Summary of today s session.

Transcription

1 IBM Global Technology Services How to integrate cloud-based disaster recovery into your existing business continuity plans Richard Cocchiara: IBM Distinguished Engineer; CTO & Resiliency Services (BCRS); Executive IBM Resiliency Consulting Services 2013 IBM Corporation Summary of today s session. Today s business environment does not allow downtime, regardless of the type of interruption. IT budgets are flat, however there is increased business need for shorter recovery times Cloud is being adopted for DR because it offers faster recovery than traditional approaches. Most IT departments do not have the skills required to integrate cloud into their DR plans. A systematic approach is required to transition applications to cloud-based DR and to integrate cloud and traditional approaches. 2

2 IT departments are facing pressures due to increasing volumes of data, intensifying regulatory requirements and expectations for continuous business operations. The amount of information managed by enterprise data centers is expected to increase by at least 50 times over the next decade 1 50x The average cost per hour of system downtime is increasing as more business operations become automated 2 $110K $182K Zettabytes* *Zettabytes equals 1 trillion gigabytes Average cost of one hour of downtime 1. Source: IDC Digital Universe Study, June Source: Aberdeen Group: Datacenter Downtime: How Much Does it Really Cost?, March And external threats are increasing globally, with economic losses from all types of disasters escalating rapidly Natural Catastrophes Source: Münchener Rückversicherungs-Gesellschaft, Geo Risks Research, NatCatSERVICE, January

3 Protecting business-critical data, applications and operations against downtime and disruptions is crucial for every organization. Would your company survive a major outage? Why you are increasingly vulnerable: Increasingly high volumes of data, applications Geographically-dispersed facilities Evolving industry and government regulations Expectations and demands from stakeholders Why a robust resilience solution: Support continuous data and operational availability Improve your competitive position and reputation Improve operational efficiency Reduce risk 5 IT risks like system outages and data loss can put an organization s reputation its most valuable corporate asset at risk. IT risks* have a major impact on a company s reputation Companies have rising IT risk concerns related to emerging technology trends Companies are integrating IT risk and reputational risk management, with strongest focus on threats to data and systems Download the full study report ibm.com/services/riskstudy IT and reputational risk management and mitigation are key success factors of our business and must be given due emphasis. C-level executive, Malaysian agriculture and agribusiness company *IT Risk is The business risk associated with the use, ownership, operation, involvement, influence and adoption of IT within an enterprise. Source: ISACA Information Systems Audit & Control Association, June

4 The study shows a clear mismatch between how well companies rate their reputation and how well they are protecting it. 80 % rate reputation as excellent or very good 17 % rate their company s overall ability to manage IT risk as very strong There is room for improvement in almost every organization Source: 2012 Reputational Risk and IT Study, a report by the Economist Intelligence Unit commissioned by IBM 7 Business resiliency is directly related to the top IT risk factors to an organization s reputation. Source: 2012 Reputational Risk and IT Study, a report by the Economist Intelligence Unit commissioned by IBM 8

5 IT risk management planning and cloud-based managed services can help organizations mitigate and respond to these IT risks. Planning, Design & Implementation Cloud-based Managed Services Data Protection Services IT Risk Assessment Services Business Continuity Assessment Services Cloud Resiliency Planning, Design & Implementation Services Disaster Recovery Services 9 Pressures to do more with less drive IT decisions to meet fluctuating business needs with innovative technology solutions How Important Was Improved Disaster Recovery And Business Continuity In Your Firm s Decision To Adopt The Following? Source: Cloud-Based Disaster Recovery Barriers And Drivers In The Enterprise, A Custom Technology Adoption Profile Commissioned By IBM (Mar 2012) 10

6 With flat IT budgets, increasing pressures to minimize downtime are causing a need to solve gaps with new technologies. Cloud solutions can economically fill this gap Source: Transitioning business continuity to the cloud 11 Cloud-based business resilience is designed to help you economically and securely meet changing business needs for recovery, continuity and availability. Differentiators Increased security and privacy Flexibility Availability Agility Choice of Proof points Helps identify physical assets as a delivery model for added security and privacy Business model not focused on data mining or advertising World-class delivery from IBM helping to improve resiliency and security Delivery models tailored to your business Scalability Pay-as-you-go pricing model Workloads that can evolve with the needs of the business Integration with traditional environments and other cloud environments Portability your data is your data; your workloads are your workloads IBM enterprise-class data center experience IBM data center networking and configuration to help provide connectivity Rapid provisioning of new services Service management automation to help enable more effective self-service Delivery models Operating systems Software environment Enabled by open standards 12

