Aug 24, 2006 10:58 AM,

Redefining business continuity

By Carol Wilson

This is the first in a series of special reports on business continuity.

Like all major telecom service providers, AT&T got a wake-up call in 2005, when a series of hurricanes wiped out networks throughout the Southeast and forced many businesses to consider a more serious approach to disaster recovery and business continuity than they had taken in the past.

But by AT&T's own research, many businesses remain vulnerable to serious disruption and loss because they either haven't made a disaster recovery plan or haven't followed through on all the steps necessary to make such a plan work.

According to an AT&T business continuity study released earlier this year, about 28% of companies have no disaster plan in place and almost half admitted they don't take protective measures when local or federal governments issue warnings of impending disaster such as severe weather.

Part of the problem may be that some businesses exist in areas where severe weather doesn't typically hit, and disasters are less expected, said Jerry Shammas, AT&T director of business continuity and recovery services. AT&T is working with its customers to promote more proactive business continuity planning in part because so many disasters aren't predictable, he said. That includes potential terrorist attacks or weather-related disruptions.

"I don't have any specific data that demonstrates that--there isn't a scientific analysis or sampling of those companies who do not have a plan--but it seems to be that based on analysis of the data, they see themselves in a lower-risk profile," Shammas said. "That could be because of geographic location--maybe they have not positioned data centers or critical business infrastructure along the East Coast in the path of hurricanes or they are not building data centers on faults or in tornado alley, or they are not in any kind of a flood plain.

"The sad part is, you don't know what is going to cause it," Shammas said. "Look at the torrential rains [which hit] in the Northeast [in June] – how many inland locations at reasonable heights have experienced some level of flooding and rain-related events? Then there's West Coast--over-development of land, deforestation is causing mud slides, erosion. Those kinds of things may not impact the facility itself but could impact the ability of the employee organization to get to work. If, for weather-related events, they can't report to work, has the enterprise provided the means for employees to work remotely?"

Even businesses that have disaster plans in place are not always following through--40% of the 1000 chief information officers and other senior IT executives polled said their companies had a plan, but hadn't tested it within the past 12 months.

Cost is one reason businesses don't always have all the tools in place that would enable them to maintain operations after a disaster knocks out one or more locations, Shammas said.

"There is cost associated with the risk," he said. "What a C-level executive needs to do is balance that cost against the likelihood of the event occurring or them being subject to the risk. What are the critical components that are going to cause the most pain and suffering? They need a risk assessment that quantifies the likelihood of the risk and the cost of mitigating the risk."

Relatively low-cost professional assessments are available, Shammas said. The businesses AT&T polled had more than $10 million in annual revenue to protect, making an assessment a reasonable investment.

Businesses might not be aware of all the tools available to them to essentially "virtualize" an organization so that if a major facility is taken out --as happened to many businesses after Hurricane Katrina--it is possible to recreate an organization over distributed sites that function much like a centralized facility.

"Over the past five years, technology has made tremendous strides," Shammas said. "AT&T has continued to keep pace with this. For example, there are wireless access hot spots where one can go in a city to gain wireless access to the Internet and though a secure tunnel get access to their platform or their application or their mail server, to communicate with other workers. Obviously, if the business is an assembly or manufacturing operation that requires works to be at a location with specific tools, this doesn't help. But a worker dealing with information management or movement, which are not hardened materials, can use broadband or wireless tools to provide access to a business enterprise's infrastructure in a secure manner."

Data centers can be synchronously mirrored or asynchronously replicated, he added.

"This can go all the way up to a very high availability solution--we manage clustered servers in two data centers that synchronously mirror each other," Shamas said. "They are connected on a high availability optical network so they are operating in what is called an active environment. This is accompanied by high availability business class storage and high availability fault-tolerant, 20-millisecond failover connections on multiple diverse pathways."

Businesses may hesitate to invest in laptop computers or other tools that workers can use remotely because of security concerns, Shamas said. The survey showed CIOs are becoming more proactive in protecting their networks from cyber threats, with 81% saying they are including cyber security in their business plan for 2006.

In coming weeks, this series will examine what AT&T, Qwest, Verizon and others are doing to address business continuity and disaster recovery.