Best Practices for Disaster Recovery Design and Implementation

1. Best Practices for Disaster Recovery Design and Implementation Damian Walch Senior Vice President, Professional Services Comdisco, Inc.

2. What We’ll Cover… • Learning from the response to events of 09-11-01 • Addressing immediate actions to be taken NOW! • Recovering the information flow • Testing the strategies and plans • Planning for an outage that can be catastrophic

3. While companies think they’re immune to any long-term outage, more that one-fourth of companies have experienced a disruption in the last 5 years, averaging eight hours, or one business day. Source: Comdisco Vulnerability index Warning Comdisco 528 Disasters Supported

4. Lesson Our Experience in the WTC Disaster • 94 disasters declared related to the event • 47 customers • All platforms – mainframe, distributed, network and workarea • Communications were very difficult • Companies didn’t have backup staff for recovery • Lack of “rally points” created more chaos and added time to recovery process • Mobile trailers can be essential for recovery

5. Best Practice At-Time-of-Disaster Solutions • Speed: Time to Deliver • Good Teams: Experience in Crisis • Measured Progress: Service Levels • Networks: Wireless • Innovation: Portal for Communication

6. Where to Find It Network of Vendors Mobile Star 972.994.4900 www.mobilestar.com CIT - Technology Rentals & Services (Formerly Newcourt Financial) 800.227.5069 www.citgroup.com Data Recovery Group 888.462.3299 www.datarecoverygroup.com GE Capital 800.243.222 www.gecapital.com Aggreko 318.367.7884 www.aggreko.com

7. Solution Communications Portal To do that, you must have a wealth of current intelligence about your resourcesand what's really happening in the field. The efficient and rapid allocation of resources is key to the quick restoration of critical services and networks.

8. Building Blocks Recovery Event Sequence Restore Infrastructure Restore Application Restore Data to RPO Lost Applications Data Restore Network Event Offsite Vital Records Immediate Response Resume Business Interim Site Return Home Synchronize Lost OS Data Recreate Lost Data Transactions Process Backlog Relocate Business Function Backlogged Transactions • Recovery Time Objective Time required to recover critical systems to a functional state, often assumed to be “back to normal” for those systems designated as mission critical. • Recovery Point Objective Point in time to which the information has been restored when the RTO has elapsed and is dependent upon what is available from an offsite data storage location.

9. Checklist What is required for recovery? • Strategy: Summary of below, documented. • Data: Applications identified, backed-up and taken offsite. • People: Knowledgeable staff that understands DR and critical images. • Place: Other locations identified with sufficient capacity and testable. • Network: Capacity, equipment and software to restore connectivity. • Procedures: Action-oriented recovery plans

10. Good Idea What to Include in Recovery Strategy? PC orComputerInterface RouterorISP Portal RouterorISP Portal End User Data StorageServices Network LAN Application / DatabaseServers

11. Issue Customer Data Center Customer Data Center Customer Data Center Comdisco Recovery Center Comdisco Recovery Center Comdisco Recovery Center Comdisco Recovery Center Today Customer Data Center Storage Area Networks Tomorrow How Do you Pick a Strategy? Yesterday

12. Decision Point Considerations for Advanced Recovery Solutions COST LOCALPERFORMANCEIMPACT FAULTRECOVERY IO RATE WIO RATE Each Customer has unique requirements RESYNCH IMPACT BANDWIDTH DISTANCE

13. Building Blocks Corporate Recovery Organization Crisis Management Business Recovery Teams Business Recovery Coordinator Critical Business Functions Only Information Technology Finance Office Infrastructure Support

14. How much space is available? When is the space available? How much outside parking? Does the parking lot have lights? How many entrances and are they secure? Is there security card access into the building? How many hours per year do the tenants experience electrical outages in this building? Is the security desk manned 24 x 7? Is the building connected to any of the SONET Fiber Ring? What network carriers are providing service in building? Are there telecom rooms on each floor, shared? Is there a generator in the building to provide power backup in the event of power failures? If so, is this available to tenants? Checklist Looking for Alternative Site?

15. Tip How to Make Plans More Usable • Don’t get into analysis – paralysis!!! • Plans should be brief • Nobody is going to use a plan that requires a binder • They need to be action oriented • You should be able to access or carry them • Small enough to carry in a briefcase • Utilize on a Personal Digital Assistant (PDA) • Access via the internet • Adaptable • Just like programming, you can’t “hard code” information • Give them guidelines and resources to address the situation

16. Tip Conduct Realistic Testing • Test at least once per year, but do it right! • Require involvement from the staff that will actually do the recovery…MAKE THEM AVAILABLE • Use backups sometimes, at least inform them… • Test the information flow • Storage, databases and backend systems • Infrastructure: including network, security and middleware • Include end-users, workstations and servers

17. Windows NT Backup & Recovery by John McMains Disaster Recovery Planning for Networks, Telecommunications and Data Communications by Regis J. Bates Oracle8i Backup & Recoveryby Rama Velpuri Disaster Recovery Planning and Resources for Records Managers and Librariansby Jacqueline Virando Blueprints for High Availability: Designing Resilient Distributed Systems by Evan Marcus www.globalcontinuity.com www.drj.com www.comdisco.com www.survive.com www.gartnergroup.com www.rothstein.com Resource Resources for More Information BOOKS WEB SITES

18. What is the state of recovery plans and are they comprehensive? Ask the CIO if you have backups completed regularly for critical data on major systems or workstations within the business units? Revisit physical protection, user authentication, access control, encryption, security management for networking and communications. Do you have a command center for the management team to discuss activities and communicate? Discuss possible contracts for replacement equipment or shipping of assets from technology vendors. How would our customers contact you in the event of an outage?  Have we redirected call traffic to an alternate number? Do all executives understand their altered role to be performed at time of disaster and their successor? How are critical non-electronic documents protected and where are they stored, or they taken off-site? Next Steps What Should Executives Ask?

19. The 7 Key Points to Take Home • Know how you will communicate with • Employees • Customers • Other Corporate Offices • Develop and post rally points • Develop a “portal” to communicate proactively • Follow the “wire” and know the information flow • Test with who will recover and use backups • Plans should be brief, adaptable and portable

20. Your Turn! Questions and Answers Damian N. Walch Senior Vice President, Professional Services Comdisco, Inc. 847.518.7756 dnwalch@comdisco.com