Public and Private Interdependencies Filling a Gap in Most Continuity Plans

Transcription

1 Public and Private Interdependencies Filling a Gap in Most Continuity Plans John A Jackson Executive Vice President Fusion Risk Management, Inc. The evolution of the continuity industrytechnology advancement and businesses dependency As the adoption of information technology has intensified, IT has become inseparable from the operational performance of the business. Management awareness of this is on the rise. As such, information based risk is being added as a focus item in corporate risk management programs. Business Resiliency Disaster Recovery Business Recovery Business Continuity Future In 2007, several trends will be Data integrity and availability will continue to be the top priority Contingencies for the potential loss or unavailability of personnel will get more attention Hot site vendor options will expand, as new offerings enter the market Internal or dedicated solutions will be more and will be the precursor to active active solutions The Integration of recovery, continuity, high availability and security into a Resilience strategy will accelerate A focus on Private and Public partnerships, emphasizing interdependencies, will gain more attention 1

2 The data explosion has spawned a variety of security and protection alternatives Data Integrity & Availability Solutions In 2007, several trends will be Data integrity and availability will continue to be the top priority Contingencies for the potential loss or unavailability of personnel will get more attention Hot site vendor options will expand, as new offerings enter the market Internal or dedicated solutions will be more and will be the precursor to active active solutions The Integration of recovery, continuity, high availability and security into a Resilience strategy will accelerate A focus on Private and Public partnerships, emphasizing interdependencies, will gain more attention Companies must prepare for the potential loss of personnel Most organizations build their plans around the inherent knowledge of their in-place staff 9/11 and Katrina made many organizations aware that personnel may not be available to support the recovery now the pandemic is reinforcing that concern Plans must consider that fact, and allow for alternate personnel to pick up and implement the recovery effort 2

3 In 2007, several trends will be Data integrity and availability will continue to be the top priority Contingencies for the potential loss or unavailability of personnel will get more attention Hot site vendor options will expand, as new offerings enter the market Internal or dedicated solutions will be more and will be the precursor to active active solutions The Integration of recovery, continuity, high availability and security into a Resilience strategy will accelerate A focus on Private and Public partnerships, emphasizing interdependencies, will gain more attention Finally, some new offerings Several boutique and new vendors are expanding or emerging to challenge the leaders Hosting vendors are trying to bridge the gap and become players The current leaders will feel the pressure as new and innovative options come to the forefront In 2007, several trends will be Data integrity and availability will continue to be the top priority Contingencies for the potential loss or unavailability of personnel will get more attention Hot site vendor options will expand, as new offerings enter the market Internal or dedicated solutions will be more and will be the precursor to active active solutions The Integration of recovery, continuity, high availability and security into a Resilience strategy will accelerate A focus on Private and Public partnerships, emphasizing interdependencies, will gain more attention 3

4 Companies are actively migrating to dedicated continuity solutions, and beyond! Applications are becoming so critical that a shared approach may no longer provide the required RTO. The amount of storage and data, coupled with shrinking backup windows, is making it difficult to backup all required data. As companies require more sophisticated solutions, the price delta between shared and dedicated narrows. Data protection technologies such as mirroring and replication restrict flexibility ATOD a big problem will most certainly arise. Interdependencies between applications and platforms are proving difficult to re-connect multiple sites during recovery. Many companies now have secondary data centers available to them because of mergers or acquisitions, plus there is an abundance of co-lo space from the dot com era. 1. Move to Dedicated Continuity Solutions None 8.62% Mobile Hot Site, 3.45% Hot-Site Vendor 49.14% Internal 31.9% DRJ Survey 2,204 respondents Reciprocal 6.90% What is Your Main Alternate Site Strategy? In 2007, several trends will be Data integrity and availability will continue to be the top priority Contingencies for the potential loss or unavailability of personnel will get more attention Hot site vendor options will expand, as new offerings enter the market Internal or dedicated solutions will be more and will be the precursor to active active solutions The Integration of recovery, continuity, high availability and security into a Resilience strategy will accelerate A focus on Private and Public partnerships, emphasizing interdependencies, will gain more attention 4

5 There is a continuing shift in what companies consider Mission Critical Accounting & Finance Manufacturing Data Warehousing Supply Chain Online Customer Interaction Instant Messaging Internet based Company s perspectives on application availability are changing Companies are becoming more dependent on critical applications. When a major application goes down, companies downtime tolerance is shrinking Companies who have not done a BIA or similar process in a few years are not recovering their most critical applications. 75% 50% 45% 40% 35% 30% 25% 20% 15% 10% 5% 0% CPM/KPMG Contingency Planning Survey of 778 business continuity professionals < hours hours >72 In 2007, several trends will be Data integrity and availability will continue to be the top priority Contingencies for the potential loss or unavailability of personnel will get more attention Hot site vendor options will expand, as new offerings enter the market Internal or dedicated solutions will be more and will be the precursor to active active solutions The Integration of recovery, continuity, high availability and security into a Resilience strategy will accelerate A focus on Private and Public partnerships, emphasizing interdependencies, will gain more attention 5

