ManagingData in Troubled Times
The importance of data-recovery plans has never been more evident. For banks and other financial companies, tomorrow's goal is to make recovery a non-issue by ensuring continuous availability, even in a disaster, with a mixture of astute business practices and well-chosen technology.
Times are uncertain and when it comes to safeguarding data, financial institutions already possess a keen understanding of the need to prepare. Yet, while backup and recovery systems continue to fill vital roles, technology and revised business practices could act as catalysts for a new approach.
"Our industry has gone through a lot of changes over the years," says Pat Corcoran, chief of global marketing and business development for the Business Continuity and Recovery Services unit of IBM Global Services. "Back in the '60s and '70s, companies didn't really worry about having their systems up and running within 24 hours."
In fact, in the "old days," downtimes of a week were not only acceptable, they were a way of life. But, in a relatively short time, a transformation has occurred. By the 1990s, Corcoran says, a new term emerged: business recovery. And while the approach was "still reactive-it was still focused primarily on technology-the business elements were starting to pick up more." By the late '90s, a different concept took hold, driven more by organizational than purely technological considerations. This concept came to be labeled business continuity.
Corcoran traces the progression: "Years ago, the recovery could have been three to four days, if not longer. Now the recovery is 24 hours or less. What we see in the future is, there won't be any downtime" for the simple reason that "companies won't be able to afford downtime."
In coming years, the focus will shift to performance, he says. "So in the future, the continuity issue will be, not that you're down, but rather, is your performance at the level you expected to run your business."
Corcoran explains that the mission of IBM Business Continuity and Recovery Services is to handle technology, facilities and the "environment to house (a client's) people, whether it's at one of our facilities, at one of their facilities ... or a mobile facility."
IBM has 17 facilities nationwide, and worldwide it maintains more than 100 locations in 76 countries "that support technology across the board and user space." Sizes range from 25 seats to 500, he says.
There are two perspectives on data recovery, says Jerry Silva, senior analyst in the retail banking practice at TowerGroup, based in Needham, MA. When short-term data is involved, recovery can be a straightforward process. Picture a batch processing job that goes poorly overnight. In that instance, the recovery would involve reverting to "a good copy of the data prior to that batch job's running," Silva explains. "And that's something that operations systems face on a day-to-day basis, and they need to have good backups."
These types of backups usually span a two- to four-week period.
Long-term data recovery may be influenced by a number of factors, Silva says, including loss of the physical site.
To illustrate, he poses a few relevant questions from the bank's perspective: "Do we have a strategy or a policy that dictates how often we do the backups, what data sets we back up, and which of the customers' information or our own bank administrative information we back up?"
The physical media also play a role, he says, depending on whether data is going to be used short term and stored on magnetic tape or whether it needs to be put on optical disks for archival storage.
"So the data recovery issue becomes a lot broader in terms of how do we get that data back and where do we store the stuff, all the way down to the tactical: Do we keep it in-house? Do we buy a warehouse? Do we use a service like Iron Mountain (a record-management company) to take care of the actual media for us?"
When a recovery operation is necessary, says IBM's Corcoran, the typical scenario involves some type of an outage, whether it's "a hurricane, earthquake, flood, even the terrorist attacks." Bank managers must be careful in examining the issues involved in preparing for such an event and take care to avoid a common mistake-a flawed premise of sorts-that often arises because many people focus on technology or, more specifically, on the IT systems that would be unavailable.
"The real issue is not your systems," he says, but rather the fact that "information you need to manage and run your business isn't available."
When examined in these terms, the "big picture" becomes a panorama. "You can't just look at your own company," Corcoran says. "Today, most companies have virtual enterprise" operations as well, he says, with extensive communications between business partners, sales agents, suppliers and customers. All these interrelationships are factors to consider for a continuity and recovery plan.
"You've got to look at how your business functions and what outside or external sources could impact the flow of information from the business," he says.
For financial institutions, are some "old-school" approaches to recovery compatible with today's all-too-different times?
