ARTICLE POSTED July 31, 2006 Getting Back to Business in Higher Education By Pankaj Shah and Jim Gerrity Along the continuum of storage area networking capabilities, higher education is forging its own category of solutions for its unique requirements. Colleges and universities are implementing "business resumption" strategies that cost-effectively support a wide variety of recovery time and recovery point objectives (RTOs and RPOs). The need was re-emphasized as colleges and universities in the southeastern United States rallied back to operation after Hurricane Katrina in 2005. Higher-education institutions required storage capabilities to not only allow them to protect applications and data associated with collaborative research efforts with other schools, but also quickly resume business-side services such as managing payroll. How are Information Technology (IT) departments at colleges and universities determining the appropriate level of protection to give to particular applications&151;and cost-effectively building business-resumption solutions? Avoiding a 'Failure of Imagination' Some critics may argue that higher education was oblivious to the need for storage area networks (SANs) and business-continuity and disaster-recovery applications before Hurricane Katrina. But, in fact, a series of incidents and the responses of effected colleges and universities—the University of Miami to Hurricane Andrew in 1992, Colorado State University and the University of North Dakota to Midwestern flooding in 1997, Pace University to the World Trade Center attack in 2001—gave the rest of the higher-education community plenty to think about in terms of challenges and tactics in the event of unplanned data-center outages. But certainly at least two things changed in the wake of Hurricane Katrina. First, the higher-education community would no longer be able to view business-resumption capabilities as a luxury. Dillard University, Loyola University New Orleans, Tulane University, the University of New Orleans, Xavier University of Louisiana and several Louisiana technical and community colleges with New Orleans campuses were each put temporarily out of business in the hurricane's aftermath. Some were even out of operation for the entire fall 2005 semester. Since then, colleges and universities throughout the United States have looked anew at how they might leverage state, regional and national research-and-education cyber-infrastructures or individual arrangements with one or more schools outside their vicinity to host some services in the event of an emergency. Second, a "failure of imagination" would no longer be able to be legitimately blamed in the event that a college or university was caught unprepared by a disaster. After Hurricane Katrina, a conversation intensified throughout higher education about how schools would respond to a tremendous array of events: accidents, earthquakes, terrorist attacks, tsunamis, etc. The Ohio Supercomputer Center located at The Ohio State University, for example, has been looking at how a pandemic might impact information systems and personnel, including how the center would resume its most critical services with only one-third of its regular information technology staff. How would we re-establish Web presence, distance-learning programs, online educational materials and student-registration services, phone service, e-mail and client-server services for academic and administrative systems? What happens if we completely lose one of our key physical locations? Do we have enough distributed personnel to restore systems and be available to our users? In developing strategies for business resumption, colleges and universities have been thinking deeply about scenarios that just a few years ago were considered unthinkable. Defining RTOs and RPOs If budgets were unlimited, building a business-resumption strategy would be a simple yes/no decision. If a college or university elected to have one, the strategy would provide for multiple ways of rapidly recovering services from any one of several hot sites of varying distances away from the primary campus. In fact, providing the most sophisticated recovery capabilities for all services handled by a higher-education institution is not financially feasible because costs can reach into the millions of dollars for even small schools. The chief information officer (CIO) must make difficult choices and assign storage resources strategically. RTO and RPO are simple but important concepts to consider in this regard. RTO (recovery-time objective) indicates allowable downtime, or how soon after a data-center failure the school needs to regain access to a service. RPO (recovery-point objective) signifies the amount of data that is acceptable to have been lost and subsequently recovered once the service is restored. The CIO must look at the array of services that the institution's network supports, including supercomputing and grid-computing applications for research, connectivity to research and education networks such as Internet2, grant preparation, graduate placement and online admission, e-mail (a flagship application at many schools today), payroll and other administrative functions, financial