Welcome!

Security Authors: Liz McMillan, Vincent Brasseur, Pat Romanski, Elizabeth White, Gilad Parann-Nissany

Related Topics: Cloud Expo, Java, SOA & WOA, Linux, Security, Big Data Journal

Cloud Expo: Article

Integrate Cloud-Based Disaster Recovery into Business Continuity Strategy

DRaaS will continue to gain market strength as a solution this year while evolving to better meet customer requirements

Cloud-based Recovery-as-a-Service (RaaS) is becoming big business. Research and Markets forecasts the global market of RaaS and cloud-based business continuity will reach $5.77 billion by 2018, creating major opportunities for business continuity and risk management specialists alike. Likewise, Reportstack announced recently the global Disaster Recovery-as-a Service (DRaaS) market is expected to grow at a Compound Annual Growth Rate (CAGR) of 54.64 percent from 2014 to 2018.[1]

One of the leading drivers for small and mid-size businesses (SMBs) as well as enterprises seeking cloud solutions is Disaster Recovery (DR).[2]Organizations seek improved resiliency and failover in response to service disruptions of all kinds including natural disasters, cyber-attacks and technical malfunctions. In 2013, the financial impact of natural disasters worldwide was more than double the $100 billion estimate of 1990.[3]McAfee® Labs Threats Report indicates service disruptions are inevitable and becoming more predictable, with a reported 20 million new types of malware in the third quarter of 2013 alone. In a recent survey, IDC found that 71 percent of respondents experienced less than 10 hours of annual downtime, with a projected financial impact for SMBs of $125,000. Larger enterprise organizations could potentially have a corresponding annual financial impact of $17 million.[4] Dun & Bradstreet surveyed Fortune 500 companies with 59% of respondents reporting 1.5 hours of downtime each week, amounting to a projected $46 million impact annually for companies of 10,000 employees or more.[5]

However, the impact may be even greater. In a 2013 Ponemon Institute study, 91 percent of the participants reported that their organizations experienced unplanned downtime in the past two years. When you consider it takes about two days to recover from an IT event, if at all, the cost can be much higher in terms of lost revenue and damage to a company's reputation through reduced customer loyalty.

Floods, mudslides, ice and snow storms, hurricanes, tornados and cyclones, fires and droughts have one thing in common: all can have a negative financial impact on day-to-day business. Hurricane Sandy ranked as the largest global disaster in 2012 with a price tag of $65 billion. At the same time, New Jersey residents and municipalities had to cover an additional $8 million to $13 million in unmet expenses. Businesses are still trying to recover from the hurricane, with many resorting to bankruptcy protection. In 2013, 296 adverse weather events, predominantly in Europe and Asia, caused $192 billion in worldwide economic losses. Although the dollar amount was 4 percent less than the 10-year average, the number of events was greater than the 10-year average of 259.[6]

Other factors generating a need for Disaster Recovery planning include the risk potential from cyber attacks on Wi-Fi access into secure networks, Distributed Denial of Service (DDoS) attacks, resistant malware, insider threats, attacks on employee-owned device, or bring your own device (BYOD), and breakdowns with out-of-date, legacy systems.

Banks have been particularly hard hit in the last couple of years by DDoS attacks, prompting an April 2014 notice from the Federal Financial Institutions Examination Council (FFIEC), which requires banks to assess risk, monitor, and develop response plans to mitigate against DDoS attacks.[7] Attacks are becoming more sophisticated and can shut down business activity, slow website connections or prevent access to institutional websites. These attacks can be system-wide or come in via peripherals. For instance, an unsecured keyboard video mouse (KVM) switch allows cyber attackers to capture keystrokes and password information or access information through unauthorized universal serial bus (USB) devices and microphones.[8]

Cybercriminals are becoming stealthy and developing tools and botnet source codes that are increasingly complex and capable of avoiding detection. Cryptolocker, for instance, can be delivered by e-mail and is added to the start-up menu. It encrypts the data, infects the system and locks the organization out. Criminals then demand a ransom to unlock the data.[9]

Today, 31 percent of PCs continue to run on Windows XP operating systems. It's not just PCs that are at risk, as a number of medical devices and point of sale (POS) systems use Windows to run transactions, and the systems are not consistently updated. In April 2014, Microsoft announced it would no longer provide support and updates, placing systems and equipment at increased risk for cyber attacks. Because enterprise and institutions invest so much time and money in legacy hardware and software, these systems will require expert knowledge moving forward to maintain system security.

