Download .PDF of White Paper >>
From COOPs to Oops! A Survival Guide for Continuity of Operations
Hurricanes Katrina and Rita. The World Trade Center. Oklahoma City's Alfred P. Murrah Federal Building. Each an instance of devastation in its own right. Collectively, a sequence validating organizational leaders' perception of today's heightened threat to operational continuity.
Certainly, the great merchants and industrialists of the nineteenth century had less cause for concern. The predominant threat to their operations was fire - a risk that could be minimized through precautions such as fire-proof safes and night watchmen. J. P. Morgan, Alfred P. Sloan, John D. Rockefeller, and Andrew Carnegie knew nothing of biological agents, nuclear exchange, identity theft, worms, viruses, and suspicious mail.
Times have changed, and business continuity experts, environmentalists and Department of Homeland Security officials concur. Citing terror threats in addition to natural disasters like hurricanes, tornadoes, and floods - which are also becoming more frequent - they warn that over 90% of organizations that suffer a significant data loss will be out of business within two years of the incident. No wonder the acronym COOP - Continuity of Operations Planning - is now common coin among executives and managers worldwide.
Organizational Resilience: A Self-Diagnostic
COOP is part of a broader disaster preparedness planning process that extends from first-response issues, such as first-aid supplies, to secondary organizational concerns, like public relations, investor relations, and leadership succession. The focus of continuity of operations plans (COOPs) is narrower - namely, to ensure operational continuity during a disaster or, failing that, to ensure continuity resumes as quickly as possible thereafter.
According to the Business Continuity Institute - a provider of research and accredited training to members in more than 75 countries - some 80% of organizations with a robust continuity plan are likely to survive a major business discontinuity. Although no substitute for a rigorous review of your own continuity plan, the diagnostic of Figure 1 will help you assess your organization's readiness for the worst that nature - either Mother Nature or human nature - can throw your way.
The Best Laid Plans
COOP has advanced considerably in recent years. A multiplicity of approaches now helps organizations protect their data, applications and communications infrastructure. These include data back up and replication in remote locations, deployment of information management software, use of cloning applications that image PCs for subsequent installation on alternative hardware platforms,
Figure 1 - Assessing Your Organization's Continuity of Operations Plan
Instructions
1. Column A: Identify every conceivable disaster for your organization. Examples include fire, flood, hurricane, ice storm, earthquake, power outage, suspicious mail (anthrax, explosive device, etc.), workplace violence, cyberterrorism, pandemics (e.g. bird flu), and release of hazardous materials (accidental or intentional).
2. Column B: For each disaster, determine a relative probability (1 = less likely; 3 = more likely). This stage may entail research specific to your location, industry, and other organizational characteristics.
3. Column C: Assess the business impact of each disaster (1 = moderate; 3 = severe). Considerations include employees' inability to report to work, customers' inability to obtain products and services, failure to fulfill contracts, and interruption of your supply or distribution chain.
4. Column D: Consider your ability to respond to each disaster in light of resource availability. Does your organization have the requisite resources either in house or through third parties? (1 = sufficient resources; 3 = gross inadequacy of resources).
5. Column E: Calculate the COOP Index for each disaster by multiplying columns B, C, and D.
Example
| A | B | C | D | E |
| Disaster | Relative Probability (1 = less likely; 3 = more likely) | Business Impact (1 = moderate; 3 = severe) | Resource Availability (1 = sufficient; 3 = grossly inadequate) | COOP Index Col B x Col C x Col D |
| Hurricane | 1.5 | 2.75 | 2.0 | 8.25 |
| Suspicious mail | 1.0 | 2.0 | 1.25 | 2.50 |
| Cyberterrorism | 2.25 | 3.0 | 1.0 | 6.75 |
| ¦ | ¦ | ¦ | ¦ | ¦ |
| ¦ | ¦ | ¦ | ¦ | ¦ |
| ¦ | ¦ | ¦ | ¦ | ¦ |
Action
Beginning with disasters that have highest Continuity of Operations Index, identify ways to improve resource availability. Examples might include acquiring IT tools to facilitate operational continuity, establishing agreements with third parties, and conducting additional training.
and contracting with third parties to provide fixed or mobile IT facilities in the event an agency's offices become inaccessible.
