March 5, 2019 7:00:05 am

Planning for Disasters

By Jesse Rosales

What happens if you lose all your critical data tomorrow? It’s a question that all businesses should be able to answer with confidence. Everyone wants and needs to ensure their critical data is safe, secure, and recoverable. However, it is often one of the most overlooked parts of an IT security plan. Most IT providers offer a backup solution, but the way it is implemented and maintained is not always equal. In fact, two IT providers could use the exact same backup software vendor and yet the protection level that each client gets, could be drastically different. As I engage with SMBs from an assessment prospective, I typically ask the same 4 questions.

Do you have a documented DR plan or process, and has it been tested in the past 6-12 months?
Does offsite replication exist and to what frequency is it tested for data validity?
Do you know how long your retention policies for those backups are?
Do you know for sure that ALL critical business data is being covered?

The answers I typically get are alarming. 9/10 clients I meet with don’t have a disaster recovery plan at all. That makes me nervous in the year 2019 with concerns around an increasing number of security vulnerabilities, data breaches, and data corruption attacks. The most common answer I get to the other questions is, “I don’t know”. If you don’t know if ALL your critical data is being covered, replicated offsite, being tested regularly for validity, then you might as well assume it is not and that your data is at risk.

A true DR plan is not as straight forward as backing up data folders on a server. Other things that need to be considered are; acceptable RTO (time to recovery) and RPO (data loss tolerance), calculated cost of downtime or loss of data, and where data actually lives (mobile devices, hosted email (Office 365/ Google), an individual’s workstation/laptop or personal Drop Box account, etc).