Win
AN IPAD MINI see page 53 for entry details
GOVERNMENT TECHNOLOGY REVIEW
VIRTUAL DESKTOPS GET REAL WEIGHING THE SUCCESS OF
SWARH’S
TOTALLY MOBILE FUTURE
NOV/DEC 2013 • ISSUE 21
DCaaS
BIG-DATA ROUNDTABLE ● THE BEST PRODUCTS OF 2013
HOT NEWS! New PRIMERGY servers are built to
...operate safely at up to 40â °C. Lowering your Air-conditioning costs, while running your biggest loads.
au.fujitsu.com/primergy
COVER STORY:
BUSINESS CONTINUITY: ARE YOU REALLY READY FOR ANYTHING? It used to be as simple as cloning your primary data centre into your second one. But these days, ensuring you can continue delivering services in the event of a catastrophe has become both more complex – because of the number and sophistication of the applications at hand – and easier, because abstraction of virtual devices has provided unprecedented flexibility in technical architectures. We look into the latest strategies around business continuity.
SPECIAL FEATURES
20
REGULARS 2
Editor’s letter
4
News
52 Opinion: Ovum, Esri, Flexera Software 56 NBN Update
FEATURES 18 GTR Leaders’ Forum A range of IT industry thought leaders share their predictions for 2014. 28 The best products of 2013 We offer a year-end guide to some of the best and most important products of the year. 36 Virtual desktops get real With Windows XP about to expire, virtual desktops are more relevant than ever.
CASE STUDIES 16 Department of Agriculture and Food
22
Western Australia
DAFWA’s business continuity investment is paying off. 46 South West Alliance of Rural Health A telecoms group-buying arrangement has evolved into a regional, collaborative IT strategy.
40 WEIGHING THE SUCCESS OF DCaaS
ROUNDTABLE: BIG DATA
The introduction of the federal government’s data centre as a service multi-use list (DCaaS MUL) was a landmark phase in the formalisation of data centre hosting and cloud service delivery. But has it worked? We look at its successes and challenges to date.
Today’s governance mandate requires government agencies to keep an increasingly unwieldy volume of information on hand for storage and analysis. But how are governments coping with the new demands of big data? We ask two industry experts to find out.
48 Transport for NSW, Turbid The Internet of Everything is offering new ways to collect and analyse operational data for Transport for NSW and civilengineering venture Turbid. 50 Coolamon Shire Council An end-of-life council system has been replaced in a major overhaul for rural Coolamon Council. GTR NOV/DEC 2013 | 1
It may have been an intrinsic part of the push towards improved governance a decade ago, but business continuity as a concept has faded from the tips of executive tongues as new priorities – cloud computing, privacy, budget pressures, new government policy and the like – dominate the agenda. That doesn’t mean, however, that it doesn’t matter. Business continuity goes without saying these days. It is part and parcel of everything you do, and an unremarkable part of any project you’re likely to be embarking upon. Especially in the world of 24x7 online government, your services must go up and stay that way – floods, fires, earthquakes or alien invasions be damned. This issue, we look at how the business-continuity imperative has shaped strategy and implementations across all levels of Australian government. It is a universal theme, with an increasingly universal aspect: the cloud. By shifting essential services into an intrinsically scalable, fault-proof environment, government bodies are finding that business continuity is becoming easier than ever – as long as the ancillary risks are also addressed. One way of helping this happen has been through the federal government’s data centre as a service multi-use list (DCaaS MUL). Launched nearly two years ago, the list was an incredibly important step forward for cloud and business continuity efforts, since it applied some of the same procurement rigour around cloud and hosting requirements as had been applied to other types of procurement in the past. Our feature this month looks at its history and likely future. Continuing the theme are virtual desktops, which have expanded from being a technological novelty into a core part of the modern operating posture. Virtual desktops offer a significantly different operating environment and have long been a crucial part of business continuity efforts; flip through the magazine to read about the state of the art. You may be surprised what the technology is capable of these days. Also in this issue are our regular features – a roundtable discussing the latest in bigdata issues, for one, and the latest on the NBN rollout – as well as a special look at the best products of the year, and a view towards 2014. I might also take the opportunity to remind you about our reader survey, which will close in early December. The prize is a Mac Mini – and all you have to do is tell us what you think of the GTR magazine and Web site. Drop by www.surveymonkey.com/s/ RS2S6HR to participate. As always, I’d love to hear your thoughts and feedback, particularly as we head into 2014. What’s on your agenda?