Silva says yes. "I've been involved in some contingency planning with financial institutions where they say, 'OK, what's the worst that can happen?'" He returns to two typical scenarios: a hurricane and a nuclear attack. "Frankly, in the planning sessions that I've been involved with, it's been good enough to take tapes that are stored off-site ... and have those tapes shipped to a disaster recovery site-for example, one run by SunGard-and then just load up their systems that way."
Others see the situation differently, including Robert Shinbrot, regional vice president for Oracle Financial Services Consulting, which delivers disaster recovery and continuity assessment, strategy and project implementation for banks and brokerage firms. "Traditionally," Shinbrot says, "a lot of financial institutions employ backups on a periodic basis, daily or weekly. And their theory is that if a disaster strikes, they restore from tape or some other types of backup devices, as well as maintenance windows and things like that."
Oracle's view, however, is that "maintenance and standard technology issues should not require bringing a system down." The same holds true for "backup and making systems available," he adds. "They should be available continuously and not require a restoration process."
On Sept. 11, both successes and shortcomings were evident in recovery/continuity efforts, says Raymond Paquet, a vice president and research director at Gartner Research. He illustrates the downside with a simple example. "If the data center was in Manhattan and your people lived in New Jersey or Long Island, they couldn't get to the data center because all the roads were closed," he says. "So, in a disaster recovery/business continuity scenario, you need to look at more than just the technology."
In addition, Paquet says, "more and more of these business systems are more and more intertwined with all sorts of different components. And the classic example of this is e-mail right now." While in the past, e-mail was not perceived as mission-critical to a transaction processing system or a trading floor system, "if all your notifications go out via e-mail, then you can't notify your customers. You've got problems," Paquet says.
Such added complexities will "create a re-prioritization, from a recovery perspective, of applications," he says.
In the recovery-plan learning process, IBM's Corcoran says testing is critical, although he prefers to use the word "exercise." The reason, he says, is because exercise is "something that makes you stronger. So if you ever need to use your strength, you have the capability; everything's trained to do it. Exercise is a better term." And when clients exercise their plan, he says, "every time, they're going to learn something and enhance it."
International Data Corp. research released in December 2001 examined IT spending, including disaster recovery and business continuity, in relation to both the economic slowdown and Sept. 11. Melissa Dragon, senior research analyst in IDC's financial services sector, prepared the study.
"Spending in data recovery, backup systems and remote access systems will be a function of how fast companies want to be up and running," she wrote. "Not only does this involve expenses for hardware, applications, storage and telecommunications but there is also a question of how prepared the partners of financial institutions are to address similar threats."
Gartner's Paquet says the attack on America has impacted institutions' budgets in the area of disaster recovery. "There was a massive flurry of activity in Q4 of 2001," he says. "However, if you think about a typical corporation, Q4 is budget time." The first and second quarters of this year are providing the opportunity to execute these budgeting plans. "So what we had is a lot of budgetary activity in disaster recovery in Q4, and now in Q1 and Q2, there should be more purchasing activity."
Paquet raises an important question: Does this level of activity point to a sustained market with sustained growth? "Historically, (disaster recovery) has been an event-driven mechanism, and the only caveat to this-and it's a very unfortunate caveat-is if we have another disaster, it will create another spike," he says.
According to Corcoran, shifts in recovery and continuity initiatives already are under way, and larger financial institutions are among the innovators. In the financial services industry, "recovery scenario solutions are moving more and more to be less than 24 hours," he says. Banks and other financial services companies need to be able to transfer funds quickly, and in many cases they are "mirroring their environments, or at least mirroring their operating system or their data, to our facility or to another facility, so they can have quick recovery," he says.
"So, I think in that case-in rapid recovery or high availability-they are leading the charge" among all industries, the IBM manager says of banks.
And Corcoran predicts the trend will continue.
In the future, when the idea of recovery will be supplanted by continuous availability and continuous performance, "I think the financial industry will be the ones leading that charge," he says.
