Risks and Rewards of Disaster Recovery in the Cloud

One of the fastest-growing areas of cloud migration for banks, especially smaller institutions, is disaster recovery. Banks are seeing big advantages to moving their disaster recovery operations to the cloud, a recent survey by Computer Services Inc. (CSI), a Paducah, Ky.-based technology provider for financial institutions, indicates. Of those banks surveyed that had implemented cloud services, 27 percent said they have seen the greatest benefits from the cloud in disaster recovery.

CSI has seen a 69 percent increase over the past two years in the number of customers using a cloud-based disaster recovery system, says Dan Holt, the president and general manager of CSI's managed services division. But as more banks move their disaster recovery operations to the cloud, one major barrier standing in the way of wider adoption of cloud-based disaster recovery is the issue of controlling one's own fate in the event of a disaster. "Many banks don't want to relinquish control," he explains. "They're sensitive about letting their data go outside of their doors."

Many of the banks that talk to CSI about the company's own cloud-based disaster recovery system hesitate to go the cloud route for this reason, he acknowledges. The bankers surveyed in the company's cloud study identified security, compliance and loss of control as their biggest worries about adopting cloud services.

The concept of putting disaster recovery in the cloud underscores two of those biggest concerns. Not only are banks allowing their data to be mirrored in the cloud, but disaster recovery is a heavily regulated area of banks' operations. Banks have to prove to regulators that they can recover from a disaster in a sufficient amount of time to limit the disruption to their services. Banks understandably could be suspicious about leaving an area of such importance to regulators in the hands of a cloud provider.

Address Compliance Concerns

However, often that same need for compliance drives banks to the cloud for disaster recovery, according to Matt Gerber, CEO of Liberty Lake, Wash.-based IT-Lifeline, a company that specializes in banking disaster recovery in the cloud. Many of the banks seeking IT-Lifeline's services are not confident that they can meet the guidelines of the Federal Financial Institutions Examination Council, the regulatory body that performs disaster recovery audits on banks. "A lot of the banks coming to us are in a panic because they have to do a test in a couple of days, and this year we have seen a lot of regulatory attention [regarding] disaster recovery plans," Gerber says.

A cloud-based approach to disaster recovery can facilitate compliance, since one of the chief benefits of using the cloud for disaster recovery is reducing the speed-to-recovery time that regulators are looking for. Banks using the old secondary data center recovery model typically took 24 hours to recover their most critical applications. A full recovery of all of the banks' operations normally took 72 hours, Gerber says. But IT-Lifeline usually is able to perform a full recovery in 24 hours, with the most critical applications back up and running in just a few hours, Gerber says. Instead of having to physically move staff to a secondary data center to fire up backup servers, a bank only has to call IT-Lifeline, which turns on the servers it has dedicated to that institution in its server center in Washington state.

[Can the Cloud Ever Be Safe?]

Another benefit of putting disaster recovery in the cloud is reducing the costs associated with maintaining a second data center, says Marcus Royster, senior VP of information technology at Tacoma, Wash.-based Columbia Bank, a client of IT-Lifeline. Four years ago, Columbia Bank was using the basement of one of its larger branches as a secondary data center for disaster recovery.

"Having to maintain a separate disaster recovery facility just didn't make sense for us. It was too expensive to maintain all of the hardware and space needed to facilitate our personnel in the time of a disaster," Royster recalls. But now all of the bank's data is being mirrored in IT-Lifeline's facility, eliminating the cost of maintaining that second data facility. In addition to writing off the cost of maintenance, the bank also was able to eliminate the second data center from its books as a nonproducing piece of capital.

Although Columbia Bank initially was a little troubled about leaving control of its data disaster backup capabilities to a vendor, Royster was impressed by IT-Lifeline's efforts to gain accreditations from regulators. IT-Lifeline had completed an SSAE16 audit (a compliance audit for cloud providers) by the American Institution of Public Accountants. Any bank looking to use a cloud provider for disaster recovery should look for a similar accreditation, he stresses.

Most of IT-Lifeline's customers fall in the $100 million- to $4 billion-asset range (Columbia Bank has $4.8 billion in assets), and larger institutions should be more cautious about considering such a solution for disaster recovery.

"Cloud is limited by the size of the bank, and those really large banks aren't interested in the concept [of disaster recovery in the cloud]," says Gil Brodnitz, global head of IT strategy and architecture for financial services at Capgemini, a Paris-based technology and consulting firm.

For bigger institutions, outsourcing disaster recovery to a vendor only adds the headache of doing due diligence in finding a partner, Brodnitz says. Disaster recovery "is inherently complicated enough. A lot of things could go wrong," he says. Data replication for disaster recovery takes a great deal of bandwidth, and for really big institutions this makes cloud-based disaster recovery impractical. "If you're a smaller bank working with a multitenant server center, it would make sense," he says. But most cloud vendors wouldn't have the infrastructure to han- dle all of the data from a bigger bank, Brodnitz suggests.

More Interest From Large Banks?

But over the past year one of the bigger vendors in this space -- Terremark, a Verizon company headquartered in Miami, which focuses on IT infrastructure solutions -- has seen more large banks than ever before looking for cloud-based disaster recovery, says Tom Mays, the company's senior VP for advanced data solutions. Terremark's connection to a technology company as big as Verizon allows it to scale to meet the data needs of a larger bank, he says. Some of the banks that Terremark has signed up for disaster recovery in the past year have more than 1 petabyte of data to be replicated. Since March, Mays adds, Terremark has doubled the size of its customer base. He attributes this to interest in the benefits of speedier recoveries and lower costs that the cloud enables for disaster recovery.

In the future, Mays says, the cloud model could replace the old secondary data center model for disaster recovery at an increasingly rapid rate. Since moving disaster recovery to the cloud doesn't interfere with a bank's production environment, it is an excellent area for banks that haven't tried any cloud services before to do so, he advises. "This [model] will grow exponentially over the next few years in popularity," Mays predicts.

Jonathan Camhi has been an associate editor with Bank Systems & Technology since 2012. He previously worked as a freelance journalist in New York City covering politics, health and immigration, and has a master's degree from the City University of New York's Graduate School ... View Full Bio