Business continuity is the investment made by a business to be proactive in avoiding the risks associated with a disaster. Typically, this investment is an operating expense that serves as an insurance policy on an ongoing basis.

Disaster recovery is the plan associated with the reaction that follows a catastrophic event that disrupts the productivity of a business. This type of investment is more difficult to manage because it’s a “in the event of” plan that can easily fall through the cracks if not kept up with.

The two most important aspects of a DR plan involve sound, comprehensive planning and regular testing intervals that ensure the overall effectiveness of the plan. The most effective strategy is to give ample attention to both – mitigate risks as much as possible and have a solid plan to address the unforeseen.

Why is it so important to prepare for disaster now when Hurricane season is months away?

Given the geographic area that we live in, hurricanes stay top-of-mind when businesses think of a “disaster.” The truth of the matter is, several events occur each year within the walls of a business that could potentially serve as a disaster:

o Loss of mission critical data

o Power or hardware failures

o Disgruntled employees

o The list goes on…

The most important question to ask is whether or not your business can survive in the event of the unknown – and not knowing the answer to that question is just as dangerous.

Business continuity is too expensive for SMBs. What options do I have?

This is a common misperception among small to mid-sized businesses for a variety of reasons. The first is the lack of knowledge in terms of what options are available. The second is the possible impact on the business by failing to implement a proper plan.

Technology has evolved over the years to the point that what was once extremely expensive to purchase and manage is now far more simplified and cost-effective. In addition, several of the products and services associated with BC and DR have become commoditized, which drives down cost and creates a more affordable solution set for business owners.

Learn more about these cost-effective solutions in other blog articles.

Colocation – Disaster Recovery Toolkit: Business Must Go On…DR & Colocation

Online backup solutions – Disaster Recovery Toolkit: Knock, Knock. Who’s There? Your Data

Email Continuity – Disaster Recovery Toolkit: Can your Email Server Weather the Storm?

If you were unfortunate enough to experience Hurricane Ike, how did your email server fare? Not everyone can afford to keep their servers in a nice, safe datacenter or colocation facility. Does that mean your business is subject to your building’s physical power or Internet connection? The answer to that question is absolutely not. There are two ways small businesses can increase email uptime without breaking the bank.

Hosted Email Solution
Option one would be a hosted email solution. Hosted Microsoft Exchange providers are all over the Net, helping keep the cost of full-featured email hosting affordable. You can even add mobile devices to these plans for a nominal fee, further bolstering disaster recovery strategies and giving you and your employees corporate email at your fingertips at all times.

Need to convey when the office will be back up and operational? You can send out updates and keep everyone looped in. Emailing evacuated employees becomes a great way to keep lines of communication going without having to call everyone individually.

As far as day to day operations, with the improvements to Outlook 2007 and Outlook Anywhere feature, using a hosted provider looks more attractive to small businesses every day. With these technologies, you won’t even know the Exchange server is not on your local area network (LAN). You will also reap the savings by not having to deal with the backups and administration of an email server. Almost all hosted email solutions come with service level agreements. I don’t know about you, but getting 99.999% uptime sounds good to everyone.

Managed Filtering Service
If you already have an email server and don’t feel like making the switch to a hosted solution, your second option could be a filtering service, like MX Logic Email Defense with the disaster recovery feature enabled. With this service, not only do you get top notch hosted spam filtering that prevents spam from hitting your server, in the event of an outage, your emails are spooled and held by MX Logic for 60 rolling days. While spooling, users are able to log into the MX Logic page and check emails. When connectivity resumes, the messages are then delivered to your email server.

Both solutions have benefits and negatives. I’d be happy to answer any questions you may have or give you more information about either of these two options.

Business continuity and disaster recovery planning are all about a company’s ability to survive and continue operations in the face of physical and environmental events, such as natural disasters (fires, hurricanes, earthquakes, etc), network outages, disgruntled employees and computer viruses. Critical business technologies – telephone, email, Internet, corporate applications, databases – must be included in the planning process to ensure corporate survival and continued operation.

The straightforward method for reducing the impact of these events is to position your critical technologies in a more secure and resilient environment. You can either invest in constructing your own environment or utilize a commercial facility. For small and medium-size businesses, the former is often costly, as it includes:
• Installing electrical generators
• Using uninterruptible power supplies (UPS)
• Improving cooling and fire protection
• Increasing physical security
• Maintaining redundant communication lines for voice, Internet and data traffic

Colocation refers to hosting your equipment at a commercial facility, specifically designed to provide the redundant services required to guarantee uptime. Properly designed colocation facilities provide redundancy in all environmental systems such as generators, UPS, HVAC and communications, along with greatly improved physical security.

Taking advantage of the benefits provided by a colocation facility requires rethinking how technology is deployed within your organization. Usage of a colocation facility can range from providing a secure “mirroring” location for corporate data and server “images” to housing all servers and PBXs.

In determining the value of colocation, design decisions focus on assessing the value versus the cost of having all technology components available and operational regardless of what happens to your company’s facilities. This assessment is then used to determine what should be moved to colocation.

