Docstoc

Disaster Recovery Planning

Document Sample
Disaster Recovery Planning Powered By Docstoc
					Disaster Recovery Planning
EDUCAUSE Evolving Technologies Committee
Lori Franz: University of Missouri-Columbia
Date: September 15, 2003


 Introduction

Disaster recovery planning recognizes the possibility of severe damage to infrastructure and physical plant from
unforeseen circumstances which can seriously impair mission critical academic and operational processes. An
adjunct to physical security, which seeks to prevent selected disasters, is disaster recovery. In the event that we
cannot protect facilities or equipment from unforeseen damage, it is imperative that contingency planning be in
place to allow the restoration of critical services as soon as possible and the establishment of continuity of
important work processes simultaneously or shortly thereafter.


 What Is Disaster Recovery?

Disaster recovery consists of the planning and activities that allow an organization to return to an acceptable
state of work and associated activity after a sudden unplanned calamitous event, which causes damage and/or
physical loss. Disaster recovery planning may be alternately called Business Recovery Planning, connoting a
focus on activities to restore the processes rather than necessarily to restore the physical attributes. An
excellent discussion of the related activities can be found at www.drii.org on the non-profit Disaster Recovery
Institute website.


 Why Is Knowledge of Disaster Recovery Important to Higher Education?

Universities have become increasingly aware of their extreme dependence on their information storage,
communication and processing systems, and networks. Paper based systems have become incomplete
records as reliance on technology has increased. Teaching functions rely more on course management
systems to provide gradebooks, teaching materials, and portfolios. Research progress and results rely primarily
on computer storage. Disasters such as fire, eco-terrorism, vandalism, and tornados, including 9/11, have
impacted several universities increasing the awareness of risk among university administrators. As examples,
in the last decade, news stories have included natural disasters such as tornado damage to William Jewel
College and the University of Missouri, flood damage to Colorado State University and the University of North
Dakota, hurricane damage to a number of Florida and South Carolina colleges and universities, and earthquake
damage at California State University-Northridge. Terrorist related incidences include a fire at the University of
Washington, firebombing at Michigan State University, and damage related to the World Trade Center attack at
Pace University. The coining of yellow, orange and red terror alerts and the accompanying vigilance make the
possibility of system loss more real to educational decision makers who once considered their environments
safe.


 What Are The Implementation Challenges?

Preparation for disaster recovery focuses on planning. The decision makers are forced to choose among the
following alternative recovery strategies for with respect to a planned response to a potential disaster:
            EDUCAUSE EVOLVING TECHNOLOGIES COMMITTEE
            OVERVIEW OF X
            DATE

                     1.    Do nothing
                     2.    Defer action – work on slowly recovering and rebuilding capacity
                     3.    Revert to manual procedures
                     4.    Develop reciprocal agreements with other centers or campuses
                     5.    Create an alternative site or business facility
                     6.    Develop an alternate source of production
                     7.    Contract a service bureau
                     8.    Form a consortium to provide mutual coverage
                     9.    Design a distributed processing environment
                     10.   Develop alternative communications
                     11.   Mitigation
                     12.   Preplanning (source: www.drii.org )

The challenge of disaster recovery in educational environments is exacerbated by
    • the decentralized nature of university computing
    • the incremental growth of computing systems
    • scarce resources for investing in low probability events
    • lack of widely promulgated industry standards for educational entities
    • lack of priority of disaster preparedness over competing activities


 Who Are The Major Vendors?

The Disaster Recovery Journal provides a directory of vendors which includes everything from consultants to
subterranean vaults. http://www.drj.com/vendor/drj5a.html The vendor list includes a comprehensive list of
related products and services.


 What Are The Rules of Thumb for Judging Among Them?

The choice of alternative plan and the services and backup systems to be employed should consider:
                  • Priority level of the service lost to the institution
                  • Cost/benefit trade-off
                  • Risk analysis related to institutional loss of services
                  • Level of recovery needed (speed, completeness)


 How Should We Proceed?

