Tape is not dead!

For several years I have been chagrined by the various proclamations from industry experts that “Tape is dead”. These reports (many of which are published by vendors that do not offer a tape product) extol the virtues of using disk as a replacement for tape, but ignore the operational benefits and cost savings that tape provides in the enterprise IT environment.

These benefits become more apparent as the quantity of data and the size of the enterprise grows. At some point, it becomes evident that keeping all copies of all data on spinning disk storage is simply unsupportable – both operationally and financially.

Even so, the many myths regarding the demise of tape have been perpetuated over the years. Therefore I was very pleased to see an article debunking some of these myths appear in the June/July 2008 issue of Z/Journal.

This article, “Mainframe Tape Technology: Myths and Realities”
(By Stephen Kochishan and John Hill) discuss several of these popular myths and then describe both the reality and best practice that aptly describe the issue. This article should be an interesting read for the enterprise storage professional.

ATT Study confirms DRJ and Forrester results

The following study announcements were found clogging my inbox on Friday...

Survey finds most businesses prepared for disasters Bizjournals.com - Charlotte, NC, USA The survey found that 77 percent of Seattle and Portland executives indicate their companies have a business continuity plan.

AT&T 2008 Business Continuity Study Continuity Central (press release) - Huddersfield, UK AT&T has published the results of its latest annual survey of business continuity practices in US organizations. The 2008 survey is the seventh such survey...

AT&T Study: One in Five US Businesses Does Not Have a Business ...Converge Network Digest - USA For the seventh consecutive year, AT&T's Business Continuity Study surveyed IT executives from companies throughout the United States that have at least $25...

Reading just these excerpts, it took me a moment or two before I realized that they were all describing the same AT&T study.

These particular reports are a little light as far as presenting the specific results from the AT&T survey, but still very timely considering the topic of my last post. The consensus of these interpretations of this AT&T study seems to be that 80% of companies have a Business Continuity plan. 59% of the respondents have updated their plan within the last 12 months, but fewer (46 percent) have had the plans fully tested during the same time period.

Using these numbers in place of the percentages from the DRJ/Forrester study referenced in the previous post, we end up with a set of calculations that look something like this:

80% of the companies have a Business Continuity Plan.
59% of the companies update their plan at least once a year. This means that (.80 * .59 = 47%) 47% of the companies have a plan that is updated at least once a year.
46% of the companies actually test their recovery plans at least once a year. This indicates that (.46 * .47 = 22%) 22% of the companies have a plan, update and test it at least once a year.

This result isn't too bad, I guess, but it doesn't incorporate the result from the Gartner study that only 28% of the planned tests actually are successful and meet all of their objectives. If we apply this calculation to the results of the AT&T study, we find that:

(.28 * .22 = 6%) Only six percent of the surveyed companies can be expected to have successful Business Continuity exercises that meet all of their business requirements.

This is discouraging news indeed.

Are we prepared?

I attended a Disaster Recovery seminar last week aimed at building a better disaster recovery plan. Some of the statistics presented sparked my interest but rather than taking the presentation at face value, I thought that some additional discussion and analysis about some of these findings would be useful.

It is fortunate that I did take a closer look as some of the statistics that were presented as fact did not bear up to close scrutiny. In fact, upon verifying the presenters’ source information it became apparent that one of the statistics I had chosen as the starting point for my analysis had been misinterpreted and used out of context of the original source document.

However, I was still interested in where this information might have led with the proper analysis, so I discarded the seminar materials and went looking for similar – but more accurate and verifiable data that that could stand up to analysis.

These are the results.

