Welcome!

Cloud Expo Authors: Carmen Gonzalez, Pat Romanski, Elizabeth White, Liz McMillan, Victoria Livschitz

Related Topics: Cloud Expo, Java, SOA & WOA, Linux, Security, Big Data Journal

Cloud Expo: Article

Integrate Cloud-Based Disaster Recovery into Business Continuity Strategy

DRaaS will continue to gain market strength as a solution this year while evolving to better meet customer requirements

Cloud-based Recovery-as-a-Service (RaaS) is becoming big business. Research and Markets forecasts the global market of RaaS and cloud-based business continuity will reach $5.77 billion by 2018, creating major opportunities for business continuity and risk management specialists alike. Likewise, Reportstack announced recently the global Disaster Recovery-as-a Service (DRaaS) market is expected to grow at a Compound Annual Growth Rate (CAGR) of 54.64 percent from 2014 to 2018.[1]

One of the leading drivers for small and mid-size businesses (SMBs) as well as enterprises seeking cloud solutions is Disaster Recovery (DR).[2]Organizations seek improved resiliency and failover in response to service disruptions of all kinds including natural disasters, cyber-attacks and technical malfunctions. In 2013, the financial impact of natural disasters worldwide was more than double the $100 billion estimate of 1990.[3]McAfee® Labs Threats Report indicates service disruptions are inevitable and becoming more predictable, with a reported 20 million new types of malware in the third quarter of 2013 alone. In a recent survey, IDC found that 71 percent of respondents experienced less than 10 hours of annual downtime, with a projected financial impact for SMBs of $125,000. Larger enterprise organizations could potentially have a corresponding annual financial impact of $17 million.[4] Dun & Bradstreet surveyed Fortune 500 companies with 59% of respondents reporting 1.5 hours of downtime each week, amounting to a projected $46 million impact annually for companies of 10,000 employees or more.[5]

However, the impact may be even greater. In a 2013 Ponemon Institute study, 91 percent of the participants reported that their organizations experienced unplanned downtime in the past two years. When you consider it takes about two days to recover from an IT event, if at all, the cost can be much higher in terms of lost revenue and damage to a company's reputation through reduced customer loyalty.

Floods, mudslides, ice and snow storms, hurricanes, tornados and cyclones, fires and droughts have one thing in common: all can have a negative financial impact on day-to-day business. Hurricane Sandy ranked as the largest global disaster in 2012 with a price tag of $65 billion. At the same time, New Jersey residents and municipalities had to cover an additional $8 million to $13 million in unmet expenses. Businesses are still trying to recover from the hurricane, with many resorting to bankruptcy protection. In 2013, 296 adverse weather events, predominantly in Europe and Asia, caused $192 billion in worldwide economic losses. Although the dollar amount was 4 percent less than the 10-year average, the number of events was greater than the 10-year average of 259.[6]

Other factors generating a need for Disaster Recovery planning include the risk potential from cyber attacks on Wi-Fi access into secure networks, Distributed Denial of Service (DDoS) attacks, resistant malware, insider threats, attacks on employee-owned device, or bring your own device (BYOD), and breakdowns with out-of-date, legacy systems.

Banks have been particularly hard hit in the last couple of years by DDoS attacks, prompting an April 2014 notice from the Federal Financial Institutions Examination Council (FFIEC), which requires banks to assess risk, monitor, and develop response plans to mitigate against DDoS attacks.[7] Attacks are becoming more sophisticated and can shut down business activity, slow website connections or prevent access to institutional websites. These attacks can be system-wide or come in via peripherals. For instance, an unsecured keyboard video mouse (KVM) switch allows cyber attackers to capture keystrokes and password information or access information through unauthorized universal serial bus (USB) devices and microphones.[8]

Cybercriminals are becoming stealthy and developing tools and botnet source codes that are increasingly complex and capable of avoiding detection. Cryptolocker, for instance, can be delivered by e-mail and is added to the start-up menu. It encrypts the data, infects the system and locks the organization out. Criminals then demand a ransom to unlock the data.[9]

Today, 31 percent of PCs continue to run on Windows XP operating systems. It's not just PCs that are at risk, as a number of medical devices and point of sale (POS) systems use Windows to run transactions, and the systems are not consistently updated. In April 2014, Microsoft announced it would no longer provide support and updates, placing systems and equipment at increased risk for cyber attacks. Because enterprise and institutions invest so much time and money in legacy hardware and software, these systems will require expert knowledge moving forward to maintain system security.

Business Continuity Planning is No Longer Optional
All of these factors point to the need for systematic security planning. Business Continuity Management (BCM) refers to the plans executed and activities performed on a daily basis to maintain business consistency and ensure critical business systems will be available when disaster strikes. And although the term Business Continuity Management is used interchangeably with DR, it is considered to be a separate, overarching strategic plan which includes disaster recovery, crisis management, incident response and contingency planning, as well as business impact analysis, recovery time objective (RTO) and recovery point objective (RPO).

