CDP – Buzz Vs Benefit

Ian Masters, UK sales and marketing director at Double-Take Software, discusses Continuous Data Protection (CDP) to separate the buzz from the benefits. For organisations focused on solving real-world problems, understanding the distinction will help them make the best choice to safeguard their electronic assets.

There is some uncertainty in the market over what defines CDP. The Storage Networking Industry Association (SNIA) defines CDP as “a methodology that continuously captures or tracks data modifications and stores changes independent of the primary data, enabling recovery from any point in the past. CDP systems can provide fine granularity of restorable objects to infinitely variable recovery points”.

The capabilities described by the SNIA definition of CDP are not trivial. They require a technology solution that stores all data changes as they happen and can arbitrarily return to infinite points in time to recover previous versions of data. This makes true CDP a very expensive proposition for customers. This expense may be difficult to justify when an organisation’s data isn’t perceived as sufficiently valuable and even where the value is recognised, most can’t afford these types of CDP solutions. In this sense, true true-CDP products are a solution to a problem that customers cannot afford to solve.

Companies are instead opting for near-CDP solutions or backup and recovery solutions that integrate CDP-like capabilities. While solutions based on the strictest definitions of CDP may eventually gain momentum in the market as the enabling technology comes down in price, the majority of businesses don't have a Recovery Point Objective (RPO) that requires, and justifies, this type of CDP. There is clearly a need for something that provides better recoverability than tape but is simple and affordable enough to deploy across the enterprise, not just on a few systems.

Another issue affecting take up of CDP is that it has traditionally taken a very narrow approach to business continuity. Solutions have mainly focused on file-level recovery and not application data like that created by Microsoft Exchange Server or Microsoft SQL Server. If the first line of defense in a disaster recovery solution is protecting the data, the second is undoubtedly protecting the application. Providing a real-time copy of the data and availability of the application associated with it, enables a Recovery Time Objective (RTO) significantly better than that provided by solutions like tape backup or CDP. CDP provides no provision for RTO and focuses solely on RPO, which is only half of the customer challenge.

While true-CDP solutions have not gained widespread traction, the promise of CDP, despite its problems, thrives. It does so in the form known as near-CDP. Many traditional backup vendors have differentiated themselves from their competitors by integrating CDP capabilities into existing solutions rather than attacking the concept head-on. These solutions provide many, but not infinite, points of recovery. This satisfies most customers’ RPO goals far more readily than relying on retrieval from tape-based solutions by providing snapshot copies of important data for recovery purposes.

Though near-CDP promises to be an easy way to augment the backup solutions that customers use today, it still doesn’t account for the complete recovery of a company’s business critical systems. To the end-user, recovery isn’t complete until they are able to resume their work where they left off. This means not only restoring a previous version of the data but also the operating systems and applications and all the other aspects that are required to give users access to that information. Double-Take Software believes the future of CDP lies in hybrid solutions that incorporate an overall recovery management strategy combining data replication and protection, application availability and point-in-time recovery.

Alternatives exist today that provide this unified approach to recovery. In these solutions, asynchronous file-based replication is combined with application availability and snapshot technologies to fulfill at least the spirit, if not the definition, of CDP. In terms of data protection, real-time replication provides for the continuous capture of changes to protected data and the storage of those changes separate from the production data. If needed, a company can recover to this real-time copy of the data in the event of a major disaster. Because these solutions are typically based on byte-level replication, including features such as compression and bandwidth throttling, they are more efficient at moving data across long distances when compared to the data movement technologies employed by purebred CDP solutions.

For recovery from unwanted changes such as those caused by human error, viruses, or corruption, disk-based snapshot capabilities allow rollback to multiple (albeit not infinite) copies of the protected data. Disk-based snapshots are usually difference-based (copy on write technology) and consume less storage space. Their periodic nature also further reduces storage requirements when compared to keeping infinitely accessible copies of data changes. A combination of data replication and disk-based snapshots ensure that the RPO goals for a company’s data can be met.

Where these solutions truly exceed the promise of CDP is their ability to ensure RTO goals as well as RPO goals. By continuously monitoring the availability of the production systems and failing over to a secondary system in the event of an outage, they provide an RTO of minutes rather than hours or days. Most true-CDP solutions today do not provide any high availability for the applications creating the data and instead leave recovery to the IT administrator who is most likely using a complex, manual, time consuming process.

