12.08.09 Event Mike Perdue Presentation
description
Transcript of 12.08.09 Event Mike Perdue Presentation
PRESENTS
DISASTER RECOVERY & BUSINESS
CONTINUITY IT BEST PRACTICES
DECEMBER 8TH, 2009
House Keeping
• Rest rooms
• Food
• NDA
Objectives For Today
Signature
Technology
Network
Overview
The Business
Aspects of IT
Disaster
Recovery &
Business
Continuity
Technical
Best
Practices
Toys for Tots
The U.S.
Marine Corp
Lunch &
Networking
Opportunity
10 Minutes 75 Minutes 75 Minutes 15 Minutes 60 Minutes
Who is The Signature Group?
Founded in 1997 as an IT Consulting, Strategy Management & Systems Integration Firm
Three Primary Practice AreasEnterpriseSmall & Mid-MarketFederal, State, Local Government
BusinessProgram and Project ManagementStrategic PlanningMergers and AcquisitionsProof of Concept, R&D and StandardsTechnology Process and Change ManagementRegulatory ComplianceDisaster Recovery Planning
Design and ImplementationServer Consolidation and VirtualizationConsolidated/Shared StorageDatacenter Design and ConsolidationLocal and Wide Area NetworksWireless Solutions & NetworksNetwork Security and AuditsVoice over IP solutions (VoIP)Unified MessagingCorporate Messaging (Exchange)Global Directory Services (AD/NDS)
SignatureCare Managed ServicesTurn Key Monitoring and ManagementHelpDeskOver-The-Wire Data ProtectionReal Time Disaster Avoidance/Recovery
Select TSG Clients
What is STN?
Signature Technology Network (STN) is a free membership based group* of Senior IT
Executives in the DC Metro Area from a broad array of industries.
Purpose:
• Social and Peer Networking
• Sharing of Best Practices
• Discuss Technology & Business Solutions
• Access to Independent Industry Experts
• Forum for Ongoing Education
Dedicated Learning Sessions
Panel Discussions
Roundtable Events
Manufacturer and Vendor Presentations
Looking to the Future of IT
Benefits:
• Learn from Success and Failures of Peers
• Understand Do’s, Don’ts and Best Practices
• Learn the Solutions that Your Peers are Using to
Improve the Performance of Their Business
• Hear What Independent Experts Say About
Various Technologies and Business Solutions
• Gain Direct Access to Manufacturers and
Vendors to Understand their Long Term Road
Maps and How These Will Help You Plan And
Invest Wisely For The Future
•NDA’s are required for all participating members
Signature Technology Network
STN 2010 Events Calendar
• Tuesday, January 12, 2010
Windows 7/Server 2008/Active Directory
8:00 am – Noon
The Tower Club
• February 10-12, 2010
Collaboration Technologies & Managed Services Exhibition
Virtualization Business and Technology Best Practices – Educational Track
ASAE Technology Conference
Walter E. Washington Convention Center
• Tuesday, March 9, 2010
Microsoft Exchange 2010 and Collaboration Solutions
8:00 am – Noon
The Tower Club
For Small and Medium Enterprises
Michael Perdue, Chief Executive Officer
The Signature Group, Inc.
Important Thoughts
A Flexible and Fluid Plan is Required to Handle a Broad Range of Situations
“A Failure to Plan is a Plan to Fail”
• Winston Churchill
“No Plan of Battle Ever Survives Contact With the Enemy”
• Credited to Field Marshall Helmuth von Moltke, General George C. Marshall and Napoleon Bonaparte
Interesting Facts & Stats
60-90% of all companies that suffer from a disaster and do not recovery critical systems within 30 days are acquired or out of business in 2 years – International Data Corp
Only 6% of companies suffering from a catastrophic data loss survive, while 43 percent never reopen and 51 percent close within two years – University of Texas Study
Only 35 percent of SMBs have a comprehensive disaster recovery plan in place – Gartner
SMB’s lose an average of $84,000 for every hour of system wide downtime – International Data Corp
The survival rate for companies without a disaster recovery plan is less than 10% – Touche Ross
So What Do We Really Mean By Disaster
The Disaster Spectrum
Extinction Level Event OUT OF SCOPE
Global Thermonuclear War (Too Big)
______________________________________________________
9/11
Flood, Hurricane, Tornado, Blackout
Building Fire
Facilities Issues
Core Switch, Router or Carrier Failure IN SCOPE
Critical Application Outage
______________________________________________________
Non-critical Server Outage
Access layer switch down OUT OF SCOPE
CEO drops Iphone in toilet (Normal Maintenance)
User spills coffee in keyboard
The Typical Disaster
• Fairly Localized- Even 9/11 was an extremely geographically localized event
• Lasts between 1-5 days - Don’t build a plan based on the 100 year earthquake/hurricane unless
