eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
On September 15, four days after the World Trade Center attack in New York, Geoff de Lesseps, CEO of TheBeast, had something important to tell the world. “I am happy to report that our two most important assets—our employees and our software code—are safe, and we are open for business,” he said.
TheBeast develops software and platforms for real-time data distribution and online securities trading across the Web, wireless connections, and wide-area networks. On September 11, the company was relatively lucky. Although its offices were on the 80th floor, just below where the first plane hit, all 63 of the companys employees escaped the building safely. By the end of the week, most were working in an alternate facility in New Jersey.
The company, however, wasnt as fortunate in saving its data. TheBeast had a disaster recovery plan that entailed only weekly backups of software code. There was no backup plan implemented for other data resources, such as e-mail. When disaster struck, the company had to scramble. “The mandate was to back up every week,” says Ashok Mittal, the companys senior vice president of corporate technology. “There was an update that was supposed to happen on Monday, but that night we were working until 3:00 A.M.” The backup never happened, and as a result, the company lost about a months worth of labor on updated code—not to mention its hosting facility.
In early September, TheBeast was scouting around for a hosting provider so it could get out of the application-hosting business but it hadnt found a partner by September 11. The company and its customers lost any information housed in the on-site data center that wasnt backed up to its Level 3 off-site data center.
TheBeasts experience isnt unique by a long shot, say analysts. Today, if a disaster were to strike in Anywhere, U.S.A., nearly every company would lose some if not all of its data. And companies with online components are often hit the hardest, because their entire business models are tied to technology.
In our January 15 story “Be Prepared,” we examined the key strategies and technologies necessary to implement a good disaster recovery plan. As a follow-up, here are the top ten questions that companies relying on the Internet to conduct business should ask themselves and their partners in the process of developing rock-solid plans.
After taking a look at its own disaster recovery plan and asking some of these questions, TheBeast has completely rethought its strategy, says Mittal. “Unfortunately, you cant do too much planning,” he says. “We have learned to take disaster recovery very seriously.”
ASPs Disaster Recovery
ASPs Disaster Recovery
1. What should you know about your ASPs disaster recovery plan?
If your ASP goes down, you can literally be without the applications you need to conduct business. If youre an e-business, the impact is even more immediate. You cant tell your site visitors to come back tomorrow. Thus youll want to ask your ASP several questions before you sign on the dotted line.
“One of the most important questions you can ask is whether youre going to have a dedicated server,” says Mika Krammer, research director with market research firm Gartner. The most serious ASP-related disaster is watching your ASP go out of business. If your data is on its own server, you may be able to walk in and purchase it outright. ASP customers that have their own servers also avoid problems such as viruses and outages brought on by other companies that share their sites.
Of course, the typical disaster recovery drill also applies here. An ASP should be able to tell you how often it backs up your data, how much time it needs to get your system back up in case of a failure, and whether it uses off-site backup, says Joel Schleicher, CEO of Interpath, an ASP.
ISP Disaster Recovery
ISP Disaster Recovery
2. What questions should you ask your ISP about its own disaster recovery plan?
If an ASP is the lifeblood of a company, then an ISP is its circulatory system. If your backbone connection is compromised, eventually your business will suffer. Therefore, many of the questions a company asks its ASP are also important when talking with a current or potential ISP.
Does the provider have redundant architecture in place? Can it handle peak traffic? Does it have adequate funding? This is an important question when you consider the current climate in the ISP world. Where are its points of presence, and are they far enough away from each other that in case of a disaster, some of the POPs will be left standing? “Youll want a provider who has its own private backbone made up with multiple fibers,” says Paul Keresey, director of product management at Genuity, a storage and content delivery network hosting service.
Enterprise Disaster Recovery
Enterprise Disaster Recovery
3. What kinds of businesses can benefit from enterprise disaster recovery services offered by companies such as Hewlett-Packard, IBM, or SunGard?
A disaster recovery service provider is like a technology insurance policy: If the worst happens, the provider will be able to recreate your entire infrastructure—from your desks and chairs to your databases and servers—in a new location. The best part is that most companies will plan your disaster recovery process from start to finish.
Sound expensive? It is. Disaster recovery services can charge in the millions, making them out of reach for some companies. Certain businesses, however, should consider using such a service. For example, if your customers dont have deep ties to your site or service and you suspect an outage might push them to a competitor, then by all means engage a disaster recover company. If you think you cant afford such a service, keep in mind that most service-level agreements provide financial penalties for outages; if your site goes down, chances are youll get some sort of refund. Funnel this cash to your disaster recovery company and the solution may end up paying for itself.
On the flip side, few if any service-level agreements cover the level or type of destruction of the World Trade Center. If a disaster such as a terrorist attack happens again, you may not be covered financially. Your best bet is to read your service-level agreement. And keep in mind that most outages last less than 48 hours, which is far less time than it would take most organizations to fail over completely to an alternate site. You may be back up and running before your disaster recovery service even kicks in.