Evaluating the Options
No solution is ‘one size fits all’. Each company’s business is unique so each business continuity recovery plan will be different. However, the high-level approach to business continuity planning is generally the same. The key to business continuity and recovery planning is to first understand the impact an outage, loss or major disaster would have on your ability to provide a product or service and then pick the right procedures and tools to minimise that impact.

The first recommendation we make is to assess and rank each of the business systems within your organisation and assign the appropriate level of protection to them. Not all systems require the same levels of protection; in fact, some may not need protection at all. Successful plans account for this and are able to restore systems defined as business-critical as rapidly as possible while making the most of limited resources. The challenge for most companies in prioritizing these systems and choosing the right solution is simply a matter of quantifying the value of the data the solutions protect and calculating the Return on Investment (ROI).

Summary
The reality of CDP is that it has not lived up to the buzz it generated. This is not because the promise of CDP isn’t appealing to customers but because CDP, as narrowly defined by industry organisations, was not permitted the opportunity to integrate with other data protection and recovery capabilities. A hybrid solution combines the best of CDP with the best of continuous data replication and application availability while keeping costs down. Successful vendors will continue to build CDP into their products where it is appropriate and successful IT organisations will learn to use the technology in a way that best addresses all of its recovery goals while staying within budget and without sacrificing capabilities.

Double-Take Software will be exhibiting at the Business Continuity Expo and Conference held at EXCEL Docklands from 2- 3rd April 2008 - the UK's definitive event for managing risk, resilience and recovery. This event will explore the solutions and best practice to ensure operational continuity and protect a company's interests before during and after an incident.
For further information visit www.businesscontinuityexpo.co.uk

BAA uses text messaging in emergencies

BAA Gatwick, like all major international airports and airlines, has a crisis management team on standby 24 hours a day. Every year, around 30 million passengers travel through Gatwick and the Crisis Team is on hand to ensure that any event with the potential to cause major disruption is kept to a minimum.

Until now the team were contacted via pagers, but as they all now have mobile phones the airport’s Contingency Planning Manager, Barry Owen, began looking for a way to communicate by text message instead. Esendex’s simple, reliable and cost-effective ‘desktop messenger’ service offered the solution.

It enables Gatwick’s Call Centre, which is responsible for contacting the Crisis Team, to send out a short message from a network computer to the mobile phones of various user group members simultaneously and within seconds. Barry Owen says:

"The pager service we were using offered us a text message facility but it didn’t allow recipients to text back - so in an emergency we’d have a group of people all trying to call one telephone number to confirm they’d received the message.

The team’s emergency response is regularly tested through training exercises - getting the communication right at the start is key. During the busy summer months we also made use of the new system to keep the team up-to-date on how the day-to-day airport operation was running and this proved invaluable"

Are You Getting Value from Your BIA?

James R. Mitchell, CBCP
Director, eBRP Solutions, Inc.

Cost vs. Benefit
The standard practice of conducting a Business Impact Analysis (BIA) to determine the basic recovery requirements (Mission Critical Processes, RTO’s, RPO’s, Critical Applications, Suppliers, and other Resources) is a vital phase of every Business Continuity Management program.

The BIA process can be long and difficult – no matter what data collection method is used. Is the return on your BIA investment (time, manpower and resources) offset by the value of the results?

If a BIA is a fundamental part of BCM, the underlying cost may simply be a necessary evil. But, when a BIA is a one-time ‘project’ – as in many organizations – is the cost realistically proportional to the value?

Some organizations conduct a BIA expecting to repeat the process at regular intervals. However, once the initial BIA is completed and the true cost known, such expectations are often abandoned.

Focus on change
Failure to update a BIA is a leading cause of Recovery Plan failure. Change is the only constant in business. A BCM program lacking up-to-date BIA data yields Plans that don’t reflect the organization’s true requirements.

Intending to update a BIA is easy; yet the update process often fails.

Consider the effort required to complete the original BIA: questionnaire preparation, distribution and collection; interviews to “normalize” the results, plus the cost of analysis and report generation.