EDITOR David Braue e: editor@govtechreview.com.au NATIONAL SALES MANAGER Yuri Mamistvalov e: yuri@commstrat.com.au Tel: 03 8534 5008 ART DIRECTOR Annette Epifanidis e: annette@commstrat.com.au Tel: 03 8534 5030 DESIGN & PRODUCTION Nicholas Thorne CONTRIBUTORS Joshua Gliddon, Beverley Head, Steve Hodgkinson MELBOURNE OFFICE Level 8, 574 St Kilda Rd. Melbourne Vic 3004 PO Box 6137, St Kilda Rd Central 8008 Phone: 03 8534 5000 Fax: 03 9530 8911 Government Technology Review is published by CommStrat ABN 31 008 434 802
www.commstrat.com.au All material in Government Technology Review is copyright. Reproduction in whole or in part is not allowed without written permission from the Publisher.
To subscribe to GTR magazine phone: 03 8534 5009
David Braue, Editor E: editor@govtechreview.com.au
2 | GTR NOV/DEC 2013
email: subs@govtechreview.com.au or go to www.govtechreview.com.au/subscribe
Parramatta City Council commits to Windows 8.1 rollout NSW’s Parramatta City Council has revealed it will become the first local government organisation in Australia to widely deploy Microsoft’s new Windows 8.1 operating system, which will be released on Friday. The operating system will provide a productivity environment for the council’s 750 employees, and will be rolled out across the council’s tablets and laptops before finally being installed across its desktop PCs. Also integrated into the mix will be Windows Phone 8 based smartphones. The council is also developing a Windows application that will let employees deliver 24/7 remote access to the council’s tools and services. In the long term, the council will build on the technology platform to introduce smart devices including 3D printers, videoconferencing tools, and mobile computing. “The consistent experience delivered by Windows 8.1 across a range of devices was a key element in our decision to upgrade and
4 | GTR NOV/DEC 2013
provide employees with the tools they need to work effectively whether they’re offsite or in the office,” said Parramatta City Council Lord Mayor Cr John Chedid in a statement. Council’s desire to mobilise its employees plays a big part in its decision to adopt the newest version of Windows at its release. The seamless mobile experience is expected to facilitate council workers’ access to a consistent user experience regardless of location or device, with tasks ranging from property inspections to community events and booking appointments while in the field. “Technology has transformed the services local councils have been able to offer in recent years, and it is of course a critical step in continuing to improve the level of service for citizens,” Microsoft Australia public sector director Michael Gration said in a statement. “Deploying Windows 8.1 will help speed up and streamline administrative work while maximising the time spent doing practical good as part of their job.”
Lockheed Martin builds Australian security skills with Canberra facility A new Security Intelligence Centre (SIC) in Canberra represents government contractor Lockheed Martin’s fourth such international facility and will be a focal point for the company’s intelligence-driven security activities in the region. A core part of more than $10 million worth of investment, the SIC will see Lockheed Martin’s business operations combined into a single facility and builds on the NexGen Cyber Information and Technology Centre (NCITE) opened in Canberra two years ago. With a strong focus on cybersecurity issues and building out the company’s base of security experts, the SIC operation will support the company’s IT-related security efforts in Australia and worldwide. “This new Centre is an investment in technology, expertise and talent for increased innovation throughout our Lockheed Martin team,” said Sondra Barbour, executive vice president of Lockheed Martin’s Information Systems and Global Solutions division while opening the SIC facility. “As cyber threats become increasingly sophisticated and persistent, our cyber intelligence analysts continuously adapt and improve their methods in collaboration with government and industry partners, implementing new mitigations to keep ahead of the threats.” The Canberra facility will be staffed by cyber-intelligence analysts who will build local extensions to the company’s global network defence, and work with colleagues around the world to strengthen the government contractor’s cyber-security capabilities. Lockheed Martin Australia employs over 700 people and in 2012 reported turnover of over $200 million.