Some companies, such as a manufacturer with a single facility housing all company operations, may benefit most by mirroring data and server images. Companies with multiple locations or whose revenue generation models are less tied to a single location, such as financial or sales-based organizations, will benefit more by moving all critical technology to a colocation facility.

The benefits of colocation were once available only to large corporations due to costs. Today, colocation, virtual servers (virtualization), data replication, remote computing, and large bandwidth communication pipes provide smaller organizations powerful new tools to address business continuity and disaster recovery needs.

Hurricane Ike convincingly demonstrated that available technology means little unless coordinated planning and preparation have preceded the need. Colocation and other tools should be considered when developing a plan, but the most critical component is having a plan.

Hurricane season is officially here. Businesses are now planning and refining their disaster recovery and business continuity plans to prepare for potential disruptions. Companies need to make sure and investigate a few specific areas – offsite backup, colocation, email continuity and data recovery. A voice-over IP (VoIP) telephone network and SMS text messaging are other smart continuity tools.

VoIP allows users to connect to a phone system from anywhere in the world, through the Internet. This becomes vitally important in disaster recovery as response teams head to pre-determined disaster response locations. At that point, team members can easily plug in the VoIP phone and instantly become an extension of the core system. To the outside world – clients, vendors, etc – this is transparent, as business transactions and internal communications continue.

Business communications act like any other IP-based application. Take email as an example. The user doesn’t worry about the actual location of the email server. Users plugs into an Internet connection and, through a Web portal or VPN, email works. The same thing goes for telephony, if IP is being used. Corporate telephony can be anywhere with an Internet connection. This flexibility and adaptability is ideal for any emergency or disaster situation where other networks may be inoperable.

Another ingredient to investigate when preparing for hurricane season is an SMS server. Ask anyone that endured Hurricane Ike, and they will tell you that cell phones were paper weights for 4 to 5 days, except for SMS text messages. The first day or two after the storm, users would notice as much as a 12 to 24-hour delay on the message, but it would eventually get through the network to the intended recipient.

Companies can leverage this easy and affordable medium for disaster recovery by utilizing an SMS server for communications to clients, vendors and internal employees. As long as administrators can reach the network, company officials can send messages to one or multiple groups, individuals and numerous distribution lists for a secondary line of communications.

How are you preparing for hurricane season? Has your DR/BCP plan been tested within the last 12 months?

Without access to your business’s mission critical data, productivity as a whole could come to a screeching halt.

For years, businesses have relied on tape backups to secure their primary data repository. While the technology associated with these types of solutions continues to become more refined, one aspect of this process still leaves a business vulnerable – human error.

We can invest tons of money to secure the latest and greatest hardware and software to protect our data. However, without the commitment of one or more key employees to mange the process of changing tapes, reviewing logs and initiating support as needed, one mistake will render this effort useless.

To counter these measures, IT solution providers have introduced advancements in how data is encrypted, compressed and secured. With the presence of cost-effective and increased bandwidth capabilities, the industry has evolved and offsite backup solutions are now more viable then ever.

Offsite backup technology has made great strides to effectively secure your data online (offsite) at a price that is easy to justify.

If you haven’t considered an offsite backup solution within the last 12 months, it is probably time to revisit the subject. At RSA Corp, we bundle disaster recovery (including offsite backup) into our managed IT support service. However, there are backup solution providers worth checking out.

Here are some key factors to consider when looking at what an offsite backup can bring to the table:

• Government-sanctioned AES encryption
• Automated, unattended backups with status updates via email notification
• Real-time file restoration capabilities
• Remote restoration capabilities for both single file and “bare bones” restores
• Back up multiple platforms on one network, i.e. Windows, Linux,

When you add up the value associated with these key features and combine it with the fact that this type of solution costs pennies per gigabyte, it truly builds the case for incorporating some form of an offsite backup solution in to your disaster recovery planning. The cost is negligible, and the reward far outweighs the risk. It’s a no-brainer.

I would love to hear your story about how offsite backup saved your business.

It’s that time of year again…hurricane season is upon us. With the effects of Hurricane Ike still fresh in Houston’s memory, what are the lessons learned when it comes to securing the integrity of your business?

While history continues to repeat itself, a disaster’s long-term effects on a business can be substantial. Consider the following business downtime statistics:
• Only 6% of companies survive a catastrophic data loss, while 43% never reopen, and 51% close within two years
• Only 35% of small and medium businesses have a comprehensive disaster recovery plan in place
• International Data Corp estimates that companies lose an average of $84,000 for every hour of downtime.
• According to Strategic Research, the cost of downtime is estimated at close to $90,000 per hour
• The survival rate for companies without a disaster recovery plan is less than 10%

The cold, hard facts associated with these statistics are difficult to believe.