Business Continuity Planning is No Longer Optional
All of these factors point to the need for systematic security planning. Business Continuity Management (BCM) refers to the plans executed and activities performed on a daily basis to maintain business consistency and ensure critical business systems will be available when disaster strikes. And although the term Business Continuity Management is used interchangeably with DR, it is considered to be a separate, overarching strategic plan which includes disaster recovery, crisis management, incident response and contingency planning, as well as business impact analysis, recovery time objective (RTO) and recovery point objective (RPO).

BCM is a set of processes and practices created to identify and mitigate threats and their potential impact while providing the framework to prevent, mitigate and recover from disruptions of all kinds including the implementation of new programs, processes, system virtualization and other process shifts. And, although closely related, DR is more about the process of building continuity capabilities for infrastructure and applications. More specifically, DR is the business' ability to maintain critical operations and provide services during a disruptive event.[10]

Disaster recovery and business continuity continue to rank as two of today's top business concerns due to the prevalence of natural and man-made disruptions. A recent Continuity Insights and KPMG Continuity Management Program Benchmarking study was conducted to determine whether enterprise organizations are prepared for a disruptive event. The study involved 434 executives from 22 countries. Approximately 71 percent of those surveyed indicated a senior management board had been established for the purpose of developing a BCM, which made a big difference when conducting business impact analyses (BIAs), recovery objectives, adopting global standards and addressing cyber security issues. However, 36 percent of the respondents indicated they did not address cyber terrorism issues in the BCM. More than half of those surveyed stated they were prompted to initiate a BCM plan, DR plan or crisis management plan due to a disruption. Outages were due to weather problems, power interruptions and IT security issues and represented a nine percent increase in disruptions over the previous year's responses.[11]

Zero Tolerance for Downtime
New technologies and business trends such as virtualization and mobile device BYOD policies, cloud computing, real-time data analysis, e-commerce, third-party cloud-based providers, and globalization are prompting more companies to establish DR and BCM plans as part of overall business strategies. These trends make 24x7 availability the number one priority. At the same time, enterprise organizations are seeking fast Internet speeds, real-time information and ubiquitous connectivity to remain competitive, which leaves no room for downtime.

So, what is the cost if a business continuity plan is not instituted? Plenty, according to leading analysts. In a published study by Touche Ross and ioSafe, companies without a DR plan have a survival rate of less than 10 percent. Gartner, a leading information technology research company, breaks it down even further, predicting 25 percent of PCs will fail this year, while mid-sized companies will experience about 20 hours of network, system and application downtime at an average cost of $70,000 an hour. Forrester, another leading research company, predicts that 24 percent of companies will have a full data disaster.[12]

Business Continuity Planning is Key
In its annual business continuity trends study, Continuity Central reports some interesting findings in the way survey respondents are handling business continuity this year. More than half of those surveyed expect to make small changes to existing BCM plans in 2014, while a quarter of the respondents are expecting bigger changes, and eight percent anticipate a more thoroughly integrated plan. Five percent will implement ISO 22301 projects this year. As the first international standard developed for BCM, the ISO 22301 specifies what requirements businesses must meet to ensure the business recovers from a disaster or disruptive event.