Solutions provider NEC Australia joined the Northern Territory government in kicking off a new IT skills-training course designed to give young and indigenous students a leg up into the information technology sector. The IT Apprenticeship Hub program is a five-year commitment to education and training that will see students mentored by NEC Australia staff, helping give them marketable skills and guide them to jobs with NEC or within the NT’s own ICT industry. Students will spend 12 months in the program, which will begin next year and look to train up at least 50 work-ready apprentices by the end of 2018. At least half of those will be young indigenous Australians. NEC will also choose ten candidates for the NT Student Based Apprenticeship and Traineeship (SBAT) program, which will see them registered with Australian Apprenticeships NT to gain skills at NEC’s Darwin Service Delivery Centre and gaining higher formal education qualifications through a Certificate II, III or IV in IT at Charles Darwin University. NEC was recently awarded a $34.6m ICT services contract with the NT Department of Education, which will provide the opportunity for apprentices to serve 15 weeks with NEC field services, 14 weeks on the NEC service desk, and 10 weeks in NEC engineering.
Redland City Council overhauls ECM to boost service The 900 employees of South-east Queensland’s Redland City Council will soon have access to a new enterprise content management (ECM) platform after the local government area committed to implementing Objective Corporation’s ECM 8 platform.
Cleveland is the seat of Redland City Council
CC BY-SA 3.0 Toby Hudson
NEC builds IT career path for young, indigenous NT residents
“IT Apprenticeship Hub leverages our role as a major supplier of IT services to the Northern Territory Government to deliver value back to the communities we operate in,” NEC Australia managing director Alan Hyde said in a statement. “The programme is designed not only to deliver direct benefits to participating students, but also to develop a training framework and workplace culture that ensures NEC Australia staff can impart knowledge to apprentices effectively.” A NEC Australia Trainee and Apprenticeship Coordinator (TAC) will manage the initiative; build awareness amongst students, teachers and parents; and foster a participatory workplace culture.
Redland’s investment is part of an effort to improve information efficiency by consolidating information, facilitating collaboration and laying the foundation for unstructured data management. The system will be integrated with the council’s existing business applications to provide a consistent service delivery platform for Redland’s 136,000 residents. “We realised that we needed to consolidate our unstructured data into one central repository linked to our existing line of business systems,” said Redland CIO David Macniven in a statement. “This would also enable us to improve our management, and hence service delivery to rate payers. By implementing Objective ECM, we will unite our data and collaborate more efficiently, both internally and within the community.” The objective implementation ties in with the council’s ongoing program of change, in which it is realigning itself around a customerservice focus that is expected to improve transparency and auditability of documents. Information-level access controls ensure documents are only accessible by authorised employees. “Objective has over 25 years of experience in delivering information management solutions that meet the requirements of Australian public sector organisations,” said Objective CEO Tony Walls, “and we are committed to supporting local government. We are pleased that Redland City Council has selected Objective as a strategic partner and that they share our vision for the importance and value of information management.”
GTR NOV/DEC 2013 | 5
NSW Health preps cloud platform for e-business overhaul NSW Health’s services delivery arm, HealthShare, anticipates to boost the speed of regular payroll runs by four times in the wake of a decision to roll out a new back-end business environment to support its more than 140,000 workers. HealthShare announced that it would deploy Oracle Engineered Systems (OES), including Oracle Exadata Database Machines and Oracle Exalogic Elastic Cloud, to support its new deployment of the Oracle E-Business Suite, Fusion Middleware and Oracle Database.
The new systems will be implemented within new whole of government data centres, with applications expected to be migrated by the end of this year and systems in production by 2014. After a business analysis confirmed a direct link between reduced data processing times and increased efficiency of service centre operations and costs, the new architecture was chosen based on its promised performance, scalability, standardisation and ability to provision for future growth. The OES solution was expected to deliver six to eight times the computing performance of the existing platform, with HealthShare confirming that a proof of concept showed the Oracle environment was twice as fast as its nearest competitor. An Oracle Database-as-a-Service (DBaaS) offering will be delivered by HealthShare
on top of OES< providing a standardised and consolidated database for all manner of applications into the future. Other Oracle modules were chosen to complement the back-end applications: for example, Oracle Identity Management will enable single sign-on for all NSW Health staff. Oracle SOA Suite and WebLogic Server will provide a flexible middleware layer, while Oracle’s InfiniBand-based Sun ZFS Storage appliance will provide high-end integration requirements.
