A Practical Guide to Business Continuity

Transcription

1 EFFORTLESS DATA WHITE PAPER A Practical Guide to Business Continuity 1

2 Executive Summary One of the most important, but seemingly most overlooked, aspects of a complete data protection solution is a Business Continuity plan. The list of why s are endless, and common: the cost of implementing a plan seems expensive, the planning itself takes more time and follow through than budgets and IT departments allow for and finally, the question always remains, when will you actually use it? Too often, Business Continuity (BC) and Disaster Recovery (DR) planning fall by the wayside for these exact reasons. However, business continuity is the most important planning you can do. After all, what happens when you can t get to your critical data? The trick is to use a little common sense and whittle the job down to practical terms that can be implemented, budgeted and executed in a timely manner. The goal is to never have to use BC and DR plans other than verify that they work but to have just enough insurance and resources to keep things going without hurting the operations of the business. The following whitepaper is a practical guide to building an affordable, but comprehensive, business continuity plan that is part of a an end-toend data protection solution. Defining Business Continuity and Disaster Recovery SnapServer SAN Manager can monitor and manage multiple S2000 storage systems locally or remotely using a local windows application or via web browser in heterogeneous environments. The GUI accesses storage event logs and immediately displays any faults. Notifications or text events can be sent to system administrators or even to a remote management organization. Business Continuity Business Continuity is the ability to keep vital business operations running in the event of failure in the existing infrastructure. Typically, when a part of the existing infrastructure fails, IT is expected to provide a response within a given time period, typically referred to as an SLA (Service Level Agreement). These failures can include power failures, application errors, network failures, data integrity issues, human error or any other issue where the majority of the infrastructure is still in place, but operations are halted and need to resume. Disaster Recovery Disaster Recovery is when the infrastructure is significantly impacted and no longer available, impacting Business Continuity. This is most often a major natural disaster or other act of God. The number one requirement in DR is that the data is protected off-site. Data is the only thing truly unique in the data center. It is the only thing that can t be readily replaced. Don t Plan for the Perfect Storm We have all heard the perfect storm scenarios where a random series of events has led to a seemingly inconceivable disaster. Often, papers on BC and DR site these major disasters as the reason for planning and funding these programs, when the reality is that they don t happen often and when they do it is almost impossible to plan for every imaginable disaster. The truth is, most BC/DR incidents are not full-blown natural disasters. According to Strategic Research Corp., the primary causes of BC/DR incidents are: 44% Hardware A system component fails (can include servers, switches, disk drives, RAID controllers and/or another core piece of infrastructure) causing either a loss of services or failure to meet a Service Level Agreement (SLA). 32% Human Error The primary cause of human error is either a mistake in a configuration setting, or issuing the wrong command on a production system. This can usually be prevented with testing, but often these changes are being made on-the-fly and time does not allow for adequate testing. This happens frequently after hardware replacement. 14% Software and Firmware Errors These failures are often related to operating systems hanging, driver incompatibilities and the introduction of new applications to servers that contend for resources. 7% Virus/Security Breach The reality of IT is that malicious attacks happen, often as system users download files from unsecured sites. These activities cause real problems that require a solid recovery plan. This is where the ability to maintain an RPO (Recovery Point Objective) is vital to bring systems back to the time before the attack without any data corruption. 3% Natural Disaster Natural disasters are often cited as a leading reason for BC and DR planning but they represent a relatively small percentage of actual BC and DR events. 2

3 Beyond the research related to the leading causes of BC and DR events, an IT manager needs to focus on having a plan and an agreed-upon response to his company s top concerns. We recommend building what-if scenarios and testing them to see what you have, what you need and where the gaps exist. For example: What if we have lost our RAID array? What if we have lost our primary network switch? What if we have lost our tape library or Virtual Tape Library? What if we have corrupted our finance, web, or application server? What if we have lost all power to the data center? What if we only have our backup tapes and all the hardware is gone... how do we recover? Regulatory SLAs for data protection are...? What if we need to restore all data in (XX) minutes or hours? Like most design efforts, greater value is achieved from time invested up front. The next section outlines a model to build a BC/DR plan. Key Points of a BC and DR Plan To state the obvious, the most important thing is to have a plan and to have set the proper expectations about the effectiveness of the plan based on business and technical resources. Next, is to conduct an initial test of the plan, review it on a regular basis and conduct spot tests on a random basis. The base process for BC and DR plans is simple: 3

