This is an emergency

In the midst of a credit crisis, it can be hard to allocate budgets towards initiatives like disaster recovery. But as Pier Ford reports, Middle Eastern enterprises neglect such systems at their peril.
This is an emergency
By Piers Ford
Sun 08 Feb 2009 04:00 AM

In the midst of a credit crisis, it can be hard to allocate budgets towards initiatives like disaster recovery. But as Pier Ford reports, Middle Eastern enterprises neglect such systems at their peril.

Hardly a week goes by without a disruptive event, manmade or natural, taking place in one part of the world or another. Floods, fires, oil refinery explosions, terrorist threats and plain old bad weather seem to interrupt daily life with increasing regularity, forcing organisations of every kind to look at their business continuity (BC) and disaster recovery (DR) strategies - or lack thereof - with more urgency than ever before.

If the headlines alone weren't enough to galvanise CIOs into action, the need for compliance with an increasingly stringent array of regulations, such as the Sarbanes-Oxley Act (SOA) for any company looking to conduct business on the international stage, is focusing minds on the role played by IT in BC and DR planning.

Middle East CIOs face the same challenges as their counterparts throughout the rest of EMEA – to find a solution that fits their purpose now and in the future within a reasonable budget.

The SOA, for example, requires organisations to understand the risks that may impact their financial reporting processes; and that will almost certainly include the risk that could arise from inadequate BC and DR strategies.

Opinions vary as to how rapidly BC is coming of age in the Middle East. On the one hand, fast-followers of technology are embracing trends like storage virtualisation that allow them to build data management strategies which naturally meet the scope of BC requirements.

On the other, even in such a rapidly growing region, many larger organisations have to cope with a legacy of systems based on a habit of building solutions for specific business needs rather than with a holistic architecture in mind, and face considerable challenges when it comes to BC and DR planning for their complex infrastructure.

"Larger organisations in this region are starting to realise that holistic BC is about expecting the worst and hoping for the best, and treating DR as one element of that," suggests John Coulston, head of marketing at Dell Middle East.

"It needs to be part of every process within the organisation, whether you're talking about a deskbound office worker, the data centre or a payroll application. And CIOs certainly understand that. Our position is that if you can simplify the data centre and your technology investments, and add in some basic professional services as you build your BC strategy you'll be better able to prepare for a disaster more quickly," he continues.

Business isn't always interrupted by a news-making event, of course. Usually, the reasons for disruption are far more mundane. As Coulston explains, the varying levels of maturity of public infrastructure across the region can have significant implications at a local level. Power supplies are not consistent, for example. And this means that emerging technologies such as mobile are coming into their own as they allow organisations to build more flexible DR strategies.

But other industry watchers suggest the region's rapid growth presents an even greater challenge for the BC-aware CIO. Sovereign Business Integration Gulf has recently implemented a state-of-the-art IT infrastructure with integrated DR for the International Bank of Qatar (IBQ). Managing consultant Joss Marsh says the real issue for CIOs is keeping pace with the speed of change.

"Since we implemented the system 12 months ago, there has been a 300% growth in the number of users and the amount of data held by the organisation," he says.

"You have simply got to get the DR element right from the start, and then plan ahead. BC planning must start with risk analysis so that your in-country DR is adequate to cope with regional upheaval. You need to think about where you keep copies of your core data," continues Marsh.

And even in this rapidly developing environment, a significant proportion of business processes remains paper-based. With automation levels still relatively low, a large number of financial transactions can depend on the existence of a single piece of paper - and as Marsh says, a solid BC strategy has to take into account the manual as well as the technology elements.

"IBQ is very much more involved than the majority of organisations in terms of DR planning for its IT systems," says Marsh.

"One of the things we've found to be prevalent among banks out here is that the strategic growth of IT tends to be about fitting the best solution to a particular need. So they end up with a wide variety of operating systems, database types and applications, all loosely integrated. And every variation has been put in by an out-of-country consultant who leaves once the system is live and only takes the odd telephone call."

Marsh says the consequences extend beyond the difficulties of BC planning or DR: "We've found general backup issues to be seriously problematic because of the sheer variety of systems that are out there in the field. So when it comes to tackling a problem like disaster recovery, you actually have to tackle a much wider problem. It really needs a solution that's unified and will cater for every system on the network, right down to individual machine level."