Transport Safety Bureau picks BlackBerry for mobile direction Ailing mobile vendor BlackBerry may have been written off by many industry pundits, but the Australian Transport Safety Bureau (ATSB) has thrown its weight behind the mobilemessaging stalwart by announcing it will equip its field investigators with BlackBerry Z10 and Z30 smartphones. The smartphones will be used for the recording of safety data, which includes filling in forms and taking photos, as well as for everyday communications. BlackBerry Enterprise Service 10 will provide messaging, security and broad access to the organisation’s mobility platform. “Being able to securely share real-time data from accident sites is crucial to our investigative role,” said ATSB chief commissioner Martin Dolan in a statement. “With BlackBerry 10, our investigation teams are able to navigate to locations, take and share high-quality photos, and collaborate on data from any site they’re sent to, all within a network that conforms to the high security standards that we need.” ATSB has a five-year relationship with BlackBerry, which has fought in recent years to stay relevant as nimbler competitors steal sales – and once-unassailable government contracts
6 | GTR NOV/DEC 2013
won on the back of BlackBerry’s perceived higher security – from the company. The BlackBerry 10 mobile operating system received US government FIPS 140-2 certification before its release, helping it score a significant deal with US Immigration and Customs Enforcement. BlackBerry 10 is currently being evaluated for secure Australian government usage by the Australian Signals Directorate (ASD), which if successful will add the operating system to its Evaluated Products List (EPL). “We chose BlackBerry 10 for its trusted security, ease of migration and cost-
effectiveness, which has overall helped the ATSB realise significant savings,” Dolan said. “We see this latest iteration of Blackberry’s mobility platform as an enabler of our own technology future, including plans to stream live video from investigations and if we choose to, support a broader range of device types within the organisation.” The latest smartphone market-share figures show BlackBerry’s market share has almost disappeared in the US as it fell out of the ranks of the top-five smartphone makers; the platform recently made a small resurgence in Australia, growing market share to a meagre 1.3 per cent.
NT government continues mainframe investment with coresystems upgrade
“Taking an early-adopter approach to technology has always been a priority for DCIS, particularly given our portfolio’s focus on immediate and reliable transfers of oftensensitive information.
The Northern Territory government will base its core database systems – covering functions including accounting, personnel management and vehicle registration – on an IBM zEnterprise BC12 mainframe that has been chosen over alternatives for its costeffectiveness and improved efficiency. The announcement, which reflects a four-year refresh for the government’s Department of Corporate and Information Services (DCIS), makes the NT government one of the first customers in the world for the revamped mainframe, which offers twice the capacity of its predecessor z114 and is designed to support high-end, Linux-based server consolidation for construction of private-cloud architectures. “With significant and rising transaction volumes across the department, our infrastructure needs to enable fast, reliable access to data which can drive down costs while also improving levels of service,” said Scott Thomson, data centre services director with DCIS, in a statement.
Following rigorous trials of the zBC12, both test and production systems, we’re confident that its significant advancements will contribute not only to our internal efficiencies, but to the quality of support we can deliver to the agencies that rely on us.” The choice of the IBM mainframe offers a shot in the arm for mainframe architectures that have progressively been abandoned by many one-time proponents of the technology. Yet despite year-onyear decline of around 40% in unit sales, according to recent Gartner figures, the growing number of MIPS being shipped suggest there is still demand for the highend, vertically-integrated systems – which will, many predict, play a significant role in cloud architectures moving forward. DCIS has been an IBM mainframe user for three decades. “We’ve typically run most of our government and businesscritical applications on IBM platforms, and have nothing but trust and respect for the technical expertise which their teams bring to the table,” said Thomson. “As the latest iteration in our technology partnership with IBM, we’re looking forward to the next level of cost and time reductions that the zBC12 will bring to our operations upon completion of the project.”