7 Certain challenges are slowing the adoption of cloud-based resilience by a broader community. IT skills gap: the transition to cloud-based DR requires knowledge and application of many different technologies Virtualization Cloud Networking (this is a critical skill in order to properly define bandwidth requirements) Application-specific SLA s must be defined in order to identify which applications should be moved to cloud-based DR (aka application tiering) Changes to management and legacy recovery processes must be documented IT, business, and recovery teams must be educated on new processes The type of cloud deployment (public, private, hybrid) must be defined Concerns about security, compliance, and control issues in the cloud must be addressed To learn more, visit the IBM booth to see the results of a recent study conducted by Forrester Research: Cloud-Based Disaster Recovery Barriers And Drivers 13 So you re ready to use cloud for DR. Are you ready to Provide disaster recovery services for production data that s in the Cloud Identify the resilience tiers with the greatest affinity for cloud resilience Adapt your business continuity management program to govern cloud and noncloud environments Adjust your business continuity procedures for cloud technology recovery Update or create documented IT disaster recovery plans Integrate your existing plans with the new cloud environment Define you network requirements Plan for no connectivity It is common to see a false sense of security among cloud consumers regarding disaster recovery planning. Just because businesses are outsourcing the infrastructure (IaaS), applications (SaaS), or platforms (PaaS) to the cloud does not absolve them of the need for serious disaster planning. Reference: Practical Guide to Cloud Service Level Agreements, 2012 Cloud Standards Customer Council 14

8 A systematic approach to adopting cloud-based resilience reduces transition and adoption time and helps you realize benefits faster. 15 Transition to cloud-based disaster recovery starts with data discovery and requirements definition. Step 1: Strategy Collect key business resilience requirements data on application and data dependencies. Profile existing applications, governing policies, strategies and plans. Understand the business direction, and identify and document the resilience requirements. Analyze workloads to determine which applications and data have the greatest affinity to cloud recovery. Determine the most appropriate cloud resiliency delivery model. Understand the potential network latency, and define the cloud architecture that will support the resiliency requirements. Ascertain legacy resiliency processes that may need to change, including plans, policies and procedures such as training and communication. 16

9 The next step is to build a transformation strategy and develop a design. Step 2: Design Identify candidates with cloud resilience affinity. Perform financial analysis, proposed resilience tiers placement, architectural diagrams, and executable transition plan Design and construct the transition plan, being mindful to manage the different application-specific SLA's. Help manage quality, security and compliance. Integrate resilience cloud solution and legacy recovery into one cohesive picture determined by which of the traditional processes in the organization needs to be preserved. Update policies and procedures, and identify and document changes to management and legacy recovery processes. 17 The third step is to understand migration, standardization and registration issues. Run a pilot program in which the initial installation or instance is convened at a test center and subsets are tested. Educate all personnel so that they are well versed in the new environment, including how to use the cloud-based services, what changes have been made to recovery procedures and the use of the recovery and testing portal. Hands-on supported transition provides education through example rather than by trial and error. Deploy the new solution. The move begins, validating each new service until the enterprise is confident that it can manage it. Step 3: Transition Provision target resilience environment. Using methods and tools, we automate, virtual or physical servers for recovery and configure the workload for resilience testing. 18

