The Cloud is not THE answer

[anderm1]

Lately, I have been perusing other continuity planning blogs and have found an overwhelming number arguing that the cloud is equivalent to an all encompassing business continuity and crisis planning strategy. Though many of these bloggers are blogging as a means of promoting their product, not all are.

I am hear to counteract these blogs which, in my mind, are not only incorrect, but seem to be misleading readers on purpose.

You see, any experienced continuity planner can tell you that there is more to business continuity than where critical systems and data are stored. Going to a CFO or CEO and explaining to them that you have found the holy grail of business continuity planning, and that said holy grail is the cloud, will likely lead to a quick trip out the door.

Yes, I can certainly see and appreciate the merits of moving IT systems to the cloud (continuity of systems and apps, availability of data, ability to access systems and data remotely in some cases), but doing so will not in itself prepare your organization for a crisis.

What these blogs touting cloud computing fail to recognize is that there are other components of business continuity planning outside of disaster recovery. Where will the cloud get you when your crisis is a PR / communications crisis? How will it address a loss of building situation, when your building houses a call centre or a trade centre? What does it do to mitigate or prepare you for a pandemic?

As I have stated, the cloud certainly has a place in the day-to-day discussions of continuity planners, but it is receiving far too much credit and much too little skepticism.

Relying on the cloud as your continuity strategy is far too simplistic of an approach to take and will only leave your organization exposed to the many risks facing it on a daily basis. Be diligent and thorough when seeking new continuity strategies for your organization, and do not be afraid to challenge your peers when it comes to something like cloud computing - business continuity planning is a complex field and any pundit suggesting that there be a catch-all continuity strategy is misinformed or seeking to misinform.

What do you think? Do you agree or disagree?


Check out my blog - thecontinuitylounge.blogspot.ca

[robert.a.berra]

You're absolutely right. While the Cloud protects against catastrophic data loss (or, at least, pushes responsibility for it off onto the Cloud provider, who is presumably better able to protect against it and recover from it), it doesn't address the other two elements of Business Continuity; loss of facility and loss of personnel.

I think this is a symptom of a problem that appears to me to be endemic in the BC community; an over-focus on data and computing. This may be because a lot of people come to BC/DR from an IT background, but it's unforgiveable. Having all your data safely ensconced in the Cloud is great, but if forty percent of your staff are out of commission during an influenza pandemic all those ones and zeroes are going to be a lot less useful. Focusing too much on data/application availability shows a tunnel vision that will get you blindsided when your building is under four feet of water.

We as BC/DR/EM professionals need to understand the entirety of the field, or partner with those who can shore up our weak spots. My personal knowledge is heavily skewed toward people and facilities, and my knowledge of the IT end of things is admittedly weak. Thus, if I'm going to put together a BC/DR/EM plan for an organization, I'm going to rely heavily on those who know IT when it comes to that leg of the tripod. The problem is that some people in BC/DR/EM roles don't know that there is a tripod. Their IT leg is so secure that only a complete collapse of society would bring it down, but the other two are barely there at all. That is not a BC/DR/EM plan, it's an IT recovery plan.

[pridder]

I agree with your assessment of the cloud approach. I've seen it as a quick fix solution when real assessment and strategies are absent. It's the difference between employing a BCM planner and dumping DR responsibilities on sombody's lap. Now I'm not saying that the cloud lacks merit. It's simply another tool in the box and the effectiveness needs to be measured against the other strategies at our disposal.

A special thanks to you Robert. I've long managed BCM from a three pronged "tripod" approach. My legs however were people, process and technology with consideration for facility hovering over all three. I think that consideration for facilities should probably receive more attention than I've awarded. I often tout the importance of work recovery sites but maybe it's time to turn my tripod into a chair.

[grewjac]

A few years ago, I had a seven-week project with a company that does payroll and other services for customers, where I, accompanied by a couple of IT technical guys, led a series of BIA's with the executives. Based on the findings, we presented recommendations for their production environment, most of which was necessarily high-availability asn near-zero tolerance for data loss. But the techies recommended cloud storage as the basis for the data protection. On the PowerPoint slide, there was the data center lower left, a vendor-furnished recovery center lower right, and this white, diaphanous blob of mist (a cloud image) top center, with lightning bolts connecting the three objects. The client CEO visibly squirmed as he asked, "Just where IS this "cloud" located?" His CIO responded in chorus with my boss, "This is just one optional solution; there are other ones we will be recommending..."

All of this to ask, why "cloud?" Data needs to be protected in a secure, fortress-like site, and the image of a cloud conveys the polar opposite. Can't some storage vendor some up with a re-branding of this otherwise decent option?