IncTechnology.com > Disaster Prevention

Recovery after the Storm

Mike Gorsage — 2008-10-28T15:04:16-05:00

Small business is the cornerstone of the U.S. economy, with more than a quarter million small businesses accounting for millions of dollars in commerce each year. Unfortunately, countless businesses have closed in recent months because of natural disaster. Reminiscent of Hurricane Katrina three years ago, Hurricane Ike swept through Galveston, Texas, causing massive power outages, scattering employees within the state, and shutting down thriving businesses. While some businesses reopened weeks later many were unable to recover from the customer and revenue losses and remain closed today.

Disasters like Hurricane Ike illustrate the growing need for business continuity plans that effectively address how to run a business once information technology operations are disrupted, often making the difference between losing and recovering a company.

Protecting your assets

The most critical assets of any business are its employees and data. Therefore, any business continuity plan should address the safety and accessibility of each and determine how the business will continue to run amidst destroyed or damaged IT infrastructure, applications, and machines. However, it is critical that such a plan also include processes for employees that manage IT operations, otherwise the plan is rendered useless.

When the lights go out

During a natural disaster, electric supply powers are often the first sign of disruption -- and the costliest. A simple battery backup which connects to a Universal Serial Bus (USB) port can safeguard against the loss of customer lists, information about current projects, accounting ledgers, and other critical data at risk in the aftermath of any disaster. There are also hard drives that can plug into a USB port that automatically back up data. These measures can prove to be both reliable and inexpensive business continuity tools. In addition, laptop computers can be used to store and remove data during disasters, essentially serving as a mobile system running on a backup generator.

With the use of any business continuity tool, it is recommended that a business supply its data center with a backup power system with enough fuel to last at least a week. In the instance that the network is disrupted, businesses should use a dedicated backup network or remote server. However, backing up files is essential despite having a backup battery, and options including an off-site storage service or self storage (i.e. fireproof containers, fireproof cabinet, etc.) can aide in preventative measures. The after effects of a disaster -- power failures and surges -- are often the real calamity for businesses’ IT operations.

Employee roadmap to safety

While business continuity plans prevent data losses within IT infrastructure, applications, and machines, it is critical that the plan include processes for employees that manage IT operations. Once a business loses operational capabilities, employees can still resume IT operations at another location. However, it is important to note that moving to another location may be impossible or slightly delayed depending on the type of disaster. A hurricane or other disaster can render traffic impossible with employees facing limited access to roads and airports. The key is to maintain communication with employees so they can be directed to the backup facility based on their current location. In addition to a current contact list with several options to get in touch with every employee, an effective business continuity plan should include processes and scenarios for employees managing IT operations responsible for coordinating communication.

Practice makes perfect

When compiling a business continuity plan to run a company in the aftermath of a disaster, it’s important to include a budget with costs for alternative IT infrastructure, applications, machines, employee transportation, and new business sites. Business continuity plans, which should represent at least 20 percent of a company’s basic IT operating budget, should be tested at least once a year and updated to reflect business changes like mergers and acquisitions or divestitures.

In recent years, the damage experienced by businesses along the paths of hurricanes and other disasters reinforce the growing importance of having a business continuity plan at all times. Beyond running a business while IT operations are disrupted, a business continuity plan often makes the difference between losing and not losing a business. The key to recovering a business after a disaster is preparing and practicing the continuity plan.

Mike Gorsage is the National Technology Practice Leader for Tatum LLC. Tatum is the nation’s largest executive services firm, providing financial and technology leadership to businesses of any size.

SOS: Safely Outsource Storage

Jean Thilmany — 2008-07-28T17:00:59-05:00

Like their larger counterparts, small businesses need to create copies of vital digital business data on a set schedule. The backup copies can be used to restore original data should computers crash or a natural disaster strike.

But rather than buy or build on site storage, backup, and recovery systems, many small businesses increasingly opt to outsource these offerings to managed storage service vendors who provide businesses with the backup software and the automatic off site storage, taking away the backup hassle factor in the process. But is outsourcing backup right for you?

One big benefit plan

Under some plans, the service provider takes responsibility for storage and backup. Small businesses that don’t employ a large number of IT people often make one employee responsible for transferring pertinent files to tape, disk, thumb drive, or the like at regular intervals. To ensure data isn’t lost in, say, an office fire, the employee must then take the saved files off site, usually home, says Mike Garland, director of marketing at DataPreserve, a backup service provider in Scottsdale, Ariz.

Sounds great in theory. But it doesn’t always work in execution.

“I entrusted my data backup to a great staff person, but she was so busy,” says chiropractor Sky Moore, who heads Moore Chiropractic Center in Avondale, Ariz., a small practice comprised of several practitioners.

