WhitePaper BusinessContinuityPlanning

SCHOOL OF COMPUTER SCIENCES UNIVERSITI SAINS MALAYSIA

CST233: Information Security and Assurance Academic Session: 2011/2012 Assignment 2

Name: Toh Wei Chun Matrix No.: 107638 Title: Business Continuity Planning (Hot site , Warm site, Cold site) Lecturer Name: Dr. AmanJantan

0|P a g e

WhitePaper BusinessContinuityPlanning

Table of contents

Introduction. Business Continuity Planning (BC).. Who are the real owners of Disaster recovery (DR) and Business Continuity (BC)?..... Importance of disaster recovery planning for businesses.. Cold Site recovery Pros and cons of using cold sites. i. ii. iii. Cost.. Training and Storage.. Availability.

2 3 4 5 6 8 8 8 8 9 11 11 11 12

Warm site recovery. Pros and cons of using Warm sites. i. ii. Cost..................... Availability.

Hot site recovery.. i. ii. iii.

Pros and cons of using Hot sites . 14 Cost... 14 Down Time 14 Disaster Recovery Testing. 14

Conclusion. 15 Reference.. 16

1|P a g e

WhitePaper BusinessContinuityPlanning

Introduction Every business needs to face the reality of disasters. Nowadays, almost all business records are using computer to record and stores in electronic form. But, most electronic records, like emails or transactions are store into soft copy. If electronic records are lost, they might be impossible to re-create and this make trouble to that organization if want to check back the data. For most businesses, data loss is not an option.Disaster Recovery (DR) is the process an organization uses to recover access to their technology infrastructure critical to an organization that are needed to resume the performance of normal after a natural disaster or a disaster caused by humans[2]. While Disaster Recovery plans, or DRPs, most of the company only focus on their technology infrastructure critical, manpower also are the most important element that should be coverin any organization. So, when creating a DR Plan, both types of disaster need to be considered. Disaster Recovery Plans are generally part of a larger, more extensive practice known as Business Continuity Planning. DR plans should be well practiced so that all staff are familiar with the specific actions that need to take when a disaster occur. DR plans must also be adaptable and routinely updated.

2|P a g e

WhitePaper BusinessContinuityPlanning

Business Continuity Planning (BC)

Business Continuity Planning is the way an organization can prepare for disaster recovery. These programs prepare for multiple problems. Detailed plans are created that an organization will take to help recover any of critical operations that may have been either completely or partially interrupted during or after a disaster. In order to be fully effective at disaster recovery, these plans are recommended to be regularly practiced as well as outlined.A backup site is a location where an organization can easily relocate following a disaster, such as fire, flood, terrorist threat or other disruptive event [1]. This is an integral part of the disaster recovery plan and business continuity planning of an organization. In the event of a disaster, a backup site is where your data center will be recreated, and where you will operate from, for the length of the disaster. The organization can create the backup sites in another location or have an agreement with a second organization to operate a joint backup site.There are three types of backup sites, which is cold sites, warm sites, and hot sites. The different between these backup sites is based on costs and effort implementation. The organization also can choose the backup sites based on work area.

3|P a g e

WhitePaper BusinessContinuityPlanning

Who are the real owners of Disaster recovery (DR) and Business Continuity (BC)? Most people would say the owners would or should be the person who is supporting the IT equipment, or the operators handling the business functionsbecause they are the ones operating the system or know how it works. Actually, the true owners of Disaster recovery (DR) and Business Continuity (BC) are the business managers of the organization. IT staff just know to repair the system, but business managers understand the potential loss in terms of financial, reputation. Business managers are responsible for ensuring provision of necessary budgets, manpower, resources, alternative methods and other to prevent disasters.

4|P a g e

WhitePaper BusinessContinuityPlanning

Importance of disaster recovery planning for businesses

The importance of disaster recovery planning for organizations has become a critical component of business planning. For those organization which do not develop a contingency plan have high degrees of loss the data if a disaster occurs.The process of develop a contingency plan are like to insurance. In the event something goes wrong, it ensures continuity of business. A well-developed plan plays a large role in how smoothly a business can transition back to restoration in the event of a disastrous situation. It is becausenowadays many businesses are extremely reliant on having technology resources, networks and information systems. Any interruption in the information technology system could result in a total breakdown of daily processes. A disaster recovery plan can help mitigate any permanent damage and help ensure the business' continuity and survival.

