NY disaster underlines business continuity
banking technology online
By Fabien Buliard
Thursday, 25th October 2001 - The destruction of the World Trade Center
(WTC) in New York on 11 September has not only caused many of the most prominent
financial institutions in the world to lose a shocking number of their employees,
but also the technological infrastructure on which their businesses relied.
TowerGroup estimates the cost of replacing these systems as $3.2 billion.
In an event of this magnitude two conditions must be fulfilled to ensure business
continuity – access to a disaster recovery location and a back up of the data
lost on site.
According to Ian Glover, a director at Insight Consulting, which specialises
in business contin-uity, companies affected fall into three categories. In
the heavily regulated financial sector, few firms would fit into the first
category of those without any disaster contingency plan.
However, Glover believes that not all recovery plans being used by financial
institutions are comprehensive. Following the disaster, many brokerage firms
had to divert much of their activities to their offices overseas, mainly in
London or financial centres in Asia. At the second level of continuity planning,
some firms will have a third party recovery contract for the provision of
temporary dealing rooms, computer systems and an office envir-onment. Access
to such centres is sold to more than one client and the problem with this
particular set-up is that many of the same kind of companies need to use the
same facilities. Glover says they can all be accommodated but not necessarily
in the location they thought they were going to get.
‘That is causing logistical problems in terms of getting people to the centres
and providing the connections back to the main exchanges,’ he says. These
contracts also provide recovery positions for a limited period, after which
they move on to a very costly charge per seat per day.
The shortcomings of such contracts have led many financial organisations
to chose to run their own recovery centres, which are geared to take over
the business for a longer period of time. ‘The idea is that you would use
such facilities while you look for other accommodation within your property
portfolio, or go to the marketplace to find something, or back to your existing
building for normal operations. They have the ability to recover to a minimal
level, but they may struggle to find available resources,’ says Glover.
Another major issue raised by the WTC tragedy is the ability of companies
to recover the data that was stored in the twin towers. According to a report
published on 12 September by software house mi2g, ‘most banks and insurance
companies have routine batch back-ups for all their key data. In addition,
trading floors have a regular back-up every hour or per transaction.’
Some organisations will have mirrored systems with every single transaction
written to the main computer system being written to a duplicate system located
elsewhere. ‘With those systems you would recover the data immediately,’ says
Glover. ‘Other organisations work on a back up principle, which means that
in some cases the data could be 24 hours out of date.’
The problem is the location of such backed-up data. It won’t have survived
if the mirrored copies or back up tapes were located within the WTC.
Glover says he knows of at least one client that had its primary system
in one tower and duplicate system in the other tower, underlying the case
for backing up data well off-site. Last month’s attacks will inevitably lead
to higher business continuity investments. However, financial institutions
in the UK might be better prepared than their US counterparts, because they
had already faced terrorist attacks. Glover says past attacks at Bishopsgate
in 1993 and Canary Wharf in 1996 caused many London-based institutions to
review their location and recovery centres.
‘Banks moved their back-up sites at least three or four miles away, off
the Docklands island, but we’re already getting questions as to whether that’s
far enough away,’ he says. ‘A balance needs to be struck between the geographic
separation and accessibility.’
He points out that most business continuity plans are designed to provide
recovery, making the assumption the right number of technical staff and business
people will be available to continue the operation. ‘What we haven’t had in
the past is significant loss of life,’ he explains.
Much was made of the ability of the US markets to get up and running so
soon after 11 September. While this was mainly due to fierce determination
not to be beaten, the existence of recovery procedures greatly contributed.