6 What is IT Resilience? I T Resilience supports Business Resilience by allowing the organization to Accomplish, Communicate, Respond and Sustain business operations in the face of positive and negative stressors. It is the evolution from a Protected to an Adaptive infrastructure, capable of meeting the organizations Capacity, Access, Performance and Availability requirements. I T Resilience is about: Ensuring the organization s ability to respond to business challenges Allowing seamless and continuous business transactions to occur Maintaining flexibility to meet changing IT demands Providing an infrastructure that compliments the rate of change Enabling the organization to meet security and privacy obligations Monitoring and predicting change to ensure continuity of operations In 2007, several trends will be Data integrity and availability will continue to be the top priority Contingencies for the potential loss or unavailability of personnel will get more attention Hot site vendor options will expand, as new offerings enter the market Internal or dedicated solutions will be more and will be the precursor to active active solutions The Integration of recovery, continuity, high availability and security into a Resilience strategy will accelerate A focus on Private and Public partnerships, emphasizing interdependencies, will gain more attention Why are Interdependencies so critical? No company is an island with its systems or operations Organizations depend upon the public infrastructure for critical services: Electric, Gas, Water, Telecommunications, Transportation Services including Police, Fire, Public Safety and Emergency Management Medical and Government Services Companies interact electronically with their suppliers, customers and partners Resilience and risk mitigation strategies must consider interdependencies in order to achieve their intended goals. 6

7 What are Public Interdependencies? Agencies and organizations that your business relies upon to operate Utilities - Electric, Gas, Water, Telecommunications Public services - Police, Fire, Public Safety, Emergency Management & Transportation Medical and Government Services Hurricane Katrina, 9/11 and Oklahoma City are graphic examples of this interdependency issue Why are Public Interdependencies Important? Recovery operations in your facilities are dependent on these services in order to operate Inoperative services and quarantined buildings or business zones may prohibit operation or even entry Infrastructure providers count on each other to do their jobs, assuming other services will be there when needed, but will they? People rely on infrastructure providers for health and safety What are Private Interdependencies? Relationships with other commercial organizations that are critical to IT They involve: Suppliers, Vendors, Customers, Trade Associations, Same industry partner or competitive firms 7

8 Why are Private Interdependencies Important? Disasters often affect multiple organizations, so others may not be up and running when you recover Once you recover, at home or at a recovery center, you cannot fully operate if others with whom you interact are not also operational September 11 brought this to light in the financial industry and drastically impacted some firms recovery timelines The recent Gulf Coast hurricanes reinforced the issue of interdependencies across multiple states Visualizing Interdependencies Emergency Services HEALTH, SAFETY Individual Customers DISASTER EVENT Transportation TRAVEL TO WORK Telecommunication VOICE DATA Electric Power HEAT Natural Gas WATER BANKS People Resource Local Remote Information Processing Local Remote Physical Plant Local Remote Business Customers Suppliers Federal Reserve Other Banks Water Supply Wastewater Other Organizations Addressing Interdependencies Organizations must plan for include external interdependencies in their business continuity plans considering the magnitude of current threats and the effect of these interdependencies Industries must create industry-wide business continuity plans for their members Organizations must take a systemic view of potential problems created by supplier, customer and other interactions at time of disaster Public agencies must understand the capabilities of private companies to respond to disasters Organizations like the FBI sponsored InfraGard group, Public and Private Businesses Inc and even the Red Cross are focused on highlighting and addressing this aspect of planning! 8

9 The Interdependency Workshop The workshop is designed to assist your organization in understanding: The risks you face based on your geographical location The interdependencies of the local public agencies and the infrastructures they provide The effect of a public infrastructure failure or outage on firms in a given geographic area The business to business interdependencies that exist How the interdependencies would further complicate, and possibly delay individual companies recovery efforts Steps in an Interdependencies Workshop Exercise Define a scenario Consider the geographic area Identify the Public Agency impacts Identify the potential business interactions Discuss the scenario and the interdependencies that might occur Defining a Scenario The infrastructure disruption under consideration may be due to a natural disaster (e.g. flood, tornado, ice storm, snow storm, etc.) or a man-made event (e.g., regional power outage) The disruption might affect a single infrastructure (e.g. electric, telecommunications, water, etc.), or a single building (e.g. fire, anthrax contamination) in the defined area of the city What are some likely scenarios for this community? 9

10 A Regional Event In Chicago Categories of Interdependencies to consider? Major Businesses Government Offices Utilities Medical facilities Transportation State Police & State Government Offices Secretary of State & Government Offices Boeing Corporation METRA ABN Amro Mayor & City Government Offices Northern Trust Chase Bank AT&T Long lines US Alcohol Tobacco & Firearms Harris Bank LaSalle Bank Bank of America US DEA & Federal Protection Services US Marshall METRA FBI / Secret Services Offices Federal Reserve Bank Federal Courts Chicago Board of Trade Identifying Public Infrastructure Providers Telecommunications (voice and data) Electric Power: Natural Gas City Water Department Other?? 10

11 Government Organizations and Agencies Federal State City and Local Fire Police Government, courts Emergency Management Private Companies and Businesses Who are the major businesses in your area Who are the people or organizations you interact with: Suppliers Customers Partners Competitors Trade Associations What to Know About Other Businesses Why is there an interdependency concern? What is their overall recovery strategy What is covered What is not covered and why not Recovery Time Objective by shared Application (time to recover and make operational) Recovery Point Objective by shared Application (how current will the data be) Recovery vendor and primary site if using a shared vendor Major business to business interface points, systems, data feeds Contact point during a disaster, and how to contact Major concerns about their recoverability 11

12 Interdependency Take-Aways Understand the potential interdependencies, the more prepared we will be to respond to crisis Develop a relationship with public agencies and having them understand your recovery capability may reduce interaction and potential friction when problems arise Minimize...One often encountered problem, misunderstandings between organizations, can be minimized by better understanding the interdependencies that exist Open Discussion Knowledge gained? Applicability to your plan? Regional considerations Putting the Focus on Interdependencies John A Jackson Executive Vice President Fusion Risk Management, Inc. JJ@FusionRiskMgmt.com (847)