Secure Data with Cloud Computing
Now that cloud computing has matured as a platform, more companies are beginning to trust that moving critical data to the cloud will ensure against loss in the event of a disaster or event. Forbes predicts that overall cloud spending will grow by about 25% this year, reaching $100 billion for software and services as well as cloud infrastructure. More SMBs will join the cloud at a growth rate of 20 percent over the next five years and more mid-sized companies will move to public clouds.[13]

More companies are seeking ways to reduce the cost of DR, which represents about 25 percent of the overall IT budget, without sacrificing security. However, as network architecture gains complexity, data recovery from on-site storage is becoming a long and arduous process, and on-site backup and restore has increased risk associated with it due to its potential for failure. The cost becomes even greater when organizations put time, effort and money into additional architecture to mirror all servers, applications, data, software and network connections. To that point, CIOs realize cloud storage poses less of a risk while the recovery process makes sound financial sense. Cost avoidance is gained as enterprise no longer needs to make large capital investments and infrastructure upgrades to maintain availability.

Cloud Service Providers (CSPs) offer a range of storage options and as-a-service offerings, which makes DRaaS a faster and more simplified process. Likewise, virtualized servers have brought down the cost of cloud storage, making it easier for SMBs to compete on the same level as larger organizations.

DRaaS Provides a Low Cost Solution
DRaaS is a flexible platform, enabling enterprise organizations to choose whether it's necessary to restore the entire organizational infrastructure or just critical applications. Organizations gain more control because they get to decide how data should be saved and what critical infrastructure needs to be restored and in what order. A recent study by the Aberdeen Group reports DRaaS is growing as the preferred solution because it reduces the risk of losing critical business data and experiencing a business interruption; critical applications can be up and running in minutes, not days; and it's a faster way of bringing the business back to normal.

Benefits of DRaaS as a pay-as-you-go recovery model are lower costs and minimized downtime as applications are automatically restarted once the problem is identified. Because DRaaS is on a virtual platform rather than on an on-site server, business continuity requirements to meet performance standards and consistency can also be achieved. A virtual backup site provides much needed data replication while providing faster recovery time at a lower cost because it runs on higher capacity, shared architecture. Testing can occur more frequently, because the system is always ready and does not have to be placed offline to test.[14]

Creating a Business Continuity Plan
A greater number of businesses today are taking advantage of cost-effective, pay-as-you-go DRaaS and BCM plans. BCM takes into account the scope of requirements for backup and restoration of data, applications, systems and in some cases, facilities, to ensure business continuity when disaster strikes. The first step when developing DRaaS or BCM is finding the right cloud service provider to help your organization determine solution architecture to meet your recovery performance needs and requirements; this can be done by performing a business impact analysis with a qualified professional. Once complete, a feasibility plan is needed to ensure proper procedures are implemented and followed. Results must then be measured by testing the system repeatedly for availability, completeness and verified backup. The plan should then be shared with key personnel so everyone knows their roles and responsibilities when downtime occurs.

The Future of DRaaS and BCM
DRaaS will continue to gain market strength as a solution this year while evolving to better meet customer requirements. The service is expected to become faster while efficiently optimizing infrastructure storage and servers. Virtualization will be key to meeting customer service level agreements while addressing recovery point and recovery time objectives. Platform flexibility will be integrated with self-service for larger companies with internal IT staff. Expect more companies to ask for a hybrid combination of DR strategies combining on-premise backup solutions with cloud platforms for data archiving and recovery. This way, on-site and cloud applications can be synched for rapid recovery.

Some customers will seek multiple CSPs for different cloud services, opening up new opportunities for vendors and risk management specialists. Storage is expected to double in growth in 10 years, while IT staff remains in demand. CSPs and risk management specialists who can serve as trusted IT advisors will be better positioned to take advantage of opportunities from companies seeking purpose-built back-up solutions. While at the same time, CSPs who enact simple, consumer-oriented pricing strategies will make decision-making easier for enterprise and speed up the sales cycle for solution specialists and channel partners. Last but not least, giving the customers what they want, true customer support, can make the difference in building a larger customer base and improving customer loyalty.[15]

