Disaster Recovery: preparing your business to survive the worst!

Just stop and think: even if your company's core business is not technology, your entire operation depends on technological resources to operate. Computers, notebooks, tablets, smartphones, servers, printers, backups saved on external hard drives, phones... And, of course, the company possibly has a digital presence: at least one website, profiles on major social networks, and it uses the web, whether via e-mail or any other method, to communicate with customers, suppliers, and partners.

This is only natural. Currently, we are in the middle of the information technology era, which makes our professional life a lot easier. However, on the other hand, as reliable as it may seem, the slightest slip can trigger a crisis capable of interrupting the operations of the entire company. This “slip” could be human error, a natural disaster (floods, earthquakes, etc.), a general blackout, or, of course, a cyberattack. A good example is ransomware.

Overnight, critical data becomes inaccessible, communication is disrupted, and critical applications cannot be used. What can be done? Give up and leave it to fate? Of course not. To get around such situations and to return to normalcy as soon as possible, it is essential that the company have a Disaster Recovery plan. Unfortunately, many businesses do not have one.

Steps for a good plan

Disaster Recovery is the name given to the strategic plan that lists a set of actions to be taken to prevent, survive and remedy a crisis. We are talking about a series of policies and procedures that, a priori, are designed to prevent a disaster from occurring. However, this set of rules also lists actions to be put into practice if something goes wrong, so that business continuity is guaranteed, and any errors that arise later can be corrected to prevent them from happening again.

It is, roughly speaking, a true survival guide. And, like any survival guide, it should be written with great responsibility and parsimony. The first rule when creating a successful disaster recovery plan is that it must be built around the real threats your corporate ecosystem may face. No company is the same, so corporation X may be more likely to suffer from a particular problem than corporation Y. Understanding what risks you are vulnerable to is critical.

The Disaster Recovery Plan (or simply DRP) should then be created following these three steps:

• Crisis Management: the actions that must be taken to fix the problem;

• Maintenance of Operational Continuity: routine actions to ensure the correct functioning of services;

• Service Recovery: the restoration of affected assets, such as lost data, broken hardware, corrupted information, etc.

Remember that, of course, DRP is not a perpetual strategy — it should be constantly updated as the company adopts new technologies and new risks to business continuity are identified. After all, imagine yourself trying to survive today with a guide written ten years ago!

Technology is an ally!

When we talk about disaster recovery, it might even seem like we're telling you that we can't trust technology because it's unreliable. Make no mistake... This is not the purpose of a DRP, just as the existence of airbags does not mean that we should stop using cars to get around. New technologies that have appeared on the market can help you (and a lot!) devise your plan.

Cloud computing, for example, is a much more flexible, scalable, and reliable way to store your backups, with a much higher uptime (availability) rate compared to on-premises servers. Several solutions available on the market make backup copies and assist recovery in an automated way, reducing the time needed to remedy a crisis. In addition, IT governance frameworks and models can be very helpful.

And, needless to say, user awareness is also very important before, during, and after a crisis, as all employees are properly trained to act according to the plan. That is why it is important to educate them and ensure that the entire company is aligned with the security strategy.