All educational institutions with a reliance on information technology and communications should begin the
process with a detailed planning process to evaluate risk and determine how best to minimize that risk.
Specifically, the planning should begin with assessing the impact of various disaster scenarios involving all
critical data and communication equipment and facilities. Copies of records and documentation for the recovery
of physical spaces (blueprints, conduits, equipment and logical and physical network design) should be
collected and located in a safe space. Personnel and response teams should be identified for the scenarios,
indicating who backs up whom, who does what, and who calls whom. Recovery strategies should be laid out
including the determination of design and redundancy to provide the level of disaster discovery desired.
Modifications to existing technology and addition of appropriate backup equipment and sites should be
implemented as appropriate. Procedures, crisis communication plans, and priorities should be established.
Finally, when in place the plan should be tested with drills or other test procedures.




            PAGE 2 OF 4
             EDUCAUSE EVOLVING TECHNOLOGIES COMMITTEE
             OVERVIEW OF X
             DATE



 When Will Disaster Recovery Planning Become Essential on Campuses?

Planning for disaster recovery is essential for every campus. Awareness of the need to proceed with this
planning must occur among and flow from campus leaders. Priority should be placed on the elements of
business process continuity that are essential for restoring operations.


 How Is Disaster Recovery Planning Evolving?

Business process recovery has long been an organizational issue, but recent events have
brought the need to the forefront. Campus librarians have previously been among the most
knowledgeable of disaster planning to preserve information. From the Educause Information
Resource Library a number of resources are available for consideration by campus leaders.
The library contains accounts from numerous accounts of planning from institutions as well as
institution specific disaster plans which can be found by searching under disaster recovery or
disaster recovery planning.
http://www.educause.edu/asp/doclib/subject_docs.asp?term_id=144


 What Are The Issues To Be Addressed?

The University of Wisconsin DoIT (Division of Information Technology) suggests the following essential
questions:
    • Should universities have more than one Internet Service Provider?
    • What is the optimal level of network redundancy desired?
    • Are dual off-site data center operations needed?
    • Should contract services planned or on contingency?

They also provide a checklist for disaster preparedness at the following URL:
http://www.doit.wisc.edu/security/docs/DRPChecklist.pdf


 Where Are The Likely Impacts In The Coming One to Three Years?

Any additional incidences of domestic terrorism and cases of activists drawing attention to their causes through
vandalism will create additional pressure for universities to plan strategies to protect their information based
operations. Natural disasters are always possible, although more likely in some locations.


 Conclusion

The information resources of any institution of higher learning are so integral to the mission of the institution that
contingency planning must be in place to allow recovery of essential functions in the face of either a natural or
manmade disaster. Academic leaders and their administrative counterparts must work together to prioritize and
create appropriate plans and actions to assure the institution can continue to function in the face of a
catastrophic event. This paper provides a number of helpful resources to guide that planning.




             PAGE 3 OF 4
               EDUCAUSE EVOLVING TECHNOLOGIES COMMITTEE
               OVERVIEW OF X
               DATE



 Related Higher Education References


Trial by Tornado: One records facility's response to a devastating tornado demonstrates the necessity of a solid
disaster recovery plan, Infopro, March 2000, Volume 2, Number 1 page 37-39.

Miami Colleges Deal With Wake of Hurricane Andrew, Chronicle of Higher Education, September 16, 1992.

Carnevale, Dan, Preparing for Computer Disasters, Chronicle of Higher Education, February 28, 2003, Volume
49, Issue 25, pp. A33-34. http://chronicle.com/free/v49/i25/25a03301.htm

Monaco, Frank J., IT Disaster Recovery Near the World Trade Center, EDUCAUSE Quarterly, Volume 4, 2001,
pp. 4-7. http://www.educause.edu/ir/library/pdf/EQM0144.pdf



 Related EDUCAUSE2003 Sessions

Tuesday, November 4
8:30 a.m. -        Room 210D Morning Seminar : Seminar 04A - Disaster Recovery and Business
12:00 p.m.                   Continuity Planning for Centralized Computing in a University
                             Environment
                             PLEASE NOTE: Separate registration and fee is required to attend
                             this seminar.


Wednesday, November 5
2:15 p.m. -        Room 304D Track 6 : A Tumultuous Year in the Life of a Data Center
3:05 p.m.


Thursday, November 6
11:45 a.m. -       Room 304C Track 5 : Leveraging Resources and Building Partnerships for
12:35 p.m.                   Critical Infrastructure Protection




               PAGE 4 OF 4