Optimal Redundancy Allocation for Information Technology Disaster Recovery in the Network Economy Benjamin B.M. Shao IEEE Transaction on Dependable Secure Computing (2005) Gun-woong Lee 1

2 Overview  Motivation  Problem: Disasters lead to the interruption of IT-supported business processes.  I dea : Allocate redundancy for IT disaster recovery planning  Academic: Lack of studies on IT-oriented disaster recovery planning and on redundancy  Practice: How to allocate IT resources for disasters preparation and how to evaluate the tradeoffs among alternative  RQ: How to allocate redundancy to IT functions against potential disasters ?  Research Model (Discrete optimization model-integer programing)  Problem : (a)Select among competing alternatives for redundancy level (b) Find the best returns  Objective FN (RAP) : Max survivability of IT solution (Min Failure prob. of solution)  Decision Variable : Selection of IT solutions  Constraints : (a) Budget limitation, (b) at least one solution is selected  Research Methods  Simulation

Findings  Effectiveness of Redundancy Allocation Model (RAP)  The scalability of the solution method  Need for a structured decision analysis of IT disaster recovery planning  Scenario based disaster recovery planning 3

4  Design as an Artifact  Model : RAP  Problem Relevance  Disaster recovery plan based on optimal redundancy allocation is attractive to many organizations  Design Evaluation  Exact solution methods based on probabilistic dynamic programming  Simulation and sensitive analysis  Contributions  Guideline for practitioners  New insight for academic research Strengthens

5  Problematic Title  Disaster recovery (?)  Emphasize proactive prevention and reactive recovery!  Network Economy (?)  Products and services are created and value is added through social network operating on large or global scales(Wikipedia) Weaknesses

6  Strong Assumptions  Seemingly fixed exogenous variables: survivability of solution (S) and importance weight of IT function (W)  Require a robust disaster assessment  Survivability of solution is only affected by a single disaster.  Combinational impact of disasters on a IT function?  e.g., Hurricane + System Hacking  Cost of a solution is only consideration for selecting a solution  But reliability or compatibility more matters! Weaknesses and Extensions

Unanswered Questions  Is this solution method also preventive or reactive to other potential disasters?  Natural (hurricane and earthquake), Technological (computer virus and Hacking), Economic (currency crises and recession), Political (Terrorism and war), and Man-made disasters  Can this solution method be applicable to other business functions (domains)? 7