DR-as-a-Service: Compliant DR Protection for the Mid-Market

There is no shortage of stories in the IT press about the effects of disasters, like 9/11 or Hurricane Sandy, where buildings are destroyed, data centers flooded, etc. While these are sensational events, for sure, they’re not the types of disasters that are most likely to affect a typical company. Far less dramatic things happen every day that can still have disastrous consequences for the companies that aren’t prepared with an effective (and appropriate) DR plan.

What constitutes a disaster?

A disaster could be defined as any event that creates a downtime scenario for a business’s critical applications, whether that’s one application on a single server or a virtualization cluster that’s running the company’s entire production environment. This can be a software bug, an upgrade that conflicts with another application, corruption that occurs to a critical piece of data or human error. Downtime can also be caused by a hardware failure (power supplies, NICs, disk drives, etc.) or a facilities problem where power goes out and the UPS isn’t up to the task.

It’s not the fall that kills you

Whether this turns out to be a disaster or just another short-lived flashing light in the day-to-day operation of a data center is determined by how the problem is handled. As they say, “it’s not the fall that kills you, it’s the sudden stop at the end”. It isn’t the outage that defines the disaster, it’s the time required to bring applications back into production.

The cost of a disaster depends on a lot of things but it’s true that most downtime events don’t put the company out of business. Losing a critical server isn’t always a death sentence, but it does usually mean losing money, losing customers, losing productivity, etc.

Cost of a downtime

For some companies downtime means lost revenue. But a more common occurrence is lost productivity because employees can’t log on to applications, lost customers because the support system went down or lost opportunities because financial information wasn’t available to make timely business decisions. Given these very tangible costs most companies take steps to reduce their exposure to the risks of downtime. These are collectively referred to as “disaster recovery (DR) solutions”.

Is the fix appropriate for the problem?

The notion of a DR solution can mean something extremely complex and expensive, such as replicated data centers and redundant infrastructures. These may be fine for Wall St. but totally inappropriate for Main St. as they can cost more than the business they’re designed to protect. As outlined above, small to medium sized business have very real DR needs but unfortunately, there has typically been a shortage of appealing options.

Data recovery

Backup (and more accurately, the restore) is often the most common DR method employed by small or medium-sized business, even some that could be called “enterprises”. But it’s not about getting the data back, it’s about the getting the application back UP and simply restoring data is only part of that process.

Another DR alternative

A recovery appliance is a dedicated virtual server host that runs on site and maintains an active clone of critical application VMs, ready to run when the primary server goes down. When that happens IT can restart applications on the recovery appliance and fail-over users to it. Then they can be failed back when the primary servers have been fully restored.

By supporting multiple VMs, one recovery appliance can provide DR protection for many production applications and near-instantaneous recovery when downtime actually does occur. Some of these solutions, like Quorum’s onQ appliance, also provide physical-to-virtual conversion, creating a VM image from the first backup taken of a stand-alone server, enabling legacy ‘bare-metal’ servers to be protected as well.

DR Testing

Since disaster recovery is a form of insurance (“uptime insurance”), users should be able to check that it’s in force. With a recovery appliance testing can be a ‘one-button process’ that’s totally transparent since it’s a clone of the production VM or application. This gives management the confidence of knowing their ‘uptime insurance’ is in force prompting IT to run tests on a regular basis, or whenever there are changes in the environment. This is a far cry from the traditional DR process that was often so time consuming that testing was avoided at all costs.

Hybrid-cloud DR

These recovery appliances can be connected to the cloud and manage the transfer of VM images to the cloud data center, while maintaining the ability to restart VMs locally. This creates a hybrid-cloud DR solution that preserves the primary benefits of the recovery appliance concept while adding the ability to restart VMs in the cloud. With it users can get their data off-site but still have near real-time application restart, DR testing and high availability that aren’t available from cloud-only solutions.

DR as a Service

This hybrid-cloud DR solution can also be offered as a service, with companies paying a monthly subscription charge instead of buying the hybrid appliance outright. For many organizations this makes the DR solution even more accessible, since it doesn’t require an upfront purchase. Quorum, as an example, offers a DR-as-a-Service (DRaaS) solution that leverages their hybrid DR appliance and SSAE/SOC-certified data centers to house the DR cloud. But unlike other cloud-based data protection services it provides all the on-site capabilities of the onQ HA appliance as well. It also addresses another issue that many companies have, regulatory compliance.

Compliance

Many companies have to prove their production workflows are compliant to industry standards and their DR flow needs to be no less compliant. For companies that are in the business of handling credit card transactions, such as banks, educational institutions and retail establishments, PCI (Payment Card Industry) compliance is part of their IT environment, including their DR solution. The same is true in healthcare when it comes to HIPAA compliance.

But it’s not just a ‘checkbox’. True compliance in a DR context means that a certification organization audits the data handling and data protection processes employed and assures that compliance is maintained throughout.

Many companies that are looking at DR appliances and DR cloud services don’t have the IT staff or experience (or the budget) to implement complex DR solutions. There are certainly ways to protect data and bring critical applications back up after an event and a turnkey solution like DRaaS is ideal, but if it doesn’t meet their required compliance regulations, it’s not a viable option for these companies.

Summary

In the broadest sense, a disaster is any event that causes unplanned downtime for critical business applications; it doesn’t have to involve severe weather or acts of terrorism. In fact most of these events are much less dramatic, but still very costly. A disaster recovery solution must bring these applications back online and make them available to users and other programs that rely on them in an appropriate timeframe.

Hybrid-cloud recovery appliances offer an effective DR solution for mid-market companies that don’t need (and can’t justify) many of the complex and expensive solutions that the largest enterprises deploy. By hosting currently updated VM images of multiple servers, these on-site appliances can provide nearly instant failover for a company’s most critical applications and automatically replicate them to the cloud for off-site protection. DR-as-a-Service is a new offering whereby cloud providers install a recovery appliance on premises and fold its cost into the monthly cloud service charge.

Quorum is a client of Storage Switzerland

Click Here To Sign Up For Our Newsletter

About Eric Slack

Eric is an Analyst with Storage Switzerland and has over 25 years experience in high-technology industries. He’s held technical, management and marketing positions in the computer storage, instrumentation, digital imaging and test equipment fields. He has spent the past 15 years in the data storage field, with storage hardware manufacturers and as a national storage integrator, designing and implementing open systems storage solutions for companies in the Western United States.  Eric earned degrees in electrical/computer engineering from the University of Colorado and marketing from California State University, Humboldt.  He and his wife live in Colorado and have twins in college.