"CIOs in the Middle East face the same challenges as their counterparts throughout the rest of EMEA, and in fact the world, to find a solution that fits, in the face of growing data mountains, their purpose now and in the future within a reasonable budget," says Thomas Barrett, sales director, northern and Middle East at FalconStor Software.

"I see them starting to look beyond the range of top tier vendors and looking to innovative players introducing smart storage to save costs as well as provide disaster recovery capability, such as data deduplication and thin provisioning," he states.As Barrett implies, the traditional and expensive approach to BC - building duplicate, redundant datacentres, for example, or whacking up storage capacity at existing sites - has tended to restrict investment in BC infrastructure to the enterprise sector.

And many organisations are now finding that backing up primary data as part of their usual BC processes has become an unwieldy overhead, as disruptive in its own way as any external intervention from an introduced business continuity process.

For them, the emerging range of technologies that take the pressure off the data centre is probably the best bet, as they seek ways to simplify their technology investment.

You have simply got to get the DR element right from the start, and then plan ahead. BC planning must start with risk analysis so that your in-country DR is adequately prepared to cope with regional upheaval.

"We have already seen Middle Eastern firms embrace virtualisation which will give them server level disaster recovery. The next phase is the deployment of off-site elements that data replication specialists can offer," concludes Barrett.

International Bank of Qatar case study

International Bank of Qatar is one of the fastest growing financial businesses in the Middle East, placing huge demands on its IT infrastructure as it moves towards a 24x7 operation and faces up to the growing regulatory requirements of the Qatar Central Bank, which includes a robust DR solution.

IBQ turned to consultancy Sovereign Business Integration to oversee the construction of an appropriate system.

To create the right disaster recovery solution for the bank it was essential to understand two key facts: how fast the business would require each system to be recovered and the amount of data that the bank could afford to lose in the event of a disaster.

"In 99% of cases there is no leeway for any data loss," says chief operations officer James Nelson-Parker.

"Each financial transaction is far too important. Furthermore, systems are critical which means downtime cannot exceed two hours on most systems, 30 minutes on the most essential."

The decision was made to replicate not just the data but the entire virtual machine to the DR site. This ensures that when a machine is brought up on the DR site, everything is present, including application and security updates, thus reducing the overall maintenance levels.

A prerequisite of the disaster recovery solution was that it could be handled by IBQ staff without intervention and support from Sovereign. IBQ ran two DR tests over separate weekends.

The first test was to ensure the core banking system could be switched over to the DR site and switched back with no loss of transactions. In the second test, the bank switched the whole infrastructure over to DR, processed some transactions and then moved back to the production environment.

"It was an excellent achievement to get back into the production environment with only minor glitches. The whole process was extremely successful," Nelson-Parker says.

"It is a great sense of relief to IBQ that, should something happen to head office or the production environment, the bank can continue to operate effectively."

IBQ now has a comprehensively stable platform. "Instead of chasing our tails trying to fix problems, Sovereign has created a more structured IT environment that will be a stable foundation upon which to build new applications to support IBQ's expansion plans," he says.

Dr Advice from the front

Joss Marsh, managing consultant at Sovereign Business Integration, has three key pieces of advice for CIOs planning their DR strategies today: think big, think low-maintenance and remember the human element.

"The IBQ project went a great deal beyond DR," he says. "It's safe to assume that the system's required growth will be considerably greater than you ever imagined. Plan the architecture for scalability accordingly. We thought we'd thought big, but with 12 months' hindsight, we could have thought bigger!

"Low maintenance should be one of your key goals. Adopt replication technology so you only have to maintain one site, and that means your DR site will almost be self-maintaining. There is a tendency out here to treat DR as a box-ticking exercise, so as long as there is somewhere to restore from tape, the box gets ticked. But if you have a meaningful dependence on IT, that isn't practical. Recovering 48 hours of lost data from tape is inordinately expensive, so try to take a more unified approach," continues Sovereign's Marsh.

"Finally, people always underestimate the amount of effort required to build a DR strategy. It requires a huge effort up front. Technology is only 50% and the rest is people. IBQ realised that to take that many people away from their day job would rip the guts out of the IT function, and that's why they called us in," he concludes.

For all the latest tech news from the UAE and Gulf countries, follow us on Twitter and Linkedin, like us on Facebook and subscribe to our YouTube page, which is updated daily.

Subscribe to our Newsletter

Subscribe to Arabian Business' newsletter to receive the latest breaking news and business stories in Dubai,the UAE and the GCC straight to your inbox.