These advances notwithstanding, even adherence to all the above could still render an organization vulnerable to hours, days, or in some cases weeks of inoperability in the wake of an incident.
Consider: It starts out as a typical Monday morning for staff at the corporate office of a financial services company. This, however, won't be an ordinary week for the office's four-hundred fifty staff, most of whom are engaged in the company's core business of financing big-box consumer purchases such as refrigerators, washer-dryers, and big-screen TVs.
Shortly after 10 am, a half-dozen workers in the third-floor marketing department report symptoms of headache, nausea, and fever. Meanwhile, the customer service department is experiencing a peak of activity, handling almost 200 financing requests per minute, most of which require an immediate response before a retailer will accept a consumer purchase. Nevertheless, the company's COO, fearing for the safety of her staff, sends the sick workers to the hospital and orders an evacuation of the building.
From a continuity of operations perspective, the situation could be worse. The database and recently created Images of the company's most important PC configurations are replicated at a remote location. The company's far-sighted COOP planners also signed a contract last year for rapid deployment of two-hundred workstations - an on-demand, mobile command center - to support continuity of operations within four hours of an evacuation event.
It's now 2 pm. The mobile facility is already in situ, and company personnel are standing by to resume service. They'll take their posts just as soon as the IT staff can install the agency's Images - which number almost twenty in light of the disparate PCs in use at the now-evacuated building - on the mobile facility's two-hundred workstations.
However, there's a problem: None of the Images will readily port to the new workstations because of incompatibilities between the hardware from which the Images were cloned and the third-party hardware in the mobile facility. In fact, the company's IT managers will need at least another six hours before any of the PCs are formatted, and probably another two or three days before even half of them are in service. That's two or three days too late for the 30-odd national retailers who rely on this company to finance their high-credit-risk customers.
Meanwhile, news of the disruption to service has reached the markets. As the share price begins a precipitous fall on Wall Street, the company's executives find themselves battling a corporate crisis as well as a potential public health disaster.
Accelerating Post-Incident Recovery with Universal Imaging
No longer implausible, such scenarios are a source of rising concern among business leaders. Likewise in public-sector organizations in which continuity planning has become a focus. The Department of Energy, for instance, is establishing a back-up recovery network as part of its nationwide telecommunications and data infrastructure. And the United States Department of Agriculture is revamping its continuity plans in readiness for a pandemic flu outbreak or other disaster.
Indeed, maintaining the public infrastructure is critical to maintaining functional government, which is, in turn, a prerequisite to funding, supporting, and overseeing any recovery from a catastrophic event. Furthermore, federal, state, and local government agencies now manage more data than any enterprise in history. Public-sector IT systems have consequently become critical to society's socioeconomic vitality.
Meanwhile, IT providers have been active in developing solutions to ensure continuity of operations - or a speedy resumption thereof - in the wake of a major incident. One such solution that addresses the problem in the foregoing scenario is the Universal Imaging Utility (UIU) from Big Bang LLC, a Milwaukee, WI-based software company. Recently adopted by the federal government as well as numerous commercial organizations, this remarkable innovation ensures that a master Image of any Windows business-class PC created using any cloning application (Ghost, Altiris, Novell ZENworks, etc.) will deploy to any business-class PC, regardless of make, model, processor, or configuration.
Thanks to the UIU, IT professionals can now install Images on new hardware platforms in as little as thirty minutes. Organizations that use the UIU need barely skip a beat under even the most catastrophic circumstances.
Inside the Universal Imaging Utility
The UIU works by preparing a master PC (a fully configured computer that the user wishes to clone) prior to executing cloning software. Specifically, the UIU installs on this master an extensive database of drivers. In this way, the Image created by the cloning software will deploy to any PC. Key to this advance is the UIU's driver database, which contains drivers for more than 35,000 hardware components from virtually every systems integrator and OEM. Yet despite accommodating such a comprehensive suite of drivers, the database is small enough to fit comfortably on a single CD.