The current state of DR/BC

79%The percentage of enterprises that report having a formal and documented recovery plan in place. [Source: DRJ/Forrester article] This is a very strong showing and represents the significant progress that the industry as a whole has achieved. While no one can argue that the percentage should be anything less than 100%, 19% of the respondents indicated that they expect to have a plan in place within the next 6-12 months, leaving only 2% of the respondents with no plan whatsoever

81% Of those with a DR plan, 81% responded that their plans are updated at least once a year. 26% of the respondents indicated that their plans are updated in an ongoing fashion as part of the change and configuration management processes. Kudos to these folks! 14% update their plans quarterly, 18% update their plans twice a year, and 23% update their plans once a year. [Source: DRJ/Forrester article]

82%
82% of those that responded perform a full exercise of their disaster recovery plans at least once a year. 50% test once a year, 22% test twice a year while 10% test more than twice a year. [Source: DRJ/Forrester article]

At this point, the numbers look really encouraging. As a DR/BC professional myself I can look at these numbers and say “Wow! 80% is really good. We’re doing a great job!” On a personal level, this causes warm and fuzzy feelings as my GQ (Goodness Quotient) is set to 80.

However…

Simple numbers, such as these, can be deceiving. In fact, much better business decisions can be made if additional understanding and analysis of the overall results can be achieved.

First of all, even though each of the numbers presented so far are very close to 80%, it is important to realize that each additional statistic represents but a portion of the prior sample: There is a subsequent reduction in the effective end-product success at each iteration.

In other words, the numbers should be understood in this context:

79 out of 100 enterprises have a disaster recovery plan. (GQ=79)

81% of the enterprises with a plan update them at least once a year: 100*.79 = 79 * .81 = 64 (GQ = 64)

82% actually test their recovery plans at least once a year: 100*.79 = 79 * .81 = 64 * .82= 52% (GQ = 52)

Hmmm. So this means that only about 52% of all enterprises actually have a DR plan, update it and test it at least once a year. While that doesn’t make me as warm and fuzzy as the 80% number did, it’s still pretty good, right?

Well, maybe not. While this still appears to be a relatively positive indication, it doesn’t yet include any indication of how many of these DR plans are successful and actually meet or exceed the client requirements.

In order to proceed with this next analytical step, it is necessary to reference the results of an additional study, this one – a recent Gartner study that found: “Twenty-eight percent of organizations reported that their last disaster recovery exercise went well and met all their service targets. However, 61 percent of survey participants reported that they had problems with the exercise.” So,

28%“Twenty-eight percent of organizations reported that their last disaster recovery exercise went well and met all their service targets. So, a 28% “success” rate. [Source: Gartner article]

However, we must remember that this percentage only applies to those that actually have a plan and update and test their plan. So in reality, this is a 28% success rate of only 52% of the total. (52% * .28 = 15%)

The complete breakdown of this analysis is shown graphically here:

This indicates that only 15% of the total companies will actually recovery from a disaster as they have planned. In other words, 85% of all companies will either fail following a disaster or will experience difficulties that will cause them to exceed either their RTO or RPO or both.

It would make a great - although completely irresponsible - headline if we were to state that "85% of all organizations will fail following a disaster". Tempting to some perhaps, but no.

To do so would totally ignore the 61% (as reported by Gartner) who reported that they had "some problems with their last exercise". Since we do not have the detailed information regarding this statistic, we cannot
ascertain the severity or number of the problems they encountered. It is, however safe to assume that many of these problems have been corrected and that a portion of these enterprises will enjoy greater success the next time they exercise their DR validation program.

The areas of Disaster Recovery and Business Continuity are ones that capitalize on the benefits of a Continual Service Improvement methodology. Maintaining the plan and keeping it current and validating the plan via frequent test executions are two of the cornerstones necessary for a compliant and Resilient enterprise.

Source Information
Website: Disaster Recovery Journal, "The State Of DR Preparedness", http://www.drj.com/index.php?option=com_content&task=view&id=794&Itemid=159&ed=10, with references from the Forrester/Disaster Recovery Journal October 2007 Global disaster Preparedness Online Survey, verified 06/01/2008

Website: Gartner, "Gartner Says Most Organizations Are Not Prepared For a Business Outage Lasting Longer Than Seven Days", http://www.gartner.com/it/page.jsp?id=579708, verified 06/01/2008

Simple Storage Cost Model (Part 2)

One of the most obvious omissions of the previous cost model is anything that would account for the costs associated with providing a DR/BC (disaster recovery / business continuity) environment for the data. After all, if the data is important enough to your business under normal conditions then chances are it will still be required following a disaster.

