In This Chapter
Perhaps your company delivers an online service to small businesses. It helps businesses track and manage their consultant workload, managing contracts, project proposals, project management, expense reporting, and so on. This information comes from multiple customers in multiple locations. Your servers store all the data. You also provide your clients industry information that you pull from multiple sources and tailor to your clients. Service-level agreements (SLAs) make sure that your customers can access this service 24/7 and that if the system does goes down, you'll restore service in a certain amount of time.
One day, a customer reports that she can't access her account. Then more customers call your service desk with the same complaint. You realize that all the servers have shut down because of a flood. You can't restore the service and recover the data because you didn't back up the servers in the past month and didn't have a secondary storage facility. Heads roll. Lawsuits are filed. Your company goes out of business.
This extreme example shows the importance of data management in meeting customer expectations.
In this chapter, we look at the key issues that need to be part of your data management strategy: data delivery, storage, and retrieval; backup and restoration; disaster recovery; and archiving.
Before you put together a data management strategy, you need to ask yourself these questions: "What is my valuable data? Is it finance, human resources, or sales data? What would the effect be if something happened to this data?" When you have a handle on how important various categories of data are, and on the risk associated with either not being able to access that data or losing that data, you can start to put together a data management strategy. The goal is to develop a strategy that minimizes the risk to your company. Ask yourself these basic questions when you're putting your strategy together:
What categories should we put the data in?
How quickly and how often do people need to access this data?
What level of performance do we need to provide the people who use the data?
Who needs to view, access, modify, and change the data?
What continuity policies and procedures does the business have? In other words, what have we agreed to do in case of data loss or worse?
What are the security requirements for accessing this data?
How much capacity does the business need to store this data?
What are the company's retention policies (that is, how long do we need to keep the data)? Do outside compliance and regulatory factors dictate those policies?
How and where do we want to back up and restore data? Which data do we want to back up and restore?
All these questions need to be answered in the context of the value of the data and how much your company can afford to spend on the strategy, which can be a tricky balancing act. Having a clear idea of the importance of the data your company uses can help you set your priorities, however.
Note
Data management is a critical component of any service management strategy. It has five key elements:
Data delivery: Companies are dealing with ever-increasing amounts of data of all types, from structured to unstructured (see the following section). You need a way to manage all this data. Your company, customers, and partners need this data, often in real time.
Data storage and retrieval: Where are you going to store the data while customers are using it?
Data backup and restoration: Along with storing the data, you have to make sure that you have a good backup and restoration plan. Then you have to make sure that the plan works!
Disaster recovery: Disaster sometimes strikes. Make sure that you can get back any data you may have lost. Your company's survival may depend on it.
Data archiving: Often, corporate compliance or other mandates require you to store data off-site for an extended period (such as years) before destroying it.
Warning
Before jumping into discussing these critical components, we want to make one thing clear: Data integrity and security are critical. Before you can safely do anything with your data, make sure that the data's integrity is beyond reproach and that data security measures are in place. Because the topic of security is so important, we devote Chapter 17 to it.
Data comes in many shapes and sizes, and a sound data management strategy needs to deal with any kind of data that a business collects and uses, which may include these types:
Structured data generally has a defined length and format. Examples include numbers, dates, and groups of words and numbers called strings (for a customer's name, address, and so on). Structured data resides in a database or some other data store.
Unstructured data doesn't follow a specified format. It includes anything from documents such as claims forms, expense reports, medical records, and presentations to Web content, images, and even streaming audio and video files.
Semistructured data, such as an HTML document, has some structure but not enough to be called structured.
E-mail: Don't forget about e-mail! Sometimes, companies have designated proprietary file systems just to store e-mail.
The reality is that a lot of data floats around your company and needs to flow to your customers, partners, and anyone else who needs it and has permission to use it. Way back when, in the dawn of computing, this wasn't the case. The monolithic mainframe typically contained data and software applications all in the same place. The software application called the data from the database. Data was often stored on a tape that was loaded onto the mainframe when needed.
As times changed, files began to be transported over computing networks — not much data at first, because moving a lot of data through a network wasn't affordable. Now companies can move massive amounts of data from one place to another over a network — in some companies, more than a terabyte of data a second!
