Be ready when the balloon goes up

By ADAM GIFFORD


One of Roger Cockayne's first jobs in IT was preparing the disaster recovery plans for a large British organisation.

"I worked on it for nine months, working through the processes and procedures, how to get the data out if anything went wrong," says Cockayne, now a director of Hosting and Data Services. "I then had a reasonably successful test, with everything within cooey of what we wanted.

"When I reported to my boss, he said: 'I'm surprised you bothered - if the balloon goes up, I'm resigning, and that's what any disaster recovery manager would do'."

That's the big hole in disaster recovery plans. Whatever you do, whatever extra gear you put in to back up systems, you never know if you can rely on your people.

Cockayne says the premium New Zealanders place on lifestyle is also a risk.

"If there is a disaster, they will probably want to spend that time with their families."

His solution - contract out disaster recovery to specialist third party organisations.

They then become responsible for keeping data safe and transactions flowing.

"Remember, these things always go through two or three phases," Cockayne says. "The first thing is the disaster recovery, so you try to protect or salvage the people, the workrooms, the computers, the data and so on.

"Then the question is: where do you go while you wait for the building to be fixed? That means moving into valuable space where you are probably being hit with high rent because you are over a barrel.

"Then you have to get back to the original building or some permanent replacement, and people, hardware, software, data have to be duplicated again.

"The third phase will be getting back to normal, and thinking what to do if it happens again."

So what constitutes a disaster?

Earthquakes or volcanos can hit at any time, so that always has to be factored into a disaster recovery or business continuity plan in these shaky isles, especially for Wellington-based businesses. War and revolution are probably lower down the list, and terrorism isn't something most organisations can do anything about.

Cockayne says the most likely one is a bug.

"You have a shared tenancy in a tower block, and one person comes back from Asia with Sars, so the whole block is closed down. That could affect 20 companies straight off."

New Zealand has a relatively low spend for disaster recovery compared with other countries in the region.

Research firm International Data Corporation puts the size of the business continuity services market in 2003 at $17.6 million, compared with $135 million across the Tasman.

Sales of backup and recovery software, another useful indicator, were up 4 per cent to $10 million, compared to a 31 per cent jump in the Australian spend to about $80 million.

Analyst Graeme Muller says disaster recovery and business continuity planning are key business trends that have fuelled the booming market for storage.

"Business continuity tends to be costly due to the complexity of the solutions. Disaster recovery solutions, an important aspect of business continuity, are particularly costly due to the off-site facilities and high-end software and hardware required to deliver it effectively," Mueller says.

"Most companies cannot afford full-service business continuity. What differs is the level of risk that a business finds acceptable and how much they are willing to spend to insure against that level of risk."

He says few firms really understand disaster recovery. Australian research found 83.1 per cent of businesses said they had a disaster recovery plan in place, but further questioning found most respondents thought a simple backup and recovery system constituted disaster recovery.

Bob D'Ath, of Wellington consulting firm Resultex, agrees few New Zealand firms will have true disaster recovery.

"New Zealand traditionally has paid lip service, with the large financial institutions and telcos being the exception," says D'Ath, a former IT manager at the Statistics and Labour departments.

"Firms may have the ability to recover from backup tapes, but most would need weeks to get running properly again. Very few take seriously the need to be up and running the same day."

He says few organisations have the skills in house to prepare a complete disaster recovery plan, so they call in consultancies such as Resultex. "It is not something you can do at the end. You have to build it into the design at the start."

What is more important is that people do test their procedures and back-ups as a normal part of system administration.

"It needs to be part of the psyche.

"The day to day recovery of a file or directory from a recent back-up usually focuses people's minds on what their system does or does not do," D'Ath says.

The rest comes down to good plans and internal practices. "When you have a good plan, and practice it, it should be second nature when trouble occurs. There is no point in having disaster recovery as a folder of notes sitting on a shelf. It is a bit late to go looking."