On the night of 9–10 March 2021, a major fire broke out at the Strasbourg campus of the French company OVH.
OVH (On Vous Héberge – We Host You) is one of the most important cloud service providers in Europe. The flames hit several of the company's data centres, causing numerous service outages for its customers.
In particular:
- Tens of thousands of web pages hosted on OVH servers went offline;
- The email accounts of thousands of users became inaccessible;
- Numerous companies, start-ups and public bodies found their services “down”.
On social networks, a multitude of users criticised the company and its CEO, threatening compensation claims and complaining about the damage suffered. Understandable reactions which, however, should make us stop and think. Is it normal for a fire in a single data centre in Strasbourg to have such a significant impact on our business? What can we do to prevent a similar scenario in the future?
Here, then, are a few lessons we can draw from this catastrophic event.
1. “Zero” risk does not exist, just as the perfect supplier does not exist.
The first reaction after the incident may have led many to think: “I was wrong to choose OVH! I will change supplier.” In itself, this is not an incorrect line of reasoning, and selecting a supplier on the basis of quality is never a mistake. Indeed, you should only use suppliers that offer the greatest guarantees in terms of reliability, security and compliance with Italian and European regulations.
On paper, OVH had everything in order: ISO certifications, business continuity and disaster recovery plans, and a clean track record.
Consequently, those who chose OVH did not make a mistake. This is where the first great lesson comes in: “zero” risk does not exist. Even the most reliable of national and international suppliers can only try to “minimise” risks (of fire, flooding, blackout, cyber attack and so on).
Eliminating risk entirely is impossible, and anyone who promises it is either lying or acting in bad faith.
So how can you protect yourself? To answer this question, let us move on to lesson number 2.
2. Don't put all your eggs in one basket
Given that there is no perfect supplier, that even the most reliable and certified cloud service provider could disrupt our business and that eliminating risk is objectively impossible, it is essential to focus on “risk minimisation”.
There is no magic formula or standard procedure for making your business more resilient, and the strategy to adopt depends heavily on the type of business you run.
For example, if you rely on a single cloud provider for your company data backups, you can consider making redundant backups using the services of different providers. If for some reason we absolutely do not want to replicate data using cloud services offered by multiple providers, we need to check that our provider makes redundant backups in data centres located in different, adequately distant physical sites. This is to prevent a catastrophic natural event (earthquake, flood, etc.) from damaging sites that are geographically close to each other.
In any case, one of the objectives to set is to reduce as much as possible our business's total dependence on a single cloud service provider. Besides applying to cloud services, this common-sense rule should be applied to all of our business's suppliers.
3. The cloud is not a cure-all
Don't get us wrong: Argo is an enthusiastic supporter of cloud services. However, in some cases, it may be wise to opt for hybrid solutions.
This is both because not all businesses are served by ultra-fast fibre-optic networks - and therefore, in the case of demanding data recovery operations, recovery times could be longer - and because having a copy of the data always available and easily usable even without an internet connection can help us when a disruption is caused not by the cloud provider but by a malfunction of the data network.
If you want to know more, we recommend our guide to private cloud solutions: https://www.argobs.com/private-cloud-unaffidabile-soluzione-di-backup-per-aziende-fotografi-e-videomaker/
4. Rely on an external company to make your business more resilient
After examining the risks of excessive dependence on a single cloud service provider and analysing the benefits of more resilient solutions and redundant systems, business owners very often realise that they do not have the in-house skills to increase their organisation's resilience.
Even where a company already has an IT manager, internal or external, our advice is to turn to cybersecurity professionals who are able not only to draw up but also to implement effective business continuity and disaster recovery plans.
If you suffered service disruptions from the OVH fire or have realised that your business is overly dependent on a single cloud service provider and your goal is to make your organisation more resilient, write us an email or call us and we will get back to you as soon as possible to plan an intervention at your company premises or professional practice.