Noosa’s unified comms investment bodes well for hosted UC: Nexon Systems integrator Nexon is taking launch customer Noosa Shire Council’s decision to adopt its new Nexon Absolute hosted unifiedcommunications (UC) solution as an indication of strong latent government demand for modularised, pay-as-you-go UC offerings. Nexon Absolute is a cloud-based implementation of the Microsoft Lync 2013 UC platform, with the hosted platform delivered as a service and charged on a per-seat-per-month basis. It combines voicemail, video, audio, Web conferencing, instant messaging and desktop sharing capabilities and can, in line with its
cloud-based architecture, scale up and down as companies require. Noosa’s decision to adopt the Nexon Absolute offering came after time spent evaluating the solution and working with Nexon to address what Nexon unified communications business lead David Russell said were four key pillars of success for UC implementations. These included ensuring technology has the right level of integration into an existing IT environment, and is easy to support and manage; integration of the solution across different IT layers; the rollout of the UC solution
to address each specific business requirement with real, measurable ROI; and the need to address all of the varying employee profiles across a business. “With Nexon Absolute we have developed a UC service that successfully addresses each one of these challenges,” Russell said in a statement. Frost & Sullivan figures suggest the Australian UC market will grow at 13.9% annually through 2019. Implementation is still underway at Noosa Shire Council.
Designed to support public safety agencies and to increase safety and security for emergency workers, the digital network represents a significant upgrade to the analogue radio capabilities currently available within the state.
It will provide secure communications capabilities for Queensland and Commonwealth security staff, as well as for international security forces visiting the state for the G20 meetings. The network is “designed to reduce emergency response times by providing seamless interconnectivity between agencies,” Queensland minister for police and community safety Jack Dempsey said in a statement. “There will be clearer radio communication and better coverage at key public locations. It will also improve officer safety by providing for GPS enabled duress alarms and officer down alarms.” The network’s implementation will be overseen by minister for science, information technology innovation and the arts Ian Walker, and will begin later this year. Motorola Wireless is Telstra’s prime subcontractor for the project.
transitions and other virtualisation-related technology changes. “Like most organisations, councils experience a tremendous enthusiasm for technology from our customers,” Gregory Punshon, manager for information management and technology said in a statement. “We also feel the challenge of budgets: councils provide services to the community and every major investment in technology must be offset against some other service. As such, there is significant pressure for innovative solutions to increase what we provide while reducing the cost of providing it.” The decision to “step up” and lead the negotiations came as Gosford itself began extending its virtualisation commitment to consider the use of VMware View to deliver desktop virtualisation across over 600 staff desktops and laptops. This deployment will support efforts to mobilise its workforce with “improved mobility services and service delivery levels through centralised management,” IT systems administrator Byron Twilley said. “Without VMware virtualisation, it would have been far more challenging to deliver the services we provide today.”
Duncan Bennett, ANZ managing director with VMware, said in a statement that the company is “proud to be supporting this unprecedented collaboration between local councils across NSW and their joint bid to better serve their constituencies through bestpractice use of ICT.” “Since first working with them in 2008,” he continued, “we’ve had the pleasure of watching Gosford City Council establish itself as a true leader in public-sector IT innovation at the grassroots level, and we look forward to further assisting them as they set their sights on building a more mobile and resilient workforce.”
The Queensland Government has enlisted Telstra and Motorola Wireless in a 15-year project that will see a $457.3 million Government Wireless Network (GWN) built to support emergency communications across the state. The network will initially be rolled out in Brisbane, the Gold Coast and Cairns in time for the G20 meetings to be held in the state next year, then expanded across the rest of Queensland’s south-east for the 2018 Commonwealth Games.
Gosford leads VMware group-buying effort for 43 councils NSW’s Gosford City Council expects a volumepurchasing deal – sealed between it and 42 other councils with server-virtualisation giant VMware – will save up to $3 million on future use of the increasingly important VMware technologies. The deal with VMware, whose ESX Server virtualisation software is widely used across public and private sectors, covers a broad software portfolio including VMware View for virtual and mobile desktops and vCentre Operations for cloud and datacentre management. Gosford took the lead role in negotiating favourable conditions for it and 42 other of the 152 local-government areas in NSW. The group-licensing deal it negotiated will help deliver broad statewide technology objectives by giving all participants access to the core technologies to facilitate virtual desktop infrastructure (VDI), cloud-computing
8 | GTR NOV/DEC 2013
CC BY-SA 3.0, Ansend
Queensland government’s $457.3m statewide wireless network to be live before G20
for the public sector The 3rd Annual Social Media for the Public Sector Conference 2014 will provide the three tiers of government and the wider public sector with detailed information about how to strategically, meaningfully and effectively use social media to improve service and information delivery, communications and engagement with the community.
