Integrate Archiving with Disaster-Recovery Plan
Interview Topic: Disaster Recovery, IT Business Edge
October 11, 2007 – With Bryan Rollins, vice president of product management, and Paul D’Arcy, vice president of marketing for MessageOne, business-continuity and disaster-recovery specialists in messaging and communication.
Question: When we talk about disaster recovery and archiving, what kinds of disasters are we talking about?
Rollins: We collect some interesting statistics on the causes of outages in companies, IT, messaging and archiving, and they really span the range, everything from natural disasters, which get the most press, to things like power outages in data centers, down to viruses and corruptions or outages in infrastructure such as Active Directory all the way down to hardware failure, so there’s a whole range of outages and most any of those can affect any customer.
D’Arcy: What our data actually shows is that 14 percent of outages are caused by natural disasters, and the other 86 percent of outages are almost evenly split between technical failures of various sorts and human error.
Question: What role does archiving play in dealing with disaster?
Rollins: Different companies do it differently. Historically, archiving has done very little to help with disaster. Organizations have stored data separately for disaster recovery and for archiving purposes, but over the last couple of years we’ve been seeing those two spaces come together and organizations feel the best practice is to store that data once securely offsite and have that information available for both disaster recovery or for legal searches or records management or compliance purposes.
If you think about the functions you want in an archive, you want your business to have access to the same set of services regardless of natural disaster, infrastructure problems or human error. Having an archiving solution that doesn’t rely on your internal infrastructure, so even when that infrastructure is unavailable, you can continue to capture, to send and receive e-mail and make sure that all that data is still being archived and that folks like your internal legal counsel can still perform searches and handle discovery requests, that’s what business continuity is all about, along with making sure the key business functions stay up and running even during those outages.
Question: Is the role of archiving different between a manmade disaster and a technical disaster?
D’Arcy: I don’t think it changes that much. Some disasters have a different footprint. Some large-scale disasters such as a hurricane, they’re different because they can cause much more long-lasting disruption. Technical failures tend to be much more transitory – they may take a few hours or a day. When you look at something like Hurricane Katrina, there could be days or weeks of disruption, and that can cause a very different impact on an organization.
Business continuity and disaster recovery are very broad and cover a lot of solutions, but the very foundation that we’re talking about is that organizations need to have a plan, they need to have people who have clear responsibility for executing the plan, then they need to have a way to communicate no matter what is happening in the world around them. With that in place, then it almost becomes financial tradeoffs, for every application, for every business process, they have to choose: Do they want to recreate that so it will survive any sort of disaster? For different business processes, people choose different things.
We do a lot of work with e-mail, for example, and what we recommend is that it’s not only a key app, but also a key part of crisis communication. We recommend that organizations have a backup e-mail system that is delivered to a managed service and hosted offsite out of their geography and that’s also where their archiving solution goes, so that when a crisis does occur, no matter what happens to the primary, the core systems and infrastructure for e-mail continue to run throughout that period. If you’re an end user and you have no power, you won’t be able to access it, but if you get out of the (affected) area you can and other people will be able to use it as normal.
Question: You were talking about having a disaster plan. What would such a plan look like?
Rollins: A lot of that has to do with identifying what the causes of outages can be and whether your plan can accommodate that. One, of course, is the infrastructure you’re going to deploy, and once you have that up and running, how you actually activate that. One of the mistakes you’ll hear from customers is they have a very human-dependent plan: We’re going to send the following experts to the following data centers; that’s a three-hour drive away. And they’re going to rack and stack some hardware and reinstall software. What you really need is the capability to fail over without deep technical expertise to bring backup those native systems, which is why services have become so popular, because it doesn’t require you to have that dedicated staff. So one of the biggest things is to build a plan that is not expertise-dependent.
D’Arcy: When people think about creating a plan, there are two things they think about: The first thing is how they account for and protect their employees and the second is how they keep key business processes running during some sort of incident. On the employees thing, it’s usually a communications-focused plan, to give status, to do a roll call, to deliver instructions to employees, to make sure employees are safe and who’s able to work and who’s not. And with the business processes, what they do is literally create a map of their business processes — accounts payable, taking orders, manufacturing – and then they understand what technology, applications, facilities and people roll up to those business processes and they make a decision that ranks those processes about what needs to be working how long after a crisis, and then they put a plan in place to make sure all the dependent components are ready to go.
Rollins: And that they restore them in priority order. It’s called a business impact analysis, and the most important application people find out is e-mail because it’s so important for communication, for being able to restore those other business processes.
D’Arcy: One important point to make is that archiving and disaster recovery, each on its own, can be incredibly complex and quite expensive, and there are some real policy-management issues for it, compliance issues, legal discovery issues, of having to produce data during litigation. The best advice is that whenever possible, combine archiving and disaster recovery so they have one set of systems and one set of data that serves both purposes and that dramatically decreases the cost and complexity of managing both problems.
