Disaster Recovery: Handle With Care

The terrorist attack of Sept. 11, 2001, got businesses large and small to think about disaster recovery. Hurricane Katrina, just a year ago, then pushed many to get serious about adopting those plans.

Still, many solution providers expected disaster-recovery solutions to continue to be a hard sell in the small- and midsize-business segment. But now, falling product costs along with new technology, new services, and even new business pressures are opening the doors for solution providers to boost sales of disaster-recovery solutions to their SMB customers.

Even more important, the combination of high-profile disasters, regulatory and compliance issues, fiduciary responsibility and other business concerns has taken away every excuse solution providers may have for not bringing disaster-recovery solutions to customers of every size.

Businesses are more aware now of the interdependencies of their equipment and how a problem with one impacts another, said Michael Croy, director of business-continuity solutions at Forsythe Solutions Group, a solution provider in Skokie, Ill. And, he said, they are looking for a return on investment from disaster recovery. Investments in this space used to be a black hole for companies, Croy said, but not anymore. "Now customers want to invest in disaster recovery and business continuity not only to recover from a disaster but to improve IT performance and resiliency."

For small and midsize businesses, disaster recovery is a balance between cost and risk, said Steven Robb, vice president and general manager at LaSalle Business Solutions, Rosemont, Ill. "They know they need it," he said, but the ever-present question has always been, can they afford it?

Some simple questions open the doors at such businesses, said Eryck Bredy, president of Bredy Network Management, Woburn, Mass., which has seen its disaster-recovery business growing at 45 percent per year for the past few years. "I'll ask, 'Are you at all concerned about what happens in a disaster?' " Bredy said. " 'Do you have a fallback plan?' If they are a public company, I ask them what they tell their shareholders. That gets the conversation rolling."

Those questions are important. The most basic of disaster-recovery plans mainly focus on ensuring that data is backed up to somewhere other than in the building where the client has its servers. However, solution providers looking to protect clients in a disaster also need to know whether those clients have quick access to alternative sites and equipment in case their building is damaged, how easy it is to rebuild their server and data environments, or whether they can get quick access to alternative voice and data communications channels. Most importantly, they need to know how much downtime they can stand before their business suffers and how much it will cost to meet their recovery requirements.

LOWER COSTS, MORE BUSINESS
Falling costs have certainly made it easier to implement disaster recovery, said Gordon McKemie, owner of Ohio Valley Storage Consultants in Anchorage, Ky. McKemie said a complete disaster- recovery data replication that 10 years ago took four years and cost $240 million was recently done for a local bank that already had a metro Ethernet circuit in four days for about $140,000, or less than the annual maintenance contract of the two EMC arrays that were replaced, McKemie said. "And at the same time, the customer got information life-cycle management and met compliance issues," he said.

Lower costs have caused Chi's disaster-recovery business to double over the past two years, now accounting for up to 40 percent of the company's revenue, said Greg Knieriemen, vice president of marketing at Chi, a 15-employee VAR in Cleveland. "We don't run into bandwidth issues," he said. "Software is available to replicate only sector-level changes in data, so replication utilizes less bandwidth. And most midsize companies already have T1 lines, so they don't need new bandwidth."Also, small and midsize companies that for business reasons have already adopted technologies such as server and storage virtualization, data duplication, and the ability to securely share storage devices among multiple users are finding they can implement disaster recovery at little extra cost.

That's a big change from a few years ago when a disaster-recovery plan required a dedicated duplicate site with prestored, idle equipment managed by companies like SunGard or Comdisco.

A growing number of solution providers now use appliances from Compellent Technologies, Eden Prairie, Minn., to remotely replicate SCSI data from one or several storage devices natively over IP networks to a dedicated or shared storage device for both data protection and disaster recovery. Other vendors, such as Data Domain, Santa Clara, Calif., and FalconStor, Melville, N.Y., eliminate duplicate data during the replication process, thus cutting hardware, bandwidth and disaster-recovery expenses.