Businesses have become extremely dependent on Information technology (IT). So failures in IT are more likely to affect the business than other areas, and that impact is more likely to be severe.

In a networked, workflow type of environment a failure can hamper many departments and units.

5|P a g e

WhitePaper BusinessContinuityPlanning

IT environments have become extremely complex and inter-related, so the number of potential failure points is increasing day by day.

Without a proven DR and BC process organizations can go out of business within hours or days.

Cold Site recovery

A cold site is an alternate facility that already has in place the environmental infrastructure required to recover critical business functions or information systems, but does not have any pre-installed computer hardware,

telecommunications equipment, communication lines and other. These must be provisioned at time of disaster. Usually a cold site provides a computer room with power and network cabling as well as air-conditioning. A cold site is an empty space. So, the organization have to configure the space as they want for any employee to sit there, set up hardware, servers, PCs and other. A cold site is the most inexpensive type of backup site for an organization to operate, but it takes longer to get an enterprise in full operation after the disaster.With cold site recovery, there is no data mirroring and its use backup tapes to recovery the data.

6|P a g e

WhitePaper BusinessContinuityPlanning

Cold site recovery mostly is not to be choose as option in disaster recovery plan. It is because it difficult to loan equipment for regular disaster recovery testing and generally hardware like servers and computer needs to be purchased at time of disaster. Depending on the type and number of servers that the organizations require, it could take a few day or weeks to purchase and install the relevant hardware required for recovery.

In summary, a cold site recovery strategy is not recommended. If this strategy selected for your IT infrastructure, all staff in the organization need to ensure that all can get access to recovery hardware as fast as possible through set up an arrangement with your hardware supplier for preferential and urgent delivery of hardware in a disaster situation or to contract with a disaster recovery provider for them to provide syndicated recovery hardware at the cold site in the event of a disaster.

7|P a g e

WhitePaper BusinessContinuityPlanning

Pros and cons of using cold sites

Cost Implementing a cold site is far less expensive than maintaining a hot site because a cold site does not contain backed up data and any computer infrastructure. After a disaster, the organization need to take time to do all the setup required to get the business up and running. There is a lapse between the disaster and getting back so that organization can function properly, during this inoperable time the business may lose a lot of money. If this figure is too costly, a warm or hot site might be a better option.

Training and Storage A cold site can be re-purposed for other uses while do not have any disaster occur. Many businesses use the alternate site for training and storage off the main facility. This directly can reduce some of the costs associated with maintaining a separate facility.

Availability One drawback of selecting a cold site over a hot site is there is lessened ability to thoroughly test a disaster recovery plan since the technology component is nonoperational until the location is set up with equipment. Cold site do not provide immediate availability in the event of a disaster occurring if compare to a hot or

8|P a g e

WhitePaper BusinessContinuityPlanning

warm site. The business will be offline until hardware, software and staff to set up and manage operations arrives.

Warm site recovery

A warm site is an off-site recovery facility that contains data center facilities like backup power supply, cabling, air conditioning. It also has permanently available IT infrastructure similar to those at the original business site, but does not include backed up copies of data and information. With warm site recovery, there may be some data mirroring or replication although mostly restores will be
9|P a g e

WhitePaper BusinessContinuityPlanning

done from a backup.Before you can use a warm backup site to restore service, the most recent backups from the remote storage facility must be delivered before recovery can begin.Although a warm backup site contains backups, the information may be incomplete due to the fact that the backup may have been sent to the facility as much as one week ago.

Warm sites are much easier to maintain than hot sites, as they do not require the constant effort to maintain replication nor the painstaking network configuration to assure an immediate transfer. It is the most common recovery strategy and provides a balance between cost and potential for a relatively fast recovery. The warm site may take several minutes to several hours before it can fully take over in an outage. With warm site recovery, hardware is available on stand-by and, in the event of a disaster, operating system and data restores can start virtually immediately. As an additional advantage, a warm site can often be a very useful platform for testing updates, patches, new software, and confirm that backups are working properly.

In summary, a warm site recovery strategy is recommended for many environments where the Recovery Time Objective (RTO) is from 8 hours - 72 hours for priority systems. Warm site recovery time is depend on the problem that the organization face like amount of data to be restored and method to restore data.

10|P a g e

WhitePaper BusinessContinuityPlanning

Pros and cons of using Warm sites

Cost In contrast to a hot site, a warm site relies on backups for recovery. As a result, it doesn't require dedicated storage but instead can take advantage of lessexpensive shared storage. In other words, all components of a warm site, including storage, are shared among multiple customers. Therefore, most of the considerations of hot sites also apply for warm sites.