Costing Storage for DR/BC

The DR/BC components to be included in the costing model will vary wildly from enterprise to enterprise depending on the specific installation choices and recovery methodologies supported. As the recovery environment becomes more complex, more costs must be accounted for in the cost model.

In designing a fully mirrored operating environment with complete data replication, at first one might assume that a simple doubling of the costs associated with the primary site might be close enough. In rare cases this might be true, but this assumption should not be accepted by IT management unless it can be verified by a much more in-depth cost analysis.
Some of the differences that must be considered are:

Acquisition costs (CapEx):

• Storage costs: The secondary storage may be a different device type with different features, performance and cost characteristics.
• Network Equipment: Additional equipment such as channel extenders, routers, switches, etc. may be required.

Operational costs (OpEx):

• Support personnel costs: May be less than double due to economies of scale and less day-to-day management required of the recovery environment.
• Maintenance (warranty) costs for the equipment: Will probably be different based on the secondary device configuration.
• Environmental (power and cooling) costs: May be reduced at the secondary site by having redundant environmental systems in standby instead of active mode.
• Network costs: Additional monthly costs to provide the bandwidth necessary to support data replication.

Given these considerations, it is safe to assume that not only will the ratio of CapEx to OpEx expense be different but also that a simple doubling of the primary site costs would not be appropriate.

Updating the model

Again, for the purposes of illustration only, let us make-up some numbers to insert into our expanded cost model. We will utilize the following assumptions as the basis for our additional entries:
Acquisition costs (CapEx):

• The secondary storage can be acquired at 1.2 times the primary storage


• The necessary network equipment will be acquired at a one-time cost of $250,000

Operational costs (OpEx):

• The additional support personnel costs are estimated at an additional 40%
• The maintenance costs assigned to the secondary storage is estimated at 80% of the primary unit
• Secondary environmental costs are estimated at 60% of the primary site
• The additional expense for network bandwidth is estimated to be $25k/month
• The hardware maintenance expense associated with the additional network equipment is estimated to be $27,500 per year

Using these assumptions, the revised cost model is shown here:

Storage Cost Model
Acquisition Costs
Purchase 1 800TB Disk Unit		$1,100,000
Less any discounts or credits		$0
Purchase secondary storage (1.2* primary cost)		$1,320,000
Less any discounts or credits		$0
Purchase network equipment		$250,000
Less any discounts or credits		$0
Total Acquisition Costs			$2,670,000
Operational Costs	Per Year	Term 5 years
Primary Site
Support Personnel	$91,000	$455,000
Maintenance (EXCLUDING first year)	$77,285	$309,140
Environmental	$51,300	$256,500
Secondary Site
Support Personnel	$36,400	$182,000
Maintenance (EXCLUDING first year)	$61,828	$247,312
Environmental	$30,780	$153,900
Network
Circuit (Bandwidth) Expense	$300,000	$1,500,000
Equipment Maintenance (EXCLUDING first year)	$27,500	$110,000
Total Operational Costs			$3,213,852
Total Cost			$5,883,852
Cost per TB			$7,354.82
Cost/TB/Month			$122.58

Obviously, in this more complete cost model, the price per TB has gone up due the to additional hardware and network costs that are incurred for this particular DR/BC option. (Please remember that the specific costs shown are for illustrative purposes only and should not be used for any purpose other than to demonstrate the components of the cost model).

Once you have determined the appropriate numbers for your environment, it will be useful to compute the cost ratio between the non-mirrored storage and the fully mirrored and recoverable storage. This will allow you to provide two simple planning numbers to your data owners and application designers. The first is the Cost/TB/Month of the un-mirrored (and presumably unrecoverable) storage while the second number represents the monthly cost for the fully mirrored and automatically recovered storage. Once this process (and the associated costs) have been socialized throughout your enterprise, the business owners can determine early on what level of support they are willing to fund for their data.