In addition, some companies need to access data in real time, which might may be measured in milliseconds. A customer service representative who is speaking to a customer, for example, needs to get the customer's records to address an issue. Also, a large trading system may be handling massive amounts of information at lightning speed.
Data access is critical to getting the job done. The examples in the preceding section illustrate just how critical it is to access the data that you've collected and created. But how are you going to store and get a hold of this all-important information?
Here are some data storage systems that serve this purpose:
Database systems: Databases usually store structured records. Various models are available; the most popular is the relational database model (RDBM). In an RDBM, records are stored in tables (sometimes called relations). A customer table, for example, holds info such as customer ID, name, address, and age. Another table contains information about products purchased, as well as the customer ID. You can query (request information from) these two tables by using the customer ID as the common key.
In-memory databases: Some companies need to deal with massive amounts of structured information, and they need to query that information on the fly. In-memory databases, which are becoming popular, usually store structured records in a cache (such as in the computer's CPU) for fast access.
Enterprise content management systems: This type of system usually contains unstructured records: documents, faxes, call-center notes, claims, contracts, and other unstructured information that flows through the organization.
The system stores and provides online access to these documents, thereby preventing document loss and unauthorized content access, and making document retrieval much easier. Some content management systems classify documents according to type and provide a search capability for easier document retrieval.
Web content-management systems: This type of system stores all the elements of a Web page, including text and digital images. The role of this system is to simplify the publication of content to a Web site.
E-mail management systems: Some companies keep their e-mails centrally stored in a proprietary e-mail management system.
File servers: A file server is a networked computer that stores shared files.
Note
Regardless of how you're storing the data, you must negotiate the following issues with the client:
Permission to access data: In many companies, only people with specific job functions can access certain types of data. A marketing person probably wouldn't be able to access information related to manufacturing parts, for example.
Required performance levels: You need to establish the service levels demanded of these systems with regard to returning data. A business may require 200-millisecond response time around the clock, for example.
Speed of data access and updating: Data consumers may have certain expectations about how quickly they can access data and how timely the data is. All these considerations need to be negotiated between IT and the business. Sometimes, data subscribers can't get what they want because their requests are simply too expensive in terms of hardware costs.
Retention period: A retention policy states how long the data should be held.
Note
Make sure that you have a backup copy of your data in case the data is lost, corrupted, or compromised.
An enormous range of backup devices and media are available, each of which has pros and cons. For large-scale, enterprise backups, the following three types of media are most popular:
Tape: Magnetic tape is one of the oldest backup media. Although it has a low cost per gigabyte of storage, the way that the data is written to the tape also means that retrieving data from the tape takes longer than with other media. If you need extremely fast response time from your backup, using tape would be difficult.
Also, magnetic tape isn't very durable. Think about your old VHS tapes, and you get the picture. We're not saying that you shouldn't use tape; many, many companies do because it's cheap and because buying more tape for more backups is easy. With tape, though, you need to take extra care that you have the right processes in place to protect the media from getting ripped.
Tip
Just so you don't think that magnetic tape is your only choice, you can try other options, such as WORM (Write Once, Read Many) tape, using a combination of hardware and software to make the data stored on the tape nonwritable and nonerasable.
Hard drive: These drives are sometimes referred to as fixed media. Often, a hard drive is simply connected to the server or workstation for backup. Optionally, hard drives are put together in an array, sometimes referred to as a Redundant Array of Inexpensive Disks (RAID). You can configure a RAID setup in multiple ways that are beyond the scope of this book. Note, however, that retrieving data from a hard drive is easier than retrieving it from a tape.
Optical disc: Some experts believe that optical discs are the most secure backup media because they're hardier than fixed media and tapes. (Think about DVDs and CDs.) You burn your data directly onto the disc. Accessing information stored on an optical disc takes longer than acessing data on a hard drive, however.
Tip
When deciding what kind of backup media to use, consider capacity (how much data can be stored per unit), cost per gigabyte of storage, durability, portability, and regulatory compliance.
Tip
Alternatively, you can back up data at a backup service (and store backup data on the network). Backup services have become increasingly popular. The services are convenient, and you don't have to buy or maintain any hardware or software yourself. But you need to do your homework to make sure that these services meet your needs in terms of scheduling backups, recovering information, ease of use, reliability, and so on.
