HBCU National Workshop

1. Disaster Recovery HBCU National Workshop June 24, 2011 Reggie Brinson Assoc. VP/Chief Information Officer Clark Atlanta University

2. A program which develops, exercises and maintains plans to enable the organization to: -respond to a disruption with minimum harm to life and resources; -recover, resume and restore functions within time frames which ensure continuing viability; and -provide crisis communications to all stakeholders. Note: the program and its outputs: are based upon risk evaluation and impact assessment; and require management support, staff training and coordination with external agencies. What Is Business Continuity Editorial Advisory Board DRJ & DRII Certification Commission

3. The technical aspect of business continuity. The collection of resources and activities to re-establish information technology services (including components such as infrastructure, telecommunications, systems, applications and data) at an alternate site following a disruption of IT services. Disaster recovery includes subsequent resumption and restoration of those operations at a more permanent site. What Is Disaster Recovery Editorial Advisory Board DRJ & DRII Certification Commission

4. Why Disaster Recovery? • If your University is like most, it is critically dependent on the data in your computer(s) • Financial data • Customer (student) records • Emails • Documents and spreadsheets • If you expect to be in business for the long haul, you need to protect that data by regularly backing it up. • Your backup and restore capability should consider both on-site and off-site capability for restoring systems

5. Why Disaster Recovery? • Don’t yet have a data backup plan in place? Consider the following sobering statistics: • 93% of companies that lost their data center for 10 days or more due to a disaster filed for bankruptcy within one year of the disaster. 50% of businesses that found themselves without data management for this same time period filed for bankruptcy immediately. (National Archives & Records Administration in Washington) • 94% of companies suffering from a catastrophic data loss do not survive. 43% never reopen and 51% close within two years. (University of Texas) • 30% of all businesses that have a major fire go out of business within a year and 70% fail within five years. (Home Office Computing Magazine) • 77% of those companies who do test their tape backups found back-up failures. (Boston Computing Network, Data Loss Statistics) • 96% of all business workstations are not being backed up. (Contingency Planning and Strategic Research Corporation) • 25% of all PC users suffer from data loss each year. (Gartner)

6. Why Disaster Recovery? • Advice from John Lawson, former CIO at Tulane University – “Think of the worse event you can imagine, then multiply it by a factor of TEN” • Northridge 1994 • Katrina 2005 • Xavier University • Dillard University • Tulane University • Virginia Tech 2007 • Iowa 2008 • Japan 2011 • Others?

7. Why Disaster Recovery?

8. Clark-Atlanta started it’s IT Disaster Recovery Initiative in FY 2008 with the final installment of the solution implemented in FY2012 with a stabilization period of a year to follow. The phased approach entails: • Business Impact Assessment – IT resource readiness assessment • Several areas found to be insufficient: • Data protection and management • Information Security Management • Disaster preparedness and recovery capabilities • Reviewing communications capability (email, telephone, website) • There is a need to continue to coordinate with business units to sync up Disaster Recovery with Business Continuity requirements • On-going program of – Plan, Act, Do, Assess Disaster Recovery Planning & Buildout

9. Data protection and management • Critical component of the process • Implemented Storage Area Network to consolidate majority of the University’s data on a single physical platform • Implemented Virtual technology to consolidate physical servers • Allows flexibility in terms of high availability failover • Allows ability to restore application quickly to another physical location than moving physical servers • 83% (50 of 60) of CAU’s servers are virtualized • As we architect and implement new systems we try to consistently drive to these standards • Have not overlooked local data on workstations Disaster Recovery Planning & Buildout

10. Information Security Management • Not every potential disaster is an “act of God” • Need to guard against cyber-attacks, both direct and indirect (viruses and “Denial of service”) • Implemented tools to help protect our network and data housed on our servers and workstations • Implemented monitoring tools to alert us of problems early, before they can become catastrophic • In the event of an “incident” or “disaster” will allow us to control what traffic can or can not traverse the network Disaster Recovery Planning & Buildout

11. Disaster preparedness and recovery capabilities • Previous notion of disaster recovery focused on a “cold site” solution • Pursuing implementing a “hot site” solution • Pre-position servers and alternative network solution • Not a “one-for-one” solution, but focused on critical applications, e.g., Banner, WebCT, Email • In a “recovery” scenario will facilitate access, but there will undoubtedly be some “degradation” in comparison to normal performance • Off-Site is better than On-site – looking at co-location arrangements • Key consideration – chose a co-location vendor with a national presence and multiple geographically dispersed locations • Initial solution – start locally to allow us the flexibility of hands on access for testing and ensuring proper functioning of solution Disaster Recovery Planning & Buildout

12. Questions? Disaster Recovery