Disaster Recovery and Corporate Survival Strategies FT Prentice Hall FINANCIAL TIMES In an increasingly competitive world, we believe it’s quality of thinking that will give you the edge – an idea that opens new doors, a technique that solves a problem, or an insight that simply makes sense of it all. The more you know, the smarter and faster you can go. That’s why we work with the best minds in business and finance to bring cutting-edge thinking and best learning practice to a global market. Under a range of leading imprints, including Financial Times Prentice Hall, we create world-class print publications and electronic products bringing our readers knowledge, skills and understanding which can be applied whether studying or at work. To find out more about our business publications, or tell us about the books you’d like to find, you can visit us at www.business-minds.com For other Pearson Education publications, visit www.pearsoned-ema.com Disaster Recovery and Corporate Survival Strategies Pre-emptive procedures and countermeasures LOUISE BROBY FT Prentice Hall FINANCIAL TIMES An imprint of Pearson Education London ■ New York ■ Toronto ■ Sydney ■ Tokyo ■ Singapore ■ Hong Kong ■ Cape Town New Delhi ■ Madrid ■ Paris ■ Amsterdam ■ Munich ■ Milan ■ Stockholm PEARSON EDUCATION LIMITED Head Office: Edinburgh Gate Harlow CM20 2JE Tel: +44 (0)1279 623623 Fax: +44 (0)1279 431059 London Office: 128 Long Acre London WC2E 9AN Tel: +44 (0)20 7447 2000 Fax: +44 (0)20 7447 2170 Website: www.briefingzone.com First published in Great Britain in 2002 © Pearson Education Limited 2002 The right of Louise Broby to be identified as author of this work has been asserted by her in accordance with the Copyright, Designs and Patents Act 1988. ISBN 0 273 66162 0 British Library Cataloguing in Publication Data A CIP catalogue record for this book can be obtained from the British Library. All rights reserved; no part of this publication may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, or otherwise without either the prior written permission of the Publishers or a licence permitting restricted copying in the United Kingdom issued by the Copyright Licensing Agency Ltd, 90 Tottenham Court Road, London W1P 0LP. This book may not be lent, resold, hired out or otherwise disposed of by way of trade in any form of binding or cover other than that in which it is published, without the prior consent of the Publishers. 10 987654321 Typeset by Monolith – www.monolith.uk.com Printed and bound in Great Britain by Ashford Colour Press Ltd, Gosport, Hants. The Publishers’ policy is to use paper manufactured from sustainable forests. About the author Louise Broby is a financial writer who has writen extensively on a wide range of topics. Her publications include Investment Regulation in Europe, Global Stock Markets, Pan-European Financial Regulations and Stock Market Globalisation. She has worked in investment banking and as a business school academic. Louise may be contacted at: Stratos Multimedia LLC 6th Floor 175 Piccadilly London W1J 9TB Tel: 07802 882 554 E-mail: [email protected] v Contents List of figures xi List of tables xii Executive summary xiii Acknowledgements xvi Introduction xvii 1 Backup and storage: potential disasters 1 Introduction 3 Terrorist attacks – single and multiple strikes 3 Natural disasters 4 Power failure 7 Lightning 10 Attacks caused by human intervention 11 Vulnerability to malicious attacks 12 Systems failures, disruptions 13 Effects of disasters 14 First line of disaster recovery 15 Conclusion 15 2 Corporate state of readiness 17 Introduction 19 Recent survey 19 How to cope with economic fluctuations 22 McKinsey findings 22 Data availability 23 Factors affecting corporate state of readiness 23 Precautionary steps 23 Mobile phones prove their worth 24 Conclusion 25 3 Information security 27 Introduction 29 DTI surveys 29 Protective measures 34 vii Contents General control procedures 35 Conclusion 37 4 Corporate disaster recovery/business continuity plans 39 Introduction 41 Definitions 41 Factors affecting the administration of plans 42 Terrorist attacks – should they be given priority? 43 Global business continuity 44 The BCM process 44 Insurance against disasters 46 Frequency of risks 46 Review of the business continuity plan 48 The disaster recovery plan 48 BAM (business activity monitoring) 50 Conclusion 50 5 Data backup and storage solutions 53 Introduction 55 Tape backup and restoration of data 55 Advantages of tape backup 55 Tape formats 56 Backup products: service and maintenance 57 New backup technologies 58 Retrieval – primary and secondary storage 60 Backup architectures 62 Types of network 64 SAN management software 65 Benefits of fibre channel storage networking 65 Environments 67 The fibre channel market 67 Interoperability standards 67 Wireless LANs 68 Conclusion 68 6 Spreading of risk: remote backup and storage facilities 69 Introduction 71 viii Contents The command centre 71 The recovery centre 71 Colocation facilities 72 Duplicate facilities 72 Emergency facilities 73 Colocation providers 74 Online backup: Netstore 76 Advanced security centres: Ernst & Young 76 Business continuity datacentres: IBM/Telefonica 77 The role of broadband 77 Conclusion 78 7 Outsourcing/insourcing/ASP/MSP/SSP/WASP 79 Introduction 81 Trends in outsourcing 81 Major drivers of outsourcing 83 Insourcing 85 Insourcing or outsourcing? 