Often, the original BIA process “project”, may take three to eight months. Significant business changes make the prospect of repeating that lengthy process daunting. Postponing the update may be rationalized. Like most things in life, postponing difficult tasks allows them to grow more unwieldy

To streamline the process, the updated BIA must focus on the changes – rather than repeat the entire process. It is likely that much of the information from the earlier BIA is still valid. The update process simply entails drilling down to which business processes have changed, and how those changes affect the original BIA results. Of course, the method used to conduct the earlier BIA will determine just how easy – or how difficult – the update process becomes.

In Information Technology, an updating process is generally ongoing (Change Management) because IT changes have a direct impact on daily operations. In business operations, changes occur regularly, but are seldom, if ever, documented. (To be fair, no matter how robust the IT program, not every organization consistently correlates its Change Management information with its DR Plan.)

The Whole is Greater than the sum of its Parts
Is it sufficient for individual business process “Owners” or function leaders to update their own critical resource requirements? Yes, if the update method allows for the capture of changes in enterprise-wide dependencies (on other processes, applications, etc.). But no effective update can be conducted in a vacuum; any change to critical dependencies or resources is likely to have a corresponding affect upon those dependent processes.

While it may be efficient for a process team to update its own BIA, only by collecting and integrating changes across the enterprise can the true impact of business changes emerge.

The Path of Least Resistance
Frequently, the cost of updating a BIA (in manpower and time) is perceived as unjustifiably high. Not updating a BIA may become an accepted risk. BCM management may opt to focus on BC/DR Plan updating (assuming most process owners understand the impacts of change and will modify their Plans appropriately) without revising the BIA. The more burdensome the BIA process, the higher the propensity not to repeat it.

Once made, such a decision often becomes institutionalized. Later, the failure to reflect fundamental changes in the organization’s structure may result in flawed Plans and a failed recovery. With luck, flaws show up in a test or exercise – not a real life incident.

What’s in your Toolbox?
Does your existing BIA format lend itself to manipulation? Or do you have to start from scratch? Do you use software that integrates BIA and Plan development?

Does the BIA format lend itself to the use of collaborative tools? Can business process owners gain access to the original BIA survey? Network- or Web-based collaborative tools reduce the pain of updating a BIA, while enabling monitoring and auditing of the process by the BCM leaders or planners.

Assess your options, and pick a BIA updating method that works best for your situation. It may not be free, it may be time-consuming, and it may not be painless. But it will pay dividends if you have a disruptive event.

An out-of-date BIA exponentially increases the chances of Plan failure. The BIA provides the core upon which an organization’s Plans depend. Without up-to-date BIA information, the validity of Plans should be questioned, and their successful execution must be suspect.

eBRP Solutions, Inc will be exhibiting at the Business Continuity Expo and Conference held at EXCEL Docklands from 2- 3rd April 2008 - the UK's definitive event for managing risk, resilience and recovery. This event will explore the solutions and best practice to ensure operational continuity and protect a company's interests before during and after an incident.
For further information visit www.businesscontinuityexpo.co.uk

NATIONAL AND INTERNATIONAL SECURITY – THE THREATS, THE RESPONSES, THE OPPORTUNITIES

Insights into US homeland security science and technology priorities, expert analysis of a range of threats from terrorism to pandemics, and examination of major security programmes in the UK and overseas are all features of the International Security & National Resilience (ISNR London) conference, which will be held at London’s Olympia from 3-5 December 2007. ISNR London incorporates the former APTS show.

DAY 1

Top US Department of Homeland Security official to give insights
Day One of ISNR London is designated the US Department of Homeland Security 2007 Science & Technology Stakeholders International Conference – the first ever initiative of its type to be staged in the UK. The S&T Directorate is the gateway to the US Department of Homeland Security for private sector and academic solutions providers and this event will provide a unique opportunity for conference delegates from the UK and other European countries to meet with senior DHS leaders.

The Honourable Jay M Cohen, the Department’s Under Secretary, Science & Technology, will lead the plenary level insights into how the DHS S&T Directorate is employing science and technology to enhance security and safety. Participants will include the S&T Directors of Transition, Research and Innovation.

DAYS 2 AND 3

Highlights include:

Matching capability with threats
The plenary session will be led by Admiral Sir Alan West, Parliamentary Under-Secretary of State for Security and Counter-terrorism; Dr Paul Weissenberg, Director, Aerospace, GMES, Security and Defence, Enterprise and Industry Directorate General, EU Commission and the Honourable Jay Cohen. Three of the world’s most senior government representatives will discuss how new strategies and technologies are being adopted to enhance security on a national and international level.

