Cloud and Big Data: Business Continuity for Outside of the Enterprise

Transcription

1 Cloud and Big Data: Business Continuity for Outside of the Enterprise Daniel Mikulsky, MBCP Business Continuity + Disaster Recovery - Offering Manager dmikulsk@csc.com CSC Global Cybersecurity - Delivering Cyberconfidence

2 The Plain Truth: The breakneck implementation of cloud computing has propelled mission-critical processing outside the enterprise The experts of "big data" analytics are pulling in data from multiple sources from way outside to generate information that drives revenues. The boundaries for disaster recovery are now more porous than ever Every business continuity planner needs to devise strategies for cloud and big data within the business continuity management framework.

3 The 3 rd Platform is Driving this Change! DR returns to Operational Cost model but now with instantaneous RTOs and RPOs What will DR look like? Source: IDC Predictions 2015 Accelerating Innovation - and Growth -on the 3 rd Platform December 2, 2014 DR transition to Midrange computing lost economies of scale. DR was conceived in the Mainframe era

4 Cracks and Fractures in Information Technology Delivery Public Private Hybrid Bursting CAPEx to OPEx Risk DRaaS RaaS BIA Plan Test All about the App SMAC Data Science The Internet of Things Outside in Implications on Business Continuity and Disaster Recovery

5 Enterprise Business Continuity Management- Large, Complex, but Contained!

6 Public Cloud AWS, Microsoft, Google Public Cloud Cloud is where Compute, Storage and Services are purchased on demand Hybrid Cloud Private Cloud Private Cloud with Bursting to Public Cloud Private Cloud

7 Financial Benefits - 3 rd Platform return from CAPEx to OPEx 1 st Platform - Mainframe RTO > 24 hr RPO > 24 hr Cost Efficiencies: Recovery off of Tape Subscription service - Equipment on demand At time of testing (ATOT) and at time of disaster (ATOD) Compute, storage (tape drives and DASD), other equipment or services. 2nd Platform Midrange RTO > 1 hr RPO < 15 minutes (asynchronous and dependent upon bandwidth) 3 rd Platform Cloud RTO < 1 hr? RPO < 15 minutes? Recovery to a Cloud Less Cost Efficiencies: Subscription service - Equipment on demand ATOT and ATOD for compute, rapid obsolescence of midrange computing systems. CAPEx Investment /Disadvantages: Storage is an upfront capital expenditure, purchased for an average of 5 years based on uncertain usage estimates Storage purchased today for a requirement 5 years away is more expensive than if purchased in the future (18 month rule on storage) Gold copy For testing, doubles the storage at the DR location Fixed Recovery Site What if DR center is also at risk? Cost Efficiencies: Equipment on demand Compute, storage, other equipment or services are procured ATOT and ATOD not tied to an annual subscription or contract Avoid capital expenditures for equipment that is only needed ATOT and ATOD Different storage options avoid entire duplication of storage for the Gold copy Available only for applications which can be virtualized note: most mission critical applications tend to be legacy applications which are not easily virtualized.

8 Cloud Computing Hyperscale Data Centers Meaning for BC-DR Currently holding back the deluge of mission critical applications that can move up to the Cloud BCM Program - Anticipate heterogeneous IT of onpremise, and multiple Cloud providers (public, hybrid, private) Cloud Risk - Physical Disruption Low. Goal: % or 11 9 s uptime or 32 milliseconds down-time per year Risk - Cybersecurity Current Pain Point Stronger reliance on BIAs - Hybrid Clouds and Solving Cybersecurity Explosive migration of mission critical applications which can be virtualized moving to the Cloud A New Financial Risk Tracking of Cloud Apps Forgetting DR Planning and Testing Cloud Provider accountability