85 Application service providers (ASPs) 86 Managed service providers (MSPs) 87 Storage service providers (SSPs) 87 Wireless application service providers (WASPs) 87 Choice of provider 88 Managed services – survey findings 88 Conclusion 89 8 Backup and storage costs/disaster costs 91 Introduction 93 Backup and storage costs 93 ROI and TCO models 94 Cost of downtime 96 Cost of security incidents 97 Under-investment in IT security by UK companies 98 The role of business impact analysis 98 Costs associated with major disasters 99 Cost estimate surveys 101 Insurance 101 Conclusion 102 ix Contents 9 Backup and restoration in financial services 103 Introduction 105 Pioneers 105 Competitive advantage 105 Exposure of banks 106 Watchdogs 106 Compliance 107 Misuse of financial systems 109 Vulnerability 110 Technology leaders 111 Dealer room recovery service 111 Conclusion 112 10 The backup and storage industry players and their products/services 113 Introduction 115 Industry trends – vendor alliances 115 September 11 – vendor assistance 115 Major players 116 Industry associations 125 Conclusion 126 11 Summary of conclusions 127 Chapter 1 129 Chapter 2 129 Chapter 3 129 Chapter 4 129 Chapter 5 130 Chapter 6 130 Chapter 7 130 Chapter 8 131 Chapter 9 131 Chapter 10 131 Overall conclusion 132 Glossary 133 x Figures 1.1 Transient surge with 10 microsecond rise time 8 1.2 Transient surge generation 10 2.1 Response to the question: When did you last review your organization’s disaster recovery plan? 20 2.2 Sector variation in companies’ reviews of disaster recovery plans 21 3.1 What proportion of UK businesses have suffered security incidents (arising from premeditated or malicious intent) in the last year? 29 3.2 What proportion of UK businesses have suffered a serious security incident in the last year? 30 3.3 What proportion of UK businesses have suffered security incidents in the last 12 months? 30 3.4 What proportion of UK businesses have incident response procedures in place? 31 3.5 Which of the following objectives are very important to UK businesses in the event of a security incident? 32 3.6 After the security breach, what changes were made to prevent future incidents? 32 4.1 BCM – an ongoing process 45 4.2 Risks measuring/probability 47 5.1 Secondary storage migration 61 5.2 Local backup 63 5.3 SAN example 63 5.4 Traditional storage vs fibre channel-enabled SAN 64 5.5 Storage area network 66 7.1 Which of the following significant systems or security processes are outsourced? 81 7.2 Which UK businesses are outsourcing security policies and standards development? 82 8.1 Storage growth industry estimates 94 xi Tables 1.1 Main causes of IT data loss in the US 3 3.1 The percentage of companies using technology 33 4.1 The different areas of crisis in the BCM process 46 8.1 Total cost of ownership model 95 8.2 Return on investment model 95 8.3 Impact to businesses of computer downtime and data loss in the US 97 8.4 Estimates of the insured loss (all lines of business) from the terrorist attacks of September 11 100 8.5 Most costly insurance losses in 2001 in property and business interruption 100 xii Executive summary The focus on disaster recovery and corporate survival strategy has heightened in recent months, following September 11 as well as deepening recessionary trends. Mission-critical data are the life-blood of many organizations, especially in the financial sector, and transport and communications. The ‘it never happens to us’ attitude has been badly shaken by the wide impact of the World Trade Centre attacks, with a roster of finance companies reading like a ‘who’s who’ in finance, all affected, some seriously with loss of life, IT systems and offices. Companies are now revising their disaster recovery and business continuity plans and examining whether new hardware and software solutions, a repositioning of remote backup facilities or the creating of replicate facilities are the answer. This Executive Briefing sets out to examine the state of the disaster recovery and backup market in the UK and the US, and the solutions that are being recommended by software vendors and implemented by industry. CHAPTER CONTENT ■ In Chapter 1, an overview is given of the potential disasters that can cause damage to equipment and backup data. With the fading of the impact of the bombings in the City of London in the 1990s, terrorist attacks were on the backburner for a while, but with the devastating attacks on the World Trade Centre, terrorism is right back on the agenda for backup strategies and disaster recovery plans.