More Stories By Mike Castañeda

Mike Castañeda is the Director of Technology at Lam Cloud Management, a New Jersey-based provider of proven Business Continuity, Workplace Recovery, Data Center and Network solution.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
We are reaching the end of the beginning with WebRTC, and real systems using this technology have begun to appear. One challenge that faces every WebRTC deployment (in some form or another) is identity management. For example, if you have an existing service – possibly built on a variety of different PaaS/SaaS offerings – and you want to add real-time communications you are faced with a challenge relating to user management, authentication, authorization, and validation. Service providers will want to use their existing identities, but these will have credentials already that are (hopefully) i...
One of the biggest challenges when developing connected devices is identifying user value and delivering it through successful user experiences. In his session at Internet of @ThingsExpo, Mike Kuniavsky, Principal Scientist, Innovation Services at PARC, described an IoT-specific approach to user experience design that combines approaches from interaction design, industrial design and service design to create experiences that go beyond simple connected gadgets to create lasting, multi-device experiences grounded in people's real needs and desires.
"Matrix is an ambitious open standard and implementation that's set up to break down the fragmentation problems that exist in IP messaging and VoIP communication," explained John Woolf, Technical Evangelist at Matrix, in this SYS-CON.tv interview at @ThingsExpo, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The Internet of Things will put IT to its ultimate test by creating infinite new opportunities to digitize products and services, generate and analyze new data to improve customer satisfaction, and discover new ways to gain a competitive advantage across nearly every industry. In order to help corporate business units to capitalize on the rapidly evolving IoT opportunities, IT must stand up to a new set of challenges. In his session at @ThingsExpo, Jeff Kaplan, Managing Director of THINKstrategies, will examine why IT must finally fulfill its role in support of its SBUs or face a new round of...
Cultural, regulatory, environmental, political and economic (CREPE) conditions over the past decade are creating cross-industry solution spaces that require processes and technologies from both the Internet of Things (IoT), and Data Management and Analytics (DMA). These solution spaces are evolving into Sensor Analytics Ecosystems (SAE) that represent significant new opportunities for organizations of all types. Public Utilities throughout the world, providing electricity, natural gas and water, are pursuing SmartGrid initiatives that represent one of the more mature examples of SAE. We have s...
The Internet of Things will greatly expand the opportunities for data collection and new business models driven off of that data. In her session at @ThingsExpo, Esmeralda Swartz, CMO of MetraTech, discussed how for this to be effective you not only need to have infrastructure and operational models capable of utilizing this new phenomenon, but increasingly service providers will need to convince a skeptical public to participate. Get ready to show them the money!
Scott Jenson leads a project called The Physical Web within the Chrome team at Google. Project members are working to take the scalability and openness of the web and use it to talk to the exponentially exploding range of smart devices. Nearly every company today working on the IoT comes up with the same basic solution: use my server and you'll be fine. But if we really believe there will be trillions of these devices, that just can't scale. We need a system that is open a scalable and by using the URL as a basic building block, we open this up and get the same resilience that the web enjoys.
The Internet of Things is tied together with a thin strand that is known as time. Coincidentally, at the core of nearly all data analytics is a timestamp. When working with time series data there are a few core principles that everyone should consider, especially across datasets where time is the common boundary. In his session at Internet of @ThingsExpo, Jim Scott, Director of Enterprise Strategy & Architecture at MapR Technologies, discussed single-value, geo-spatial, and log time series data. By focusing on enterprise applications and the data center, he will use OpenTSDB as an example t...
P2P RTC will impact the landscape of communications, shifting from traditional telephony style communications models to OTT (Over-The-Top) cloud assisted & PaaS (Platform as a Service) communication services. The P2P shift will impact many areas of our lives, from mobile communication, human interactive web services, RTC and telephony infrastructure, user federation, security and privacy implications, business costs, and scalability. In his session at @ThingsExpo, Robin Raymond, Chief Architect at Hookflash, will walk through the shifting landscape of traditional telephone and voice services ...