In 2014, attendees will:
• Obtain practical information that can be used to strategically build and manage their organisation’s social media presence.
• Hear public sector case studies showcasing the key learnings from successful social media usage and campaigns.
For more information and to register to attend visit www.govtechreview.com.au/publicsectorsocialmedia
Now Co-Located With
21 & 22 May 2014 | Melbourne
Government Mobility and App Solutions Conference
Mobile applications and technologies such as smartphones and tablets are changing the way that governments provide information and services and engage and communicate with the community.
The Government Mobility and App Solutions Conference will present solutions, practical information and case studies that will assist local, state and federal governments and the wider public sector to develop a strategic approach to mobile solution delivery.
For more information and to register to attend visit www.govtechreview.com.au/mobilityapps Super Early Bird registrations now
Call for Speakers now open.
Kim Coverdale Conference Convenor
available – visit the conference
To be considered for speaking program
p (03) 8534 5017
websites to register now and save
selection please send your proposed
e kim.coverdale@commstrat.com.au
(www.govtechreview.com.au/publicsectorsocialmedia)
presentation title, abstract of 100 to
(www.govtechreview.com.au/mobilityapps)
150 words and brief speaker bio to:
business Continuity
THROUGHOUT 2013, THE NSW PUBLIC ACCOUNTS COMMITTEE HAS BEEN INVESTIGATING WHY THE STATE’S DEPARTMENTS OF PREMIER AND CABINET AND FINANCE AND SERVICES HAVE YET TO IMPLEMENT RECOMMENDATIONS FROM THE AUDITORGENERAL WITH REGARD TO DISASTER RECOVERY. ● By Beverley Head
10 | GTR NOV/DEC 2013
“ALTHOUGH 70 PER CENT OF FEDERAL GOVERNMENT IT LEADERS SCORED THEMSELVES WITH AN A OR A B IN TERMS OF THEIR DATA BACK UP AND DISASTER RECOVERY PREPAREDNESS, ONLY 8 PER CENT FELT COMPLETELY CONFIDENT OF BEING ABLE TO RECOVER 100 PER CENT OF THEIR DATA IN THE EVENT OF A DISASTER.”
I
t prompted sharp words from the chair of the committee, Jonathan O’Dea in September. “It’s too late to find out if a plan works when in the middle of a disaster,” he said. “This needs fixing now.” In an era of e-government, where services and communications have increasingly moved online, the need for proven disaster recovery and robust business continuity strategies is clear. For many processes, there simply is no paper alternative to fall back on. Today’s technology – hardware and software – is more reliable than ever. Governments’ continued appetite for virtualisation naturally imparts resilience also as it allows workloads to be shifted should a device falter. A growing interest in and adoption of cloud computing at all levels of government is also supporting business continuity. But there is still the flood that can take out a data centre; the backhoe through a cable; the rogue meteor perhaps. There are no statistics to gauge how well prepared Australian governments are to ride out a disaster – but there has been some investigation of the situation in the US which makes for interesting reading. In June MeriTalk an online forum focused on government IT released the findings of its survey, Disaster Unpreparedness. What that revealed was that although 70 per cent of Federal Government IT leaders scored themselves with an A or a B in terms of their data back up and disaster recovery preparedness, only 8 per cent felt completely confident of being able to recover 100 per cent of their data in the event of a disaster. Many respondents also reported particular uneasiness about the resilience of data stored on mobile devices.
