An Insite White Paper. Managing the Risks of Business-Critical Applications, Reliably. Overview and Checklist for Mid-market Companies

Transcription

1 An Insite White Paper Managing the Risks of Business-Critical Applications, Reliably. Overview and Checklist for Mid-market Companies

2 Managing the Risks of Business-Critical Applications Introduction A decade ago, only Enterprise businesses could claim that software applications were business-critical to them, in that IT system failure would directly result in loss of revenue and profits. Recognising the business risk and their dependence on IT, the majority spent vast sums on implementing fault tolerant solutions, including disaster recovery to manage the risk of catastrophic Data Centre failure. Meanwhile, the majority of mid-market companies employed software solutions on a piecemeal basis to improve efficiency and gain a better understanding of business performance. However, manual processes could always prevail if IT systems fell over. It was rare that a midmarket business had implemented and genuinely relied on a business-critical application. Fast-forward to the present day where application costs have decreased, whilst functionality has increased tenfold, and those companies who relied on manual process when systems broke down find themselves in a new era. Just like Enterprise organisations before them. IT systems have become intrinsic to the existence of mid-market companies, with the majority of business functions heavily reliant on business-critical application uptime and performance. Crucially, if business-critical systems fail, mid-market companies revenue and profits are adversely affected and manual processes are no longer able to provide a credible safety net. Whilst Enterprise organisations have always aligned the support and management of business-critical applications with business risk, many mid-market companies do not recognise the risk and are left vulnerable and hurting when systems fail. So what do you need to consider when deciding how to support business-critical applications? Our nine-point checklist is a good place to start. Key drivers of increased dependency on IT systems

3 A 9-point checklist 2 Ensure that the support is regulated by a robust service level agreement. Evaluate the real risk of application failure 1 with department heads and engage with a support provider who has appropriate capabilities and pedigree. Specialist, external organisations are usually better equipped to provide these services as their personnel are focused on business-critical applications all day, every day, without the distraction of more general IT support requirements. When selecting an external provider, ISO accreditation should be considered mandatory to demonstrate sufficient operational rigour and controls to guarantee the security of your data. This accreditation provides substantially greater assurance than flashing lights on the latest firewall or other security appliance. The last thing you need when staff is unable to work due to IT system failure is a laissez-faire, best endeavours approach to problem resolution. Make sure response and fix times are guaranteed and a clear escalation path all the way back to the software vendor is in place. This should be mandatory regardless of whether systems are supported internally or outsourced. Critically, if you use a Cloud or managed service provider, be clear on what they are guaranteeing with regard to actual application availability/uptime. (Insite is unique amongst Cloud providers in that it provides contractual guarantees of application uptime, not just operating system availability.) 3 Always have a support arrangement with the software manufacturer. Today s applications are complex and faults will always occur which only the manufacturer can resolve. It is normal for system integrators implementing applications to include this level of insurance as a component of a more proactive support agreement. Mid-market businesses investment in IT risk management compared to business dependency on IT If you use a Cloud or managed service provider, be clear on what they are guaranteeing with regard to actual application availability/uptime

4 4 Don t expect applications to be self-maintaining. 6 Always ensure that IT infrastructure has capacity. In addition to the right mix of support processes, skills and a SLA, applications need to be continuously monitored so that minor faults can be identified and resolved before they manifest into something more malicious which takes the application offline. Experienced providers will utilise Synthetic Transaction Monitoring to perform simple tests of application availability and performance every 10 minutes. This technology is increasingly important as it is the only objective measure of application health. In a world where many mid-market companies make purchasing decisions based solely on cost, inadvertently omitting risk management, it is all too tempting to spend the bare minimum on IT infrastructure instead of setting a realistic budget. You cannot get a quart out of a pint pot. IT is similar in that application performance will be unpredictable and slow if insufficient resources are deployed - two words which should never be associated with applications on which your business is dependent. 5 Don t expect IT infrastructure with single points of failure to be resilient. 7 Always test new developments before making them live. Individual hardware components fail from time to time - it is not a case of whether something will break, but when. Resilient infrastructure for today s applications is no longer eye-wateringly expensive, so single points of failure should be engineered out from day one to avoid costly failures in the future. Whilst this may be stating the obvious, many organisations do not adhere to a release process which enforces rigorous testing of application enhancements before they are applied to production. It is essential that isolated Development, Test and Training environments are available to manage this risk. Business vulnerabilities as a result of lack of investment in faulttolerant solutions and disaster recovery capabilities

