Data centers: strategic choices to anticipate digital and economic resilience

The business continuity of a company, or a public service, is largely dependent on the proper functioning of its information systems. This increased dependency has led to the adoption in France of the essential service operator (OSE) status[1], as an extension of the Operator of Vital Importance (OIV) status, in order to characterize an entity that provides an essential service and relies on information systems whose failure would have a significant impact on the functioning of the economy or society.

This observation of dependency was further reinforced during the Covid-19 health crisis with the essential availability of hospital information systems and telecom/internet operators, the continuity of institutions, massive remote work, distance learning, medical teleconsultations, etc. The policy of widespread lockdown around the world led to a sharp increase in internet traffic that could reach 70% in some European countries according to KPMG[2]. The infrastructures that support these services have held up so far because they are natively designed to be resilient.

As the repository of digital infrastructures, the data center plays an essential role in application availability. Its architecture is defined according to certain service continuity objectives in the Uptime Institute framework (Tier I to IV for increasing availability from 99.671% to 99.995% uptime). In addition, the data center operator can implement site replication systems ("dual sites") for immediate recovery in the event of a total outage.

To address the explosion of certain needs, as is currently the case for collaborative work applications, service providers can rely on cloud technologies that offer significant elasticity for additional storage and data processing resources within a very short timeframe. The territorial network strategy of major digital service providers also contributes, through traffic decentralization (Edge Data center), to ensuring service delivery to everyone.

Digital services owe their proper delivery to the service continuity of fixed and mobile networks through the interconnection of different national operators' networks. In addition, investments made in the decentralization of CDN (Content delivery networks) functions have contributed, by reducing the distances between content and their consumption locations, to improving the resilience of major content platforms that are bandwidth-intensive. At the enterprise level, access to multiple competing connectivity providers also allows data centers to distribute risk and ensure traffic flow.

During periods of high demand, IT departments can use several prioritization strategies to ensure the resilience of critical applications in order to adapt quality of service according to the type and criticality of flows, particularly through the use of SD-WAN (Software-Defined Wide Area Network). The question of flow prioritization also arises on the Internet, particularly concerning the delivery competition between "professional" flows (applications used for remote work, for example) and "recreational" flows (streaming video, for example).

Within an organization, whether public or private, anticipating the unpredictable is not limited to digital tools, even though, as we have seen, the latter constitute a major axis of business continuity. To prepare for any eventuality, namely unpredictable events preventing the smooth operation of activities due to the inaccessibility of production facilities or the inability of teams to accomplish their missions, the company must prepare.

This is precisely the objective of business continuity plans (BCP) and disaster recovery plans (DRP), which are the daily reality of data center operators: what characterizes, and therefore mainly differentiates, these mechanisms is temporality. Thus, while the BCP responds to short-term risks with procedures to maintain the essential activities of an organization, the DRP's function is to restore the entire activity to working order, in the most orderly and rapid manner possible. The DRP is therefore more "long-term" and generally follows a sudden halt of an entire production chain: major incident on production facilities, epidemic, etc.

BCPs and DRPs must in particular enable the maintenance, or even reinforcement, of the security/safety level of central sites that are all the more critical in times of crisis. Concretely, this involves, for example, adopting new accreditation procedures reducing physical contact when accessing sensitive sites, implementing remote surveillance for buildings closed to the public with audio/video verification, or establishing a reserve security team capable of replacing any agent who might be on sick leave, for example.

BCPs and DRPs must benefit from clear and structured written procedures to be effective. And above all, cover all subjects around the triptych that constitutes any organization today: human resources, production tools, and digital infrastructures. It is only in light of the existence and relevance of this documentation that an organization will be able to face any type of unforeseen event, while sustaining the fewest possible losses.

[1] The Network and Information Security (NIS) Directive specifies the rules for designating OSEs.

[2] https://www.forbes.com/sites/markbeech/2020/03/25/covid-19-pushes-up-internet-use-70-streaming-more-than-12-first-figures-reveal/