IT Disaster Recovery Solutions: Create a Plan & Be Prepared for the Unexpected

Posted July 21, 2020

Disasters can happen to any company at any time. Depending on your physical location, you may be quite accustomed to dealing with some incidents such as hurricanes or wildfires. Yet, the unexpected can hit at any moment. It’s important to have disaster recovery plans in place, and IT is one of the most vital areas. You need both a disaster plan and the agility to apply an appropriate cybersecurity incident response to anything which might happen, whether it’s a weather incident, a public health disaster, or a data breach.

What is IT Disaster Recovery?

During and in the aftermath of a disaster, IT assets and data can be affected in a number of ways. Servers can lose power, and employees may be unable to get into the office. Data can be lost and resuming operations can easily be delayed. If data is permanently lost it can take weeks or months for a company to recover.

IT disaster recovery plans focus on ensuring the preservation of a company’s data and IP and the continuance of operations at the IT levels. IT is also a key part of business continuity plans, which might include ensuring employees have the equipment and bandwidth they need to continue work from a remote location if, for example, they have to evacuate the area.

Why is IT Disaster Recovery So Important Right Now?

The current situation, which is unprecedented in modern times, has put a spotlight on disaster recovery in general. However, the IT perspective is also very important because of the growing number of cyber attacks and data breaches. In 2019, there were 1,473 reported data breaches, with more almost certainly going unreported. Ransomware is also a huge and growing problem, but it can be particularly well mitigated with a proper cloud disaster recovery plan that includes protected backups.

The vast majority of companies cannot continue operations anymore if the “servers are down.” The first point of contact for most customers with a new service provider is social media or the company’s website. Email is perhaps the most popular method of communication. Without IT in progress, business can’t continue.

All of these factors make an IT disaster recovery plan absolutely vital for all companies.

What is in a Good Disaster Recovery Plan?

A good disaster recovery plan takes into account the kind of disasters likely to strike. Cyber attacks and public health are concerns everywhere, but other situations may vary. Civil unrest is more likely in large towns. Hurricanes hit a particular part of the country. Earthquakes also tend to fall into predictable zones.

However, there are elements that come into play regardless of the precise nature of the disaster. Your disaster recovery plan should include:

Your tolerance for downtime and data loss. How long can your website be down before your customers start to get mad? Which of your data is most important. If you make most of your money from e-commerce, then your tolerance is probably very low. If you are a face-to-face service provider such as a plumber or hairdressing salon, you might be able to go for a few days.
An inventory of hardware and software so you know what needs to be protected and what needs to be prioritized as you recover from the disaster.
A proper plan for who is responsible for what, including backup personnel if needed. It’s very easy for a key employee to end up injured or with no communications during a crisis.
Secure, protected backups. Too many companies rely on on-premise infrastructure for backups.You should always have your data backed up in at least two locations, one of them is far enough from your office to be less likely to be involved in the same event. For example, if you are in Florida, consider a backup location in the American Midwest. Off-site backups can be taken smoothly and automatically, but make sure your backup provider takes steps to prevent your backups from being encrypted or wiped by ransomware.
A backup worksite if possible. Alternatively, make sure you have systems and procedures in place that allow employees to quickly pivot to working from home, or their hotel room. This means ensuring there is enough VPN bandwidth to support remote work (a problem for some companies during the current crisis), working out how compliance requirements can be pursued. If remote work is not possible, you may be able to contract dedicated workspace on a temporary basis. Make sure that you contract enough seats.
Check your service level agreements and ensure that they have continuity and disaster recovery clauses in place. Your vendors need to be part of the solution.

Once you have a plan you need to test it, not once but regularly, and ensure that existing and new personnel from the CEO down are properly trained on what to do if a disaster happens. For many small to medium-sized companies, outsourcing to disaster recovery companies can be the perfect solution. Your business continuity and disaster recovery plans will benefit from expert help and disaster recovery solutions that are proven to work and customized for you. Make sure that your provider is always available.

What About Incident Response?

Your primary approach should be to plan for as many eventualities as possible. However, if an unexpected incident does happen you will need to be ready to analyze it and learn from it. Digital forensics is an important part of this; you need to be ready to collect and analyze digital artifacts for both internal and external investigations. In the event of an attack or breach you need to be ready to both provide law enforcement what they need and pursue your own investigations.

After the incident, you should always look at your plan again and work out where it did well and where it fell short. This is particularly important for events which you did not predict, but is vital even for problems that might occur regularly. How did your plan and people perform in the field?

Incident Response and Disaster Recovery

Being prepared isn’t just for large corporations. Your business is critical to you, so why would you treat it any differently?

It’s important to ensure that your business is resilient and is capable of recovering from not only a failure but also an attack. To this point, disaster recovery and incident response are tightly linked.

This cheat sheet gives insight into the fundamentals of what goes into creating effective incident response and disaster recovery plans.

Download