Disaster Recovery
With the recent furor over bird flu, many companies -- including my employer -- have been revisiting their disaster recovery plans to consider what they would do to maintain business continuity during a pandemic situation.
The general consensus is that in a pandemic situation, there would likely be a state of emergency declared and "nonessential" workers would be asked by the government to stay home (where "asked," as is customary for government, means "forced.") So what does a company do to continue operating when all of its workers have been declared "nonessential" and can't come to work? Why, they just have everyone telecommute, of course!
Or so they believe. There's nothing like a disaster recovery exercise to show how technically unprepared companies are for a large number of remote workers. The technology is available, but companies don't have the infrastructure to handle everyone using it at once, and for the most part, they've never considered this.
Here's an example: a company has 3,200 people set up to work remotely. A VPN infrastructure is in place, and these people routinely connect via a secure tunnel, using a secure authentication method, and work from home or other locations. Sounds like they're well-prepared for a pandemic situation at corporate headquarters.
But... how many of those people can connect at one time? Supporting 3,200 total users is very different from supporting 3,200 concurrent users -- a userbase that size may require a VPN concentrator that supports only 100-500 people at a time. In addition to the concentrator, though, there are a lot of other parts of a remote-access infrastructure that need to be considered. Is the network backbone able to handle the full number of remote users connected at once using relatively high-bandwidth technologies like Remote Desktop? Are terminal servers used for remote access, and if so, can they handle that many simultaneous users? How many sessions are licensed for these terminal servers? Often, companies have only paid Microsoft for so many terminal server users, even if they have the technological capability to handle more. Can the help desk support all the calls that would come in from people who haven't used remote access in two years and are suddenly expected to do all their work that way? Can help desk support them when the help desk employees are also stuck at home for the same pandemic situation?
Part of being prepared for a situation like this for a company involves not just verifying the infrastructure, but also verifying that everyone who in theory can remote in has actually tried it. When the help desk is closed and people can't come in to work is not the time to discover that half the support staff has no idea how to use the VPN client, and another 15% of them have expired passwords or smart cards or tokens.
Any large increase in telecommuting could require upgrades and preparation work of this type, but a pandemic could force companies to do so in a rather sudden manner -- and pandemic preparation may cause companies to do such work in advance (indeed, as a secuirity architect involvement in such preparation is part of my job.)
While I certainly hope that a disease pandemic doesn't actually come to pass, I can't help but be curious as to what the effect it would have on the work environment would be. I can see two likely outcomes (both of which would likely happen to varying degrees):
- Some employees, after telecommuting for a week or two, would discover that they are every bit as capable of performing their jobs from home as at work. This could greatly increase the demand for alternative working arrangements, as some people discover that they like such an arrangement. Of course, it wouldn't be for everyone -- many people would be eager to get back to the office, foreign as that concept is to me.
- Managers faced with the sudden absence of many of their employees might find out that far from needing all of them at the office, they don't need all of them at all. I wouldn't be surprised to see several employees being quietly let go in the months after a disaster scenario as the company discovered that they can do without them. (This, by the way, is one reason why some people advise against taking any vacation longer than a week.)