Business Continuity Encompasses the Cloud
By Bob Violino
Business continuity has become a high priority for companies, and one of the most significant recent trends in BC planning and practices is the emergence of cloud computing as a key component.
"The cloud has fundamentally changed business continuity," says Rich Cocchiara, distinguished engineer and CTO for Business Continuity & Resilience Services at IBM. "Capabilities previously only available to larger companies, such as remote failover, are now within reach of many small and medium size businesses."
The on-demand nature and geographic diversity afforded by the cloud lets organizations put backup operations far away from their primary operations at an affordable price. "This affordability—combined with increased testing capabilities and future improvements in network bandwidth and server and storage capacity—will force companies to re-evaluate the need for self-recovery," Cocchiara adds.
Relying on the Cloud
Shaklee, a Pleasanton, Calif., provider of nutrition and home care products, relies on the cloud for much of its BC effort. The company has two main thrusts to its BC plan—technical and operational—according to Chris Jones, vice president of IT and CTO.
"In addition to systems being available quickly in the event of a disaster, they must be usable by knowledgeable workers," Jones says. This entails the managed recovery of IT services, network and communications availability and physical facilities for workers.
To effectively execute a BC plan, Jones says, companies must have certain foundational technologies and processes in place. Core components of the plan include backup and recovery, IT service management, system monitoring, back-office systems, data warehouse, networking, virtualization, infrastructure as a service (IaaS) and geographically distributed applications.
The cloud plays a key role in Shaklee's BC plan. "There has been a significant change in the availability of cloud and SaaS [software-as-a-service] solutions and services that, when adopted correctly and strategically, can dramatically reduce business continuity risk and complexity for an organization," Jones says.
For backup and recovery, "the cloud adds new alternatives to the traditional offsite physical storage option," he says. In IT service management, the cloud and SaaS-based applications offer new alternatives to provide overall service management in the event of a business recovery need.
System monitoring, integrated into IT service management, ensures that the BC plan is meeting customer demand. "Once again, in addition to traditional solutions, there are good SaaS offerings here," Jones says. Shaklee recently added monitoring services from New Relic.
SaaS is also playing a role in ensuring the continuity of Shaklee's data warehouse. "In any disaster event, you are going to want to get real-time reports on how your organization is or isn't working," Jones points out. "Again, good traditional and SaaS-based marketplace solutions exist." Shaklee uses a cloud-based service from PivotLink for its data warehouse globally.
Networking is another key focus of the BC effort. "In addition to providing access for workers, the network is how you connect to new locations in a disaster," he says. "Managed network providers enable you to quickly expand your resources to extend and maintain the new network. They also can enable you to still have remote access to your private network." Shaklee has partnered with managed network, security and cloud services provider Virtela to manage its global network.
Virtualization and IaaS are requirements for efficiently restoring systems in a disaster, Jones says. "With virtualization, gone are the days of laying down a base [operating system] and then restoring data and applications on top," he says. "Now, in disasters, you can quickly restore [operations] by restoring the entire system in a single virtual container."
Shaklee is leveraging virtualization containers on its HP/UX, AIX, Windows and Linux environments, Jones says. As a result, what would otherwise take days to restore now takes minutes.
Another component of Shaklee's BC plan, geographically distributed applications, allows application distribution across data centers. "This is in effort to remove any single points of failure," he says. "This can easily be done with most Web-based technologies out of the box."
The effort to protect the company from business interruptions is an ongoing effort. "Disaster recovery and business continuity have and always will be a continuous process," Jones says.
And the BC strategy must include input from all over the organization. "All senior executives must be involved in the strategic commitment to business process continuity," Jones advises. "Employees from all functions are involved in the operational planning."
Having a strong BC strategy in place has huge implications for the business. "A BC strategy is a critical success factor in mitigating risk and ensuring that our company has the ability to continue serving our customers," says Mike Batesole, CFO of Shaklee. "If we don't serve our customers, someone else surely will."
Securing the Infrastructure
Another company that's invested considerable time and effort in its BC plan is LeapFrog Interactive, an online ad and marketing company in Louisville, Ky. The company offers multiple digital services to clients, including hosted services such as virtual servers, Web hosting and email.
Leapfrog began to rethink and redesign its IT infrastructure about six years ago, says Carl West, vice president of managed technology solutions.
"Virtualization technology for x86 processors was readily available, and we had a goal to keep the entire infrastructure as secure and portable as possible," he says. "We began putting a business continuity plan together for our [critical] systems," such as hosting for public services and project management. Later, the company expanded this to its development environments and other internal resources.
The BC plan includes not just virtualization, but shared storage, backup and replication, network redundancy, documentation, routine tests and a failback procedure.
Planning the strategy involved a number of key participants. "Our entire team of engineers worked with me to come up with a solid technical solution," West says. He worked with the company's leadership team consisting of the CEO, CFO, vice president of client services and vice president of business development to create the best path for the company.
"One challenge we encountered was figuring out the best way to deal with our always-growing storage needs," West says. "In the early days, we had only two or three [terabytes] of data. As we continued to grow, we had to quickly come up with a strategy to keep that data backed up and under control."
The solution was to use storage replication and deduplication. "That allowed us to have several copies of our data without taking up as much storage as we used to," he says.
Another component of the BC plan is geographic redundancy. "We like to keep our data centers a minimum of 90 miles apart," West reports. "That's close enough for a quick drive to get to the site, but far enough apart to give us a buffer for many environmental disasters."
One key best practice is to focus on the truly important Items, West says. "Not everything is critical," he says. "Perform a business impact analysis and focus on the items that really matter for your business."
It's also vital to perform periodic reviews of the plan. "It's easy to create a plan and forget about it," West says. "You need to get it out and dust if off every once in a while to ensure everyone is ready."
Automation a Key Factor
For a growing number of organizations, automation is becoming a key factor in business continuity.
"From a technology perspective, automation is something some companies are looking into in order to make planning more streamlined and less error-prone," says Rachel Dines, a senior analyst at research firm Forrester Research in Cambridge, Mass., who covers infrastructure and operations issues. "It's also easier to keep plans up to date when you use an automated system."
Workforce continuity and emergency communications have recently emerged as top challenges for BC planning, Dines says. "Events like hurricane Sandy highlighted the vulnerabilities in these plans," she says. "Testing can improve both of these challenges, but it's also important to think about workforce continuity plans that go beyond just 'work from home', which is what many companies tend to use as a catchall for all employees."
One thing organizations will need to overcome is the tendency to separate recovery functions that really should be working together, Dines says. "Business continuity and disaster recovery [DR] teams have become too siloed in recent years," she says.
There was an initial push to separate the two functions in order to make sure that business continuity teams did not become too bogged down in the technology side, Dines says. "But they've now taken this split too far and fail to coordinate activities together," she adds.
"Moving forward, BC and DR teams need to make an effort to work together more closely, starting with the planning and testing cycle."