Enterprises ignore disaster risk: apathy about SAN spending heightens data dangers

America's Network, April 1, 2004 by John (American congressional representative) Tanner

In the wake of the 9/11 terror attacks in the U.S., disaster recovery suddenly became the indispensable business process. Of course, disaster recovery wasn't exactly a luxury before--making back-up copies of company data was a routine procedure for most data-dependent enterprises in preparation of other kinds of disasters, from fire and electrical blackouts to earthquakes and extreme weather.

But 9/11 was different. Blame it on the sheer scale and notoriety of the event and the emotional impact worldwide, not to mention the human cost. In any case, 9/11 proved to be a major test for businesses worldwide from a business continuity standpoint, whether they had an office in the World Trade Center or not. The question for enterprises everywhere, quite simply, was this: Could your business have survived something like this?

Meanwhile, storage technologies had been rapidly advancing with the rise of storage area networks (SANs) and SAN switches, broadening options for disaster recovery plans. You can link storage servers in different cities together across the network, with automatic back-up of data in real time at different sites. Your company can be up and running again in no time even if one site is destroyed in a catastrophic event. Don't have the expertise to set up a multi-site SAN? Call up your local storage service provider (SSP) or data center operator. They can set it up for you for a monthly fee.

That, at least, was the idea. However, more than two years later for the majority of businesses, the disaster recovery paradigm hasn't advanced very far.

FADING MEMORY

"It's quite strange--right after 9/11 everyone was focused on disaster recovery, but after a year or two, 9/11 has slipped from memory for most people," says Rod Chan, regional program manager for Greater China at storage vendor EMC.

The level of concern varies from one industry segment to the next. The financial industry, for example, has certainly taken disaster recovery far more seriously than most. It has led the private sector in disaster recovery spending since 9/11, and will collectively spend $3.56 billion on such projects this year alone--a 26% increase from 2001, according to figures from U.S.-based financial-services industry consultancy TowerGroup. Spending from governments is also on the rise.

But overall, the majority of enterprises aren't spending very much on disaster recovery at all. One report from Sagitta Performance Systems claims that 54% of enterprises surveyed devote less than 1% of their IT budget to disaster recovery, and 75% rely mainly on back-up tapes as the core pillar of their disaster recovery strategy.

"Every enterprise, whether they're in the banking business or manufacturing or a small-medium business, if you ask them if they have prepared a disaster recovery plan, 100% of them will say yes, but the degree varies as to how comprehensive or well thought-out their plan is," says Chan. "Maybe all they do is back up their data tapes every day. Is that a disaster recovery plan?"

Part of the problem is cost; comprehensive disaster recovery plans can get expensive, and the impact of the global economic downturn has forced many companies to cut back spending on all fronts.

Another problem, however, is that the growing number of options available is bogging down the decision-making process for many IT managers and CIOs who are either still learning the ropes in terms of new DR technologies and services, or are still hashing out which solutions will give them the most protection for the least amount of money.

PROTECTION LEVELS

For a start, there's the question of just how much protection the enterprise needs in a disaster-type situation.

"For example, how fast do you need to restart everything?" says Chan. "You can buy equipment today where the restart time is quite fast, but it's also the most expensive."

DR protection levels these days can be generally grouped in three categories: cold, warm and hot back-up sites.

In the cold site scenario, the back-up site sits unstaffed and virtually empty until disaster hits. Then the company rents and installs the necessary equipment, brings the back-up tapes from the primary site and loads all the data into the machines--a process which takes days.

A warm site has dedicated equipment and staff on standby until disaster strikes and the back-up tapes arrive shortly thereafter, allowing for the company to be back up and running within 24 hours. A hot site involves actually linking the sites and carrying out data replication in real time or near-real time, which can have you up and running again within an hour or two.

The hot site is the most expensive of the three, naturally, which is why warm sites are the most popularly implemented among enterprises with advanced DR strategies.

Unsurprisingly, then, cost balancing is the name of the game in DR planning, says James Hung, manager of zSeries and TotalStorage for IBM Systems Group.

"The whole decision of whether a company should subscribe to DR service or perform its own DR arrangement is mainly an investment and benefits statement based on cost effectiveness," he says.