FACT: Today, most businesses do not have a comprehensive DR plan
FACT: The costs associated with downtime are substantial
FACT: The survival rate for businesses hit by a disaster is slim-to-none

While these statistics are real, the implications behind them are even more sobering. Businesses are left vulnerable due to poor planning, lackluster follow up, and a genuine lack of understanding in terms of how to overcome these challenges. How does this continue to be the case?

1. Many businesses are not aware of the options
2. If a DR plan is in place, it has not been tested or kept up-to-date
3. The planning associated with the DR plan is not comprehensive

In the coming weeks we will examine several aspects of a well thought-out disaster recovery (DR) plan, featuring an in-depth look at what processes to consider and what options are available.

Smart companies along the U.S. southern coasts are testing their business continuity and disaster recovery plans in preparation for the upcoming storm season. For those who have outgrown their plans or struggle with outdated procedures, refining the plan is a top priority.

Companies invest time, money and resources to create solid business continuity plans in order to ensure speedy disaster recovery and enhanced information security. The planning process is a significant project requiring risk assessment, in-depth interviews with key employees, evaluation of business processes and technologies, backup and recovery strategies, and testing of the plan.

What happens when the plan is solid and ready to go?  Don’t just put in on a shelf. Make the information gathered in the continuity planning process readily available, as a business guide. This information provides insights into the inner workings of day-to-day processes, which gives you a magnifying glass over each business function.

Three Ways to Leverage Your Business Continuity Plan

STRENGTHEN INFORMATION SECURTIY

During the continuity planning process, executives become aware of which employees hold the keys to certain information. Some discover that too many people have access to restricted data and proactively initiate steps to tighten information security.

Conversely, some realize that only one person manages payroll, contracts or authorization of banking procedures, which prompts them to take actions to ensure these financial capabilities are backed-up. The plan provides you with a high-level view of your infrastructure, allowing you to recognize potential technology risks, track incidents more effectively, monitor assets and enhance control of vendors.

PREPARE FOR MORE THAN NATURAL DISASTERS

Don’t limit your continuity plan to addressing only natural disasters or terrorist attacks. Data breach, power failures, network outages, disgruntled employees, computer viruses and software bugs should all be accounted for in the plan.

Data breach is the first concern regarding information security. According to a study by the Ponemon Institute, the total average cost of a data breach is $6.3 million, but can range from $225,000 to $35 million. Lost business due to interruptions in productivity accounts for more than 65% of the cost.

REDUCE BUSINESS RISK

Review the risk assessment performed at the onset of continuity planning. It gives you information about significant circumstances that could impact your company’s ability to meet strategic business goals. This knowledge allows you to evaluate the significance of such an event, and then prioritize based on the likelihood of its occurrence.

Consider issues regarding environmental compliance, safety regulations, business interruptions, financial inconsistencies and lacking IT infrastructure.

For seven more ways to leverage your BCP plan, download our white paper “Ten Opportunities to Capitalize on Your Business Continuity Plan.“

Unfortunately, it sometimes takes a major crisis to get decision-makers, in both the public and private sectors, to put together adequate plans to effectively prepare for, respond to and recover from natural or man-made disasters.

While disaster response and recovery efforts were common prior to Sept.11, government and private organizations placed a much higher emphasis on business continuity planning in the aftermath of the attacks.  They began building more resiliency and back-up systems into their business technology infrastructure.

This should come as no surprise considering only two of the 131 businesses whose technology was directly affected by Sept. 11 attacks were able to perform a successful failover, despite the magnitude of the disruption.  Of the 129 remaining sites, 70 percent (90 businesses) were able to resume some level of critical business operation after 120 hours (5 days) of downtime. The remaining 30 percent (39) lost their data completely.

In light of these facts, the hard question needs to be asked…

Is your business capable of sustaining an event that poses a real threat to its ability to continue with core business operations?

Technology is the piston that drives a business’s core processes.  As such, much consideration should be given to how these processes will continue to operate in the event certain resources of today are not available tomorrow.

1. What if a leaky sprinkler pipe slowly drips water on your servers, which are located in “the room that no one ever goes into” ?
2. What if a fire breaks out and destroys not only your servers, but the stack of data backup tapes stored on top of the servers for quick access and convenience?
3. What if the facility you are accustomed to being at each day is leveled by a category five hurricane?

The point to this line of questioning is that a disaster can come in many shapes and sizes.  You often have little to no warning prior to its impact. The amount of downtime you’re forced to incur can prove catastrophic to your business and its ability to survive long-term.

Have verifiable plans in place for such a situation.  A deep understanding of how your business transactions function is critical to creating verifiable plans.  It’s important to understand which core business processes must survive in the event of a disaster. Questions must be answered as to what operations currently support key business processes.

Ask yourself:

As reliance on technology intensifies, it’s critical to recognize the competitive advantages associated with an established technology portfolio.  However, it’s equally important to realize the ramifications of not being able to access that technology in the off-chance that the unlikely becomes likely.

How would it affect your business if your competitor had its business up and running before you could even figure out what wasn’t working? If you are in Houston, how did Hurricane Ike affect restoration of key operations?