That busy office manager recently forgot to backup data to tapes for three weeks running. Then, as is always seems to be the case in such situations, the computer crashed. Moore had now way to recover the three weeks of patient data and transactions.

After sorting out that sticky situation, he began using DataPreserve. The software searches daily for newly created digital data, encrypts the information, and moves it via the Internet to the vendor’s data center.

Moore runs routine checks to ensure proper data has been backed up and can be quickly restored.

Backing up remote locations

Some backup and storage providers, like Robobak of Atlanta, provide supplemental software for remote offices and off site business locations, allowing even the branch offices made up of one person to save data. These locations don’t have to install software on every machine at every location, says Bobby Kuzma, vice president at ElectroNerdz, an IT service provider in Lakeland, Fla.

ElectroNerdz uses Robobak’s services for nearly all its clients. The backup solution also allows customers to archive data at the vendor site for long-term regulatory retention, Kuzma says.

“The entire thing requires far less care and feeding of the IT guys,” he says.

SIDEBAR: Questions to Ask Before Outsourcing Backup

Here are some questions small business owners should ask when contemplating off site backup and storage. They come from Jim Walker, DataPreserve president.

How much time will it take? For small business owners, data backup should be automated as often as needed. Most will choose daily some -- an accountant working during tax season, for example -- will want to back up every 15 minutes.

Will the data be encrypted? Typical copying of files can increase the risk of data compromise if the data isn’t encrypted. Any transmission across the Internet is vulnerable if not encrypted.

How much will it cost? Depending on the solution and the amount of data stored, an automated, encrypted remote data backup service starts around $15 per month depending on the amount of data stored. Expect to pay $2.50 per gigabyte or more.

What is the vendor’s process for quickly recovering the data? Be sure to understand and test the system for ease of recovery before disaster strikes. Keep a copy of passwords and an outline of the recovery process in a secure location. Also be sure to periodically test the data to ensure it can be readily restored.

Tech Talk: E-mail Storage Sails for Boat Supplier

Elizabeth Wasserman — 2008-06-19T08:59:05-05:00

Quantum Marine Engineering, of Fort Lauderdale, Fla., custom makes boat stabilizers, thrusters and other hydraulic equipment for yachts all over the world. Staff members rely on e-mail to communicate with customers. IT Director Michael Bartlett tells IncTechnology.com how e-mail archiving helped the company manage mailboxes and facilitated e-mail retrieval on demand.

Elizabeth Wasserman: How does your business use information technology?

Michael Bartlett: The single technology that the owners of Quantum have decided and maintained as critical to our business is e-mail. Our market is worldwide. We build custom equipment that is essentially for boat builders. A lot of communication is from the sales side and engineering side, between our engineers and ship builders, and between our engineering staff and captains and those on board. These often have to do with specifications on board, changes in specifications back and forth and, because sales are worldwide and we're driven by e-mail, keeping records of who said what to whom and when is critical for us.

Wasserman: So what problems did you encounter?

Bartlett: Everybody wants to grow their mailboxes without restraint. They want to keep all of their inbound and outbound e-mail as a record. Because technical specifications are spent back and forth and projects stretch of several years, sometimes staff changes and then you have a point of dispute with the customer. The original specification was half inch. At some point, it changed to three-quarters of an inch. And we have to know who changed what and when. Some mailboxes grew to 2 gigs. At that point, we started have problem with our Exchange performance and the individual users' performance -- especially if they were mobile users.

Wasserman: Why did you decide on an archiving solution?

Bartlett: To have a permanent record that is separate from the Exchange server. We decided to use the GFI MailArchiver. This way, the e-mail is not deleted, it can't be manipulated, and we can search it and track things down. A huge reason is to keep the size of the individual Exchange mailboxes down. We have a default limit of 250 megs for individual e-mail boxes. Once people understand we have a separate archive of all e-mails, they realize they don't have to save everything. It keeps the database smaller and it has improved the Exchange system performance.

Wasserman: How has this helped your business?

Bartlett: The system we're using is searchable. Our administrators can search the whole database. Each department head has the ability to search through their department e-mails. We had a moment already when the owners realized that this was a good move. We had one of those situations where a product arrived at a shipyard and the specifications were not right. We had to find the e-mail where the specifications were changed. The engineers on both ends had made changes. I was able to find this e-mail in five minutes. That proved the worth of the system in everyone's eyes.