Off
-site Web Hosting”>
Off-site Web Hosting
4. What issues should an e-business consider when choosing an off-site Web hosting facility?
Think of a data center as a home away from home for your vital information. If your off-site home isnt secure, then your data isnt secure either. Companies that have off-loaded their servers to data centers should demand to see their providers security plans and shouldnt be shy about testing them. Call your facility and ask for your password. Show up at the data center and walk around unencumbered. Peek into other companies cages. Youll quickly learn how secure your data really is, but security is only one of many concerns.
The number-one concern for most online businesses, says Genuitys Keresey, is connectivity. Companies want to know how many backbone providers are connected to the data center. Providers should have multiple backbones coming into a facility, so in case one fails, theres no break in service.
Dont forget to negotiate a strong service-level agreement and follow up with a strong backup plan. Although TheBeast offered its customers premium off-site disaster recovery backup, two clients failed to take the offer, and they lost their data as a result.
Online Backups
Online Backups
5. What are the benefits of online backups?
Online backups make perfect sense on paper. At scheduled times throughout the day, a third party backs up the files and applications that youve selected, using the Internet as a conduit. Since a service is looking only for changes on your drives, the process is as quick as when you perform a full backup on your local network (as long as you have a fast Internet connection). And the backup resides off-site, so there is a decreased chance that your data will be lost as a result of an on-site disaster.
Online Backup Risks
Online Backup Risks
6. Does online backup pose any security or reliability risks?
As with anything that sounds too good to be true, online backup is a smart service but has real drawbacks, says William B. Carolan, managing consultant with Arup Risk Consulting, a disaster recovery planning firm. When you place something online, there is an immediate security risk. Although security has become much more sophisticated, there is still a very real exposure to security breaches, says Carolan.
To minimize risk, dont rely solely on an online backup service. Back up locally, and take the backups off-site. Keep in mind that online backup exposes your data to multiple points of failure. If your Internet connection fails, youre in trouble. And if your providers servers crash or are hacked, you can lose everything.
Content Delivery Networks
Content Delivery Networks
7. What role do content delivery networks play in a disaster recovery plan?
On September 11, millions of people rushed online to get updates on the terrorist attacks. While the traffic jam put an enormous strain on Web servers, most large news and information sites were using content delivery networks that absorbed the excess page requests. “On September 11, 80 percent of the traffic coming into MSNBC was handled by Akamai, along with 12.7 million streams of video,” says Kieran Taylor, director of product management at Akamai Technologies.
Pure content players should keep that in mind when planning for a disaster. Content delivery networks can handle excess traffic, preventing server failures. They can also keep your site online in case your main server fails because of a denial-of-service attack or an environmental problem. The peace of mind doesnt come without a significant cost. Most content delivery networks, however, charge customers based on the amount of content served up; the ongoing costs may be negligible compared with the benefits.
Online and Off
-line Coordinators”>
Online and Off-line Coordinators
8. How can online and off-line disaster recovery plans tie together?
In a real emergency, if you dont have an off-line plan in place, it will not matter whether your Web site is back up in 15 minutes or less. If you dont have desks for your employees and a way to access your site, your business will grind to a halt. Companies should have off-line fixes for online problems.
Need a way to get employees back online? Find alternative locations, and distribute passwords and access numbers for use in case of an emergency. When your salespeople depends on CRM applications, make sure those are the first to be brought back online, says Marty Ward, a director at Veritas Software.
Public Internet Safety
Public Internet Safety
9. How safe is using the public Internet to transfer mission-critical data?
The safety of an online transmission depends on the level of encryption that youre using and the type of data being transported. Experts say that most companies will want to avoid using the public Internet for mission-critical data. Currently, most companies are liable for data breaches, as with personal information. For example, any company that deals with health-related information is legally responsible for keeping that data confidential. Not doing so can result in heavy fines, sanctions, and lawsuits. In addition, once a file leaves your gateway, its subject to whatever bottlenecks it encounters on the Internet.
Currently, there is no way to implement quality of service on the Internet. When your application or storage solution depends on a steady stream of data, a holdup in the transfer of that data may crash your applications, and you may actually lose bits and bytes of data along the way. Thats not to say that a company should never use the Internet as a transfer mechanism. Small offices can use the Web to transfer non-mission-critical files in an emergency. And one use creates little if any liability for a company: using Voice over IP as a short-term replacement for telecom services.
Backup Services
Backup Services
10. To what extent should a site have duplicate backup services and components for credit-card processing or customer service?
The answer depends on how critical it is to process transactions in a timely fashion. When a loss of credit card processing also spells a loss of customers, you may want to consider a second provider. Most small and medium-size companies, however, cant afford a duplicate service. The deciding factor should be a side-by-side comparison of capital outlay versus revenues lost. Surprisingly, you may actually be exposing data to more risk by contracting with multiple providers. No service is completely hackproof, so by mirroring data on more than one service, youre actually raising your risk dramatically.