Disaster Recovery: Prepare Customers For The Worst

Here's the best disaster-recovery advice available: Avoid disasters altogether. But as most VARs know from experience, that's not always possible.

Take it from Patrick McNicholas. The president of Maverick Computers, a West Palm Beach, Fla.-based system builder and solution provider, became an expert on disaster recovery when his own business had to rebound from five hurricanes in three years.

Each time, as his region dealt with power outages, disrupted telephone service, damaged roofs and disrupted lives, McNicholas and his staff worked untold amounts of overtime, not just getting Maverick back in business but helping customers get back in business.

"Our own training has been through our own misfortune," McNicholas said. "We had three years in a row of back-to-back hurricanes. We lost our roof two years in a row. We learned from getting beat up ourselves. We had the worst-case scenario followed by the worst-case scenario."

McNicholas and his staff have come to learn these key points about disaster recovery:

• Finding a list of hard-and-fast best practices to deploy before and after a disaster is challenging. Data redundancy is a well-known facet of disaster recovery, but many other intangibles, such as restoring lost telephone service, are not.

• There is no one technology vendor that provides a turnkey disaster-recovery solution.

• Training in disaster recovery is lacking, leaving solution providers on their own to acquire the skills necessary for auditing customers before and assisting them afterward.

• Government help is minimal or nonexistent in developing plans for restoring essential technology services to small businesses such as health-care providers, law enforcement agencies and even some utilities.

The upshot is that Maverick has developed its own disaster-recovery solutions, including a portable satellite telephone and what amounts to a data center in a moveable storage pod that can be delivered to clients whose infrastructure has been wiped out.

Data Recovery Only The Starting Point
While Maverick learned the hard way that disaster recovery entails far more than just backing up and recovering data and restoring IT infrastructure, that is a focal point for solution providers when planning for the worst.

For businesses, the "worst" is often categorized as the complete loss of a facility, along the lines of the damage caused by Hurricane Katrina or the Bay Area earthquake of 1989. The first question VARs need to ask is whether a disaster-recovery solution is even viable.

The loss of a facility would be a death knell for a retail operation such as a supermarket, auto repair shop or a factory, and rapid data recovery would become less of a concern. On the other hand, the loss of a facility may be little more than an inconvenience for a services-driven business, such as a law firm or financial office. In those businesses, data and records are the tangible items that must be protected.

NEXT: Managing the audit

Managing The Audit

While data protection proves to be the foundation for business-continuity planning, a good disaster-recovery plan will take into account much more than just the data.

Equipment, applications, connectivity, infrastructure and personnel also must be part of the equation, and the only way to fully comprehend what each of those elements means to a business requires an audit. Simply put, the first brick in the road to a disaster-recovery plan comes from knowing who does what with what resources.

Audits of applications and hardware can be accomplished quickly using tools such as those from LANauditor or EMCO Software to build a picture of the businesses' IT world. The adventurous could move beyond just inventory applications and sell desktop and network provisioning and management suites as part of the inventory task.

The issue of accountability proves a little more complex. Here, VARs will need to look over job descriptions and interview management to fully comprehend the impact personnel have on data processing tasks. Luckily, that chore can be speeded by implementing an HR-centric application into the mix, creating another revenue source for the VAR. VARs can look to several HR applications on the market to help define roles and responsibilities and still offer added features for HR departments. On the other hand, smaller businesses may be able to create a roles and responsibilities document using a spreadsheet or a generic document.

Setting Priorities

Armed with an inventory of computing resources and staff responsibilities, VARs can move to the next phase of disaster-recovery planning: prioritization.

What capabilities does a business need and how quickly does it need them? For example, a business may need a working accounts receivable system immediately, while accounts payable may be able to wait a few days.

In an ideal world, the best practice would be to restore all systems simultaneously, and in the case of a nonphysical disaster (data corruption, virus attack), that may very well be possible. Tackling virtual disaster that does not entail loss of hardware proves to be straightforward, and several software suites exist on the market that provide almost instant data recovery techniques.

Many of the major backup suites include a disaster-recovery element, which integrates backup and recovery into the disaster-planning process. Look to companies such as Acronos, Symantec, DataMirror, NovaStor and UltraBac Software to provide comprehensive backup applications with disaster-recovery modules.

Disaster-recovery products come in all shapes and sizes and with a variety of feature sets. Filtering through what best serves the customer's needs and offers benefits to the VAR can be a daunting task. Simplifying the selection criteria can come from the adage, "In for a penny, in for a pound."

Simply put, select a suite that backs up all servers and all desktop PCs—and also offers remote management capabilities. Integrating a suite that provides those capabilities along with remote booting and network managing allows the VAR to execute the restoration process, which reduces angst for the customer and creates service revenue for the VAR.

With disaster-recovery suites, integrated products prove to be the best choice. After all, no VAR wants to be faced with the arduous task of managing multiple backup and recovery products and perhaps face the specter of processes falling through the cracks.

NEXT: Physical disaster and risk assessment

Physical Disaster And Risk Assessment

For disasters in the physical realm, the equation becomes much more complex. Not only does the VAR have to consider recovering the data and applications, the VAR has to consider the impact of unusable hardware.

If the business world was filled with unlimited budgets and unlimited resources, the simple answer would be to just have two of everything (servers, buildings, PCs, staff) located in different geological areas. But very few organizations can afford that level of protection.

That fact is what drives the risk assessment process: identifying the most critical systems and processes and then building a solution to bring those processes back online quickly. Solution providers will need to balance risks against costs.

"We tell all of our customers, just like with real estate where it's 'location, location, location,' with data protection it's 'redundancy, redundancy, redundancy,' " McNicholas said. "Without redundancy, you're dead in the water."

Maverick's recommendation to customers usually depends on the customer's budget, means for physically dispersing data geographically and other business-specific issues. A national insurance company may have the resources to keep data centers on both U.S. coasts. But a small auto parts business may be advised to back up data on hard disk to be locked in environmentally safe storage.

For some businesses, simply having a small network at an alternate location may be adequate to keep critical data processing functions active while waiting for an insurance payment or other assistance to rebuild their original infrastructure. Very small businesses may be able to function with a single PC at the VAR's location until recovery, while larger businesses may be able to operate out of a branch office.

The Bottom Line: Training And Expertise

Simply put, a successful disaster-recovery solution comes down to proper planning and expertise. That is what makes the disaster-recovery market an attractive proposition for VARs. But solution providers are largely on their own when it comes to acquiring that expertise.

Despite the shock of Hurricane Katrina, vendors and government agencies are still are falling short in providing basic training for IT professionals in best practices, McNicholas said.

"I wish there was a better answer," he said. "We've trained all of our own people internally. I wish there was an agency out there that trained in this kind of thing. There is no real overall agency that handles all parts of disaster recovery."

Even after developing in-house training, selling disaster recovery as a consulting service is not easy. Some customers are reluctant to listen, like one Maverick customer who was adamant that his company was prepared to handle a disaster—until his phone service was wiped out.

But for solution providers that have their customers' best interests in mind, having disaster-recovery expertise and solutions available is part of being a full-service IT shop. And those customers with well-managed businesses will appreciate your expertise.

FRANK OHLHORST is director of the CRN Test Center.