BCM is a set of processes and practices created to identify and mitigate threats and their potential impact while providing the framework to prevent, mitigate and recover from disruptions of all kinds including the implementation of new programs, processes, system virtualization and other process shifts. And, although closely related, DR is more about the process of building continuity capabilities for infrastructure and applications. More specifically, DR is the business' ability to maintain critical operations and provide services during a disruptive event.[10]

Disaster recovery and business continuity continue to rank as two of today's top business concerns due to the prevalence of natural and man-made disruptions. A recent Continuity Insights and KPMG Continuity Management Program Benchmarking study was conducted to determine whether enterprise organizations are prepared for a disruptive event. The study involved 434 executives from 22 countries. Approximately 71 percent of those surveyed indicated a senior management board had been established for the purpose of developing a BCM, which made a big difference when conducting business impact analyses (BIAs), recovery objectives, adopting global standards and addressing cyber security issues. However, 36 percent of the respondents indicated they did not address cyber terrorism issues in the BCM. More than half of those surveyed stated they were prompted to initiate a BCM plan, DR plan or crisis management plan due to a disruption. Outages were due to weather problems, power interruptions and IT security issues and represented a nine percent increase in disruptions over the previous year's responses.[11]

Zero Tolerance for Downtime
New technologies and business trends such as virtualization and mobile device BYOD policies, cloud computing, real-time data analysis, e-commerce, third-party cloud-based providers, and globalization are prompting more companies to establish DR and BCM plans as part of overall business strategies. These trends make 24x7 availability the number one priority. At the same time, enterprise organizations are seeking fast Internet speeds, real-time information and ubiquitous connectivity to remain competitive, which leaves no room for downtime.

So, what is the cost if a business continuity plan is not instituted? Plenty, according to leading analysts. In a published study by Touche Ross and ioSafe, companies without a DR plan have a survival rate of less than 10 percent. Gartner, a leading information technology research company, breaks it down even further, predicting 25 percent of PCs will fail this year, while mid-sized companies will experience about 20 hours of network, system and application downtime at an average cost of $70,000 an hour. Forrester, another leading research company, predicts that 24 percent of companies will have a full data disaster.[12]

Business Continuity Planning is Key
In its annual business continuity trends study, Continuity Central reports some interesting findings in the way survey respondents are handling business continuity this year. More than half of those surveyed expect to make small changes to existing BCM plans in 2014, while a quarter of the respondents are expecting bigger changes, and eight percent anticipate a more thoroughly integrated plan. Five percent will implement ISO 22301 projects this year. As the first international standard developed for BCM, the ISO 22301 specifies what requirements businesses must meet to ensure the business recovers from a disaster or disruptive event.

Secure Data with Cloud Computing
Now that cloud computing has matured as a platform, more companies are beginning to trust that moving critical data to the cloud will ensure against loss in the event of a disaster or event. Forbes predicts that overall cloud spending will grow by about 25% this year, reaching $100 billion for software and services as well as cloud infrastructure. More SMBs will join the cloud at a growth rate of 20 percent over the next five years and more mid-sized companies will move to public clouds.[13]

More companies are seeking ways to reduce the cost of DR, which represents about 25 percent of the overall IT budget, without sacrificing security. However, as network architecture gains complexity, data recovery from on-site storage is becoming a long and arduous process, and on-site backup and restore has increased risk associated with it due to its potential for failure. The cost becomes even greater when organizations put time, effort and money into additional architecture to mirror all servers, applications, data, software and network connections. To that point, CIOs realize cloud storage poses less of a risk while the recovery process makes sound financial sense. Cost avoidance is gained as enterprise no longer needs to make large capital investments and infrastructure upgrades to maintain availability.

Cloud Service Providers (CSPs) offer a range of storage options and as-a-service offerings, which makes DRaaS a faster and more simplified process. Likewise, virtualized servers have brought down the cost of cloud storage, making it easier for SMBs to compete on the same level as larger organizations.

DRaaS Provides a Low Cost Solution
DRaaS is a flexible platform, enabling enterprise organizations to choose whether it's necessary to restore the entire organizational infrastructure or just critical applications. Organizations gain more control because they get to decide how data should be saved and what critical infrastructure needs to be restored and in what order. A recent study by the Aberdeen Group reports DRaaS is growing as the preferred solution because it reduces the risk of losing critical business data and experiencing a business interruption; critical applications can be up and running in minutes, not days; and it's a faster way of bringing the business back to normal.

