Is Disaster Recovery Becoming Obsolete?

Is Disaster Recovery Becoming Obsolete?
Mohan Menon explores whether the cloud will replace traditional Disaster Recovery, and whether newer
technologies are making DR obsolete
When I was working for IBM in the early 1990s, IBM was in crisis. Till then, the darling of the Fortune
500 companies, its unassailable position was under serious threat. Newer more cost‐effective systems
were growing in market share and were apparently going to unseat the market‐leader and 800‐pound
gorilla of computing systems – the IBM mainframe. The competition was having a field day. There were
full‐page newspaper ads depicting cartoon dinosaurs, implying imminent mainframe obsolescence. The
mainframe apparently was in its death‐throes.
Today, 25 years later, the mainframe is still alive and kicking. Though its market share has greatly
diminished, it has a cult following amongst the enterprise elite, especially in the financial industry, who
continue to swear by its rock‐solid stability and powerful transaction processing capability. The
mainframe has also adapted over the years to run on lower cost hardware, lower maintenance costs and
newer cutting‐edge technology. A half‐century since inception, it is still a relevant piece of great
technology that drives many of the back‐end services that consumers rely on.
Traditional Disaster Recovery (DR) grew up along with mainframes. In the 1960s and 1970s, when
mainframes started replacing manual clerical work en‐masse, it also introduced concentration risk. A
mainframe failure was tantamount to a battalion of workers falling sick at the same time. The demand
for DR set in. Geographically separated recovery sites proliferated, both dedicated and syndicated
(multi‐tenanted). Tape‐based weekly transmissions of production data to the DR site increased in
frequency to daily transmissions and eventually to instantaneous real‐time or near real‐time
transmissions across high‐speed networks.
As with the naysayers of mainframe longevity, some say that such DR (let’s call it traditional DR), is set to
become obsolete, to be replaced by ‘DR in the cloud’. Traditional DR requires companies to spend huge
amounts of capital expenditure (capex) to setup up or populate alternate IT data centres. If you use
commonly available intel‐based systems, why lock yourself up in capital investments in DR when you can
rent or opex it from the cloud (DR‐as‐a‐Service or DRaaS in cloud jargon)? And you can enjoy the
elasticity of expanding and contracting your DR requirements as per your needs.
Several well‐known companies are riding the wave of this disruptive paradigm. And they are rendering a
great service by proliferating DR usage and practice by making it easy to setup DR capability. Go to their
websites, and with a few clicks of the mouse, you can provision a server almost instantly. A few more
clicks of the mouse and you can setup DR at one or more distant geographic location. No more waiting
for months in line for capex budgets to be approved and implemented.
A plethora of cloud‐based options have surfaced. The more conservative organisations have the option
of keeping their production systems under their watchful eyes on‐site and just renting their DR siblings
on the cloud. Those who are even more conservative can keep critical systems within‐premises and load
less urgently‐needed systems like those for training, software development and testing onto the cloud.
Or simply do plain vanilla backups onto the cloud.

Cloud‐based DR is indeed making it easier and cheaper to provision DR. Smaller companies that couldn’t
afford DR can now easily afford it. It also encourages a controversial trend towards decentralised IT that
business departments adore, to the chagrin of CIOs who are wary of IT infrastructure proliferating
uncontrollably outside the domain of Corporate IT.
All this leads to the DRaaS market share expanding exponentially. Gartner predicts that “by 2018, the
number of organisations using disaster recovery as a service will exceed the number of organisations using
traditional, syndicated recovery services.”
Though DRaaS is definitely here to stay and grow rapidly, it is an outsourcing business model which
requires you to trust your data in the hands of an external organisation. Phenomena like the Panama
Papers serve to emphasise the risk of keeping data with third parties. One of my former clients, a bank,
has reversed a decades‐old IT data centre outsourcing contract in favour of in‐sourcing it back. Was their
desire for an increasing bottom‐line, overshadowed by their decreasing risk appetite?
Especially in industries like banks and financial services that place a high value on data confidentiality,
cloud‐based DR will grow more slowly. Their ancillary systems will proliferate to the cloud, such as
systems for software development, testing and training. But these companies are unlikely to move their
core systems to the cloud overnight until it has stood the test of time and demonstrated rock‐solid
reliability and security. The biggest perceived risk in the cloud is still security and confidentiality.
Interoperability between cloud providers also needs more work to increase potential adopter
confidence. If I am dissatisfied with cloud provider A, how quickly and transparently can I move my IT
systems to cloud provider B? Cloud providers need to work on standards for cloud interfaces and
interoperability.
So whilst we will continue to see an aggressive market growth for cloud‐based DR, traditional DR will
continue to thrive for quite some time to come. The remainder of this article is more on traditional DR.
Are newer technologies making DR obsolete?
Some people say that DR itself is headed the way of the Woolly Mammoth ‐ doomed to extinction.
Apparently, the advent of ‘DR‐killer’ technologies like ‘Continuous Availability’ and other such ‘Disaster
Avoidance’ techniques, have made DR kind of archaic. These newer technologies update transactions
into mirror systems at two sites, simultaneously in real‐time, with scarcely any disruption as a result of
failure at one site. They say that a disaster at one site is therefore not a disaster at all. No need for
‘Disaster Recovery’ because a disaster never takes place, or is never felt, and passes off as a mere
‘incident’.
All these new technologies have their limitations. They greatly improve resilience but they do not offer
you 100% protection. You cannot eliminate risks completely, but you can manage them. Even with these
technological advances, what do you do if there is failure at both your sites, e.g. in the case where data
corruption gets faithfully replicated to the mirror system at the alternate site? Or what if all of your
most recent transaction data did not replicate across to the DR site and you now need to figure out what
data went missing and how to reconstruct it? And if the ‘fail‐over’ did execute successfully, wouldn’t you
then be at risk for having lost your DR site? Wouldn’t you still want to urgently notify, escalate, troubleshoot
and arrange to fix whatever has failed? All that still requires DR strategy and planning.

Hence terms like Continuous Availability, Disaster Avoidance, Zero down‐time, IT Continuity are all the
same animal in different clothing. They are still about DR – albeit with a little more emphasis on the
preventive aspects of DR.
Perhaps the current international standard on DR, ISO/IEC 27031 “ICT Readiness for Business
Continuity” or IRBC, will silence the jargon‐mills with its all‐encompassing title. IRBC is closely aligned
with ISO‐22301 on Business Continuity Management. But IRBC is a painful 4‐letter tongue‐twister which
I find a little clumsy to verbalise in board‐rooms, meetings and presentations. The world craves two and
three letter acronyms (BC, BCM, IOT, BCP….). So let the time honoured term DR continue and this is
unlikely to be unseated any time soon. Let DR encompass all the other DR‐wannabes. If at all necessary,
we could make one small change to reposition ‘Disaster Recovery’ into a wider and more inclusive term,
‘Disaster Resilience’.
DR is here to stay.
Biography
Mohan Menon AFBCI is a free‐lance BC & DR consultant based in Southeast Asia. He also chairs the
Malaysian Forum of the BCI and is a board member of the BCI’s Asia Chapter.
Mohan.mkmenon@gmail.com
www.resilientsolutions.biz