Not all data is created equal. Consider the following questions when devising a backup strategy:
What is the company's critical data? How often do we need to back it up? Does the company have the right physical security in place to protect this media?
Do we have the right priorities in terms of data backup? In other words, have we considered whether we need to have a different backup plan for more critical data or for data that falls under various compliance regulations?
What should the backup data do?
Do we need to send the backup off-site for secure storage?
How often do we need to retrieve the data, and how quickly can we retrieve it?
Does the staff need training to use this media?
Can we get the data back to our applications in the amount of time specified in the SLA?
Have we tested the backup plan to make sure that it works?
Note
Backup can be expensive. You don't necessarily want to back up every piece of data every day and quickly fill your media. Sometimes, it makes sense to back up only what has changed. Determine what is optimal for your company based on service-level expectations.
Bad things happen to good companies, so every company needs a disaster-recovery plan, which outlines what happens in case all (or part) of your system becomes unusable. The plan is a formal document that details the business-continuity effects of a disaster as well as the who, what, where, and when of addressing a disaster head-on, such as how long the company can afford for the system to be down and how the business will be affected.
Different companies have different strategies. Some have a complete facility ready to go if disaster strikes. Others prepare a cold facility, which has the equipment (such as computers) but isn't yet up and running. Still other companies simply back up their data and applications online — a method that takes more time.
Note
Critical elements of a disaster-recovery plan include the following:
Application inventory: Know what applications you're running and all the data you're using. If you don't have this information, how can you plan to restore what's necessary in priority order?
Risk analysis and business-impact analysis: Any worthwhile plan includes a thorough analysis of how downtime will affect critical systems and data. Make sure that you also analyze any regulatory or compliance mandates, including which systems you must return first. This analysis involves determining both the effects and the magnitude of those effects. If your call-center customer information is destroyed, for example, you need to determine the effect of this loss and the potential magnitude of its effect on your business.
Tip
Risk analysis and business-impact analysis are disciplines in their own right. Standards bodies such the Information Technology Infrastructure Library (ITIL) reference various portals to help companies determine risk and impact and to develop business-continuity plans. For details on ITIL, see Chapter 5; for more information on ITIL and continuity management, check out
Disaster-recovery teams: The plan may involve people from across the organization, including employees from IT (hardware, software, communications, security, and facilities) and customer-facing staff members. Some team members are responsible for getting the hardware up and running when disaster strikes. Some are responsible for getting data back online. Some are responsible for communication — informing your customers, partners, and others about the situation and its status. Training may be an important part of the plan, so that everyone knows his or her role and exactly what to do in case of disaster.
Operating procedures: You should establish what each person needs to do to get data up and running again.
Testing and maintenance: Test the plan before you need it, and test it again on an ongoing basis to make sure that it still works.
Warning
Does your company already have well-articulated plans for data storage, retrieval, backup, and disaster management? If so, you probably feel that you're in good shape, and we hope that you are — but even well-thought-out backup and recovery plans are worth very little if you have low-quality data. Place a high priority on ensuring the accuracy and trustworthiness of data at the outset of any data management plan.
Archiving is the process of loading data into long-term storage before you consider destroying it. We're talking about both digital data and paper documents here. Many companies still have to contend with archiving their paper-based documents.
You need to archive your data for several reasons:
Compliance: Government bodies have various regulations about how long a company needs to store certain types of information. In the United States, for example, publicly traded companies must comply with the Sarbanes-Oxley Act of 2002, which stipulates that electronic data must be kept for three to seven years.
Offloading of records: To lower the cost of storage, you may want to move your data from more expensive, highly reliable devices that can deliver data quickly to less expensive yet still reliable devices that allow you to get to the data if you need to.
E-discovery: Sometimes, you need to locate specific information that you need in a court case or a legal dispute.
Peace of mind: Although you may not think that you need all your data, you'll be glad that you can find it when you need it.
Warning
Keeping inactive data on your active servers or workstations usually isn't cost-effective. Many companies transition this data to another system that may be less expensive to maintain. If you do the same thing, make sure that you don't introduce errors into the process when you move the data. Also make sure that the new system can handle the load.
Some companies outsource archiving to a third party that specializes in storing data until the time comes to destroy it. Some of these organizations can index the data so that you can get to it if necessary.