Hurricane season is here and we are seeing more and more hurricane preparedness information; from updating home insurance, collecting materials and supplies, to planning for evacuation. There is so much available information on how to protect your family and home, that if a hurricane does tear through your area, knock on wood, you have no excuse not to be prepared. But what happens to your business? Information on how to protect your business during the hurricane season is not as easily accessible, but it is just as important.

Disaster Recovery planning can be vital to companies, especially here in Houston, during the hurricane seasons. It may be too late to protect your data and other assets if you wait until the “rain drops [start] falling on your head”, as B.J. Thomas would say. Are you part of the 65% of small to medium businesses that does not have a disaster recovery plan in place? If you are, are you also aware that according to research by the University of Texas, only six percent of companies survive a catastrophic data loss, while 43% never reopen and 51% close within two years? Those odds are not very reassuring.

Most companies are still recovering from budget cuts and do not see the value in investing in disaster recovery. We can understand their point of view. Nobody wants to pay for something they won’t use. But how can you be sure you won’t need it? Like insurance, a solid disaster recovery plan is a good value even if you never need it. But it’s priceless if you do!

So what is the next excuse that we’ve come across as to why companies do not invest in proper disaster recovery planning? Our favorite excuses include:

• “My IT guy says our data is backed up, so I don’t worry.”
• “Our IT department is doing the best they can and we do not have time to learn and implement a new process.”
• “I know we should, but we can’t afford what our IT guy says we need to do.”
• “I’ve talked to the “experts” and it all seems so complicated.”

George Black, President and CEO here at RSA Corp, treats the company like a family member. There is no way he would just take somebody’s word for something this important. Running a business is a lot of work, and it would be devastating to watch it all get washed away because a short cut was taken. RSA Corp, a Managed IT Service provider, has witnessed many companies turning to us once they get themselves in the middle of a sticky situation. Of course we help them get back on track, but that takes more time and money than a preemptive strike!

We recommend that you, as a business owner, do your homework or partner with an IT company that has. RSA Corp offers our clients a range of Business Continuity Planning and Disaster Recovery planning and implementation services so they have one less thing to worry about. Wouldn’t it help you to have experts handle the difficult stuff?

During this hurricane season, RSA Corp’s clients will be singing…

“Raindrops keep fallin’ on my head
But that doesn’t mean my eyes will soon be turnin’ red
Cryin’s not for me
‘Cause I’m never gonna stop the rain by complainin’
Because I’m free
Nothin’s worryin’ me”

Hear the entire song so you can sing along when you have your disaster recovery plan in place: “Raindrops Keep Falling on my Head“

It’s once again time to review your IT Disaster Recovery/Business Continuity (DR/BC) plan. Actually, since Hurricane season officially started June 1st, it is well past time. You do have a plan, don’t you? There is an adage from a wise but unknown sage that goes something like this: “If you fail to plan, you plan to fail”. Lofty words and a bold assertion, but they are based in fact.

Business continuity vendors like to toss out widely quoted statistics that 80% of businesses that experience system outages longer than 10 days, fail within 18 months. Searching the web for “business continuity statistics” yields widely varying and possibly even questionable results. Even so, it is clear that, based on data post Ike, Rita, and Katrina, a significant number of businesses failed to recover. Once we clear the hurricane season, there are always hardware failure, fires, theft, sabotage, even the possibility of a pandemic that could result in a partial or total loss of systems and data or availability to them.

Even if your business survives, what are you at risk to lose? eCommerce, phone, or even email sales losses can be easily computed by taking average daily sales and dividing it by 24. Chances are that if a significant portion of your revenue is generated this way, it won’t take many hours before the cost justification for protecting these systems becomes apparent.

Disaster Recovery refers to your ability to recover key systems from a catastrophic event. Business continuity refers to the ability for your business to continue to functions during that recovery. Two different concepts, but they intermesh at many points in your IT infrastructure.

Key Questions to Ask Yourself

As a decision maker for your company, how do you determine your risk? How do you balance recoverability with cost? How much protection is enough? What technologies are available for protecting critical systems and which ones are right for my needs and budget?

There are many “DR in a box” offerings (we have one ourselves) some of which only address rudimentary DR/BC needs (not ours, of course), but consideration should be made for the unique needs of your company. There are a dizzying array of products and services available that range from backup to tape or disk and storage offsite to complete duplication of systems, replication of data, and automatic failover capabilities to a secure location. Cloud services are featured prominently in many offerings. What is right for your business and your budget? A start to answering these questions would be to consider the following:

• What systems does my company need to operate on a day to day basis? (Phones and voicemail, email, data, applications)

• How long can my company do without access to those systems? You may be indefinitely without phones by using cell phones and forwarding your main number to an alternate phone, but access to data or email may be required within a single business day or even within a few hours. If your company relies on a web presence for ordering you may not be able to tolerate any downtime.