Server virtualization technology from companies such as VMware also cut disaster-recovery costs by making it easy to replicate and migrate virtual server images.

David Klauser, president and CEO of Gravity Data Systems, an Oakbrook Terrace, Ill.-based solution provider, said such technologies, along with a push by more than 50 percent of his clients to use third-party hosted data centers to protect their data, has given many of them a de facto disaster-recovery plan. "We can put a data infrastructure in a hosted data center and go to 30 customers, understand their needs and replicate their data to a single device over IP from anywhere in the world," Klauser said. "So I can go the customer and say, 'I've optimized your data infrastructure, now replicate it to a hosted data center for disaster recovery. "FACTORING IN THE RISK
Alice Quinn, senior vice president of sales and marketing at IPR International, a Conshohocken, Pa.-based provider of online data protection services, said her company helps customers recover from data losses an average of 1,500 times per quarter, double that of a year ago. Customers use IPR to recover from a business-threatening disaster five to 10 times a month, she said.

Those losses come from disasters large and small, ranging from a server crash to rebuilding an entire data center, Quinn said. "The majority are little things," she said. "Yes, 9/11 happened, Katrina happened. But it's mainly little things. One client let a person go, and he tried to delete all the client's data. The client lost only an hour of work, but it could have been a lot more."

Successful disaster recovery requires planning for the right disaster, said Kip Lindberg, vice president of enterprise sales at Ncell Systems, Minnetonka, Minn. In California, for instance, everyone plans for an earthquake when they are more likely to be hit by a pandemic illness brought from overseas, he said. In his own backyard, companies plan for disruptions from tornados when a blizzard is far more likely to disrupt business. "They are assigning a weight on disaster recovery that is not commensurate with the risk," he said.

Solution providers said Hurricane Katrina and Sept. 11 may have grabbed the big headlines, but for most companies and their solution providers, potential natural and man-made disasters lurk around every corner. For instance, said Croy, one company might have to evacuate its people if a neighbor has a chemical spill. "If you need to evacuate, the impact on your business is just as severe as if the chemical spill happened in your building," he said.

THE SERVICES ANGLE
Managed service providers and data center service providers such as IPR or Arsenal Digital Solutions, Cary, N.C., are enabling solution providers to bring disaster recovery as a service.Arsenal has built turnkey server and storage infrastructures in 45 data centers worldwide that can be dedicated to a single customer or shared by multiple customers, letting solution providers turn disaster recovery into a service, said CEO Frank Brick.

Brick said that Arsenal lets partners provide three levels of disaster-recovery services, which can be mixed or matched according to requirements. The first is a network service that allows a customer to do an on-site bare-metal restore of a damaged server using operating systems, applications and data that were replicated off-site. The second, an electronic vault for customers that lose their primary site, allows servers to be rebuilt remotely or to be rebuilt at the remote data center for next-day shipment to the customer's temporary site.

Third, customers that need to recover from a disaster in minutes or in a couple of hours can contract space at the remote site for placement of cold servers. "So if a site is out, the customer can call us and tell us employees are on the way, and we can have the servers ready for them," Brick said.

IPR has data centers co-located in multiple facilities where the company provides its customers with the needed equipment and infrastructure, Quinn said. Often, a single piece of equipment has multiple "tenants," she said.

In case of a disaster, customers can access their data directly from the co-located facility, Quinn said. For customers unable to access their data online, IPR can make a third copy of the data for delivery to the customer's temporary or permanent site, she said.In the end, the best way to be successful with disaster recovery is to bake it into a customer's normal processes, make disaster recovery a part of changes to their systems and centralize as much of the company as possible, said Jim Damoulakis, CTO of Glasshouse Technologies, a Framingham, Mass.-based storage consultant.

"There'll always be the case where a customer doesn't get it," he said. "But now, we're getting customers who never had disaster recovery before come and ask us about it. The awareness is really high. And unless the organization is really, really strapped financially, it's hard to ignore the need."

SCOTT CAMPBELL contributed to this story.