4 Step 1: Define and Assess What are the priorities of your organization? Familiarize yourself with corporate goals and be sure to get buy-in for your plan from the CEO and other key executives. Understand what issues you face from business, contractual and regulatory perspectives, and set these as a minimum. Define how long your business can be without IT services. Once you have defined what needs to be done (key applications and services), and how long you have to do it, (your Service Level Agreement), then the process becomes more manageable, budget-friendly and executable. Typically, the top items for small business are: Keep Revenue Flowing Keep Communications Up ( , IM, Phones) Keep Customers Engaged and Happy (Web Site, Service and Shipping) Track the Transactions (Billing and Accounting) Step 2: Research and Recruit Now that you know what needs to be protected and the SLAs required, talk to your internal sponsors, suppliers and partners to find out what tools and options are available, then build a set of key data (equipment, services, budget) to help get ready for designing a solution. This is a topic that has been well documented by other companies and information on best practices is easily accessible online. Step 3: Design Hit the whiteboard and map things out! Document the design, then outline the testing and ongoing monitoring of the plan and tools. This is where the greatest cost and your greatest success will come from. At this point, you should bring in not only technical resources, but also business partners to test the impact and implications of the proposed plan. Step 4: Implement Now that you have a plan, process and budget, get the equipment and start implementing the BC/DR changes. This will almost always be a phased approach designed to reduce impact on production systems. Implementation should be based on business risk reduction, budget realities and technical capabilities. Make sure this phased approach is supported by your business champions as well as the IT team. Step 5: Validate Once you have the first four steps implemented, we suggest two ways of validating the BC/DR plan. The first is from Jon Toigo, CEO of the Data Management Institute. He suggests walking around the data center and placing colored Post-it notes on hardware throughout the room. For example, a yellow Post-it would signify a hardware failure, while a blue Post-it would signify the application running on that device failed. Then gather your team and workshop each step of the solution, ensuring that the team clearly understands what needs to be done in the Post-it scenario. The second way of validating your BC plan is to actually take your systems down, and then clearly document, step-by-step, the process to rebuild the application, the network or storage to an operational state. This way, you clearly understand how it affects users, the business and your customers. Step 6: Maintain Make sure your have the tools and software in place to monitor the equipment and networks you need available for your BC and DR plans. Ensure that you have budgeted for on-site spares or the proper service contracts. Building the Plan and a BC/DR Score Card It is easy to over-build a BC/DR plan, so we have provided a few simple tools to help you work through the key what-ifs and to help with budget justification. The first tool is the BC/DR score card that will provide you with a checklist to help analyze your needs. Following is a sample BC/DR score 4

5 card that has been completed. There is a blank score card for you to use at the end of this white paper. The second tool is a BC/DR justification tool. One significant challenge for most BC and DR programs is getting budget. This interactive tool found at will help you size the impact for not planning or investing to protect the company. In a recent report from Network World, A conservative estimate from Gartner pegs the hourly cost of downtime for computer networks at $42,000, so a company that suffers from an average downtime of 175 hours per year can lose more than $7 million per year. Obviously, this estimate is based on a larger organization, but the cost of downtime is not just a single number, it varies by applications and company size. Please visit to plan a customized cost for downtime for your company. 5