Big Bang has achieved this feat of miniaturization by exploiting so-called "white box" drivers. A video card manufacturer - ATI Technologies, for example - may produce branded drivers for each of its major customers: HP, IBM, Dell, and so on. The branded variants will typically differ in functionally insignificant ways such as inclusion of bespoke logos for each customer. The UIU database omits these brand variants, including only the unbranded "white-box" versions that ATI Technologies and its counterparts supply to individuals who prefer to build their own PCs from OEM-supplied components, typically packaged in so-called white boxes.
Of course, OEMs are continually developing new drivers for new products, but that's not a concern for UIU users: The UIU database continuously updates its stock of drivers from Big Bang's servers, minimizing the chance that an Image will ever lack the requisite drivers for a host PC.
Beyond COOP
Whereas companies might adopt the Universal Imaging Utility with Continuity of Operations in mind, the benefits of universal Imaging extend well beyond incident recovery. The UIU adds value to an organization's everyday routines, not just during times of operational discontinuity. For example, it reduces the number of Images the IT department need manage from as many as 30 - not unusual in larger organizations -to just one. The ensuing labor savings make practicable much more frequent Imaging. This means application updates and operating system patches - essential to protecting against security incursions - can undergo deployment as often as weekly. Previous to the UIU, a schedule of quarterly or semi-annual updates was more typical, especially in organizations that have to maintain hundreds or even thousands of PCs.
In helping ensure that all PCs are up to date, the UIU transforms the role of the IT professional from reactive (restorative) to proactive (preventive). That said, the UIU greatly diminishes the labor required on those occasions when a platform restore is necessary - for example, events such as security incursions, hardware failures, and user errors. That's good news for end users as well as IT personnel. Indeed, end users report a 50% reduction in set-up times for new platforms (from one hour to thirty minutes) and a 75% reduction for reinstallation of an operating system (from two hours to thirty minutes) when IT staff have the UIU in their toolkit.
A thirty-minute system reinstallation revolutionizes the economics of troubleshooting. Now, if a problem looks like it's going to take more than 15 minutes to fix, an IT professional's best approach will generally be a platform refresh using a Universal Image - more efficient than expending time on further diagnostics. A platform refresh will also ensure a more stable as well as a more current PC, incorporating the updates in the latest universal Image from which it was cloned.
Cumulatively quite substantial, the time savings enabled by the UIU allow IT professionals to apply their expertise to strategic issues that advance the organization's mission rather than to operational tasks like downloading drivers and managing Image files. Also, the new reality of a single master Image significantly eases compliance with security policies, software licensing and regulatory requirements. The Sarbanes-Oxley Act, for example, dictates IT-related controls to monitor financial reporting. Compliance with these regulations is considerably easier when managing one universal Image.
The benefits of a single Image notwithstanding, the UIU is flexible enough to support more than one Image. For instance, IT managers can create distinct Images for each functional group. In this way, an Image for the company's sales group might conform to one configuration and include sales-forecasting application software, whereas Images for finance, engineering, and customer service will conform to other configurations with applications relevant to each business function. Unlike the creation of multiple Images to accommodate incompatible hardware requirements, these Images are created for reasons that align with the organization.
Next Steps
Although no one can predict exactly where or when that next sideward blow will land, forward-thinking organizations realize that they can and must ready themselves for any eventuality. Their employees, customers, and shareholders are counting on them. When the lights go out or the servers go down, they need to resume operations quickly, before key stakeholders turn to more resilient - or just more fortunate - competitors. The Universal Imaging Utility helps organizations prepare for the unexpected by giving them the capability to rapidly restore critical data and applications on any PC. To speak to a sales representative or to learn more about the UIU, contact:
Binary Research International Inc
5215 N Ironwood Road, Suite 200
Milwaukee, WI 53217
Tel. 888-446-7898
Fax. 414-961-1716
UIUSales@BinaryResearch.net
www.BinaryResearch.net
About Big Bang LLC and the Universal Imaging Utility
The UIU is developed by Big Bang LLC, a Milwaukee, WI-based software development, training, and consulting company. The need for a product like the UIU became apparent to Big Bang while conducting Ghost Training Workshops. Workshop attendees were desperately searching for a solution to the problem of creating, storing, and maintaining multiple Image files. Big Bang has partnered with Binary Research International, Inc. (BRI) of Glendale, WI. BRI, a software distributor, training developer and provider, is best known as being part of the company that developed Ghost, the world's first software cloning utility.