For governments the world over business continuity isn’t just about restoring power, or communications, or data – it’s about keeping information systems running so that Centrelink payments are made, waste is collected and schools can open. Despite the flak that they took from the Public Accounts Committee (PAC) this year, NSW State Government departments understand this keenly. When Government Technology Review approached the Department of Finance and Services for a response about the PAC grilling it faced in September, it provided a lengthy written response explaining in some detail how it was tackling the issue. At the heart of the approach is the State’s Digital Information Security Policy, which was adopted in November 2012. That policy mandates development of Information Security Management Systems that emphasise systems resilience and which comply with international standards including ISO 27001. According to the Department, “All agencies are required to have achieved compliance with the policy by 31 December 2013. Agencies must annually attest to their compliance, commencing on 30 June 2014.” The policy also sets out requirements for disaster and data recovery, noting that compliance with ISO 27001 should help in this regard. “Disaster recovery capability should be developed in conjunction with an agency’s business continuity program,” it reads. “This requirement builds on Treasury guidance TPP 09/05, Internal Audit and Risk Management Policy for the NSW Public Sector, which deals
with agencies business continuity planning as part of the broader risk management framework.” It also pointed to the embrace of more cloud computing in line with the policy released in early September. “Under the Cloud Policy agencies are required to undertake a comprehensive risk assessment in relation to the storage and maintenance of public sector information and records by a cloud provider. Depending upon the service type, business need and delivery model adopted, an understanding and mitigation of risks will be required, and as part of this, business continuity and disaster recovery plans must be well documented and tested. “The Cloud Policy outlines key provisions for agencies to consider in order to maintain business continuity and to ensure the ongoing availability of data. This includes contractual provisions and procedures for backup, restoration of services and disaster recovery.” Finally, the State Government’s twin data centers at Silverwater and Unanderra deliver natural redundancy by hosting a shared pool of computing resources in secure environments. NSW State agencies, local and shire councils are also being invited to source ICT services from these data centres, which in effect form a government cloud. At a federal level the Australian Government Information Security Manual (ISM, at bit. ly/176SnoX), which was updated by the Defence Signals Directorate in August this year, provides guidance on the issue – noting the need for agencies to develop business continuity strategies to deal with what might be termed “natural” disasters and those prompted by deliberate intrusions. GTR NOV/DEC 2013 | 11
business Continuity
TAKE THE WEATHER WITH YOU Business continuity is a particular challenge for local government w hich needs to support a broad slew of often widely dispersed and disparate services – from public libraries to council services; from waste collection to core administration. A series of devastating weather events over recent years have heightened the awareness of Queensland based enterprises of every ilk to the need for a robust disaster recovery plan and proven business continuity strategy. While Logan City hasn’t been hit as hard as Brisbane, Toowoomba or Ipswich, the district and its council are acutely aware of the need to be prepared. According to Jim Barclay, chief information officer of Logan City Council, the most practical approach to business continuity is to work out what could happen if disaster struck, gauge the impact of that, and then determine which elements of the business need to be restored in what timeframe. “There are always going to be limits on what you can put up from day one,” he said. “You need to look at what the business needs to run, and build backwards from that.” But he acknowledged that internal users and Logan City residents have rising
12 | GTR NOV/DEC 2013
expectations about the availability of services. Downtime is in the main entirely unacceptable. At Logan City Council the risk management team worked with external consultants to draft a disaster recovery and business continuity plan for the organisation, with input from managers of all areas including technology. Barclay says that plan is now reviewed each year, and an annual test is performed by simulating a particular disaster scenario. From a technical standpoint technical infrastructure and services have been spread across a number of different council buildings, there is an offsite disaster recovery facility, and the organisation has duplicate mobile communications networks, uninterruptible power supplies and diesel generators to keep systems operational during power outages. Barclay says every new piece of kit or service bought by the Council is also scrutinised with regard to its resilience. He says that in the future more comprehensive adoption of cloud based computing services by the government sector will make business continuity less arduous to achieve. Logan City, for example, already runs a series of externally hosted web applications which ensures that staff could at least access calendar information remotely should disaster strike. But he still believes that wholesale adoption of cloud services is three to five years hence. And on past form that’s plenty of time for a few more natural disasters to strike.
The manual stresses the need for individual agencies to determine which applications and services are critical and then offers a handful of practical suggestions – for example it helpfully recommends that in situations where there is limited bandwidth available agencies institute a policy to strip attachments from emails to maximise bandwidth available for critical applications. It also points to the additional insight available in the Australian National Audit Office paper on business continuity management, which is available at bit. ly/17aNUuC – although this 2009 resource pre-dates much of the Federal Government’s cloud computing initiatives.
