Was your savings account data burned?

Was your savings account data burned?

By Zatni Arbi

JAKARTA (JP): "What happens to my savings accounts now? Do the
banks still have the data, or have I lost all the money that I
entrusted to them?"

As the riots raged out of control last month and we all felt
helpless because of the lack of a reliable national leadership,
that must have been among the many questions on peoples'
minds.

It was a fair question to raise as we watched looters ripping
computers off tables and carrying them out of burning buildings.
Banks rely heavily on information technology and if their
computers get damaged there is a risk that vital data may be
lost.

All big companies, particularly financial institutions,
collect massive amounts of data. Banks hold information on every
single customer, and large banks with a scattered bank of
automated teller machines (ATMs) transfer funds electronically.
Every single transaction is recorded by binary numbers, a series
of 1s and 0s, which are called data. If they ever lose this data
they will be out of business. And you will be too.

Luckily most large banks and financial institutions cannot
lose their data so easily because it is regularly backed up.
Different banks have different policies on how often backups are
made, but they are invariably made fairly frequently.

The backup tapes are stored in a protected, fireproof vault at
the data center or at a different location. Storing the tapes
"off-site" offers more protection than on-site storage.

The data center itself is usually very well protected. To
minimize the risk of flooding it is usually located on the upper
floors of a multistory building. Normally it is camouflaged in
such a way that you won't be able to find it easily unless you've
been an employee of the company for quite some time. In a well-
managed security environment, visitors won't see any sign
pointing to the Data Center. Even when you know where it is
located you may not be able to get in because it is supposed to
be a highly restricted area.

However, just like in any other walk of life, disaster can
strike at any time.

If a calamity destroyed the data center business activities
would be interrupted. This would mean a lot of angry bank
customers because ATMs would stop dispensing money. Does this
sound familiar to you?

ATM users are by no means the only people who would be
affected by the destruction of the data center. A bank is a
service institution and when its activities are suspended, even
for just for one hour, it loses revenue on services that cannot
be rendered.

To avoid a prolonged suspension of operations, many reputable
banks and other organizations have prepared themselves against
such an event with something called a Disaster Recovery Plan
(DRP). With the help of a reliable DRP, the bank can resume
business activities in a very short time after a serious
disaster.

"A good DRP has a number of elements," said Ronnie A. Dumaguin
of PT Pratesis, a company which has been providing disaster
recovery services to various companies in Indonesia. "First, it
has to assign several Disaster Recovery Teams, each of which is
responsible for a different set of tasks. Once a disaster has
been declared, the teams will then follow the procedures detailed
in the Plan."

DRC

Within 15 minutes of the disaster a damage assessment should
be carried out to determine whether it is necessary to move the
data center to a different location. If the damage is not serious
this may not be necessary. But if, for example, the data center
building is no longer safe operations will have to be relocated
to a Disaster Recovery Center, or DRC.

A DRC should be equipped with enough hardware, software,
network facilities and communication links to set the entire
operation in motion again with the minimum disruption to
services.

"Preferably a DRC should be quite a distance away from the
location of the primary data center," Ronnie explained. "Last
month's riots showed why this should be so. If the data center
was destroyed outright during riot it would not help much if the
recovery center was very close by."

Another very important element of the DRP is the holding of
regular training and simulation exercises to ensure that staff
now how to react. For example, data center staff should know
where they have to meet after evacuating the building, and
members of the recovery team should know where the command center
has to be set up.

The exercises also help to uncover pitfalls in the Plan. If
any mistakes have been made or responsibilities left unallocated
this will become evident during the exercises.

Organizations do not normally organize their own contingency
plans for the simple reason that no one knows when disaster will
strike. Waiting for an uncertain event is one of the most boring
tasks that an employee can be paid to do. In most cases disaster
management is subcontracted to companies that specialize in
providing the service such as PT Pratesis and Gateway Group Inc.

According to a survey conducted by the UK National Computing
Center (NCC), a lot of disasters have ended as just that because
of a lack of funds allocated to ensure business continuity.

Luckily, according to analysts at Gartner Group, banks are
among the institutions that allocate the highest percentage (6 to
8 percent) of their information technology budget to disaster
recovery services.

We can only hope that large Indonesian banks with advanced
information technology, including the ubiquitous BCA, will have
some level of protection and disaster recovery plan in place. At
least then it is not so easy for such banks to lose their data
and purge your savings account!