Terrorist attack scenarios
The key issues concerning critical infrastructure protection will be put under the microscope by leading experts. Global and generic threats, including terrorism and pandemics, will be examined, and insights provided into UK and wider European CIP policy. A significant new feature for a conference of this type is two table-top exercise scenarios on defeating the terrorist threat to CIP. The subjects are an attack on a major event and a city centre.

Illegal migration threat
E-borders is a key component of UK Government’s border transformation programme and central to its strategy for immigration and asylum. The conference stream on integrated border management will feature a session examining the major milestones of this multi-billion pound programme. There will also be analysis of the security consequences of illegal migration, a factor which is changing the social, economic and political landscapes of communities on a global basis.

The challenge of Al Qaeda
Internal security, policing and intelligence are high on virtually every government’s agenda. The challenges addressed in this stream include changing Al Qaeda operational patterns in Europe, the recruitment of terrorists via the web and the impact of global insecurity on the UK. Also examined is the role that the media can play in the event of a major crisis and how it can be used more effectively to disrupt a threat.

NATO – an opportunity
The role of the NATO Technology Development Programme is to identify national capability gaps and achieve common approaches to technology requirements. A dedicated session will highlight the requirement gaps in the NATO programme and how they can be exploited by potential suppliers.

For further information please contact Victoria Bailey or Nick Johnstone at CMS Strategic on Tel: +44 (0)20 8748 9797 or email: info@cmsstrategic.com

For more information about ISNR London please visit: www.isnrlondon.com or contact Richard Clarke, Event Director, Tel: +44 (0) 208 910 7142 or email: richard.clarke@reedexpo.co.uk

Pedalite Pedals – We are on Again

& so are new pedals...

Having reported to you in the pages of this journal the other day, that is to say on Tuesday, November 20, 2007, the failure of one of the Pedalite Pedals of my review set and my assumption that water might have been the culprit I would like to update you on what it happening.

Firstly, it seems that it is some sort of mechanical problem rather than water and something in fact appears to have come adrift inside the pedal affected. More details on that as soon as I get the information back from the good folks at Pedalite International who now have the set of old pedals to carry out investigations up them.

I now have a brand new set of pedals on my bike and, as before, I am thrilled with the powerful flashes of light from the LEDs in the pedals. I feel so much safer riding my bicycle in the dark, and often for me this is a must; the riding of it in the dark, that is.

The nice folks from Pedalite International in fact came personally, but then I do not live a million miles away from their offices, to change the pedals on the night of Wednesday, November 21, 2007, so that investigation into the failure of the pedal could begin the next day. Now that is what I call customer relation management.

There is a chance that the set that I was given on the Cycle 2007 Show was in fact a “Pre-Production Model” and now a proper production run of the pedals and the failure could be due to that fact. We shall find out in due course I hope and think.

I have to say that I am very happy that the last report and verdict on the Pedalite Pedals is not going to be the final one as I am, in general, very fond of those pedals. We all hope that this is but a freak incident and all will be well in the end. As Simon Theobald, the Managing Director of Pedalite International, said to me on the phone, Murphy and Sod are alive and well and their law often still has bearing on things.

I doubt that there is anything out there on the market that gives the same visible protection to the cyclist as do those pedals and they are an “always on” system, with no batteries to worry about and no chance of forgetting to turning them on.

I shall keep you updated as to the outcome of the investigation and as to the further riding experience of mine with the Pedalites.

© M Smith (Veshengro), November 2007

Pedalite Pedals – The Final Verdict?

Further to my previous article about the Pedalite Pedals here is the final? – I think – verdict on them, and it is not as good as previously thought.

After having now used the Pedalite Pedals for less a month I must say that my first impression of “Wow! I am bowled over” has rather changed.

This is due to the fact that one of the pedals, the right side one has, probably due to the amount of rain and associated mud we have had in the last couple of days, basically, ceased working, as regards to the lights. The white diode only now works – as a stationary light and non-flashing – when the pedals are actually in motion – and that only, it would appear, as and when it feels like it – and the other two diodes, the amber and the red are no longer working at all. The strobe effect is gone and there is no longer any energy left after the pedalling has stopped while the left side one, so far, is working still as well as before.

