Off-site disaster recovery and security

I took an interesting help desk call today, from an IT person supporting a research centre, asking if the DCC offered off-site disaster recovery type services (perhaps this was really business continuity support services, but the answer's the same). The short answer is that we don't, but the longer answer was an interesting discussion about the centre's needs. The most interesting thing to me was the strong message that local University systems were not geared up to handle specific services of this type. I've commented before about the difficulties in getting reasonable backup systems in place (see My Backup Rant), and this is one step further. I think this person will be very capable of putting a good local system in place, but given the long-term value and sensitive nature of the data, needs a good quality service to provide that bit extra. It's looking as if he might have to go to the private sector to achieve this, although there may be services linked to HE, such as AIMES Grid Services (linked to Liverpool University, I believe). Perhaps the Atlas Petabyte Store at STFC is an in-sector service that might do the trick.

There was a question on whether (in the future) it might be sensible for such a project to attempt to get certified to ISO 27000. That's a big task; my guess is it might be too big a hurdle for a research centre to jump through. However, I believe that taking an approach linked to ISO 27000, without attempting to go as far as certification, can be extremely valuable. In particular, the ISO 27000 approach involves doing a security risk analysis, building what's referred to as an Information Security Management System (ISMS) to deal appropriately with the risks, and reviewing that ISMS in a continuos improvement cycle known as Plan-Do-Check-Act (PDCA). From my experience approaching this systematically can reveal that previously un-considered risks are more significant than obvious headline risks.

How important is "off-site"? I do think it is important that off-site means not in the same building. But it doesn't necessarily have to mean not in the same city. Here in Edinburgh, I would quite happily regard the main IT services at Kings Buildings, a couple of miles up the road, as off-site. In deciding, you do have to think about the threats; in central London, you might need to think about whether certain types of threats make larger areas on the city inaccessible, in a way that would probably be less likely in Edinburgh. But if you're locked out of your offices and your local IT services have been destroyed, just having an off-site backup may be comforting but is not going to get you up and running in the short term.

I thought there might be some current JISC information relevant to this, but on a quick scan I wasn't able to identify anything.

Note this is a much simpler service than data preservation or even data curation; much more of a standard commercial offering.

But it is good to see research centres taking these issues seriously.