Banks are starting to use cloud computing services to manage a critical and sensitive part of their technology needs — disaster recovery.
Banks that rely on cloud computing would rent space on servers held by a third party rather than manage that hardware in-house. Cloud services promise to save banks money and accelerate recovery time, but uptake has so far been slow, with smaller banks in the vanguard.
"Our IT costs related to disaster recovery will be cut in half, and the recovery time will be reduced to one-third," John O'Brien, executive vice president for information technology at Congaree State Bank in Columbia, S.C., said. Recovery time "will be hours instead of days now," he said.
Congaree, which has two branches and assets of $122 million, began working with Safe Systems Inc. of Alpharetta, Ga., in 2006 for hosted e-mail services. It plans to implement Safe Systems' hosted disaster recovery service, Continuum, by midyear.
Congaree will then shift its disaster recovery plan from the use of redundant servers at one of the bank's locations to Safe Systems' off-site machines.
"It is an effective use of resources and it helps us meet regulatory requirements and shareholder obligations to have a recovery plan to get back up and running as quickly as possible," O'Brien said.
Cloud services for disaster recovery work by not only storing data, but making a mirror of entire networks. That typically includes software applications and configurations, mechanisms for storage and middleware, among other things.
In the event of a disaster, "you need to reconstruct the entire computing environment," said Bernard Golden, the chief executive of HyperStratus Inc., a cloud consulting firm in San Carlos, Calif.
Banks would then be able to continue running their systems from a remote location, using a data link to their cloud provider. Once the bank has re-established its physical location, the provider can then send the mirror image of the bank's system to the reconstructed facility.
Some of the top vendors in the remote recovery industry include CA Inc., International Business Machines Corp. and SunGard Data Systems Inc. as well as smaller providers such as i365 Inc., a unit of Seagate Technology PLC, BlueLock LLC and Doyenz Inc.
But such remote services worry many banks, which are heavily regulated with respect to how and where they secure their customer data — and which are charged with getting up and running within hours following a breakdown.
"Financial institutions have to know exactly where their data resides," said Darren Bridges, the president of Safe Systems, who says his company has only two locations where it places servers (one in Georgia and the other in Utah). "We know exactly where their data is in our secure facilities."
Still, the majority of banks are not interested in remote disaster recovery services. Only 3% of financial services companies said they had plans to implement cloud-based disaster recovery services in the next 12 months, according to an IT hardware survey Forrester Research Inc. conducted in the third quarter of 2010. And 7% said they had plans to do so in the next year or later. Eighty-one percent said they were either not interested, or were interested, but had no plans to purchase cloud products and services.
"The most traditional model [for disaster recovery] is shipping tapes" containing backup data, a process that "has been around forever," Rachel Dines, an analyst at Forrester, said. "But longer term, [banks] are moving away from that, and the main reason is it is very expensive."
One reason small banks have been the more aggressive customers of cloud services is that "in general, large banks already have their own recovery facilities and data center infrastructure, so cloud-based disaster recovery really does not do much for them," John Morency, research vice president for systems, security and risk at Gartner Inc. in Stamford, Conn., said
Industry experts said it was critical for banks to determine how well a cloud vendor encrypted data, and to understand what happened to data if the bank should terminate the working agreement. "Cloud is a new paradigm that lowers the cost of disaster recovery and makes it achievable by a full range of banks," said Karen Jaworski, director of product management at i365, of Santa Clara, Calif. I365 works with 80 to 100 financial institutions for a variety of cloud storage services, including disaster recovery, Jaworski said.
Though determining cost and time savings depends on the complexity of the setup, a bank's cost savings can range from 10% to 90%, Golden said.
Still, elimination of expense is not always a guarantee, as State Bank of Cochran in Georgia discovered. The bank has four branches and assets of $209 million. Until February 2010, it had been using a network-attached storage server, which made data backups every 15 minutes, for disaster recovery. The server was stored in one of Cochran's buildings, about 30 miles from its headquarters.
Cochran switched to Safe Systems' Continuum service, a process it says took less than a week.
"What it would have cost us to maintain the hardware internally, and keep up the processes, will be the same as paying Safe Systems," Leesa Anderson, the bank's chief technology officer, said. "The value is that they are there and ready, and their hardware is ready, and this is no longer all on my shoulders."
Anderson said that based on tests Cochran has conducted, moving to the cloud will reduce disaster recovery time for the bank to a matter of hours from two to three days.
Additionally, the bank can re-deploy its NAS server for storage of day-to-day data, such as archived e-mail, she said.
"The largest value is the recovery time; it is so much less than it would have been had we had to restore from what we had before," Anderson said.
