A chief technology officer in a time of COVID-19: Keep calm and make the most of the whole business suddenly realising how important IT is

The suddenness and scale of the COVID-19 pandemic took many CTOs and CIOs by surprise as worries over the impact on a supply chain in China flipped, seemingly overnight, into a fight for corporate survival. Right now, I'm following the advice to stay home. Like many IT professionals, my day is filled with domestic desktop …

[Anonymous Coward]

Let's make something clear...

... this pandemic didn't strike on-premises data centers and turned them off. They keep on humming along just like cloud ones.

The only real problem are the pipes connecting those data centers to the rest of the internet - and many users connections as well to the internet.

Telco lack of investments outside big cities because ROI is measured in years instead of months, and government inertia about building a nation-wide fibre infrastructure for the XXI century means real broadband connectivity too expensive for many companies, and often not available to end users.

Even when such projects were started, some are failing among incumbent fights to maintain a dominant position, and lack of management capabilities to sustain such efforts.

Even if you put all your applications in a shiny-shiny cloud datacenter, it's quite useless if your users have to access it through slow ADSL lines that may have to be shared among family members for work or education. Even FTTC may be slow if you're away from the cabinet enough, or many concurrent users means a lot of cross-talk interference. 4 or 5G with a data cap will help up to a point - and cells can become saturated as well.

That's very different from the 1Gb/s LANs at the office.

And once the connectivity exists, there's little difference if you VPN into a company on-premises network, or access a cloud application.

CTOs and CIOs shoud ask their CEOs to make clear the deploy of a real broadband network is no longer "nice to have". And we can't wait for greedy telcos to deploy them.

[Doctor Syntax]

Re: Let's make something clear...

"... this pandemic didn't strike on-premises data centers and turned them off. They keep on humming along just like cloud ones."

In fact, the cloud data centres are on-premises. They're just somebody else's data centres on somebody else's premises. They're also working to somebody else's priorities under somebody else's control.

[Steve Button]

Re: Let's make something clear...

In fact, that's a pretty dumb comment.

"On-premises software is installed and runs on computers on the premises of the person or organization using the software, rather than at a remote facility such ..."

If someone says they will meet you at home, they don't mean "a home" they mean your or their home. It's implied in the context. When you say "on premesis" you aren't talking about the fact that the servers are on "a premesis" it means they are on "your premesis".

[LucreLout]

Re: Let's make something clear...

They keep on humming along just like cloud ones.

While that is certainly true, what they cannot do is uproot at the push of a commit and migrate lock stock to another continent, or mirror themselves there on hot stand by (not cheap however you do it). Right now speed of resurrection due to local issues will be important.

As other countries come in and out of lock down at different times, it may be desirable to ensure that the premises on which your data center reside is in a lockdown free environment.

I'm not arguing against on-prem, because for sure you should at the very least own a copy of your data there no matter what your cloud provider may tell you, only that you aren't comparing like for like in terms of datacenter agility.

[Anonymous Coward]

"And once the connectivity exists, there's little difference if you VPN into a company on-premises network, or access a cloud application."

Well, there is. Cloud apps access patterns are unchanged by covid-19, but VPN access patterns are a lot higher than in normal circumstances.

I found my company's VPN is very often saturated and unavailable, now. What is even worse is only some rare apps need VPN, but it seems everyone goes VPN for everything ...

[Anonymous Crowbar]

Re: Duff batch spotted

Split tunnelling is the answer. However some companies, mine included see that as a security risk.....

[Psmo]

Usually Exchange servers aren't internet-addressable, so people will tend to access the full VPN even if webmail is available and they don't need any other resources.

[IceC0ld]

Silver lining

Maybe !

so NOW it seems IT is seen as important, well that's nice

it would also be nice if we are still seen as important once this is over

[Korev]

Re: Silver lining

But we're always told we're important (right up until the point our jobs get offshored to Elbonia...)

[Anonymous Coward]

What about the Foot Soldiers?

Just been told of an instance where a member of a team in his 50's whose job meant he had to remain onsite has died as a result of the virus.

Everybody else in his team caught it as well, but luckily survived.

[Anonymous Coward]

Re: What about the Foot Soldiers?

Unfortunately that's exactly what happens to the Nursing/Doctors in your local hospital.... The difference being that have to wake up every day knowing that they will be walking into that environment.

[Cederic]

Re: What about the Foot Soldiers?

Fatality rates for medical staff appear to be below those of the general population at present, and significantly below those of bus drivers.

While I hope that healthcare professionals stay safe, I'm also not accepting their constant bleating about risks, dangers and PPE that they all seem to have in ample supply when they're out shopping.

[Geoffrey W]

Re: What about the Foot Soldiers?

And I'm not accepting your bleating about healthcare professionals complaining about their conditions. They are dealing all day with death and the chronically sick. If that was me I'd be clinically depressed and mad as hell if I wasn't properly equipped.

As for your last sentence...do you follow medical professionals around taking notes about what they wear in shops? How do you recognise them? The ones with the haggard expressions, red noses, and the haunted look in their eyes? I suppose you are seeing people still in scrubs so that must mean they have just put them on for the purpose of shopping, as opposed to them being too tired to remove old scrubs they have been wearing all day. Your compassion is overwhelming.

[bombastic bob]

Re: What about the Foot Soldiers?

why was this news UP-voted by anyone... ?

[Geoffrey W]

Re: What about the Foot Soldiers?

Just to spite you.