The spreadsheet that was used in creating this sample cost model is available by visiting the Recovery Specialties website.

Simple Storage Cost Model (Part 1)

In the previous missive I described a means of assigning value to business data. In this post I will continue the discussion and show how to determine the storage costs associated with providing business data.

The cost of providing business data

The means by which IT organizations determine and assign costs are as varied as the organizations themselves. Some organizations may not have implemented any chargeback methodology or may use only hard dollar accounting costs. However, in order to gauge the true cost of data, the operational costs should be included as well.

Accounting costs

Acquisition costs (CapEx): The capital or acquisition costs are the easiest to calculate as you begin with a simple bottom-line number. In order to determine the true costs, however, it is important to understand that the capital acquisition costs typically represent less than half of the actual cost of acquiring and operating equipment.

Operational costs (OpEx): There are many operational costs that can be associated with a cost model. For the purposes of an IT cost model, at least three operational costs should be considered:

• Support personnel costs
• Maintenance (warranty) costs for the equipment
• Environmental (power and cooling) costs

Some IT environments will also include depreciation and floorspace costs to the calculation, while others may need to include specific taxes, insurance fees, or other costs specific to the enterprise.

Creating a cost model

Once you determine the components that you will include in the cost model, it is simple enough to enter these values into a spreadsheet to calculate the costs. The spreadsheet should capture the agreed upon major aspects, which include the capital and operational costs, including personnel, maintenance, and power and cooling. A typical operational time frame may be picked, such as three years to five years (depending upon the accounting practices currently in place within the enterprise).

Provided below is a very simple cost model demonstrating the costs associated with a single 800 TB disk storage unit over a five-year term. (Note: The specific costs shown are completely arbitrary and are supplied only for illustrative purposes).

Storage Cost Model
Acquisition Costs
Purchase 1 800TB Disk Unit		$1,100,000
Less any discounts or credits		$0
Total Acquisition Costs			$1,100,000
Operational Costs	Per Year	Term 5 years
Support Personnel	$91,000	$455,000
Maintenance (EXCLUDING first year)	$77,285	$309,140
Environmental	$51,300	$256,500
Total Operational Costs			$1,020,640
Total Cost			$2,120,640
Cost per TB			$2,650.80
Cost/TB/Month			$44.18

Although this model is still quite simple, I favor it as the starting point for determining actual storage costs. In particular, I am an advocate of being able to provide a “Cost per TB per Month” figure that can be referenced as IT clients request additional storage for new projects and systems.

The sample spreadsheet that was used in this example is available from Recovery Specialties.

Data Classification - Revisited

In an earlier post (see Simple data classification for Business Continuity) I described a simple means of beginning to classify the value of data for Business Continuity. I’d like to expand on that topic and perhaps approach the subject from a slightly different perspective.

The value of business data

When speaking of the value of business data, the one universal constant is “it depends”. All data is “important” to the business owner – otherwise it wouldn’t have been created in the first place, right?

But looking at the question from the terms of the “business”, the true value to the organization of any particular piece of data lies in how that data is accessed, not in any innate value placed on it by the data’s creator. In fact, the importance of data varies significantly among industries, even by application and perhaps time of day within any particular firm.

Just as the true value of data will vary in nearly every case, the process of assigning a value to the data will be different from enterprise to enterprise. Take for example, the case of a large web based retailer. In this environment, the cost of an hours’ outage might be estimated as:

Estimated Cost of Outage $'s per hour		First	Second	Third	Fourth	Fifth
(hard dollars)	Loss of Sales	X	X	X	X	X
(soft dollars)	Customer Satisfaction	Z	Z+10%	Z+15%	Z+20%	Z+25%

In this example, the retailer has determined that the cost of lost sales remains constant while the soft dollar loss relating to customer satisfaction (and future customer visits) gradually increases with the duration of the outage.
Although this is a simplistic case, it does illustrate a starting point that can be used and built upon in support of different industries and or clients. Take, for example, an enterprise in the banking or services industry. A chart such as follows might be used to quantify the cost of an outage:

Estimated Cost of Outage $'s per hour		First	Second	Third	Fourth	Fifth
(hard dollars)	Loss of Fees	X	X	X	X	X
	Loss of Float	Y	Y	Y	Y	Y
(soft dollars)	Customer Satisfaction	Z	Z+10%	Z+15%	Z+20%	Z+25%

In either case, once you have the anticipated costs assigned to components of both the “hard” and “soft” dollar categories, the value of the data to the business is represented by the sum of the individual columns
Performing this type of exercise is an important step in gaining management concurrence and understanding of the true business value of the various data components. It is also the basis of generating sustainable Service Level Agreements (SLA) as well as Recovery Time and Recovery Point Objectives (RTO and RPO).

Arthur C. Clarke Dead at 90

Arthur C. Clarke, the science fiction writer, technology visionary and Business Resiliency Futurist died last week in Sri Lanka. Sir Arthur C. Clark was 90 and the last surviving member of the “Big Three” science fiction writers (along with Robert A. Heinlein and Isaac Asimov).

During his lifetime, he authored over 100 books and thousands of technical papers, was nominated for a Nobel Prize and predicted the existence of artificial satellites in geosynchronous orbit – Also known as the “Clarke Orbit” – and that man would land on the moon by 1970.

It was in 1945 when “Wireless World”, a UK periodical, published Clarke’s technical paper "Extra-terrestrial Relays" in which he first set out the principles of satellite communication with satellites in geostationary orbits – an idea that was finally implemented 25 years later. He was paid £15 for the article.

Having grown up with Clarkes works, I cannot say that I have a favorite. I believe that his most popular works were those books of the 2001 series. beginning with 2001: A Space Odyssey in 1968.

Interestingly enough, though, I am partial to the Rendezvous with Rama series, the first book of which was published in 1972. The following is copied from the Wikipedia:

“Rendezvous with Rama is a novel by Arthur C. Clarke first published in 1972. Set in the 22nd century, the story involves a thirty-mile-long cylindrical alien starship that passes through Earth's solar system. The story is told from the point of view of a group of human explorers, who intercept the ship in an attempt to unlock its mysteries.
This novel won both the Hugo and Nebula awards upon its release, and is widely regarded as one of the cornerstones in Clarke's bibliography. It is considered a science fiction classic, and is particularly seen as a key hard science fiction text.”

In this book, the strongest underlying philosophy is the basic resilience of the alien starship. Not only are all systems replicated and completely redundant, but these systems and processes are all implemented in groups of threes. In fact, it is eventually discovered that critical systems are designed utilizing three complete sets of threes.

Just as Arthur C Clarke illustrated 36 years ago, three can be a very significant number in the information technology field today. Not only should you have (at a minimum) three copies of your data: The local copy, the onsite backup and an offsite backup, but certain advanced replication techniques also utilize a minimum of three copies. These would be the local data, the local synchronous copy and the remote (asynchronous) copy. And just like the Ramans, there should be additional copies of mission critical data.

Many lessons can be taken from the Rama books and other of Sir Clarke’s writings and applied to help strengthen Business Resilience and Business Continuity principles today.

But for now, a friend is gone.

On his 90th birthday last December, he listed three wishes for the world: To embrace cleaner energy resources, for a lasting peace in his homeland of Sri Lanka, and for evidence of extraterrestrial beings.

"Sometimes I am asked how I would like to be remembered," Clarke said. "I have had a diverse career as a writer, underwater explorer and space promoter. Of all these I would like to be remembered as a writer."

In an interview with The Associated Press, Clarke said he did not regret having never followed his novels into space, adding that he had arranged to have DNA from strands of his hair sent into orbit.

"One day, some super civilization may encounter this relic from the vanished species and I may exist in another time," he said. "Move over, Stephen King."

Until then…
Mission completed. Close the pod bay doors, Hal......