9 Is Verizon s 40 Hour maintenance window acceptable? Cloudy Interpretation of Resilience Engineering: 11 9 s uptime or 32 milliseconds down-time per year (except for maintenance) claimed is for data durability, not availability Data is durable when stored at other sites, but may not be available when needed Uptime Institute: Tier 1 (99.671%) status would allow minutes or hours Tier 2 (99.741%) status would allow minutes or hours Tier 3 (99.982%) status would allow minutes Tier 4 (99.995%) status would allow minutes Hadoop in 3 Tier 4 data centers would yield (.005) 3 = or rounded to 11-9s Resilience Engineering is Ignoring that Operational Risk Combines: Risk Categoreis: (i) Facility Risk (ii) Security Risks (both physical and data (iii) integrity) (iii) Reputation (iv) Procedural (v) Information Technology (including (vi) operational infrastructure) (vi) People (vii) Supply Chain (including outsourcing) (viii) Compliance Warning 1: Misinformation about Cloud Resiliency and impact to organization s risk profile abounds Risk Exposure: (i) Natural, man-made, or technological (ii) Accidental versus intentional (iii) Internal versus external (iv) Controllable exposures/risks versus those beyond the organization s control (v) Events with prior warnings versus those with no prior warnings

10 Disaster Recovery as a Service (DRaaS) or Recovery as a Service (RaaS) Application and Data on Cloud Disaster Recovery Procured from within Cloud DRaaS for on Premise Applications and Data Operational Factors: Applications which can be virtualized Boon to small-tier and mid-tier business that have mission critical applications that are capable of being virtualized Virtualized Cloud First Applications Development Policies Lagging for large-tier or enterprise level organizational tied to legacy infrastructure App Data App Data Warning 2: Caveat Emptor Too Many Loose and Wild Claim are made about having Full Disaster Recovery and True Business Continuity Warning 3: Insist on a Disaster Recovery Plan and Insist on a full failover Disaster Recovery Test - Business Process

11 DRaaS/RaaS Difficulty Reporting/Sizing a Disruptive Market Gartner predictions: Predicts DRaaS market could be worth $5.7 billion by 2018 By end of 2014 (five months ago) 30% of mid-size companies will have adopted DRaaS Gartner in November 2013 Evaluated Different Classes of Providers: Communications Service Providers (CSP) NTT Communications, Verizon Terremark Direct Cloud Recovery Axcient and Evault Hosting and IaaS providers Bluelock hosting, IRP International, Rackspace DR service providers HP, IBM BCRS, SunGard Availability Services AWS? Microsoft? Google? CSC? Gartner has made two important (recent) distinctions in defining this service: DRaaS - VM replication, VM activation, exercise management and servicing customer disaster declarations RaaS - VM replication, VM activation only Magic Quadrant April 2015

12 World Wide Cloud Storage Deployments

13 Big Data And the Internet of Things Next generation of Data Warehousing and Data Mining Already well established in retail buyer loyalty cards/programs contributing by incremental revenue customer experience analytics (80% of current Big Data applications) monetizing customer behavior, personalizing customer experience reversing commoditization. The era of the Data Scientist explosive career growth New opportunities Revenues from side business Case Example - Energy Industry Data Science company also uses its Crowd source list of Data Scientists for advertizing for new employment How Unexpected New Revenue Can Emerge From Big Data Forbes 12/04/2014

14 What is driving this change? Business Drivers Business transformation through industry profitability, growth, and margins Business models linking multiple supply chains across various industries Social Drivers Future of work - Skill set changes dictated by 3rd Platform technologies and aging IT workforce Employee mobility and flexibility of workforce that creates new challenges for productivity and security - Connected Culture Government policy/support: Progressive deployment of sensor-based technology to enhance Smart City, smart water, and smart energy programs as part of sustainable lifestyle in major urban developments Technology Drivers Leveraging the 3rd Platform: Seeing ROI from first-generation Big Data and analytics investments Launch of cloud-first policies, especially for infrastructure-related investments - 3rd Platform solutions becoming less expensive Commoditization of sensor technology - Many IoT deployments consist of multiple sensors to map and monitor their situation or environment. Normal price curve reductions over the past five years have lead to more deployments and use cases of IoT sensors. Data-driven experiences - Connecting people, data, things and the desire to use data to make decisions that affect behavior or outcomes Source: IDC FutureScape: Worldwide Internet of Things 2015 Predictions December, 2014

15 3 Vs of Big Data and yes, even cows on the IoT! Volume Terabytes Records Transactions Tables, files 3 Vs of Big Data Velocity Batch Near time Real time Streams Structured Unstructured Semi-structured All of the above Variety

16 Big Data is basically about turning large data into small data (information) by bringing compute to the storage

17 Framework of Tools Open Source Apache Decouples compute nodes from storage Master nodes job tracker and name node Slave nodes task tracker and data node MapReduce calculates from big data at the slave node, and sends little data back to the master node. Fault Tolerant for storage HDFS stores a minimum of 3 copies of data at different slave nodes Fault Tolerant for Processing 2 master node copies for processing.

