Disaster Planning Essentials and Disaster Planning Checklist

Transcription

1 Disaster Planning Essentials and Disaster Planning Checklist BSSI2 /bssi2 I /company/ SECURITY FANATICS /infosecgurus I /company/

2 If your office building was destroyed by a fire, a lighting strike, a flood from a water main break or hurricane, are you confident that you could get everything back up and running again fast? What about a denial of service attack, non-recoverable server crash, hacker invasion or even a disgruntled employee determined to get revenge on you? If these questions make you feel uncomfortable, they should. Most companies find it incredibly frustrating when their Internet is down for a couple of hours yet they ll spend more time and money planning the office Christmas party than preparing for a disaster that could put them out of business. But We Have A Backup! You Say? That s better than nothing; but having a backup does NOT guarantee you could recover all your business processes and systems fast enough to prevent serious damage to you in lost sales, reputational capital, client relationships and legal consequences. It also wouldn t account for the following scenarios: Complete or total loss of your office building or the ability to access it Fraud, cybercrime attacks, theft or vengeance from a disgruntled employee Death or complete disability of a senior executive Complete loss of power, utilities or Internet connectivity for extended periods of time The protection and restoration of critical business FUNCTIONS (not just data) Oversights in your data backup (web sites, 3rd party cloud applications, overlooked PCs, etc.) Restoring your IT systems if EVERYTHING is gone due to a fire, flood, tornado, etc. The Difference between Disaster Recovery and Business Continuity and Why You Should Care Face it downtime is depressing, frustrating and downright dumb since it can so easily be avoided. You can t afford to lose business and customers because of failed computer systems. If you think data backup is synonymous with disaster recovery and you aren t sure what business continuity means, you re not alone. Most of the business owners we talk to make the mistake of not knowing the difference and end up paying the price when data is lost, a network goes down or a disaster prevents them from accessing their physical office and the server inside. The word disaster indicates a situation where business systems are no longer functioning, or where data has been corrupted, lost or otherwise made inaccessible. That could be something as simple as a server experiencing a non-recoverable failure (thereby corrupting or deleting the data on it) or an office building being destroyed by a natural disaster. It could also be caused by a cyber-attack, disgruntled employee or any number of other unforeseen, unplanned events.

3 A lot of business owners erroneously believe that because they have a copy of their data somewhere that they must already HAVE a business continuity plan in place and could be back up and running again fast. Not true. Data backup simply means that a copy of your data is replicated to another device or location. Tape drives, offsite backup and even USB devices provide data backup. Data backup is obviously important, but the more important consideration is whether or not your backup solution provides easy disaster recovery, which means not just data duplication but also the ability to recover all your files, software and functionality quickly, easily and without corruption. For example, if your server died, you wouldn t be able to get back to work quickly if you only had a file-level backup. In order to start working again, your server would need to be replaced, your software would need to be reinstalled and your data would need to be restored. Then the whole system would need to be reconfigured with your settings and preferences. This process could take hours or even days and that s if you have all your software licenses and a clean copy of your data. In many cases, if the data wasn t backed up properly, or if a business continuity system wasn t put in place, several days or even weeks can go by while data is recovered and IT systems are rebuilt and restored. Essentially, business continuity systems are PRO-active, where disaster recovery systems are RE-active. Then there s business continuity. This is the ability of your business to continue to operate even after a major disaster. For example, having a second Internet connection would be part of a good business continuity plan if you re highly dependent on and Internet access. If your main Internet provider was out, you d have a way to keep working uninterrupted. Cloud computing is also often part of a smart business continuity plan. If your data, , files and applications are hosted in the cloud, employees could continue to work remotely from home or in another location if your office building was destroyed or otherwise inaccessible due to a natural disaster, fire, evacuation, gas leak, etc. These days you have several options to help keep your computers running and your information available 24/7/365. Storage solutions that contain backed-up, redundant hard drives, like Network Attached Storage (NA) and Storage Area Networks (SAN) storage devices, help you recover in failure situations. At minimum you need to make sure you have the right backup and disaster recovery plan for your tolerance for downtime, and you need a plan for how your business could continue to operate if you no longer have access your building, server or data. You should review your plan annually. If you want a simple and easy way to get all of this handled, give us a call. We specialize in planning, implementing and managing these projects so you don t have to.