Tech Talk: Firm Uses Backup for Accountability

Elizabeth Wasserman — 2008-06-19T08:53:32-05:00

VAALCO is a Houston-based energy company that explores, develops and produces crude oil and natural gas. It's a small, but publicly-traded company with 20 employees in Texas and more worldwide. Robert Walston, IT supervisor of VAALCO, says that moving to an online backup service helped the firm comply with regulations regarding accountability of financial data and allay disaster recovery concerns

Elizabeth Wasserman: What type of data do you keep?

Robert Walston: The critical data is the financial data. And recently, in the last year or two, we implemented Microsoft Exchange server so we have all of our e-mail data also that would be critical.

Wasserman: Why did you look for a new backup solution?

Walston: We are a public company and we were introduced to the Sarbanes Oxley requirements. Even though we're a pretty small company, our market cap is big enough to make us have to abide by the same regulations the large corporations. In late 2005, we were basically backing up everything to tape drives. I was hand carrying them to my house at the time. Once we were introduced to the Sarbanes Oxley regulations, we knew that wasn't going to cut it. It didn't meet the standards for accountability and so we had to come up with a solution pretty quickly. That's when we started looking into an offsite, online type of backup. We went with Netmass, based out of Dallas, with Asigra software.

Wasserman: How does it work?

Walston: We downloaded a client and it backs up our computers over the Internet. It's all encrypted, so it meets the securities standards and accountability standards we need. Basically, each night a couple times a week, we rotate between the accounting/purchasing and Exchange server. It's really easy to set up. Every night at a certain time, it backs up our servers.

Wasserman: You're based in Houston, which was hit pretty hard during Hurricane Rita. Does this give you peace of mind during hurricane season?

Walston: The main concern was with our auditors at the time. They didn't know where I lived and whether I lived in a flood plain. I, myself, wasn't concerned. Our offices are located on the third floor of a three-story building. Having said that, it does provide peace of mind. That's for sure. If something were to happen, a disaster in our building itself, we would be able to get these backups from a remote location and restore then in a matter of hours if we had the right hardware.

Disaster Recovery: Is Your Company a Phoenix?

Lisa Metcalfe — 2007-12-17T05:01:48-05:00

801Novelist Chuck Palahniuk said “only after disaster can we be resurrected.” For some that might ring true as the opportunity to rebuild and revitalize often creates strength -- strength within you, your business, and community. Like a Phoenix rising from the ashes, your company is reborn and ready to soar.

However, for the one in four companies that do not have a business continuity plan to respond to disasters, according to an 2004 AT&T study, resurrection after disaster is not a possibility. We live in a virtual world. Companies store and share data electronically while their mobile employees rely on electronic information to complete assignments. Accounting departments file and pay bills and compensation forms via websites, and Human Resources personnel have discarded paper files in exchange for online storage. Although technology has simplified the way we conduct business, if a company experiences a disaster without any preparation, the end result can be devastating.

Businesses rely on continuous access to data and a loss of it during any disaster may have serious consequences. Depending on the particular situation, every hour of computer downtime can cost a business thousands, sometimes millions, of dollars. Very often, small-to-medium businesses are not adequately prepared for disaster recovery. The costs associated with data storage and other technologies are noted as the number one reason for failure. According to research conducted by the University of Texas, only six percent of companies suffering from a catastrophic data loss survive, while 43 percent never reopen and 51 percent close within two years.

While disaster recovery and business continuity are cited as a top priority and business initiative, many technologists find that obtaining funding for disaster recovery is easier said than done. Although the company CFO or Controller looks at disaster recovery as important, it is difficult to identify how much the company really needs to spend to be sufficiently insured against a disaster.

Gartner estimates that only 35 percent of small to mid-sized businesses have a comprehensive disaster recovery plan in place. Nobody can predict when a disaster will strike but from studies like the one by the University of Texas we can predict that a business that hasn’t taken precautions will likely go under. This is tragic because business leaders can often make the necessary preparations at costs well below what they may think.

Expect the unexpected

When it comes to disaster preparation, many tend to think, “It will never happen to me.” After all, your company may not be in a hurricane or tornado zone, and your employees are loyal and educated on the do's and don’ts of Internet usage. But data loss can result from any number of factors, including: human error; power outages; smoke or fire damage; water damage or floods; hardware failures or software bugs; human-threats such as hacking or viruses and even disgruntled employees.

So how, you ask, could we possibly prepare for the unknown?

There are some initial steps that you can take to create a comprehensive plan ensuring that you are on the right track should disaster strike:

Examine risk: Thoroughly examine your company’s systems and determine what risks can affect overall uptime. When looking at a disaster recovery budget, many CFOs ask that IT managers thoroughly review the technology that is critical to the daily operations of the business. List the age of the assets and the likelihood of a breakdown. Review all of the software licenses and when upgrades are due. Many smaller businesses do not have the budget to consistently purchase new software or hardware, so make sure that routine maintenance is conducted and continually reexamine server capacity. Often the most “basic” of systems failures (server outage or e-mail can cause the most damage). Determine which of potential threats are most likely to occur and prioritize them by looking at the probability and potential impact.