18 The Direction is No Longer Exclusively from Inside to Out (of the enterprise house), it is Now Outside In Business Continuity Planning to Govern the Geographic Dispersal of the HDFS copies and Master Processing Nodes.

19 Change in Process Application Infrastructure Planning Model Decoupling and Dispersing of Data from the Core Applications! Big Data with Map Reduce Big Data and Map Reduce DRaaS for on Premise Applications and Data Big Data with Map Reduce Disaster Recovery Procured from within Cloud App Data App Data App Data Application and Data on Cloud Business Process Business Process Yesterday or Today Tomorrow

20 My Prediction for our Profession in 3 to 5 Years Professional Practice 2 Newly Defined Governance, Risk, Compliance Professional Practice 8 Exercise, Audit and Maintenance Yesterday or Today Once a program is established, most of the cost, labor and effort is dedicated to DRP annual testing and plan maintenance Tomorrow - Testing itself will change from a project to a service ticket Tomorrow More time will be required for Governance, Risk, Compliance. Beyond Tomorrow (and here today) Dynamic Testing - Network World July30, Netflix uncages Chaos Monkey disaster testing system As cloud outages continue to rage on, Netflix has open sourced a tool enterprises can use to test the resiliency of their cloud architectures

21 Prediction 1: The industry is splitting between those companies that provide IT and DR (Cloud providers) and to consumers of IT: Providers - DR Planners that work for IT providers will need to provide DRPs and Test Management Plans that conform to regulatory requirements mandated by their clients Consumers - DR Planners that work for IT consumers will evolve into Business Continuity Risk Managers The role of the Business Continuity Risk Manager will emcompass Governance Risk Compliance, since a majority of the of IT services will be provided from outside the organization A new set of software management tools and data structures will be needed to provide GRC the rise of metadata!

22 Americas Europe Asia Clouds Have Regional Separations Hadoop Prescribes Three Data Copies Two Issues Remain for Effective DR: Regional Separation of Data Copies within the Cloud Hadoop HDFS Data Sovereignty when implementing DR Security Professionals are discussing implementing metadata (data about data) to track security for GRC As more IT processing moves to Cloud and Big Data, the criticality of developing a metadata standard will be necessary to verify recovery capability. Australia

23 Prediction 2: Metadata standards will develop for IT Security and Business Continuity Assurance to track multiple copies of data files for: Data sovereignty Regional separation IT hardware (especially Storage Management Systems) will be equipped with GPS (Global Positioning System) and timestamp the metadata with GPS location as the data is written to Storage Management Systems A new set of software management tools that read metadata from the Cloud will provide Business Continuity Risk Managers management over data and applications resident in the Cloud governance and control over applications and data outside of the Enterprise.

24 Proposal to Revise DRI International Professional Practice 2 Proposed: Given the disruptive changes in information technology through the rapid move to Cloud Computing, Big Data, Mobile Computing and The Internet of Things; Given that the DRI International Professional Practices are the leading set of Professional Guidelines by which other standards and professional guidelines emulate, and Given that DRI International respects the professional vision, knowledge and foresight of its Master certified and Certified professionals, I hereby propose that DRI International formally empower a committee to investigate a full revision, and expansion, of Professional Practice 2 from Risk Analysis to Governance, Risk, Compliance.

25 What Predictions or Proposals Do You Want to Make?

26 Daniel Mikulsky, MBCP Business Continuity + Disaster Recovery - Offering Manager dmikulsk@csc.com CSC Global Cybersecurity - Delivering Cyberconfidence