6 Building the Plan and a BC/DR Score Card In a recent paper from ESG (Enterprise Strategy Group), they polled IT managers using disk-based backup to meet specific SLAs for key applications. 69 percent of respondents had SLAs of less than two hours mere minutes to recover data for key transactional systems such as CRM, ERP, ecommerce and other mission-critical applications. When it comes to meeting SLAs, the storage part of BC and DR planning needs to provide three types of recovery: RTO (Recovery Time Objective) defined as how quickly IT managers can find, access and retrieve required information. RPO (Recovery Point Objective) defined as the point-in-time (PIT) the IT manager needs to be able to recover... or the requirement that he roll back to a specific moment in time. RPO is a measure of the tolerance for data loss, in other words, how many transactions or hours of work the company can tolerate losing. RGO (Recovery Granularity Objective) this is how granular the storage architecture recovery needs to be: file level, block level or at a transaction level. A combination of hardware and software is required to meet each of these recovery objectives. Each combination enables IT managers to meet the three dimensions of recovery, and provide the right level of support for each SLA. Disk-based backup is at the core of all these BC SLAs, in order to provide high-speed access to data and provide instantaneous recovery of data. Storage Networking and Consolidation: Partners in BC & DR Most IT managers have read about the benefits of storage networks (iscsi or Fibre Channel) to consolidate and share storage. Storage networking is also vital to building a cost-effective BC and DR plan. Storage consolidation centralizes resources, and storage networking ties them together so they can be migrated, replicated and protected without impacting production systems and to support SLAs. Storage networking links storage islands inside data centers, remote sites and hot sites. Storage networking and consolidation for BC and DR provide several other key advantages: Single Storage Protection Policy Consolidated storage is the key to building a solid and sustainable BC and DR plan. It enables IT managers to build a single set of data protection policies and have them executed in a unified fashion. When the storage is centralized it is easier to support SLAs with a single plan, it is easier to manage and easier to validate BC and DR plans. Rapid Restore for SLAs Storage networking, combined with disk-based backup, is vital to meet SLAs (that are often under one agreement) for business-critical applications such as transaction systems, web sites and . Off-site DR Again, the combination of storage networking and disk-based backup are vital to provide off-site DR and BC capabilities. The limited bandwidth of telecommunication lines require high performance and low latency storage for maximizing the use of expensive Telco lines and to ensure synchronous communications. Regulatory Requirements Almost every business has regulatory requirements related to data protection, security and application availability. For any public company and many companies that supply government agencies, BC and DR plans are requirements. The partnership of storage networking and storage consolidation provides the tools required to share and replicate data locally and over distances. Disk-Based Backup Solutions There are several options for disk-based backup to meet SLA requirements for RTO, RPO and RGO. As you would expect, the cost of these solutions is directly proportional to RTO, RPO and RGO access time objectives. The leading disk-based data protection solutions are: 6

7 Building a Consolidated BC Plan with Overland Storage Overland Storage has worked with IT managers to build a complete storage architecture that can support RTO, RPO and RGO needs of SMBs. The Overland Storage product family can provide an integrated and modular approach to storage for BC and DR and provides a complete set of solutions to plan for your BC and DR needs. Snap Server NAS Appliances A broad range of NAS appliances that share a common GuardianOS operating system and applications, Snap Server allow the deployment and interoperability of a complete NAS architecture from simple to complex IT organizations for a broad range of solutions. With advanced data protection features, including snapshot and capacityoptimized snapshot, Snap Servers are an excellent fit within any BC and DR plan. Ease of Implementation With the web based management user interface (Web UI), GuardianOS powered Snap Servers are easy to implement and manage. From initial setup and data migration to ongoing capacity expansion with Instant Capacity Expansion (I.C.E) capabilities, the Web UI is found to be very intuitive and easy to use. Heterogeneous File Sharing Protocols GuardianOS supports all native file sharing protocols including CIFS/SMB for Windows; NFS v2, v3 and v4 for UNIX environments, AFP for Mac OS environments and FTP and HTTP that support all standard computing environments. Block Level Protocols iscsi is provided by GuardianOS to support block-level interface programs such as database applications and Microsoft Exchange. RAID Data Protection GuardianOS supports many different types of RAID volumes to satisfy varying needs of performance, capacity and drive redundancy. Advanced Snapshot Capability Snapshots can be incorporated as a central component of your BC and DR strategy to ensure that all data in every operation is internally consistent and that no data is overlooked or skipped. Enterprise-level Replication Snap Enterprise Data Replicator (Snap EDR) is a high-performance network-optimized software solution for distributing, protecting, and reporting on business-critical information throughout distributed enterprises. It allows administrators to easily control the movement of files between local and remote GuardianOS-powered Snap Servers and Windows, Linux, and Solaris application servers from anywhere on the LAN or WAN. Snap EDR provides flexible scheduling as often as up-to-the minute, variable bandwidth throttling and compression. These features enable Snap EDR to offer maximum data protection without impacting users and applications. REO SERIES Virtual Tape Libraries Overland Storage s REO Virtual Tape Libraries (VTL) provides instant access to backup data to accelerate support for regulatory requirements and SLAs. VTLs provide the ability to cache data for traditional tape automation, as well as reduce the cost of archive media and storage by only making tapes for what is required by policy. VTLs are also ideal for backup from remote sites or to DR hot-sites. VTLs enable a single backup and data protection policy with high performance disk-based storage. Overland Storage provides a full range of VTL solutions from the SMB to the enterprise. REO Backup and Recovery Appliances provide: Storage Consolidation and Networking REO can consolidate all of your backup operations into a single networked solution to consolidate data protection, and optimizing your BC and DR planning. Flexible Functionality REO appliances can be easily configured as a virtual tape library, standalone virtual tape drives, and/or disk volumes (LUNs). Easy Integration REO is compatible with all popular open systems or Windows-based backup software, physical tape drives or tape libraries. It easily connects to Ethernet (iscsi) or Fibre Channel networks for seamless integration into existing backup environments. Disk Backup Performance when configured as virtual tape, data is written sequentially and in large blocks for fast, reliable disk backup and recovery operations. Dynamic Virtual Tape patent pending technology, which automatically sizes virtual tape cartridges to match the exact capacity requirements of the backup operation. 7