Once you identify what you need to operate and determine the maximum acceptable downtime for each system, you have determined the minimum standards for the products and processes needed to recover those systems.

Case in Point

I’ll use my company, RSA Corp, as an example of this process. As a services-based business, RSA Corp does not manufacture or distribute products, and as such we are not dependent on a specific physical location as much as we depend on access to data. When we underwent our DR/BC exercise initially, we identified that because our revenue was based on services billing that our AR, AP, Payroll, and timekeeping systems were essential.

RSA Corp essentially has two core services offerings; IT staffing and IT services. Staffing essentially needs access to their CRM and phones to continue to function. Services needs access to our monitoring, ticketing, client data systems, and application development environments. Everyone needs access to email. Because we use telecommunications extensively in the course of business, it was also decided that maintaining our main and helpdesk phone numbers was a priority. That’s it really – no dependencies on a physical office per se. Consequently, our plan was to configure our systems in such a way that as long as a user had access to a Microsoft OS based PC with Windows XP or newer or a Laptop, and internet connectivity, they could perform any essential functions.

Because we contract to provide services to clients on a round the clock basis, we had already collocated a significant portion of our IT infrastructure to a secure hosting facility away from proximity to the Gulf. We placed our IP phone system, data storage, email, app servers, and monitoring systems in the facility which reasonably insured access to them in the event our business office should become unavailable. Our ticketing and payroll systems are web based SaaS and hosted by the provider. Our IP phone system allows users to take their phones anywhere there is a working internet connection and reconnect to our phone controller. Access to applications and email was provided by using Microsoft Terminal Server, and email was also available via Microsoft Exchange webmail for desktop users and either webmail or Outlook Anywhere for laptop users. VPN capability was established to allow transparent access to the infrastructure for laptop users as well.

Own and Host or Lease from the Cloud

One additional consideration would be whether it is financially desirable to own the equipment to be used for DR/BC, if any. And would you benefit more from accounting for the cost as a Capital Expense or as an Operating Expense? The technology you choose may impact one or the other, or even both.

Clearly, there are many considerations in producing a Disaster Recovery or Business Continuity plan that is right for your business. Why not schedule an appointment with one of RSA’s DR/BC specialists to begin working on your plan before the next major storm or thief pays you a visit?

Jason Kuhn, CIO at RSA Corp, explains how the benefits of a Disaster Recovery Plan and a Business Continuity Plan vary depending on the individual organization. Can there be value to one without the other?

Jason Kuhn, CIO at RSA Corp, addresses the common misconception regarding business continuity and disaster recovery by clarifying the different aspects of a business that each plan pertains to.

Business continuity is the investment made by a business to be proactive in avoiding the risks associated with a disaster. Typically, this investment is an operating expense that serves as an insurance policy on an ongoing basis.

Disaster recovery is the plan associated with the reaction that follows a catastrophic event that disrupts the productivity of a business. This type of investment is more difficult to manage because it’s a “in the event of” plan that can easily fall through the cracks if not kept up with.

The two most important aspects of a DR plan involve sound, comprehensive planning and regular testing intervals that ensure the overall effectiveness of the plan. The most effective strategy is to give ample attention to both – mitigate risks as much as possible and have a solid plan to address the unforeseen.

Why is it so important to prepare for disaster now when Hurricane season is months away?

Given the geographic area that we live in, hurricanes stay top-of-mind when businesses think of a “disaster.” The truth of the matter is, several events occur each year within the walls of a business that could potentially serve as a disaster:

o Loss of mission critical data

o Power or hardware failures

o Disgruntled employees

o The list goes on…

The most important question to ask is whether or not your business can survive in the event of the unknown – and not knowing the answer to that question is just as dangerous.

Business continuity is too expensive for SMBs. What options do I have?

This is a common misperception among small to mid-sized businesses for a variety of reasons. The first is the lack of knowledge in terms of what options are available. The second is the possible impact on the business by failing to implement a proper plan.

Technology has evolved over the years to the point that what was once extremely expensive to purchase and manage is now far more simplified and cost-effective. In addition, several of the products and services associated with BC and DR have become commoditized, which drives down cost and creates a more affordable solution set for business owners.