Develop a written plan that makes disaster protection part of the routine: After assessing all potential risks, develop a plan that will ensure business operations can fully recover from a physical, computing, or natural disaster. Your plan should reflect your specific business needs. What resources will be required over the course of time and where is critical data stored? Files can be backed-up in a number of ways -- online, microfilm and disks -- and backup files should be stored completely offsite. Companies should not store critical backup files at someone’s home. This is not a secure location and it’s important to contract with an offsite storage company. After all, if your building is destroyed by fire having backups in your office won’t help. This seems obvious but preparing for a disaster is never a daily top priority, so having a systematic backup process that is integrated into daily routines is the only way to be sure you are covered.

Depending on your company’s needs and budget, there are a variety of vendors who can help. Make sure that a list of all relevant numbers, passwords, and codes is issued to key people so that you can access the data in the event your disaster recovery plan is activated. Finally, keep in mind that communication in advance of an emergency is critical. Once you have decided on a plan and processes, review the plan with employees. Preparation ahead of time will help ensure that recovery processes run smoothly.

Test the plan: Business continuation is a key focus of planning. Make sure that plans are in place and have been thoroughly tested. Bring in an outside expert who can vet the plan and revise it accordingly. It is important to keep all key personnel involved in the testing process, so they are aware of the necessary action required should disaster strike. Testing will help to determine the practicability of the recovery process and identify any inadequacies in current procedures. Most importantly, testing the plan will demonstrate whether the business will be able to recover. CEOs, investors and other stakeholders want to know that plans are real and not just words on paper. Conducting a thorough test will help you to demonstrate effectiveness and obtain necessary budget approval.

According to the NFIB National Small Business Poll, man-made disasters affect 10 percent of small businesses, whereas natural disasters have impacted more than 30 percent of all small businesses in the U.S. Hurricanes are the most destructive natural disasters, causing power failure, flooding, customer loss, and the closure of many businesses. Although preparing for the unknown may seem like a difficult task, not preparing can have serious consequences to your business. Taking the first steps toward setting up a disaster recovery plan helps ensure that your company can, in fact, be resurrected after disaster -- the Phoenix, restored to life and ready to fly.

Lisa Metcalfe is a Technology Regional Practice Leader for Tatum LLC. Tatum is the largest executive services firm in the United States, providing strategic and operating leadership in finance and technology nationwide.

Disaster Planning in Six Quick Steps

Renee Oricchio — 2007-10-26T17:17:36-05:00

Covenant Technology, an IT consulting group based in Houston, Texas that specializes in small and mid-size businesses, has been advising clients on disaster preparedness for years. But in 2005, when Hurricane Rita blew ashore too close for comfort, a number of those plans got put to the test.

“We had one client -- an investment business -- that we had recently helped with a disaster plan. This particular client wanted a plan that meant they’d never be down," recalls David Robertson, president of Covenant Technology. The business was in Houston, close to the coast. When Rita hit, they tested the plan and were able to continue trading from an inland backup location, in San Antonio.

Robertson and his client made all the right decisions preparing for a disaster. Most businesses don’t. “Most small to mid-size businesses are not adequately protected. They don’t anticipate the possibility of an event in any form,” says Frank Scavo, president of Computer Economics, an Irvine, Calif. research firm.

There are a lot of reasons businesses tend to procrastinate: expense, time, disbelief that anything will ever go wrong, or simply not knowing where to begin. Here are six steps to get started that will hopefully minimize costs and time commitment, as well as make a compelling case to take action.

Step One: List events that may cause lost data or technology.

Ideally: Companies should have contingency plans for the kinds of disasters that they are vulnerable to based on geography or the nature of their business. A business in California may be primarily concerned with earthquakes and wildfires, while companies in Houston are focusing on floods and hurricanes. Other companies may be more concerned about being a high-risk target for theft or terrorism.
Other considerations: Scavo advises business owners to also consider more mundane disasters. “Just losing a laptop that has the only copy of a piece of critical business data can be devastating," he says. "The trend towards mobile computing has compounded this risk in recent years.”
At the very least: “Pick the ones that are most worrisome,” says Robertson. Planning for the biggest risks is better than no planning at all.

Step Two: Safeguard the company data.