8 Ensures that no capacity is wasted and eliminates the manual effort and guesswork of sizing, configuring, and provisioning virtual tape cartridges. Virtual Tape Library (VTL) when configured as a VTL, provides user-definable virtual tape library drives, cartridges and partitions. NEO SERIES Tape Automation Tape is not dead it still provides the lowest cost per GB and is the most portable form of data archive. Tape continues to be the leading media for offsite storage. With the continuous growth of storage and new regulations, Overland Storage s NEO family of tape automation solutions provide: Storage Consolidation and Networking NEO tape automation solutions can consolidate all of your tape backup operations into a single networked solution to consolidate data protection to optimize your BC and DR planning. Ideal Long-term Storage for Archive NEO library provide ideal long-term, low-cost data storage and archiving solution for organizations with large amounts of missioncritical data. NEO libraries offer a robust, flexible, and reliable solution that can meet the needs of the most demanding data center environments. Scalable Low-cost Storage The NEO SERIES is designed to accommodate rapid growth and data center consolidation, with the ability to scale quickly to as many as 1,000 cartridges on 2 to 24 tape drives. It provides almost limitless flexibility with advanced nonstop operation, remote failover, and expansion-on-demand capabilities. And it supports a wide range of connectivity options, including SCSI, Gigabit Ethernet, and Fibre Channel. Flexible Virtualization The NEO line of tape automation solutions include a unique virtual interface architecture that makes it easy to use multiple interfaces simultaneously and implement future technologies as they become available. Summary Business continuity is a big issue for IT managers. It is at the heart of the services that IT managers provide for their businesses. Like most things, a little planning and preparation can go a long way in making a BC or DR program successful. The best way to proceed is to break the problem down into smaller pieces so they can be more easily managed. Overland Storage provides the tools and solutions for SMB IT managers to implement a complete and cost effective BC and DR program. We hope this paper and the tools provided will help you build a strong yet simple BC plan for your organization. 8

9 About Overland Storage Overland Storage is the trusted global provider of effortless data management and data protection solutions across the data lifecycle. By providing an integrated range of technologies and services for primary, nearline, offline, archival, and cloud data storage, Overland makes it easy and cost effective to manage different tiers of information over time. Whether distributed data is across-the-hall or across-the-globe, Overland enables companies to focus on building their business instead of worrying about data growth. Overland SnapServer, NEO and REO solutions are available through a select network of value added resellers and system integrators. For more information, visit Worldwide Headquarters 4820 Overland Avenue San Diego, CA USA Tel Fax United Kingdom (EMEA Office) Overland House, Ashville Way Wokingham, Berkshire RG41 2PL England Tel +44 (0) Fax +44 (0)