Learn more about these cost-effective solutions in other blog articles.

Colocation – Disaster Recovery Toolkit: Business Must Go On…DR & Colocation

Online backup solutions – Disaster Recovery Toolkit: Knock, Knock. Who’s There? Your Data

Email Continuity – Disaster Recovery Toolkit: Can your Email Server Weather the Storm?

If you were unfortunate enough to experience Hurricane Ike, how did your email server fare? Not everyone can afford to keep their servers in a nice, safe datacenter or colocation facility. Does that mean your business is subject to your building’s physical power or Internet connection? The answer to that question is absolutely not. There are two ways small businesses can increase email uptime without breaking the bank.

Hosted Email Solution
Option one would be a hosted email solution. Hosted Microsoft Exchange providers are all over the Net, helping keep the cost of full-featured email hosting affordable. You can even add mobile devices to these plans for a nominal fee, further bolstering disaster recovery strategies and giving you and your employees corporate email at your fingertips at all times.

Need to convey when the office will be back up and operational? You can send out updates and keep everyone looped in. Emailing evacuated employees becomes a great way to keep lines of communication going without having to call everyone individually.

As far as day to day operations, with the improvements to Outlook 2007 and Outlook Anywhere feature, using a hosted provider looks more attractive to small businesses every day. With these technologies, you won’t even know the Exchange server is not on your local area network (LAN). You will also reap the savings by not having to deal with the backups and administration of an email server. Almost all hosted email solutions come with service level agreements. I don’t know about you, but getting 99.999% uptime sounds good to everyone.

Managed Filtering Service
If you already have an email server and don’t feel like making the switch to a hosted solution, your second option could be a filtering service, like MX Logic Email Defense with the disaster recovery feature enabled. With this service, not only do you get top notch hosted spam filtering that prevents spam from hitting your server, in the event of an outage, your emails are spooled and held by MX Logic for 60 rolling days. While spooling, users are able to log into the MX Logic page and check emails. When connectivity resumes, the messages are then delivered to your email server.

Both solutions have benefits and negatives. I’d be happy to answer any questions you may have or give you more information about either of these two options.

Business continuity and disaster recovery planning are all about a company’s ability to survive and continue operations in the face of physical and environmental events, such as natural disasters (fires, hurricanes, earthquakes, etc), network outages, disgruntled employees and computer viruses. Critical business technologies – telephone, email, Internet, corporate applications, databases – must be included in the planning process to ensure corporate survival and continued operation.

The straightforward method for reducing the impact of these events is to position your critical technologies in a more secure and resilient environment. You can either invest in constructing your own environment or utilize a commercial facility. For small and medium-size businesses, the former is often costly, as it includes:
• Installing electrical generators
• Using uninterruptible power supplies (UPS)
• Improving cooling and fire protection
• Increasing physical security
• Maintaining redundant communication lines for voice, Internet and data traffic

Colocation refers to hosting your equipment at a commercial facility, specifically designed to provide the redundant services required to guarantee uptime. Properly designed colocation facilities provide redundancy in all environmental systems such as generators, UPS, HVAC and communications, along with greatly improved physical security.

Taking advantage of the benefits provided by a colocation facility requires rethinking how technology is deployed within your organization. Usage of a colocation facility can range from providing a secure “mirroring” location for corporate data and server “images” to housing all servers and PBXs.

In determining the value of colocation, design decisions focus on assessing the value versus the cost of having all technology components available and operational regardless of what happens to your company’s facilities. This assessment is then used to determine what should be moved to colocation.

Some companies, such as a manufacturer with a single facility housing all company operations, may benefit most by mirroring data and server images. Companies with multiple locations or whose revenue generation models are less tied to a single location, such as financial or sales-based organizations, will benefit more by moving all critical technology to a colocation facility.

The benefits of colocation were once available only to large corporations due to costs. Today, colocation, virtual servers (virtualization), data replication, remote computing, and large bandwidth communication pipes provide smaller organizations powerful new tools to address business continuity and disaster recovery needs.

Hurricane Ike convincingly demonstrated that available technology means little unless coordinated planning and preparation have preceded the need. Colocation and other tools should be considered when developing a plan, but the most critical component is having a plan.

Hurricane season is officially here. Businesses are now planning and refining their disaster recovery and business continuity plans to prepare for potential disruptions. Companies need to make sure and investigate a few specific areas – offsite backup, colocation, email continuity and data recovery. A voice-over IP (VoIP) telephone network and SMS text messaging are other smart continuity tools.