aid, etc. Reasonable RTOs and RPOs must be determined for each. Different departments and groups of users within the university will value different services differently. The CIO will have to take these opinions into account, along with factors such as detectable and undetectable costs and potential to recover losses. Once it has been determined what's at stake, what services must be recovered and when, the next step is putting the technology capabilities in place to deliver the multiple levels of protection that are required. Establishing a Foundation for Business Resumption A wide range of services exists for protecting data and applications among geographically dispersed data centers and research facilities. For applications with RTOs and RPOs measured in mere minutes, there are business-continuity services in which data is continuously, redundantly synchronized across distributed data/research centers connected in server clusters or through geographically separate mirrored storage. For applications with an RTO of hours or days and RPO of minutes or hours, a fast or slow disaster-recovery service might be sufficient. In that case, storage would be mirrored asynchronously in fast disaster recovery, with stand-by servers available. In slow disaster recovery, electronic tape vaulting is used to perform backups. Generally, the more demanding RTO and RPO, the more the college or university can expect to pay for the storage capability. Creating a sound business-resumption strategy that cost-effectively leverages different storage services for different applications requires a powerful, flexible infrastructure foundation. Fiber-optic networks deliver the power, providing the necessary levels of service reliability and connection speeds. Wavelength Division Multiplexing (WDM) delivers the flexibility, multiplying the amount and types of traffic that can be carried over the glass fiber. WDM-enhanced optical networks are ideal for interconnecting primary and recovery facilities separated by distances of up to 250 kilometers and transporting services of any standard protocol—Ethernet 10/100/1000/10G, Enterprise System Connection (ESCON), Fibre Connection (FICON), Fibre Channel (1, 2, 4 and 10G), Coupling Link, Sysplex Timer, Asynchronous Transfer Mode (ATM) and Synchronous Optical Network/Synchronous Digital Hierarchy (SONET/SDH), among them. WDM transmits each application over its own "virtual channel" across the glass fiber. Depending on the amount of traffic and number of services it needs to support, a college or university can deploy highest-capacity Dense WDM (DWDM), lowest-cost Coarse WDM (CWDM) or hybrid C/DWDM/ROADM. (ROADM, or "Reconfigurable Optical Add/Drop Multiplexing," supports full, remote and automatic reconfigurability of any wavelength or combination of wavelengths, enhancing optical network robustness, wavelength transport and the ability to monitor/manage individual wavelengths.) In fact, higher-education institutions have already invested heavily in optics to support bandwidth-intensive research applications, and fiber-based connections are already established with other universities and colleges for collaboration. Institutions can leverage these in-place networks for business-resumption services. New, emerging services can be added simply using the same optical networking platforms and installed fiber infrastructure. Conclusion A recognition of the importance of business-resumption solutions has taken root in higher education, but much work still needs to be done to ready colleges and universities for challenges. A 2005 Educause Center for Applied Research (ECAR) survey of U.S. higher-education institutions showed: 74 percent reported having implemented redundancy for some single points of failure, 9 percent reporting having implemented redundancy for all single points of failure, 88 percent reported needing a "comprehensive business resumption plan and infrastructure" and 40 percent reported "no documented" disaster-recovery plan. As Hurricane Katrina and other recent events have shown, the time to prepare a college or university for an emergency is now, and many higher-education institutions can leverage existing investments in WDM-enhanced optical networks as the foundation of their business-resumption solutions. The simple scalability and protocol-agnostic flexibility allow CIOs to cost-effectively, strategically align storage capabilities with the RTO and RPO requirements of the school's network services. About the authors Pankaj Shah is Director of OARnet, a division of the Ohio Supercomputer Center. Among his previous positions was director of Infrastructure for information technology services at Marquette University. Pankaj is on the Steering Committee of StateNets group under Net@Edu/Educause and Chair of the Regional Optical Networks sub-group. Jim Gerrity is Director, Enterprise Storage, with ADVA Optical Networking. He has helped a variety of enterprises adopt a number of mainframe and open-systems storage protocols, including Fibre Channel, ESCON, FICON and Internet Protocol Small Computer System Interface (iSCSI). Feedback: feedback@snwonline.com Questions: questions@snwonline.com Technical difficulties: webmaster@snwonline.com