4 Disaster Planning Checklist Important! This checklist should only be used as a starting point for your Disaster Recovery Plan. This is in no way complete; we highly recommend you engage with a professional IT firm to map out a complete Disaster Recovery Plan for your business. Risk Assessment Define all critical functions, systems, software and data in your organization. Prioritize the above items in order of importance to your business (mission critical to minor) based on which ones, if destroyed, would have the greatest negative impact on your business. Create a document that outlines your current IT infrastructure (network documentation) so another IT person or company could take over easily if your current IT person wasn t available, or could assist in the recovery of your IT infrastructure in the event of a disaster. Determine the RTO (recovery time objective), RPO (recover point objective) and MTO (maximum tolerable outage) for every critical function and system in your business. Identify all threats that could potentially disrupt or destroy the above mentioned data, systems, functions, etc. and the likelihood of those threats. Mitigation and Planning Strategies Create an IT Assets Inventory list and identify all the functions, data, hardware and systems in your business. Identify all potential disasters and threats to these systems and functions. For each mission-critical system or function, brainstorm ways to minimize, avoid or limit the damage done. For the most likely disasters, create a disaster recovery plan specific to what damage could be done (tornado flattens your office, city evacuation, virus attack, etc.), and identify who will be responsible for executing the plan (your disaster recovery team). Identify a recovery plan and timeline for each function, and prioritize these functions by the order in which they need to be recovered if multiple mission-critical functions were affected. Create a backup strategy for your data and systems. Create a testing and validation strategy, and schedule tests for your backups. Define your communication plan in the event of a disaster to employees, clients, vendors and the media. Create a break the glass document that contains instructions on what to do if a key executive dies, is disabled or is otherwise unavailable for a long period of time. Review your current insurance policy to make sure you have sufficient coverage to replace the assets in your organization. Define a media communication strategy (how you will communicate with the press if a disaster happens). Summarize this into a disaster recovery plan and brief the disaster recovery team on the plan. Schedule a periodic meeting to review and update the plan with your disaster recovery team.

5 7 Disaster Planning Essentials 1) Have a Written Plan As simple as it may sound, just thinking through in ADVANCE what needs to happen if your server has a meltdown or a natural disaster wipes out your office, will go a long way in getting your business back online fast. At a minimum, the plan should contain details on what data and systems are most important, and a step-by-step process of how those systems will be secured, backed up and brought back online. Any good, professional IT person or firm can help you with this part of your disaster recovery and business continuity plan. If they can t (or won t) find someone who will. Here s a short list of what your Disaster Recovery Plan should include: An IT Asset Inventory of all hardware, software licenses and assets. Your IT person or vendor should have this anyway in your basic Network Documentation. If you don t have this, make sure you get one! A list of all the cloud applications you use, what data is stored there, how it s accessed (UN/PW) A process for how the data in these 3rd party cloud applications will be backed up to YOUR location to avoid losing it from the company closing, being hacked or having them simply deny you access to your data for any reason. This would include web sites, member portals, CRM systems, accounting systems, etc. A Break the Glass document of critical web sites, passwords and other information held only by key executives that are critical for running the business. If something should happen to that executive, you want to be able to keep the business running. A detailed process of how all your PCs, laptops, servers and other devices are being backed up AND who is responsible for backing them up and validating the backups through periodic test restores. A telecommunications recovery plan that would deal with a situation where all phone lines are down or your building is inaccessible. A high impact disaster plan for how your business would continue to operate if your building was inaccessible temporarily or permanently. A list of key vendors and their contact information. You should also have emergency contact information for each employee in case of a major disaster where you are unable to access your office and you must contact them at their home. Information about your insurance policies, coverage, contact information for the insurance provider, a copy of the policy, etc. You should also have documentation (receipts) and pictures of the assets in your office in case you need to submit a claim. Having this is proof that you actually owned the assets you are claiming.