Jenson Spencer is the recently appointed chief information officer at Queensland’s Department of Community Safety. Given the agency’s role, Spencer understands only too well that the information systems he and his team provide are critical – especially during a disaster. He is currently reviewing the Department’s disaster recovery and business continuity plan, and assessing the criticality of individual applications. “We categorise our applications into those that are critical for field staff or people in the department,” he explains. “This is more of an ongoing review that any IT department does periodically to make sure it is in line with business expectations.” At the nuts and bolts level, the Department runs a warm disaster recovery site which can be ready to take over all processing in a couple of hours and assesses the disaster recovery implications of any new system as it is brought on stream. It has also embraced virtualisation, with most applications now virtualised (with the exception of some legacy systems) according to Spencer – who sees virtualisation as a clear ally of business continuity, noting that virtual systems are “easier to manage and instigate if you fail over.” “It allows you to move from site A to Site B. It’s easier to manage and non-disruptive.” Queensland is currently undergoing a wholesale renewal of its information technology landscape under the aegis of Glenn Walker, the State’s executive director of ICT renewal, who has recently signaled the State’s intent to embrace more cloud computing which will naturally enhance the resilience of systems available to departments and agencies.
While Spencer is well aware of the State’s cloud computing plans, he does not believe cloud is appropriate for all applications, and where it is used he recommends organisations make sure they understand the disaster recovery plans of their cloud providers rather than simply accept their service level agreements. Kevin Noonan, research director in analyst Ovum’s government practice, believes that cloud based solutions will gain a greater foothold in all levels of government and particularly local government, especially as fast broadband percolates courtesy of the national broadband network. This will he says naturally improve the public sector’s business continuity capabilities. But he warns that – while agencies and councils often dusted off their disaster recovery and business continuity plans in the lead up to bushfire and cyclone season – “The human element is often missing.” Noonan says that when bushfires threatened Canberra in recent years agencies had “excellent technology policies – but no-one to turn the machines off.” Catering to the human element is part of the thinking behind a recently opened disaster recovery facility in Sydney. Established and operated by Nexon, the facility is part data centre, part standby office space. Director Barry Assaf explains that the facility which opened in Sydney’s inner west in January offers clients access to up to 50 workstations with a phone and a thin client where they can relocate key personnel in the event of their own premises being out of action. The data centre, meanwhile, can host clients’ computer systems, or provide access to applications on a hosted basis.
Nexon has so far signed six clients for the service, two of which have business continuity compliance requirements. Justin Bailey is Nexon’s lead on disaster recovery and believes the service would be well suited to the needs of local government. But he notes that having technical and physical infrastructure disaster recovery plans in place is only one part of effective business continuity which requires more holistic planning – including cascading communications systems to alert staff to their roles and where they might be working if disaster strikes. Technology vendor Emerson’s director of internet data centres, Tony Gaunt, says that with respect to business continuity, “the departments that are successful are those that know things do go wrong and will go wrong.” While he sees cloud computing as a natural ally of business continuity because of the nature of the beast, he warns that it’s not possible to claim that “if you are cloud ready you are disaster safe”. Public sector organisations instead need to assess immediacy and criticality of what needs to be achieved, what services need to be delivered – and “crucially what service levels it’s expecting to deliver” and work up a business continuity plan able to deliver against that. “Then set up the critical infrastructure – cooling, power, water,” he said, adding that the NSW Government’s strategy of duplicating infrastructure through two separated data centres was savvy. “The way business continuity is thought about now is that you can’t allow it to stop in the first place.” ●
BURNING PRIORITIES NSW Fire and Rescue runs one of the largest SAP implementations in Australia with 100,000 staff and volunteers having access to the system. But in the event of a disaster striking the agency’s information systems, it would only be the second cab off the rank for recovery, according to chief information officer Richard Host. The priority would be getting the 000 computer aided dispatch system operational. However with six layers of redundancy built into the system, and operations spread over three locations, “You would need a comet to hit the whole state to knock that out,” says Host. Given the agency he supports, it’s not surprising Host pays particular attention to disaster recovery and business continuity, describing the latter as his “number one priority.” Noting that “I can buy my way out of most problems, but I can’t replace data that’s been permanently lost,” Host says that the issue is treated with particular rigour, with every system tested annually along with a test of the agency’s Priority 1 situation plan. Fire and Rescue also has systems in place that would allow it to contact personnel using texts if they needed to relocate, and a business continuity plan that specifies who would be contacted and which are the most critical systems to be wound up in what order. “So, on that fateful day, we know where to go,” says Host.
“THE DEPARTMENTS THAT ARE SUCCESSFUL ARE THOSE THAT KNOW THINGS DO GO WRONG AND WILL GO WRONG.” – TONY GAUNT, EMERSON
GTR NOV/DEC 2013 | 13