VoIP allows users to connect to a phone system from anywhere in the world, through the Internet. This becomes vitally important in disaster recovery as response teams head to pre-determined disaster response locations. At that point, team members can easily plug in the VoIP phone and instantly become an extension of the core system. To the outside world – clients, vendors, etc – this is transparent, as business transactions and internal communications continue.

Business communications act like any other IP-based application. Take email as an example. The user doesn’t worry about the actual location of the email server. Users plugs into an Internet connection and, through a Web portal or VPN, email works. The same thing goes for telephony, if IP is being used. Corporate telephony can be anywhere with an Internet connection. This flexibility and adaptability is ideal for any emergency or disaster situation where other networks may be inoperable.

Another ingredient to investigate when preparing for hurricane season is an SMS server. Ask anyone that endured Hurricane Ike, and they will tell you that cell phones were paper weights for 4 to 5 days, except for SMS text messages. The first day or two after the storm, users would notice as much as a 12 to 24-hour delay on the message, but it would eventually get through the network to the intended recipient.

Companies can leverage this easy and affordable medium for disaster recovery by utilizing an SMS server for communications to clients, vendors and internal employees. As long as administrators can reach the network, company officials can send messages to one or multiple groups, individuals and numerous distribution lists for a secondary line of communications.

How are you preparing for hurricane season? Has your DR/BCP plan been tested within the last 12 months?

Without access to your business’s mission critical data, productivity as a whole could come to a screeching halt.

For years, businesses have relied on tape backups to secure their primary data repository. While the technology associated with these types of solutions continues to become more refined, one aspect of this process still leaves a business vulnerable – human error.

We can invest tons of money to secure the latest and greatest hardware and software to protect our data. However, without the commitment of one or more key employees to mange the process of changing tapes, reviewing logs and initiating support as needed, one mistake will render this effort useless.

To counter these measures, IT solution providers have introduced advancements in how data is encrypted, compressed and secured. With the presence of cost-effective and increased bandwidth capabilities, the industry has evolved and offsite backup solutions are now more viable then ever.

Offsite backup technology has made great strides to effectively secure your data online (offsite) at a price that is easy to justify.

If you haven’t considered an offsite backup solution within the last 12 months, it is probably time to revisit the subject. At RSA Corp, we bundle disaster recovery (including offsite backup) into our managed IT support service. However, there are backup solution providers worth checking out.

Here are some key factors to consider when looking at what an offsite backup can bring to the table:

• Government-sanctioned AES encryption
• Automated, unattended backups with status updates via email notification
• Real-time file restoration capabilities
• Remote restoration capabilities for both single file and “bare bones” restores
• Back up multiple platforms on one network, i.e. Windows, Linux,

When you add up the value associated with these key features and combine it with the fact that this type of solution costs pennies per gigabyte, it truly builds the case for incorporating some form of an offsite backup solution in to your disaster recovery planning. The cost is negligible, and the reward far outweighs the risk. It’s a no-brainer.

I would love to hear your story about how offsite backup saved your business.

It’s that time of year again…hurricane season is upon us. With the effects of Hurricane Ike still fresh in Houston’s memory, what are the lessons learned when it comes to securing the integrity of your business?

While history continues to repeat itself, a disaster’s long-term effects on a business can be substantial. Consider the following business downtime statistics:
• Only 6% of companies survive a catastrophic data loss, while 43% never reopen, and 51% close within two years
• Only 35% of small and medium businesses have a comprehensive disaster recovery plan in place
• International Data Corp estimates that companies lose an average of $84,000 for every hour of downtime.
• According to Strategic Research, the cost of downtime is estimated at close to $90,000 per hour
• The survival rate for companies without a disaster recovery plan is less than 10%

The cold, hard facts associated with these statistics are difficult to believe.

FACT: Today, most businesses do not have a comprehensive DR plan
FACT: The costs associated with downtime are substantial
FACT: The survival rate for businesses hit by a disaster is slim-to-none

While these statistics are real, the implications behind them are even more sobering. Businesses are left vulnerable due to poor planning, lackluster follow up, and a genuine lack of understanding in terms of how to overcome these challenges. How does this continue to be the case?

1. Many businesses are not aware of the options
2. If a DR plan is in place, it has not been tested or kept up-to-date
3. The planning associated with the DR plan is not comprehensive

In the coming weeks we will examine several aspects of a well thought-out disaster recovery (DR) plan, featuring an in-depth look at what processes to consider and what options are available.

