Backup Look at Your Disaster Recovery Plan
Importance of Disaster recovery plan
In our experience, speaking to customers we’ve found that while there’s an increasing awareness around Disaster Recovery and the necessity to have a disaster recovery plan, the scope of such plans tends to be quite limited. Many Disaster recovery plans invariably limit their scope only to mission-critical servers. While this may sound good in theory, the limited coverage could mean that in practical cases, it could take weeks or months before an organization is able to come back anywhere close to its original level of productivity.
Some of the reasons for this could be due to limited budgets and a “let’s do the best we can for now” approach. But Disaster Recovery strategies are still heavily influenced by principles that are rooted in philosophies that were extant in the early years of this millennium – roughly from 15 – 20 years ago.
Disaster Recovery Strategy
The data landscape has changed radically since then. In the last 10 years, 2 disruptive forced have upended a lot of traditional assumptions around DR. One is “cloud” (in the form of SaaS) and the other is “mobility” (in the form of tablets, smartphones, and thinner laptops). A lot of data that traditionally sat in captive business data centers has now moved either into the cloud or to user endpoints. DR strategies aren’t complete without consideration of this data set (end-user data) which can account for as much as 70% of a company’s data assets.
Also, traditional DR planning tends to classify only natural events (such as an earthquake, fire, or flood) as disasters. Modern times have introduced us to disasters such as ransomware attacks and insider threats. One could argue that a hefty penalty from a regulatory body for falling afoul of data retention requirements also qualifies as a disaster.
On average, businesses lose over $100,000 per ransomware incident due to downtime and recovery costs. And on the flip side, 96% of companies with a trusted backup and disaster recovery plan were able to survive ransomware attacks.
Let’s look at the new data for a bit.
SaaS Assets
There is a general tendency to believe that data in the cloud is automatically safe. While moving to a SaaS solution does reduce the considerable burden of maintaining an on-premise server, it doesn’t really relieve a business of the responsibility for ensuring the protection and security of business data resident in SaaS. Almost all cloud-based software vendors work using the principle of a “shared responsibility model”. This means that while they take responsibility of certain aspects like uptime, connectivity, patch management, etc., the burden of ensuring that your data is protected and safe still belongs to you. Basically, it turns out that while you can contract away from the chores that are part of maintaining servers, you can’t contract away accountability.
Endpoints
Endpoints are usually a tougher sell for DR internally, but they are also the most likely vector for malware like ransomware. Employees tend to work offline and have working copies of their most recently changed data sitting on their endpoints – making this data especially vulnerable. In our opinion, a disaster recovery plan isn’t complete without factoring in endpoints.
The common reasons one hears for not having a disaster recovery plan for endpoints are as follows:
- My users store all their data on the company server (really?)
- I have my users do their own backups (Will fail regulatory compliance every time and leaves the company wide-open for insider threats)
- My users sync all their data to the cloud (same as above)
- Backup software will slow down my system
The last one is a myth that has been perpetuated over decades. A modern, properly configured backup agent with appropriate A/V whitelisting and with features like delta incremental, network bandwidth throttling, etc. will hardly register its presence, while still providing industrial-strength protection.
Disaster Recovery Solutions
If you are responsible for designing your company’s disaster recovery plan, ensure that you’re factoring in SaaS and endpoint assets. If not, you’re possibly addressing no more than 30% of your data.
Invest in a solution that can not only handle servers but also handle SaaS and endpoints. If you don’t find a single solution you like, don’t compromise. Invest in best-in-breed solutions that are good at handling those workloads.
Look for solutions that you can manage centrally and where the backups are scheduled and are automatic. If you’re backing up to the cloud, ensure that the backup solution is not only doing data encryption but is ensuring that you have control over the backup encryption process and the keys.
For some pointers on how to pick a good backup solution, read my blog from earlier about backing up endpoints to OneDrive for Business
An effective business plan needs to include disaster recovery (DR). Are you responsible for DR in your organization? Are you currently crafting a plan? Even if you’re not, we hope this post helped in broadening your understanding of DR.
To learn about Parablu’s Disaster Recovery backup solution click here
Please feel free to reach out to us with questions or simply to exchange opinions on the topic. Just write us at info@parablu.com. We’d love to hear from you.
