Disaster recovery (DR) must be reliable, speedy and economical. These are the basic requirements for all businesses, and small to medium-sized enterprises (SMEs) are no exception. But, for smaller firms, cost considerations will be at – or near the top – of the IT manager’s list.
Organisations often view disaster recovery as little more than insurance, or as IDC analyst Phil Goodwin puts it, “an expense that is likely to have little payback”.
Large firms in highly regulated markets – such as financial services – invest heavily in disaster recovery and business continuity, not least because they are mandated to do so.
RBS, for example, was fined £56m for an IT failure in 2012.
DR on an SME budget
Smaller firms might not have the budget for DR, however. Or they might choose not to pay for it, hoping they can ride out any incident with backups and hard work. This is short-sighted.
The Uptime Institute’s 2018 Global Data Center Survey found that 31% of businesses experienced downtime that caused severe damage, but that 80% of incidents could have been prevented.
Disaster recovery is becoming cheaper, simpler and more effective, through the growth of cloud-based services.
Firms no longer need to invest in dedicated or duplicate hardware, remote datacentres and the skilled staff to maintain them. Cloud or hybrid cloud technologies allow smaller companies to outsource much of the technical side of DR provision and to move to an on-demand model.
Operating disaster recovery on a pay-as-you-go model, combined with faster data transfers over the public internet, is transforming DR options for SMEs.
Away from conventional DR
For smaller firms, conventional backup and disaster recovery has long meant saving data to tape or other removable media and storing it off-site. In case of a disaster the firm would need to source new hardware and restore data and applications.
Larger or better-resourced businesses, or those depending heavily on their data, will have invested in automatic off-site data replication and even standby servers. Others contracted with specialist suppliers to manage DR.
“In the past, DR meant having a redundant location that was either always-on, a hot DR facility, or the use of shared resources that would be configured and set up when needed,” says Roy Illsley, a distinguished analyst at Ovum who covers infrastructure solutions. These solutions are typically expensive or bring long recovery times.
Some businesses have moved to ad-hoc cloud backup solutions, including consumer-grade online storage. But this is still labour-intensive.
“Small and medium-sized enterprises often deem disaster recovery too expensive or peripheral to core operations to fully invest in,” warns Mark Wass, a director at business continuity supplier Sungard AS.
“They often settle for a DIY, cloud-based platform approach, which they believe to be cheaper, and then assign responsibility for managing it to the office manager,” he says.
Although this avoids reliance on on-site backups, it is still a manual process. And, Wass says, assuming staff can rely on cloud-based storage and access to a personal device to work on is risky.
Online DR, SaaS and HCI
Fortunately, the market for online disaster recovery is growing, and so is the choice of suppliers. Companies such as Veeam, Rubrik, Commvault, Cohesity and Nutanix provide options for businesses that need an off-the-shelf solution.
Cloud-based DR is available either directly from suppliers, or through managed service providers and IT integrators.
OGL Computer is a managed service provider with 1,200 UK SME customers. It offers a choice of cloud recovery and cloud-based data replication, as well as dedicated recovery options for VMware and Hyper-V. Recovery allows firms to restore their key applications within 24 hours – cloud-based replication provides recovery “within seconds”.
But, as OGL’s enterprise solutions architect, Steve Bennett, says, there are also customers who need, or prefer, an on-premise solution.
“The availability of cloud services is an obvious way backup is becoming easier for SMEs,” says Bryan Betts, analyst at Freeform Dynamics. “But if they can’t or don’t want to use cloud, there’s also the appliance option, either physical or virtual.
Bryan Betts, Freeform Dynamics
“Add in the availability of flash storage and modern software that provides user self-service, and you can get a box that not only takes care of all – or almost all – your backups, but also lets users themselves quickly sort out most of their data recovery needs.”
Changes in the way businesses buy technology are also affecting disaster recovery.
Hyper-converged infrastructure (HCI) started out as a way to make it easier to deploy virtual machines. But because hyper-converged systems usually include their own storage, they lend themselves to disaster recovery too. On-premise HCI systems can be out of the reach of SMEs, but the implementation of cloud-based HCI makes it much more accessible.
An example is Cohesity’s Clusters, but Nutanix and Rubrik use similar technologies. Businesses with the in-house expertise can also look at replication to enterprise public cloud providers, such as Amazon Web Services, Microsoft Azure and Google Cloud Platform.
“Cloud DR isn’t [as] neatly packaged but is more flexible,” says Peter Groucutt, managing director of backup provider Databarracks. “You can choose your replication software, such as ASR, Zerto or Veeam, and choose your cloud platform. For day-to-day replication you can keep cloud resources to a minimum but have the resources available to scale up as much as you need when you invoke DR.”
Another factor in favour of a bespoke approach is the growing need to back up cloud-based applications. The appliance-to-offsite-backup or appliance-to-cloud route is tried and tested, but data backups from cloud-based applications are largely best kept in the cloud.
IT managers should check their disaster recovery plan includes cloud applications. More software-as-a-service (SaaS) providers are including application availability and data protection options with their products.
Test, and test again
No amount of technology, though, will protect a business if it fails to work. This means having a disaster recovery plan, a robust testing regime and a plan to deal with human factors, from the availability of technical experts to senior management’s ability to act under pressure.
Roy Illsley, Ovum
“For SMEs, the main point to consider is ease of use in setting up the replication, and then how the DR capability can be tested and verified it is operating and fit for purpose,” says Ovum’s Illsley. “The area where most SMEs fail is in the process for invoking the DR plan. You must have a robust process that has clear rules on when a switch to DR is required and when it is not.”
Freeform Dynamics’ Betts goes further. “The absolutely key requirement for DR is to make sure you can recover,” he warns. “Test it often enough to make sure not just that your backup process is reliable, but that you can rebuild a working system from it within the specified recovery time objective and recovery point objective.”