Smart companies along the U.S. southern coasts are testing their business continuity and disaster recovery plans in preparation for the upcoming storm season. For those who have outgrown their plans or struggle with outdated procedures, refining the plan is a top priority.

Companies invest time, money and resources to create solid business continuity plans in order to ensure speedy disaster recovery and enhanced information security. The planning process is a significant project requiring risk assessment, in-depth interviews with key employees, evaluation of business processes and technologies, backup and recovery strategies, and testing of the plan.

What happens when the plan is solid and ready to go?  Don’t just put in on a shelf. Make the information gathered in the continuity planning process readily available, as a business guide. This information provides insights into the inner workings of day-to-day processes, which gives you a magnifying glass over each business function.

Three Ways to Leverage Your Business Continuity Plan

STRENGTHEN INFORMATION SECURTIY

During the continuity planning process, executives become aware of which employees hold the keys to certain information. Some discover that too many people have access to restricted data and proactively initiate steps to tighten information security.

Conversely, some realize that only one person manages payroll, contracts or authorization of banking procedures, which prompts them to take actions to ensure these financial capabilities are backed-up. The plan provides you with a high-level view of your infrastructure, allowing you to recognize potential technology risks, track incidents more effectively, monitor assets and enhance control of vendors.

PREPARE FOR MORE THAN NATURAL DISASTERS

Don’t limit your continuity plan to addressing only natural disasters or terrorist attacks. Data breach, power failures, network outages, disgruntled employees, computer viruses and software bugs should all be accounted for in the plan.

Data breach is the first concern regarding information security. According to a study by the Ponemon Institute, the total average cost of a data breach is $6.3 million, but can range from $225,000 to $35 million. Lost business due to interruptions in productivity accounts for more than 65% of the cost.

REDUCE BUSINESS RISK

Review the risk assessment performed at the onset of continuity planning. It gives you information about significant circumstances that could impact your company’s ability to meet strategic business goals. This knowledge allows you to evaluate the significance of such an event, and then prioritize based on the likelihood of its occurrence.

Consider issues regarding environmental compliance, safety regulations, business interruptions, financial inconsistencies and lacking IT infrastructure.

For seven more ways to leverage your BCP plan, download our white paper “Ten Opportunities to Capitalize on Your Business Continuity Plan.“

Unfortunately, it sometimes takes a major crisis to get decision-makers, in both the public and private sectors, to put together adequate plans to effectively prepare for, respond to and recover from natural or man-made disasters.

While disaster response and recovery efforts were common prior to Sept.11, government and private organizations placed a much higher emphasis on business continuity planning in the aftermath of the attacks.  They began building more resiliency and back-up systems into their business technology infrastructure.

This should come as no surprise considering only two of the 131 businesses whose technology was directly affected by Sept. 11 attacks were able to perform a successful failover, despite the magnitude of the disruption.  Of the 129 remaining sites, 70 percent (90 businesses) were able to resume some level of critical business operation after 120 hours (5 days) of downtime. The remaining 30 percent (39) lost their data completely.

In light of these facts, the hard question needs to be asked…

Is your business capable of sustaining an event that poses a real threat to its ability to continue with core business operations?

Technology is the piston that drives a business’s core processes.  As such, much consideration should be given to how these processes will continue to operate in the event certain resources of today are not available tomorrow.

1. What if a leaky sprinkler pipe slowly drips water on your servers, which are located in “the room that no one ever goes into” ?
2. What if a fire breaks out and destroys not only your servers, but the stack of data backup tapes stored on top of the servers for quick access and convenience?
3. What if the facility you are accustomed to being at each day is leveled by a category five hurricane?

The point to this line of questioning is that a disaster can come in many shapes and sizes.  You often have little to no warning prior to its impact. The amount of downtime you’re forced to incur can prove catastrophic to your business and its ability to survive long-term.

Have verifiable plans in place for such a situation.  A deep understanding of how your business transactions function is critical to creating verifiable plans.  It’s important to understand which core business processes must survive in the event of a disaster. Questions must be answered as to what operations currently support key business processes.

Ask yourself:

As reliance on technology intensifies, it’s critical to recognize the competitive advantages associated with an established technology portfolio.  However, it’s equally important to realize the ramifications of not being able to access that technology in the off-chance that the unlikely becomes likely.

How would it affect your business if your competitor had its business up and running before you could even figure out what wasn’t working? If you are in Houston, how did Hurricane Ike affect restoration of key operations?