Benefits of DRaaS as a pay-as-you-go recovery model are lower costs and minimized downtime as applications are automatically restarted once the problem is identified. Because DRaaS is on a virtual platform rather than on an on-site server, business continuity requirements to meet performance standards and consistency can also be achieved. A virtual backup site provides much needed data replication while providing faster recovery time at a lower cost because it runs on higher capacity, shared architecture. Testing can occur more frequently, because the system is always ready and does not have to be placed offline to test.[14]

Creating a Business Continuity Plan
A greater number of businesses today are taking advantage of cost-effective, pay-as-you-go DRaaS and BCM plans. BCM takes into account the scope of requirements for backup and restoration of data, applications, systems and in some cases, facilities, to ensure business continuity when disaster strikes. The first step when developing DRaaS or BCM is finding the right cloud service provider to help your organization determine solution architecture to meet your recovery performance needs and requirements; this can be done by performing a business impact analysis with a qualified professional. Once complete, a feasibility plan is needed to ensure proper procedures are implemented and followed. Results must then be measured by testing the system repeatedly for availability, completeness and verified backup. The plan should then be shared with key personnel so everyone knows their roles and responsibilities when downtime occurs.

The Future of DRaaS and BCM
DRaaS will continue to gain market strength as a solution this year while evolving to better meet customer requirements. The service is expected to become faster while efficiently optimizing infrastructure storage and servers. Virtualization will be key to meeting customer service level agreements while addressing recovery point and recovery time objectives. Platform flexibility will be integrated with self-service for larger companies with internal IT staff. Expect more companies to ask for a hybrid combination of DR strategies combining on-premise backup solutions with cloud platforms for data archiving and recovery. This way, on-site and cloud applications can be synched for rapid recovery.

Some customers will seek multiple CSPs for different cloud services, opening up new opportunities for vendors and risk management specialists. Storage is expected to double in growth in 10 years, while IT staff remains in demand. CSPs and risk management specialists who can serve as trusted IT advisors will be better positioned to take advantage of opportunities from companies seeking purpose-built back-up solutions. While at the same time, CSPs who enact simple, consumer-oriented pricing strategies will make decision-making easier for enterprise and speed up the sales cycle for solution specialists and channel partners. Last but not least, giving the customers what they want, true customer support, can make the difference in building a larger customer base and improving customer loyalty.[15]