Ideally: In addition to routinely backing up data, Robertson recommends that companies store it offsite with a Web-based data storage solution. Many third party solutions are reasonably priced for smaller businesses.
Other considerations: The more redundancies the better. A locally-owned data center that rents space is great for backing up company information. But in the event of a natural disaster, it can be compromised, too. Ask if they have a back-up system elsewhere in the country.
At the very least: “It’s cheap to just get an external hard drive, plug it into the server, and do a complete backup. But you have to remember to do it,” says Robertson. You also have to remember to store it offsite. Scavo suggests rotating sending it home with different employees.

Step Three: Safeguard the network.

Ideally: “A lot of companies take adequate measures to save data, but forget to do the same to save the system,” observes Scavo. Make arrangements in advance with a co-location facility that offers not only redundancies in backing up data, but fire suppression, backup power, and proper cooling to keep the servers humming.
Other considerations: Define acceptable ‘down times,’ which differ depending on the business. Covenant Technology’s client was an investment business obligated to continue trading and could afford no time offline. Another business may be able to close for a few days while an alternate network is loaded with company applications and data.
At the very least: Have a schematic of the network and an inventory of all the hardware that make up the infrastructure. Replacement gear won’t be exactly the same, but it will offer a roadmap of where to begin.

Step Four: Safeguard staffing.

Ideally: Essential staff needed to run business-critical technologies, like the network or certain applications, are sometimes impacted -- even if the disaster doesn't damage your business. Every key position should have someone cross-trained to take over in case of an emergency. Key staff members need to have reliable remote access to the company network.
Other considerations: “You see companies prepare for loss of equipment or data, but not people. But what about a pandemic? It doesn’t touch the system, but instead the staff,” points out Scavo. Companies need to not only consider contingency plans for displaced staff, but for losing a portion of staff or having them quarantined at home.
At the very least: Keep a running list of essential staff and cross train those positions. Also keep a check list of which employees have what level of access from home.

Step Five: Test the plan.

Ideally: All plans look good on paper. Having the occasional real life drill is where the rubber meets the road. Most consultants recommend testing and updating the disaster plan once a year, if not every six months.
Other considerations: A disaster drill is worthwhile for everyone, but it's essential for new staff. In addition to hard copies of the plan, keep hard copies of passwords and IP addresses, along with access data for bank accounts. Double-check and update each year.
At the very least: For businesses that don’t have time to test, dust off the written response protocols and have a read-through with staff. Fine tune the plan, and offer a refresher course to employees.

Step Six: Have a recovery plan.

Ideally: “You have to think about what happens after the disaster. How will the data on the alternate system be returned to the company?” asks Robertson. This requires a well thought out protocol.
Other considerations: How will recovery in one area impact the recovery in another? Allowing employees to occasionally work from home also functions as an informal drill to make sure they can work offsite.
At the very least: Factor in additional hours, days, if not weeks or months into projected times for returning to normalcy. Look at New Orleans. The immediate disaster of Hurricane Katrina lasted only a week or two. More than two years later, a total recovery is no where in sight.

What to Do Before Disaster Strikes

Ramon Ray — 2007-07-30T14:04:11-05:00

In mid-July, New York City experienced yet another catastrophe. A steam pipe exploded in mid-town Manhattan, killing one person and injuring many others. Beyond the human loss of life and injury, there were hundreds of businesses immediately affected by the blast and about 100 – including many small and mid-size businesses -- felt the impact for weeks.

The steam pipe explosion was only one of numerous natural or manmade disasters that are likely to wreak havoc on businesses this year. Hurricanes, tornadoes, and even terrorist attacks may be launched with little warning. In the steam pipe explosion alone, economists estimate tens of millions of dollars of lost revenue. Con Edison, New York City’s main provider of power and heating, said that it would pay customers for damaged goods, equipment and fixtures, but not for lost business.

What will these businesses do? What plans does your business have in place in the event of such a disaster?

Having a business continuity plan to help ensure the survivability of your business is essential these days. And that plan must include a strong technology component, as so many businesses rely on data stored in computers and on online processes for ordering supplies and selling to customers.

Depending on your type of business, your recovery options are going to be vastly different.

For retailers, if you have no access to your retail store and rely on foot traffic, it is going to be difficult for you to make any money or have a viable solution for the loss of your income. For professional service firms, which don’t necessarily have customers physically come to a particular location, the concern is more often with preventing the loss of essential data and getting the business up and running again in order to service customers as quickly as possible -- even if that means running the business from another location temporarily.

A complete business continuity solution includes many non-technology factors:

plans to replace executives, managers, and employees that might be lost in a disaster
taking care of the families of affected employees and more
insurance (of all forms and all types that you might need)

But technology plays an increasingly important role in business continuity and needs to be a central part in any plan. Here are some guidelines for what your business needs to take into consideration to properly prepare for the unexpected.

