate and backup their data without interfering with individual servers and, in most cases, without significant impact to the performance of the LAN. IP technology allows businesses to use an existing communication and broadband infrastructure to support long-haul network traffic with a secondary facility. In addition to leveraging an existing infrastructure, IP protocols are standard and well understood by information technology professionals, which in turn can dramatically reduce the learning curve and expense of adapting IP-based solutions. Centralized storage solutions also significantly reduce capital investment by consolidating resources for maximized utilization and operational efficiency. Open system solutions based on IP protocols provide greater flexibility and cost control by leveraging existing infrastructure and hardware. With an open systems solution, organizations can expand their systems as their needs grow without being tied to costly, proprietary solutions. In many cases, greater efficiencies are also gained by eliminating the need for multiple software licenses In computing, software that is copyrighted and licensed under a software license is done under a variety of licensing schemes. For end-users there are proprietary licenses and there are free software licenses, and there are proprietary Within these schemes are further classifications. , as well as the individual management of storage software for each server. Conclusions It is evident that today's environment for business continuance has changed dramatically over the past two years. Business continuance has quickly evolved into a science that includes measuring risk, understanding vulnerabilities and appropriately planning to minimize the impact of a disaster on business operations and personnel. The interagency paper is an excellent framework for any business whose ongoing operations can be significantly impaired by a disaster, but it is critical that this planning be incorporated into the IT network design. Developing and implementing a fully integrated system, coupled with sound business continuance planning will not only add value to an organization, it will generate a measurable return on investment by improving the efficiency of data storage policies and leveraging valuable human resources and the vast investment in a company's IT infrastructure. Greg Knieriemen is vice president, marketing & business development at Chi Corporation and Bernie Wu is vice president, business development at FalconStor Software, Inc. (Melville, NY) www.falconstor.com |
|
||||||||||||||||
Printer friendly
Cite/link
Email
Feedback
Reader Opinion