Cloud computing is slowly upending the disaster recovery market. Only a few years ago, disaster recovery meant one of two things: For large organisations, it necessitated huge capital investments; for the mid-market on down, it meant backing up only the most important data to tape and shuffling it off to a secure location.
Actually, there's a third thing. For many organisations, even today, disaster recovery (DR) means doing the bare minimum, crossing your fingers and hoping for the best.
The Cloud is changing all of that. On one hand, it is democratising DR, making it affordable for even SMBs to sign up for DR services. On the other, the disruption is causing confusion, often giving companies a false sense of security and luring them into bad decisions.
An SMB can take advantage of such free or cheap services as Dropbox, Box or SkyDrive, and many can confidently (and not incorrectly) say that this is a sufficient DR plan. In fact, what most organisations don't realise is that part of their DR plan are the evolving habits of knowledge workers, mirroring what many SMBs are doing for DR.
As knowledge workers become ever more mobile and rely on a growing array of mobile devices, they constantly move critical information out of corporate data stores and into their personal, Cloud-based storage simply to make that data accessible from anywhere on any device.
There are problems with this approach, obviously, but it means that if a disaster strikes, your sales team will likely have a customer list it can access. Public relations pros will have key press contacts at their fingertips, and developers will simply access their latest projects in the Cloud, where they probably already had been.
What should be obvious to you by now is that even if you are wary of the Cloud for DR purposes, you are already deeply entangled in Cloud-based DR through your tech-savvy employees.
The Danger in Laissez-Faire DR
Before you breathe a sigh of relief, thinking you're more DR-ready than you'd previously imagined, remember that this laissez-faire DR may work out when you're hit by run-of-the-mill outages, such as a brief power blackout, but if a real disaster hits, you could still be in deep trouble.
"When I lived in Florida, my organisation had to rebound after a hurricane. We learned quickly about the things we hadn't planned for but should have," says Daniel Neufeld, vice president of information systems for long-term care provider Leisureworld Senior Care.
Neufeld's organisation originally felt lucky that it was no longer tied to the corporate PBX for voice. "We thought we'd just move over to our mobile phones, but that plan didn't work out for long," he says. They hadn't realised that many cellular towers don't have battery backup.
And let's not forget that all of this employee-driven, de facto DR butts up against another looming issue: Data loss. Sure, having critical data stored in Dropbox may save CIOs when a disaster hits, but it could just as easily get a CIO fired if that Dropbox account gets hacked or a key sales manager quits after having poached all the data he needs in order to take his accounts with him to his new job.
A more pervasive and dangerous laissez-faire DR mistake is simply believing that your Cloud provider will handle data backup and recovery for you. "When Amazon had downtime, customers were up in arms," says Jon Beck, senior vice president of worldwide channels and alliances for OpSource, a provider of enterprise Cloud and managed hosting services. "There's not a service provider on the planet that won't have an outage someday. What was interesting about the Amazon outage is how many big-name customers didn't have a disaster recovery plan in place to either move data to other availability zones or to other providers."
Don't blame your Cloud provider. Blame yourself.
The Cloud Marries DR to Data Replication
The problem with DR plans that involve moving data to other zones or providers is that the public internet isn't built for shifting huge chunks of data around on a moment's notice. If mission-critical data still resides in on-premises servers, most small- to mid-sized organisations don't have the bandwidth in place for real DR, nor do they have the budget available if they wanted to add it.
Both OpSource and Leisureworld overcame the bandwidth obstacle through WAN optimisation, with OpSource using the Cloud-based WAN optimisation service from Aryaka and Leisureworld using Riverbed's Steelhead appliances.
Interestingly enough, neither OpSource nor Leisureworld was thinking about DR when it deployed WAN optimisation.
"A couple of our customers [including SaaS companies Xactly and Accept Software] started using Aryaka to replicate data from our East Coast to West Coast data centres," Beck says. "One of the great things about the Cloud, with its elasticity and flexibility, is that you don't need to have separate conversations with vendors about data replication and disaster recovery. Those discussions get merged. You're no longer forced to have assets at one end sitting idle waiting for a disaster to happen. You can be using additional capacity for data replication between two sites, but in the event of a disaster, you can spin up compute assets in the secondary site on demand."
Neufeld of Leisureworld Senior Care had a similar experience. He deployed Riverbed appliances to overcome bandwidth limitations and replicate data from nursing and retirement homes back to the home office. Each home only has a cable modem or DSL connection. Once Riverbed was in place, Neufeld was able to deploy the virtual backup solution from Veeam. "Without WAN optimisation, we wouldn't have had the bandwidth for this," he says.
What the Cloud Does and Does not do for DR
The Cloud is putting DR in reach of even the smallest organisations. SMBs may not have the time or IT savvy to sketch out a full-blown DR plan, but they can certainly sign up for Cloud-based backup and recovery solutions. For the mid-market, more involved DR is also in reach, often augmented by WAN optimisation and a variety of Cloud-based services.
The short list of benefits that come from moving DR into the Cloud includes lower TCO, the ability to consume DR as a service, the ability to get DR as an add-on to data replication and the fact that DR is dovetailing with mobility.
If you're a small organisation that doesn't have to pass compliance audits every year, simply signing up for a Cloud-based backup and DR service may well be sufficient for you. However, if your organisation is larger and regulated, you'll need to put a lot more thought behind those DR plans, and many large organisations still haven't done this.
Consider this scenario: The vacant lot next to your building has been sold, and a construction crew has moved in to start building a new office tower. This has nothing to do with your DR plans, right?
Wrong.
"If there's a construction site near you, or especially if there's construction in your building, we recommend to our clients that they get a rider on their insurance policy in the event that they're displaced as a result of the work being done," says Ginnie Stouffer, a master certified business continuity professional with IDC Partners, a business continuity firm in King of Prussia, Penn.
Construction workers could spark a fire, cut a buried power line or break through a natural gas line. Any of these events could disrupt power or force nearby businesses out of their buildings. Stouffer noted that most businesses are underinsured for disaster recovery—something the Cloud will certainly not help you with—and even those with DR plans in place may forget to scrutinise the fine print.
What happens if you need to install new servers for an on-premises system? Will you be able to get the gear in a day or two? If not, can your business afford to be down for however long it takes? Many businesses will fail if they are offline for three or four days. Equipment providers offer quick-ship agreements that you have to sign up for ahead of time. Has your organisation signed up for one? If not, does it have a third-party provider in mind that can deliver gear quickly?
Even if you are in the Cloud and don't have to rebuild your own servers, have you thought through what a disaster really means?
"All the Cloud provider does is keep the servers running," Stouffer sags. "It doesn't provide you with office space in an unaffected nearby town. It doesn't give you directions to that office. Most providers fail over from disk to disk. Do you want tape as part of the disaster recovery solution? Is your data being replicated to a different region? After [Hurricane] Katrina, we know how important that is."
In other words, the good news is that the cloud has made DR affordable for business of all sizes. The bad news is that Cloud-based DR just scratches the surface, and many organisations, whether consciously or not, are doing little more than scratching the DR surface.
Jeff Vance is a Los Angeles-based freelance writer who focuses on next-generation technology trends. Follow him on Twitter @ JWVance.
Read more about it strategy in CIO's IT strategy Drilldown.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.