I must say that had this not been a review sample and had I actually paid good money in the form of £34.95 for it I would not only be rather disappointed but in actual fact would be demanding my money back

That these pedals, or at least one of them, should have ceased working after only such a short period of time is not a good omen.

Therefore I have to say, in all honesty now, that I have to withdraw all my previous good reviews of the Pedalite pedals, as I owe it to my integrity and especially to my readers to speak the truth.

I can therefore no longer recommend Pedalite pedals. Improvements certainly will have to be made by the manufacturer in that moisture, rain, etc. do not adversely affect the electronics and other workings of those pedals.

Considering, as said, that the pedals have only been in use with me for about a month – they were fitted on October 17, 2007 and it is November 20, 2007 at time of writing – I must now give this product a definite and absolute thumbs down.

At the retail price of £35 those pedals should be entirely moisture proof – for I can only explain the failure to the fact that I have had to cycle thru water in the recent day or so – and should not be failing like the review set that I was supplied with did.

If it is a water-related failure of the pedals then I can only say that this is not a good sign and this product falls into the same category as the “Bikehut” three-LED front-lamp that failed on me in less that 5 months due to water having gotten into the workings and shortened out the LED chip and leaching out the acid of the batteries. I was told in that instance – that light I had actually purchased and it was no review sample – that the light must be kept out of direct rain by both the retailer and manufacturer's agents. Sorry? Pardon? Do they really expect anyone NOT to use the lights on the cycles in the rain? They cannot be serious, to paraphrase a certain tennis player.

© M V Smith, November 2007

The Finger on the Trigger

Time and time again when I see armed police officers, particularly in the UK and here especially those patrolling airports with Heckler & Koch MP 5's, for instance, slung across their chests, and the new G36 Heckler & Koch military assault rifle that, too, is being carried, having their fingers, literally, on the trigger with the weapon's safety, as it would appear in many cases, if not indeed most, in the “off” position, that is to say, ready to fire.

While this is, due to the heightened terrorist threat, understandable so as, as it seems they seem to think, to be able to respond to any perceived threat immediately, it is, nevertheless, an accident waiting to happen.

There is never, and I repeat this, NEVER, and I do speak here from experience, the need to ever have the finger on the trigger of a readied firearm while patrolling – Never! The finger belongs onto the trigger guard in front of the trigger but not, ever, on the trigger in such situations. There is enough time to move from trigger guard to trigger as and when needed.

While I am aware of the fact that this may delay the actual firing of the gun by a jiffy, and I do mean hear jiffy as to actual unit of time, which it is, it prevents the accidental and uncontrolled discharge of a gun due to a jitter from a perceived threat or such.

Even in a raid situation on a property and/or person/persons the finger still belongs onto the trigger guard just in front of the trigger and not actually touching the trigger or hovering about in the trigger guard just in front of the trigger. Only if and when the target has been positively identified and acquired does the trigger finger ever head for the trigger proper. No ifs or buts.

It actually surprise me that nothing has gone wrong so far in this and no serious accidental discharges have actually occurred.

The shooting of the Brazilian electrician incorrectly identified as a terrorist suspect and probable suicide bomber about to detonate and IED is not something that I am aiming at here (pardon the pun about aiming), as it has nothing to do with control of a weapon in the way we are discussing here. That is a different matter and does not stand to discussion here. And I have just added this as a king of a disclaimer.

However, accidental discharges like the one that his the news many years back when a small boy way shot by an officer during a raid on a house. The officer carried a .38 revolver with the hammer cocked and the finger on the then basically hair trigger of said revolver. The child under the blanket stirred, the officer perceived a non-existent threat and whether actually inadvertently, in a shock reaction touched the trigger setting off the round that killed the child simply because his finger as too close to the trigger, or because he thought it was a threat to be eliminated, though he did not actually see a proper target, and therefore fired, we do not know. The result, however, is one dead innocent child; the victim of bad firearms practice.

We all know that cock ups can and will happen; such is Murphy's Law, but good practice can reduce that risk, though it may never be able to totally nullify it.

And, to reiterate yet again, the best practice is: finger resting on the trigger guard not by or on the trigger itself, thus accidents can be avoided.

© M V Smith, 2007