Back up your data. This is the number one item on your to-do list. Having your data backed up and stored off site ensures that if you have no access to your business and/or if it is destroyed in a disaster that you can still have the vital records you need (employee, customer, inventory, financial, contracts, etc) to run your business -- even if all of your computers are destroyed.

Customer contact. Being able to contact customers and keep them informed can help your business as it is going through difficulties during a disaster and when it recovers post-disaster. Maybe your physical business is closed, but you are able to sell more items online. Or you partner with a nearby retailer who compliments or even competes with your business. Capturing customer information at the point of sale is a way to ensure that customers (loyal or one time only) can be informed about your new arrangements.

Telecommunications. Your telephone system is very important and, if you need to leave your office and have no way to access it, you can be in trouble. One solution is to utilize a managed telephone service provider which would provide voice over Internet Protocol (VoIP) telephony. For very small companies, a virtual PBX type phone system could be a good option as well. In the event of an emergency, using either a VoIP system or virtual phone system, you can access and/or re-configure your telephone system from a Web browser.

Service agreements. Depending on how important it is for you to keep certain technologies up and running, in the event of a disaster, it’s important to analyze the agreements (such as leases or supplier contracts) you have in place. In a disaster, what are your obligations? What does it say in the contract as far as the other party's obligations? If you need to move to a new location, can your current vendor service you? If not, how soon can you requisition the services of a new vendor?

Disasters that result in business interruptions are going to occur. Your business goal should be to mitigate damages to your business when a disaster does strike.

Ramon Ray is an author, speaker, technology writer and former small business technology consultant. He publishes Smallbiztechnology.com, a website that helps small and medium-sized businesses strategically use technology as a tool to grow their businesses.

Time to Consolidate Your Data Center

Caroline Waxler — 2007-05-25T14:27:20-05:00

More and more small-and medium-sized businesses are thinking about consolidating their data centers, as a result of having grown haphazardly or through many mergers and acquisitions. According to a 2006 report by tech research firm IDC, 80 percent of U.S. IT organizations are consolidating and in 2009 global spending on IT consolidation should hit $25 billion.

“Most of these things aren’t planned and then executives wonder how in the world they’ve grown to the number of servers they’ve got," says Cal Braunstein, chairman and CEO of research at the Robert Frances Group, a Westport, Conn. IT consulting firm. "They need to add another application, and somehow before they know it, each of these applications are on different servers.”

And, oftentimes those different servers can be in different rooms, on different floors, and even in different cities.

M&A activity sparks consolidation

One big driver of data center consolidation is the rash of mergers and acquisitions that leave the new entities with IT systems that are often incompatible, sometimes burdening even forward-looking companies with outdated systems from a company being acquired. “CIOs are telling their CEOs, ‘Could you please buy a company with the same IT platform and infrastructure?’” says James F. O’Grady, the director of technology value solution for Hewlett-Packard Financial Services.

Why consolidate when it’s an expensive undertaking? Let’s start with those systems that are the product of mergers and acquisitions. All the little band-aid fixes to make these systems work together may be costing your company money -- not to mention resources -- that could be better spent elsewhere.

Even without mergers, small and medium-sized businesses tend to be sitting on a lot of older servers being kept around in order to save money on costs of new equipment. However, since many of these machines have poor utilization rates, they aren’t necessarily the best use of money. Braunstein estimates various utilization rates of different systems as follows: mainframes (75-90 percent), Unix (10-20 percent although some achieve up to 60 percent), and Windows-Intel systems (5-12 percent).

High maintenance and licensing fees

On top of having all this old equipment around, there are high maintenance costs and licensing fees, not to mention the issues of power and cooling for all your machines. “Two years ago no one cared about power and cooling,” says Braunstein. But now that energy costs have skyrocketed, businesses are starting to be more aware. Costs for power and cooling could run 40 percent of your run rate for operational components for your data center. Consolidation can mean lower power output, says HP’s O’Grady. If you have five data centers all over the country and you really only need three, not only will consolidation save on power costs but will also save on labor costs.

Those are big numbers that could be made smaller through consolidation. On average, says Braunstein, hardware costs tend to be 15 percent of overall costs.

What it means to consolidate

Consolidation can mean different things to different businesses. For some, it’s reducing the number of data location center locations and moving equipment to places that have lower operating costs, according a March 2007 report by HP, titled “Data center consolidation: Financing options address more than just cost.” Two spaces in midtown Manhattan dedicated to holding IT are more expensive to maintain, than say, combining them both into a new one in northern New Jersey. With telecommunications advances, it’s more feasible to locate the data centers away from your office.