[Anonymous Coward]

As enterprises look at their expensive, empty offices, IT will be the enabler;

To be honest, for a lot of places Office365 will be the enabler. IT just need to plug in the usernames and email addresses, and set up SSO with other tools.

[Strahd Ivarius]

Office 365?

Only if you set up your laptops to use local egress instead of the central internet access point as most big companies do; which puts a strain on your VPN infrastructure that doesn't have the capacity to handle all the users connecting from home at the same time (and it is too late to order more hardware).

Don't forget also that unless you are working in a non-productive part of the economy you need something besides Excel and Outlook in order to work.

You need to be able to access your on-premises applications, and again the lack of VPN will impair your ability to work@home...

Very few companies have set up the needed infrastructure for working without VPN.

But for their IT one can expect to see the users being grateful.

(they were in the company I am currently working with)

[Anonymous Coward]

Agree, IT need to install VPN software as well, if they don't use cloud services. Office365 and VPN it is! And supplying laptops.

[Roland6]

>Only if you set up your laptops to use local egress instead ...

This implies usage of business grade/focused secure remote access providers and/or SIM-based VPNs (£££).

It does look like those 'savings' that cloud was supposed to deliver, will be spent on improving off-premise access to those cloud services. Which reminds me of BPR in the 90's: processes were re-engineered, services offshored etc. yet the overall IT spend didn't go down as much as everyone had suggested it would, in part because the money (and people) were available to undertake all those projects that had been waiting in the queue.

[Anonymous Coward]

>However, from the standpoint of the CTO, the incident that unfolded is unlike any disaster scenario we could have imagined or planned for

Nah, sorry. Any business of sufficient scale to have real disaster recovery scenarios should have planned for this. Global pandemic has consistently ranked #1 or #2 in national risk registers for as long as I've been doing this. Having even a skeleton plan for answering the question "What do we do if *all* of our offices close?" is not just prudent disaster planning, it's prudent business scale planning. The answer to that likely shares significant components with "What would we do if we needed to temporarily double our scale?" or "How do we facilitate flexible working?"

This can even happen by accident to many organisations through penny pinching. For example A Major Global Bank that I work with decided, several years back, that it didn't want to spend money on any more physical work space. Instead it decided to pinch some pennies and make everyone work from home 2 days a week. While a blatant penny-pinching/offshoring manoeuvre, the end result is their COVID response plan basically involved executing a straightforward `s/2 days/5 days/g` on the remote working policy (and some crash investments in VPN concentrators, but those heroics are a story for another time...). Because the business was already accustomed to remote working as BAU, it has ridden out this storm easily - the same goes for most of the global banks.

This was an unlikely event, but it was not by any measure unimaginable. That's *exactly* why you have a disaster plan for it. If it's a likely event it's not a disaster.

[anothercynic]

What AC says...

... I work for a tech company (nominally). Our services are still needed, but everything we do can be done online. Our senior leadership team are smart enough to look further than just their noses; they watched the trends in continental Europe and the Far East and surmised that it would only be a question of time that the UK would have to follow.

They started making arrangements weeks in advance for all non-essential teams to work from home where possible, arranged for equipment to be made available (and signed out) to those who didn't have such equipment at home, and also arranged for additional VPN capacity. Everyone was told to check that their VPN access worked.

And then... when the lockdown announcement came, it wasn't too big a surprise for all of us. We simply stayed home, logged into work from there and did our jobs. And things continue to tick over. Those in the organisation who have to perform emergency maintenance are given the right tools to avoid exposure to infection where possible. We haven't gotten to the point where we're testing that theory yet.

[Adair]

Good post, but I disagree with your last paragraph: This was an unlikely event, but it was not by any measure unimaginable...

A global pandemic, especially of a SARs type, was/is a 'likely' event. In fact it is a certainty; the problem is its infrequency and the difficulty in predicting it. On that basis, anyone doing DR for serious money or with serious intent should have had this one on their list of 'Must Do's, and hopefully ticked off as 'Done' (as far as Finance and senior Manglement allowed).

[Doctor Syntax]

"How do we facilitate flexible working?"

For some managements the answer to that will have been "Over my dead body". This is probably being revised PDQ as they realise the - errr - implications of that.

[Anonymous Coward]

"Any business of sufficient scale to have real disaster recovery scenarios should have planned for this"

Yep, even if they hadn't specifically planned for a pandemic specifically, they should have planned for the broader worst case scenarios. What happens if "something" happens so none of our sites are accessible, or if "something" means our revenue drops to 0 for a while.

It's what I thought when Wetherspoons boss Tim Martin commented how them losing all the revenue was completely unforseeable. Of course it was forseeable it's essentially the worst case scenario, but you just assumed it wouldn't happen and didn't plan for it.

[LucreLout]

However, from the standpoint of the CTO, the incident that unfolded is unlike any disaster scenario we could have imagined or planned for

Any business of sufficient scale to have real disaster recovery scenarios should have planned for this.

Yep - my bank has carried on just fine - no interruptions. Everyone has laptops, the VPN was already in place, the DC is hybrid (some on prem some in the cloud), so we've mostly been fine.

A well designed plan will cater for a flexible range of reasons why you can't access the office - it could have been flooding, it may have been power, it could have been terrorism - all of these are just events that have happened in one place or another in the UK in the last couple of years and should have been in the DR plan.

Further the article states:

As we prepare for the next pandemic, we should look closer at robotics and process automation.

Any CTO that hasn't already been investigating and implementing this has been stealing from their employer. Sorry if that sounds harsh to the author, but its totally true.