The Domain Name Service (DNS) is one of the most important components in networking infrastructure, enabling users and services to access applications by translating URLs (names) into IP addresses (numbers). Because every icon and URL and all embedded content on a website requires a DNS lookup loading complex sites necessitates hundreds of DNS queries. In addition, as more internet-enabled ‘Things' get connected, people will rely on DNS to name and find their fridges, toasters and toilets. According to a recent IDG Research Services Survey this rate of traffic will only grow. What's driving t...
Enthusiasm for the Internet of Things has reached an all-time high. In 2013 alone, venture capitalists spent more than $1 billion dollars investing in the IoT space. With "smart" appliances and devices, IoT covers wearable smart devices, cloud services to hardware companies. Nest, a Google company, detects temperatures inside homes and automatically adjusts it by tracking its user's habit. These technologies are quickly developing and with it come challenges such as bridging infrastructure gaps, abiding by privacy concerns and making the concept a reality. These challenges can't be addressed w...
Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at Internet of @ThingsExpo, James Kirkland, Chief Architect for the Internet of Things and Intelligent Systems at Red Hat, described how to revolutioniz...
Bit6 today issued a challenge to the technology community implementing Web Real Time Communication (WebRTC). To leap beyond WebRTC’s significant limitations and fully leverage its underlying value to accelerate innovation, application developers need to consider the entire communications ecosystem.
The definition of IoT is not new, in fact it’s been around for over a decade. What has changed is the public's awareness that the technology we use on a daily basis has caught up on the vision of an always on, always connected world. If you look into the details of what comprises the IoT, you’ll see that it includes everything from cloud computing, Big Data analytics, “Things,” Web communication, applications, network, storage, etc. It is essentially including everything connected online from hardware to software, or as we like to say, it’s an Internet of many different things. The difference ...
Cloud Expo 2014 TV commercials will feature @ThingsExpo, which was launched in June, 2014 at New York City's Javits Center as the largest 'Internet of Things' event in the world.
SYS-CON Events announced today that Windstream, a leading provider of advanced network and cloud communications, has been named “Silver Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Windstream (Nasdaq: WIN), a FORTUNE 500 and S&P 500 company, is a leading provider of advanced network communications, including cloud computing and managed services, to businesses nationwide. The company also offers broadband, phone and digital TV services to consumers primarily in rural areas.
"There is a natural synchronization between the business models, the IoT is there to support ,” explained Brendan O'Brien, Co-founder and Chief Architect of Aria Systems, in this SYS-CON.tv interview at the 15th International Cloud Expo®, held Nov 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA.
The major cloud platforms defy a simple, side-by-side analysis. Each of the major IaaS public-cloud platforms offers their own unique strengths and functionality. Options for on-site private cloud are diverse as well, and must be designed and deployed while taking existing legacy architecture and infrastructure into account. Then the reality is that most enterprises are embarking on a hybrid cloud strategy and programs. In this Power Panel at 15th Cloud Expo (http://www.CloudComputingExpo.com), moderated by Ashar Baig, Research Director, Cloud, at Gigaom Research, Nate Gordon, Director of T...

ARMONK, N.Y., Nov. 20, 2014 /PRNewswire/ --  IBM (NYSE: IBM) today announced that it is bringing a greater level of control, security and flexibility to cloud-based application development and delivery with a single-tenant version of Bluemix, IBM's platform-as-a-service. The new platform enables developers to build ap...

An entirely new security model is needed for the Internet of Things, or is it? Can we save some old and tested controls for this new and different environment? In his session at @ThingsExpo, New York's at the Javits Center, Davi Ottenheimer, EMC Senior Director of Trust, reviewed hands-on lessons with IoT devices and reveal a new risk balance you might not expect. Davi Ottenheimer, EMC Senior Director of Trust, has more than nineteen years' experience managing global security operations and assessments, including a decade of leading incident response and digital forensics. He is co-author of t...