Another approach is to consolidate at the current site by putting in a converged voice-and-data network. Or you can save space by installing racks. With a vertical rack, instead of buying servers, you buy components that altogether look a little like an entertainment system. Blade servers work on the same concept as a rack but are even more condensed. A blade comes in a smaller box, so it slides in vertically. You can get a number of these going across a couple of rows, giving you a tremendous amount of capacity in a small space.

And, then there’s the virtual approach. Companies can virtualize their servers by running many systems in a single box. Not only can that save space but it can also up performance; instead of running at about 10 percent utilization, it can be at least 40 percent.

Paying for it

No matter how you undertake it, consolidating your data center is going to cost money. According to HP, often you’ll have to keep the old data center running as you’re setting up your new one. Or, you can set up a temporary facility -- using the same type of old equipment -- as you’re taking apart the old center and setting up the new one. So, you could potentially have up to three data centers running at the same time before you get everything sorted out.

Companies, like HP, and IBM, and to lesser extent, Sun, who are all in the data center consolidation business provide financing options, including leasing, short-term equipment rental, and help with the recovering of money from asset sales. They also work with the customer to apply some of the costs to covering the purchasing of new equipment.

Another approach, says Braunstein, that may make sense, is putting the new data center inside one of your current spaces. “You could consolidate it piecemeal so you don’t have to go beyond the bounds of existing data center," he says. "It takes longer this way, however, it’s a good approach because you get to see what works as you go along.”

Locking Down the Network to Block Malware

Mary O. Foley — 2007-05-25T14:16:18-05:00

Dudley King is network security-conscious. He has to be. As principal of Pallas Technology, his customized software development business depends on it.

Two years ago, two of Pallas’ major clients, American Express and NetJets Inc., asked Atlanta, Ga.-based Pallas to undergo a vulnerability assessment. The result: Pallas now has an office full of dedicated hardware, dedicated routers, and networks linked to each client, and dedicated intrusion prevention systems.

“We have to do what we can to work in this arena,” says King. “Most of the changes we made were not expensive, but involved formalizing our procedures and segregating our work.”

With malware proliferation at an all-time high, and overseas hackers making more money from stealing financial information and trade secrets than ever, businesses big and small are at elevated risk. Small- to medium-sized businesses need to do more, not only to safeguard their own systems, but those of their clients. And companies know it: a December 2006 survey of 2,434 North American small- and medium-sized businesses by Forrester Research found that improving IT security was the top concern for 2007.

But how can smaller businesses -- many without the resources to deploy entire IT departments -- best protect themselves?

Create an office-wide security policy -- and then enforce it

If your business doesn’t have a uniform computer-user policy, it’s time to develop one, notes Joe Stewart, senior security researcher with SecureWorks, an Atlanta-based information security firm. “You’ve got to define a security policy, and then enforce it,” he says.

A lot of businesses have installed anti-spyware software, but don’t have any other guidelines or policies, and so employees do whatever they want, Stewart says. But allowing e-mail with attachments, or e-mail coming in from AOL, Gmail, or MSN accounts, can be an open invitation to viruses, worms, Trojans, and the lot. Stewart recommends office-wide “no e-mail attachment” policies and a standard e-mail gateway system. Solutions include a basic Linux mail gateway system, or outsourcing e-mail scanning to companies such as Message Labs or Postini. E-mail protection services have become more affordable, often running less than $100/month for an outfit with less than 100 users.

Beware of Instant Messaging and Skype

Does your business absolutely need instant-messaging (IM) capability? If not, block it, says Stewart, noting that it’s just one more way malware can infiltrate your network. If you do rely on IM, consider systems like Jabber (an open streaming XML alternative to consumer IM services) and set it for internal use only. Stewart also notes that popular voice over Internet protocol (VoIP) products, like Skype, are not immune. “Skype is an IM platform, not just VoIP,” he says. “The malware people know this.”

Set PCs to “limited user” where possible

Giving new-user workstations using Windows XP “limited user” privileges instead of “administrator” privileges (the default setting) for everyday tasks will help limit hackers’ ability to nefariously install malware, too. It will also help prevent employees from downloading “freeware” that could expose the office to still more computer diseases. If possible, reset other computers in the office, too, if it doesn’t interfere with existing applications.

Consider the Firefox browser

If your business can get by without Microsoft's Internet Explorer as your Web browser, make the switch to Mozilla's Firefox, says Stewart. Because Firefox isn’t as widely used, it’s safer: Web searches using Google off Internet Explorer are increasingly resulting in “driveby downloads,” malware that’s triggered when a user clicks on a seemingly legitimate Web link.