Availability Disk-based backups have narrowed the gap between warm sites and hot sites, and almost all disaster recovery service providers now offer an electronic vaulting option, which is essentially disk-based backup of production data over the network. RTOs and recovery point objectives (RPOs) of warm sites with electronic vaulting are typically less than a day, which is very close to the recovery times offered by hot sites but at a fraction of the cost. Electronic vaulting is closing the gap between tape-based recovery and a replicated DR infrastructure, and customers need to look at it because of its price and reliability benefits.

11|P a g e

WhitePaper BusinessContinuityPlanning

Hot site recovery

[4] A hot site is a duplicate of the original site of the organization. It has complete computer systems and backed up copies of data and information. In other hand, Business Records Management also provides some facility like telephones, fax machines, internet access and other to help organization maintain their business operations within minutes or within a few hours at most.

The hot site is a fully-equipped alternative facility. After disaster occur, a business can relocate with minimal losses to normal operations. This kind of backup site is a necessity for businesses that must resume normal operations as soon as possible. With hot site recovery the data required to continue operations is generally replicated to the recovery site and so is available virtually
12|P a g e

WhitePaper BusinessContinuityPlanning

immediately. Users can continue to access the database while restoration is in process as long as the data that is being updated is noted and then copied when the update is finished.

A hot site server setup is use if the primary servers fail. In an ideal setup, the hot site is located at a separate site from the primary server thus assuring that even with the most catastrophic failure at the main site the system will continue to function. Hot site recovery strategies are the most expensive solution.It requires complete duplication of the server hardware, an actual separate server site, and a secure WAN connection in order to replicate the data. However they do provide a very low RTO and RPO and therefore in certain environments they are the only option (especially financial services environments and often telecom

environments).

13|P a g e

WhitePaper BusinessContinuityPlanning

Pros and cons of using hot sites

Costs Cost will be a primary consideration because the expenses to maintaining a hot site are very high. Businesses that are too reliant upon to be online at all times are more suitable to use a hot site than a company can afford to experience some down time.

Down Time Down time is minimized since the hot site is a functional duplicate of the organization and have complete computer hardware that needs to conduct daily processes if any disaster occur.

Disaster Recovery Testing Benefit to a hot site is that is provides a way for companies to actually test their disaster plans in full. Testing is a key component to any kind of business continuity planning. A hot side provides businesses a solid way to conduct testing. In the business environment, time is money, it is often very costly for many businesses to be offline, even for a few hours. For example, a companies such as airlines, hotels suddenly going offline. Chaos would happen and the business would suffer terribly.

14|P a g e

WhitePaper BusinessContinuityPlanning

Conclusion

As a conclusion, choosing

a right

recovery strategy is going to have a big

impact on your budget. The three primary recovery site strategies do not have clear lines between them Each option has different budgetary requirements and pros and cons. You need to carefully review your budget, objectives and options before making a decision. However it is critical that whichever option you choose, you ensure that you are able to regularly perform disaster recovery tests where you go through the recovery of your systems. An untested disaster recovery plan can be highly dangerous as it may give you a false sense of confidence in your ability to recover in the event of a disaster. There are summary of three recovery strategy:

Strategy Hot site

Advantages Shortest recovery time Equipment is supplied Easy to test backups and recovery plans

Disadvantages Most expensive Short-term use of facility Facility may not always be available Not easy to test plans Facility may not always be

Warm site

Moderately priced Basic infrastructure with

15|P a g e

WhitePaper BusinessContinuityPlanning

some equipment Cold site Most inexpensive Basic infrastructure Can usually rent the space for longer period of time

available (see note below) Longest recovery time No equipment is supplied, it must be ordered and installed

Note : For most businesses, a warm site is the most cost-effective strategy for a recovery site to meet Recovery Time objective (RTO). Warm sites are often jointly leased and shared by other businesses to hold down operating costs. The downside to this arrangement is that the warm site facility may not always be available either in a disaster or for testing purposes.

Reference

1. http://en.wikipedia.org/wiki/Backup_site 2. http://en.wikipedia.org/wiki/Disaster_recovery 3. http://www.brproactive.com/ 4. http://www.ibackup.com/hot-sites/ 5. http://www.datapipe.com/solutions/disaster_recovery/

16|P a g e