More Stories By Mike Castañeda

Mike Castañeda is the Director of Technology at Lam Cloud Management, a New Jersey-based provider of proven Business Continuity, Workplace Recovery, Data Center and Network solution.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@CloudExpo Stories
The 3rd International Internet of @ThingsExpo, co-located with the 16th International Cloud Expo - to be held June 9-11, 2015, at the Javits Center in New York City, NY - announces that its Call for Papers is now open. The Internet of Things (IoT) is the biggest idea since the creation of the Worldwide Web more than 20 years ago.
"We help companies that are using a lot of Software as a Service. We help companies manage and gain visibility into what people are using inside the company and decide to secure them or use standards to lock down or to embrace the adoption of SaaS inside the company," explained Scott Kriz, Co-founder and CEO of Bitium, in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
15th Cloud Expo, which took place Nov. 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA, expanded the conference content of @ThingsExpo, Big Data Expo, and DevOps Summit to include two developer events. IBM held a Bluemix Developer Playground on November 5 and ElasticBox held a Hackathon on November 6. Both events took place on the expo floor. The Bluemix Developer Playground, for developers of all levels, highlighted the ease of use of Bluemix, its services and functionalit...
Some developers believe that monitoring is a function of the operations team. Some operations teams firmly believe that monitoring the systems they maintain is sufficient to run the business successfully. Most of them are wrong. The complexity of today's applications have gone far and beyond the capabilities of "traditional" system-level monitoring tools and approaches and requires much broader knowledge of business and applications as a whole. The goal of DevOps is to connect all aspects of app...
The 4th International DevOps Summit, co-located with16th International Cloud Expo – being held June 9-11, 2015, at the Javits Center in New York City, NY – announces that its Call for Papers is now open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's large...
SAP is delivering break-through innovation combined with fantastic user experience powered by the market-leading in-memory technology, SAP HANA. In his General Session at 15th Cloud Expo, Thorsten Leiduck, VP ISVs & Digital Commerce, SAP, discussed how SAP and partners provide cloud and hybrid cloud solutions as well as real-time Big Data offerings that help companies of all sizes and industries run better. SAP launched an application challenge to award the most innovative SAP HANA and SAP HANA...
When an enterprise builds a hybrid IaaS cloud connecting its data center to one or more public clouds, security is often a major topic along with the other challenges involved. Security is closely intertwined with the networking choices made for the hybrid cloud. Traditional networking approaches for building a hybrid cloud try to kludge together the enterprise infrastructure with the public cloud. Consequently this approach requires risky, deep "surgery" including changes to firewalls, subnets...
Want to enable self-service provisioning of application environments in minutes that mirror production? Can you automatically provide rich data with code-level detail back to the developers when issues occur in production? In his session at DevOps Summit, David Tesar, Microsoft Technical Evangelist on Microsoft Azure and DevOps, will discuss how to accomplish this and more utilizing technologies such as Microsoft Azure, Visual Studio online, and Application Insights in this demo-heavy session.
DevOps is all about agility. However, you don't want to be on a high-speed bus to nowhere. The right DevOps approach controls velocity with a tight feedback loop that not only consists of operational data but also incorporates business context. With a business context in the decision making, the right business priorities are incorporated, which results in a higher value creation. In his session at DevOps Summit, Todd Rader, Solutions Architect at AppDynamics, discussed key monitoring techniques...
Cultural, regulatory, environmental, political and economic (CREPE) conditions over the past decade are creating cross-industry solution spaces that require processes and technologies from both the Internet of Things (IoT), and Data Management and Analytics (DMA). These solution spaces are evolving into Sensor Analytics Ecosystems (SAE) that represent significant new opportunities for organizations of all types. Public Utilities throughout the world, providing electricity, natural gas and water,...
The security devil is always in the details of the attack: the ones you've endured, the ones you prepare yourself to fend off, and the ones that, you fear, will catch you completely unaware and defenseless. The Internet of Things (IoT) is nothing if not an endless proliferation of details. It's the vision of a world in which continuous Internet connectivity and addressability is embedded into a growing range of human artifacts, into the natural world, and even into our smartphones, appliances, a...
How do APIs and IoT relate? The answer is not as simple as merely adding an API on top of a dumb device, but rather about understanding the architectural patterns for implementing an IoT fabric. There are typically two or three trends: Exposing the device to a management framework Exposing that management framework to a business centric logic Exposing that business layer and data to end users. This last trend is the IoT stack, which involves a new shift in the separation of what stuff happe...
The Internet of Things is tied together with a thin strand that is known as time. Coincidentally, at the core of nearly all data analytics is a timestamp. When working with time series data there are a few core principles that everyone should consider, especially across datasets where time is the common boundary. In his session at Internet of @ThingsExpo, Jim Scott, Director of Enterprise Strategy & Architecture at MapR Technologies, discussed single-value, geo-spatial, and log time series dat...
An entirely new security model is needed for the Internet of Things, or is it? Can we save some old and tested controls for this new and different environment? In his session at @ThingsExpo, New York's at the Javits Center, Davi Ottenheimer, EMC Senior Director of Trust, reviewed hands-on lessons with IoT devices and reveal a new risk balance you might not expect. Davi Ottenheimer, EMC Senior Director of Trust, has more than nineteen years' experience managing global security operations and asse...
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
SYS-CON Media announced that Centrify, a provider of unified identity management across cloud, mobile and data center environments that delivers single sign-on (SSO) for users and a simplified identity infrastructure for IT, has launched an ad campaign on Cloud Computing Journal. The ads focus on security: how an organization can successfully control privilege for all of the organization’s identities to mitigate identity-related risk without slowing down the business, and how Centrify provides ...
The Internet of Things will put IT to its ultimate test by creating infinite new opportunities to digitize products and services, generate and analyze new data to improve customer satisfaction, and discover new ways to gain a competitive advantage across nearly every industry. In order to help corporate business units to capitalize on the rapidly evolving IoT opportunities, IT must stand up to a new set of challenges. In his session at @ThingsExpo, Jeff Kaplan, Managing Director of THINKstrateg...
"SAP had made a big transition into the cloud as we believe it has significant value for our customers, drives innovation and is easy to consume. When you look at the SAP portfolio, SAP HANA is the underlying platform and it powers all of our platforms and all of our analytics," explained Thorsten Leiduck, VP ISVs & Digital Commerce at SAP, in this SYS-CON.tv interview at 15th Cloud Expo, held Nov 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
One of the biggest challenges when developing connected devices is identifying user value and delivering it through successful user experiences. In his session at Internet of @ThingsExpo, Mike Kuniavsky, Principal Scientist, Innovation Services at PARC, described an IoT-specific approach to user experience design that combines approaches from interaction design, industrial design and service design to create experiences that go beyond simple connected gadgets to create lasting, multi-device exp...
Enthusiasm for the Internet of Things has reached an all-time high. In 2013 alone, venture capitalists spent more than $1 billion dollars investing in the IoT space. With "smart" appliances and devices, IoT covers wearable smart devices, cloud services to hardware companies. Nest, a Google company, detects temperatures inside homes and automatically adjusts it by tracking its user's habit. These technologies are quickly developing and with it come challenges such as bridging infrastructure gaps,...