Not all businesses can stop using Internet Explorer -- certain business-to-business applications, for example, require its use. But companies can limit its use in favor of Firefox for many tasks. However, Stewart warns, as Firefox increases in popularity, its risk of becoming a malware target will increase, too.

While these tips won’t completely safeguard your network, they should eliminate many of the risks. But so long as hacking remains lucrative, Stewart notes, “there is no perfect solution.”

The Future of Business Data Storage

Andrea Peiro — 2007-05-09T13:35:58-05:00

While you drink your coffee and listen to the morning news tomorrow, try an experiment to see how important the data stored in your laptop is to your business. Instead of placing your laptop in your briefcase, as you would normally do, put it in a drawer, lock it, and leave it there for the rest of the day.

How well do you think you will be able to do run your business? Probably not as well.

In the same situation, most of us would probably not be able to professionally function at all, not because of the hardware locked in the drawer, but because of the impossibility to access the invaluable information stored in it: winning proposals, financial plans, emails from employees and customers alike, and -- hidden somewhere special -- sensitive data such as your frequent flyer account and credit card numbers.

Information rules our world, and digital data is the how most of the information we use today is organized and stored.

Locking the laptop in the drawer is an experiment that helps illustrate how that data is at the core of the professional lives of business owners and entrepreneurs. The collection of data we use every day to run our businesses composes our “business intelligence” and the importance of being able to find it and retrieve it is quickly increasing. Imagine a restaurant that cannot access its dinner reservation files for a month, or a furniture importer that cannot access its shipping documents for an entire container of goods, or an accountant that cannot retrieve its customers’ electronic tax files.

In order to maintain business continuity by ensuring ready access to data, here are a few suggestions on up and coming ways to address your data storage needs.

1. Outfit all your important PCs with RAID technology.

The most common way to store data today is on hard disk drives (HDDs). With capacities of over 750GB each, and quickly increasing thanks to a new technology called “perpendicular recording,” HDDs store huge amounts of data for a very low cost. HDDs, however, are still subject to possible failure, and in some cases retrieving data from a damaged hard disk is impossible. A technology known as Redundant Array of Inexpensive Disks (RAID) offers a good solution to the HDD reliability issues for critical data. RAID has been available for over 20 years but only recently it has become inexpensive enough to be used outside specialized applications. In its basic configuration, RAID allows a user to replicate, or “mirror” data over two regular HDDs in real time. If one fails, the other has a full copy of the data available for use. Most desktops can be easily outfitted with RAID technology and the first generation of laptops with built in RAID has recently made its debut on the market.

2. Extend your storage capacity with high-speed external drives and share critical information using simple network attached storage solutions.

Even with larger and larger storage disks inside our computers there never seems to be enough space to store everything we need for business. The simplest solution to expand your everyday data storage capacity is to add one or more external hard disk drives. USB 2 or Firewire connections allow for blazing data transfer speeds making this type of storage perfect for data that does not need to be accessed as frequently. Portable external drives reach up to 200GB in capacity in form factors that fit in a shirt pocket and often do not require external power supply. To protect the privacy of data stored in an external drive you should consider utilizing software that encrypts it and decrypts it on the fly when you need to retrieve it.

If your business needs to share data among multiple users, the newest generation of Network Attached Storage (NAS) devices -- external hard dives that can connect directly to a network -- have become affordable, simple to setup and use, allowing for multiple users to concurrently access them, in some cases even wirelessly.

3. For long term backup or data archiving consider recordable HD or Blu-Ray DVDs

As mentioned, HDDs are generally subject to possible failures due to wear and shocks, making them not ideal for long-term data archiving or long term backups. To simply archive data for long-term preservation, one great option is using writable DVDs. Sturdy, inexpensive, with a long shelf life, they can store 4.7GB for the single layer type or 8.5GB for the dual layer type. On the horizon, two new DVD standards that have reached the consumer market for high definition movies are just now becoming available as data storage devices within the next few months: HD DVD (15 GB single layer and 30 GB dual layer) and Blu-Ray DVD (25 GB single layer and 50 GB dual layer). Writable DVDs provide a reliable means to archive critical data, and these new standards offer the capacity that businesses require today.

Our electronic data is becoming the most relevant source of information for all types of business decisions. The capability of storing and retrieving data has become for most small businesses a “mission critical” task, the continuity of which must be assured. The higher the value of our business data, the more critical it becomes and the more attentive our choices on how to store it, protect it and access it need to be.

Andrea Peiro is president and CEO of the Small Business Technology Institute, a non-profit organization created to foster the adoption of information technologies among small businesses.