5 8 Always plan and authorise changes. Change management and authorisation using one straightforward, repeatable process goes a long way to ensuring systems are not disrupted by own goals or knee-jerk reactions. It s important to consider the impact of all changes before any are made and to identify a regression path which quickly returns your system back to a fully functional state. 9 Always plan for the worst case scenario. Murphy s Law is real, extremists commit acts of terrorism and life is not always predictable. For these reasons organisations should consider a disaster recovery plan which includes secondary infrastructure based at an alternative location for IT continuity. Whilst this may seem expensive and unnecessary, consider what would happen if your critical applications were unavailable for weeks or even a month. The likelihood is that it took months to implement your applications so it is unreasonable to expect them to be rebuilt and available in a matter of hours. There are a plethora of DR solutions on offer, but always focus on the time it takes to invoke the DR solution (Recovery Time Objective) and the age of data residing on the DR infrastructure relative to the failed production infrastructure (Recovery Point Objective). In the absence of a fully-fledged DR solution, reliable backup procedures should be in place which enable point in time recovery and copies of critical data should be stored off site. Organisations should consider a disaster recovery plan which includes secondary infrastructure based at an alternative location for IT continuity

6 Public Cloud vs Insite Private Cloud Hosting your business-critical applications in your own Private Cloud from Insite rather than a shared Public Cloud brings major benefits. The diagram below demonstrates very clearly the Insite advantage in relation to managing your business risk. The diagram below demonstrates very clearly the Insite advantage in relation to managing your business risk and guaranteeing uptime for business-critical applications. It shows the significant value-add of the Risk Management Services that sit on top of Insite s Private Cloud platform. In addition, the Insite platform itself provides significant extra benefits compared to Public Cloud offerings Total Solution 24/7 Application Monitoring Security Incident & Event Monitoring Partial Solution = Variable Application Performance >99.9% Availability 24/7 Platform Monitoring Microsoft Software Virtual Servers Only Vulnerability Assessments 24/7 Server Monitoring 24/7 Servicedesk Operational Support SQL Database Administration Patch Management / Windows Updates Change Management Backup Management / Anti-Virus = Consistently Optimal Application Performance >99.9% or 99.95% 24/7 Platform Monitoring Microsoft Software Virtual and Servers Guarantees, or application uptime Guarantees optimum application performance Internet Only Connectivity Internet and Secure Hosting (ISO 27001) Secure Hosting (ISO 27001, ) * Depending on the platform specification agreed with the client.

7 10 reasons to engage Insite Ownership - Insite takes total responsibility for application uptime and performance enabling its clients to focus on revenue generation and competitive advantage by leveraging the power of their business systems Guaranteed application uptime of >99.5%, >99.9% or >99.95% - Insite is unique amongst Cloud providers in offering this SLA-bound guarantee Business-critical ethos - we understand the need for business-critical systems to be constantly available; highly pro-active support is focused on application uptime as well as infrastructure maintenance Secure - ISO 27001:2013 accredited by the United Kingdom Accreditation Service. IL3 and Cyber Essentials Plus accredited by the Cabinet Office and UK Government European leader - Insite is a Private Cloud and Managed Services Specialist, and a European leader in the hosting of business-critical applications Deep skills and mature processes - highly demonstrable, market-leading pedigree with Microsoft Dynamics, SunSystems, JDE EnterpriseOne and other business-critical applications dependent on Microsoft SQL Server State-of-the-art Private Cloud - consisting of 3PAR high performance storage arrays supporting a hybrid of physical and virtual servers dedicated to the exclusive use of each client Cost effective - compared to procuring infrastructure and retaining skills in-house, Insite s Private Cloud can provide costs savings of up to 30% Stress-free support - Insite s Private Cloud ensures that IT personnel never become bottlenecks and clients do not have the bother of recruiting, training and retaining expensive IT resources Passionate and effective - Insite is an agile business with an exceptional pool of technical talent. We are passionate about what we do and take the utmost care of our clients. Most importantly, we do not suffer from the apathy often associated with our peer group.

8 A selection of Insite clients Insite is the UK s leading service provider for business-critical application hosting and Private Cloud solutions. If you would like further advice or clarification on any aspect of this subject or White Paper, please get in contact. Insite Ltd. Insite Data Centre, Unit 21, Chapman Way, Tunbridge Wells, Kent TN2 3EF Telephone +44 (0) enquiries@insite-europe.co.uk ISO27001:2013 Member of SN Registrars (Holdings) Ltd 8327 Copyright 2016 Insite Corporation. All rights reserved. Issue