10 The final step is remediation, testing and workload transition to cloud-based disaster recovery. The solution team supporting the transformation should help manage the organization s environment remotely either as a dedicated or shared resource depending upon the client s requirements. Monitoring key performance indexes (KPIs) allows the organization to optimize system response time or other performance attributes. The network, servers, storage capacity and productivity are tweaked to exploit their full potential. Testing is a critical aspect of the transformation phase. The cloud-based solution must be able to be integrated with the existing resilience testing program. Step 4: Transformation Test the resilience strategy, gain customer acceptance, and perform transfer to ongoing management. 19 There are many cloud options to evaluate that can be leveraged effectively to meet your business resilience needs. Cloud computing has unique attributes that drive value, flexibility, and scalability: ever-present, convenient, on-demand network accessibility shared pool of configurable computing resources rapid provisioning and release of computing resources minimal management effort or service provider interaction Three types of cloud resiliency scenarios Manage it Yourself Create virtualized, scalable cloud environment to backup and recover your traditional data center services across several service tiers. Hybrid Cloud Blend private and public cloud services to meet your business demands for agility as well as risk appetite for sensitive applications and data. Resilience as a Service Subscribe to cloud environment that you buy on a pay-per-use basis with varying rates based upon resilience requirements for appropriate data services. Source: Based on National Institute for Science and Technology (NIST) definition of cloud computing 20

11 The result is a cloud based resilience solution customized to your unique needs for recovery, continuity and availability. Resilience Tiers including technical requirements for: Security Data latency tolerance Network bandwidth optimization Testing requirements Architectural drawings and work products that describe the solution Recommended actions to integrate your program with legacy recovery solutions and changes required to policies, plans and procedures Transition Plan describing the implementation steps and changes needed to support resilient cloud Recovery Test Plan describing the test goals and use cases to validate the resilience cloud File Plan (optional) that describes data and hardware that can be reprovisioned or retired Transformation services to help you transition to your customized resilience cloud 21 Observations and recommendations. Cloud is here to stay and is a viable option for disaster recovery Not all platforms or applications will be in the cloud, so you need to integrate traditional DR and cloud-based DR A structured approach is needed to understand the company architecture and the best way to integrate Identification of appropriate workloads for cloud is key Don t forget about compliance Create a workable implementation plan that provides adequate time for adoption Experience matters when choosing a consulting or cloud managed services partner most of the DR fundamentals still apply (i.e. testing) 22

12 Here are three steps you can take to start to improve your recovery times. Learn about cloudbased disaster recovery. Understand how cloud-based disaster recovery can offer significant benefits over traditional disaster-recovery methods. Consider an IBM SmartCloud Resilience Consulting engagement to begin to transition to the cloud. Watch the video Download the following: The case for cloud-based disaster recovery Q&A with SmartCloud VSR experts SmartCloud VSR white paper Download the paper Transitioning business continuity to the cloud 23 Hot off the press! Findings from the 2013 Reputational Risk Study. Increasingly, the Chief Digital Officer will own reputational risk X As cybercrime escalates, so will reputational risk Social media is the best tool you have to minimize reputational damage Reputational risk will become a primary justification for IT investment Your partners compliance with your security and continuity standards will be mandated 24

13 Visit the IBM booth and complete 7 simple questions to get your Reputational Risk score and get an ipad case. 25 Thank you Richard Cocchiara IBM Distinguished Engineer rmcocch@us.ibm.com ibm.com/services/continuity 26

14 Copyright information Copyright IBM Corporation 2013 IBM Global Services Route 100 Somers, NY U.S.A. Produced in the United States of America February, 2013 All Rights Reserved IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corporation in the United States, other countries, or both. If these and other IBM trademarked terms are marked on their first occurrence in this information with a trademark symbol ( or ), these symbols indicate U.S. registered or common law trademarks owned by IBM at the time this information was published. Such trademarks may also be registered or common law trademarks in other countries. A current list of IBM trademarks is available on the Web at Copyright and trademark information. Intel, Intel logo, Intel Inside, Intel Inside logo, Intel Centrino, Intel Centrino logo, Celeron, Intel Xeon, Intel SpeedStep, Itanium, and Pentium are trademarks or registered trademarks of Intel Corporation or its subsidiaries in the United States and other countries. Microsoft, Windows, Windows NT, and the Windows logo are trademarks of Microsoft Corporation in the United States, other countries, or both. Other company, product and service names may be trademarks or service marks of others. Use of the information herein is at the recipient's own risk. Information herein may be changed or updated without notice. IBM may also make improvements and/or changes in the products and/or the programs described herein at any time without notice. References in this publication to IBM products or services do not imply that IBM intends to make them available in all countries in which IBM operates. 27