6 2) When Writing Your Plan, Think Business Continuity, not Just Backup A HUGE mistake made by almost all business owners is thinking that having a backup copy of your data will enable you to be back in business quickly. Not so. Business continuity is the process of planning and systems to make sure your business continues operating after a disaster. We often see business owners shocked to learn that it may take 5-7 days, sometimes more, to get their operations back online and functioning because they only have a copy of their data. Don t make this mistake! With some simple planning (and help from your IT pro) you can make sure critical operations, and other functions don t go down for extended periods of time. 3) Automate Your Backups OFFSITE (to the cloud) If backing up your data depends on a human being doing something, it s flawed. The #1 cause of data loss is human error (people not swapping out tapes properly, someone not setting up the backup to run properly, etc.). Plus, local backups and tape drives are NOT secure and can easily fall into the wrong hands, be misplaced, lost, etc. That s why it s just smart to backup your data to a reputable, highly secure, highly available data center. Second, automate that backup so it runs automatically. We further recommend hiring a professional to set this process up and monitor it daily to make sure all of your data is being protected as expected. 4) Image Your Server or Consider Cloud Computing Having a copy of your data offsite is good, but keep in mind that all that information has to be RESTORED someplace to be of any use. If you don t have all the software disks and licenses, it could take days to reinstate your applications (like Microsoft Office, your database, accounting software, etc.) even though your data may be readily available. Imagining is simply a process of making an exact copy of your server and everything on it; that copy can then be directly copied to another server saving an enormous amount of time and money in getting your network back. Best of all, you don t have to worry about losing your preferences, configurations or favorites. To find out more about this type of backup, ask your IT professional. Another option may be to simply move your network to the cloud and eliminate the onsite server altogether. Cloud technologies are advancing fast, offering more secure and less complex and expensive options to purchasing and maintaining a server onsite. Plus, Internet connectivity is getting faster and more reliable, which is making it easier for companies to utilize cloud technologies to run their business. Best of all, cloud offers built in business continuity and backup.

7 5) Network Documentation Network documentation is simply a blueprint of the software, data, systems and hardware you have in your company s network. Your IT manager or IT consultant should put this together for you. This will make the job of restoring your network faster, easier AND cheaper. It also speeds up the process of everyday repairs on your network since the technicians don t have to spend time figuring out where things are located and how they are configured. And finally, should disaster strike, you have documentation for insurance claims of exactly what you lost. Again, have your IT professional document this and keep a printed copy with your disaster recovery plan. 6) Maintain Your System One of the most important ways to avoid disaster is by maintaining the security of your network. While fires, floods, theft and natural disasters are certainly a threat, you are much more likely to experience downtime and data loss due to a virus, hacker attack or human error (be it intentional or accidental). That s why it s critical to keep your network patched, secure and up-to-date. Additionally, monitor hardware for deterioration and software for corruption. This is another overlooked threat that can wipe you out. Make sure you replace or repair aging software or hardware to avoid this problem. 7) Test, test, test! A study conducted in October 2007 by Forrester Research and the Disaster Recovery Journal found that 50 percent of companies test their disaster recovery plan just once a year, while 14 percent never test and that s the companies who actually HAVE one! If you are going to go through the trouble of setting up a plan, then at least hire an IT pro to run a test once a month to make sure your backups are working and your system is secure, and revisit the plan quarterly or every six months. After all, the worst time to test your parachute is AFTER you ve jumped out of the plane.

8 Where Do You Go From Here? Creating a Disaster Recovery Plan is not difficult or expensive, but since most businesses don t have a clue where to start, we re offering a FREE Disaster Readiness Assessment and Consultation ($397 value) to the first 15 people who downloaded this report. At no cost or obligation, we ll come to your office to conduct an audit of your IT systems (security, backup and business continuity systems) that will determine your Risk Score and identify loopholes in your IT system s security, backup and business protection. This Assessment will go beyond simply looking at your backups (although that will be part of it). We ll also assess a number of common risk factors and known weaknesses that could put you OUT of business in an instant if disaster strikes. You re under no obligation to hire us as your to create an IT Disaster Recovery Plan for your business. Like the old saying goes, If you fail to plan, you plan to fail. By allowing us to do the hard work of putting together an IT-specific Disaster Recovery Plan, you ll greatly reduce the chances of losing everything you ve worked so hard to build in your business to a sudden, unplanned event that would be detrimental to your company s growth, profitability, reputation or survival. Sincerely,, Scott Bernstein, CPA President, BSSi2 Nick Espinosa Chief Security Fanatic CIO, BSSi2 BSSi2 Support: tickets@bssi2.com