When banks use the phrase cloud computing, the second word often heard is "control" particularly when considering how to manage business continuity for cloud-enabled functions. While many firms have balked at using cloud-based continuity because of concerns over added risk or lost control, early adopters say that with the right diligence, the cloud "is a beneficial contingency” particularly if the provider is carefully vetted.
"[With cloud-based] disaster recovery, you essentially pick up important capabilities at a reduced cost," says Bernard Golden, CEO of HyperStratus, a cloud computing consulting firm that details the different cloud options for firms.
To mitigate the perceived risk of ceding at least a portion of business continuity technology to an outside vendor, banks can choose a single-tenant private or internal could, in which some control is maintained at reduced cost savings (yet still less expensive than building out a full room backup servers). This "private" option is the choice favored by most cloud deployments for both functional and business continuity purposes.
For example, the Washington state-based Golf Savings Bank has placed business continuity for email, collaboration and loan origination functions in a private cloud that is provided and managed by Azaleos but resides in the bank’s data center.
"It makes perfect sense. You're compliant from a regulatory standpoint if you need to evoke [the continuity]," says Ellen Carney, a senior analyst at Forrester Research.
Golf is a long-time advocate of cloud computing, developing a strategy as early as three years ago, and has ramped up recently with the placement of SharePoint, the Microsoft collaboration product, and other functions into a private cloud. (Golf will merge into and take on long-time sister institution Sterling Savings Bank's brand later this fall ”a move that is not expected to impact the cloud strategy.)
CIO Karl Kurrle says the private cloud has built-in continuity. If there's a "catastrophic" event at the bank's primary data center, a backup location kicks in that's also managed as an internal cloud, giving the bank at least three layers of protection. "In the cloud environment other assets automatically take on the load."
Golden says that once banks get over their skittishness regarding turning over some control over continuity, it's a natural function to place in the cloud. "You can leverage someone else's infrastructure at a reduced cost. That's a very natural use case."
While the distributed nature of cloud computing has some backup baked in, it's still considered risky by many banks because of the reduced reliance on internal physical servers. Kurrle says placing emergency contingencies in the cloud does require a heavy dose of due diligence. "A [cloud provider] will tell you they 'have other servers' for business continuity, but you have to address everything [before committing]."
Azaleos offers business continuity as an ancillary service, and makes it part of the service level agreement with clients. The firm monitors the performance of its managed servers for breakdowns, and operates different sites of its own in Seattle and Charlotte to provide added backup.
"The cloud provides secondary locations to back up and ensure systems are running, and to provide a quick way to bail over if something goes wrong," says Scott Gode, vp of products for Azaleos, who adds that "not a lot" of firms take advantage of cloud-based continuity, particularly outside of banking, a trend he attributes to firms not wanting the expense of what amounts to an extra backup. But he says most financial services clients who adopt cloud computing also choose continuity.
"It's one of the key drivers of the cloud strategy; the ability to more easily enhance the disaster recovery experience," says Eccles, adding the bank and may in the future decide to move non-core functions to an externally managed cloud, which is one step closer to a public cloud.