the financial or risk impact is so great that the cost is justified
Examples of the Most Common Disasters
Extended Power Outage Extended Carrier Outage
Critical System Failure Facilities Issues
Hurricane Tornado
Earthquake Fire
Pandemic Flood
Define Objectives
RTO and RPO must be balanced against financial and risk requirements
The Solution Spectrum
Recovery Time and Point Objective
Weeks Days Hours Minutes Seconds
Off-Site
Tapes
Data
Vaulting
Asynchronous
Replication
Synchronous
Replication
Geographically
Extended
Clusters or
Virtualized HA
Platforms
Data
Availability
Needs
Amount of
Non-
Reproducible
Data
The RPO Organizational Spectrum
Recovery Point Objective
Days Hours Minutes Seconds
Associations
& Non-
ProfitsProfessional
Services
Firms
Financial
Institutions Non-
Reproducible
Data
Transactions
or Data
Change per
Second
Retail
Online
Transaction
based
Vendors
Should be based on
Financial and Risk Impact
Organization Size Matters
It’s an Issue of Balance
Disaster Solution
Cost to Implement
Cost to Maintain
Risk
Cost of Downtime
and/or Lost Data
Defining your “Objectives”
Inventory all Systems and Applications
• Include System Dependencies
Perform Financial and Risk Analysis for each System
Categorize
• Critical ∙ Nice to have
• Sensitive ∙ Should be dead already
• Vital
Define your RTO and RPO by Category/System
DR Thoughts and Best Practices
Build a Plan Based on Automation, Systems,
Processes, & Documentation
John or Jane may have been affected by the disaster
Align your Plan with your RTO and RPO Requirements
Per System, Service and Application
RTO and RPO should not be globally defined
Every Organization is Different therefore Every Plan should be Different
Tape Backup and Restoration alone is not Traditionally Considered an Effective
Disaster Recovery Option unless RTO and RPO is
Extremely High
.
The Recovery Data Center/Facility
Initial Tendency is Typically too Aggressive
• If you are not NORAD then don’t plan like NORAD
Align Recovery Center Location and Facility with Organizational Requirements
• If all of your employees and/or clients are located in the DC metro area don’t put your redundant data center in Utah/Denver/Kuala Lumpur
• Best Practice for SME is greater than 20 miles but less than 60 miles from your primary facility -- location dependant
• Align geographic location of recovery center with staff that is knowledgeable about your systems
• Use remote offices where practical (if systems, staff, connectivity and facilities can support)
• DON’T COUNT ON TRAINS and PLANES
The Recovery Data Center/Facility
In Major Disasters Long Haul Communications may be Substantially Compromised
Understand the Specifics about Collocation Facilities:
• Carrier• Power• Fire Suppression• Hardened Status• Physical Security• Placement on National Critical Infrastructure List• Green Initiatives/Programs
The Datacenter Facility
Traditional Models
Internal Datacenter
Facility
High Availability and Failover
Between Systems
Redundant Telco Connectivity
Limited Power Redundancy
Offsite Backups or Data Replication
Collocation Datacenter
Facility
High Availability and Failover
Between Systems
Redundant Telco Connectivity
Multiple Levels of Power
Redundancy
Offsite Backups or Data Replication
Internal Datacenter w/ Hot or Standby
Facility
High Availability and Failover
Between Systems and Locations
Redundant Telco Connectivity
Multiple Levels of Power
Redundancy
Replicated Data Between Locations
and Offsite Data Protection
Internal Multi-location
Datacenter Facilities
High Availability and Failover
Between Systems and Locations
Redundant Telco Connectivity
Multiple Levels of Power
Redundancy
Replicated Data Between Locations
and Offsite Data Protection
Cost to Implement & Maintain
Non-Carrier
Neutral
Facilities
Less focus on
Protection
The 9 Step Planning Process
1. Services/System Inventory
2. Critical Vendor Inventory
3. Risk/Financial Analysis & Categorization
4. Identify Possible Solutions
5. Select Solutions
6. Implement Solutions
7. Create Recovery Manual & Documentation
8. Test Recovery (“Soft” and “Hard” testing)
9. Train, Maintain, and Continual Testing
Step 0. Selling Management• Define Legal, Audit, and Regulatory Requirements
- Sarbanes-Oxley
- HIPPA
- SEC
- Contract or Client Specific Requirements
• Perform Financial Analysis - Cost of Downtime or Lost Data
• Perform Risk Analysis- Risk Associated with Downtime or Lost Data
• Avoid FUD Approach (Fear, Uncertainty, and Doubt)
Less of an issue in the post 9/11 and SoX world
Questions & Answers