Disaster Recovery Plan and Why it May Fail.
In an event of a disaster, corporates usually face hurdles to bring back IT Systems to normalcy.
WRONG decisions are mostly done at the point of failure.
When disaster strikes, organisations are gripped by so much panic that sometimes critical job functions are overridden by incorrect management decisions regarding what needs to be done right away and what could be held up and dealt with later.
This, in many instances has aggravated disasters that could otherwise have been easily handled had disaster recovery plans been meticulously adhered to.
In recent times big strides have been taken to protect data from damage and total loss at an individual level. There is now a good chance of recovering a better chunk of one’s individual data in the eventuality that the undesirable happens.
It is on the corporate front that a problem still persists due to large data volumes handled on a day to day basis.
Organisations now store their critical information in data centres and centralised repositories, mobile devices and the cloud.
Mobile devices receive and transmit this information on the go.
Network infrastructure becomes a backbone to this linkage as it enables effective communication between these entities, all things being equal.
What if this infrastructure was to go down at some point? What if an attack crippling the network was to occur? Would you have an effective fall-back plan to recover sufficiently, and to reasonable levels of production without further aggravating your vulnerability against a fall up attack of the same nature.
Furthermore, and long would you take to restore normalcy to your critical infrastructure and business function?
These are questions that demand answers before we even attempt to tackle the issue of disaster recovery. But just what is it that we are calling disaster?
Disasters come in many forms with different impact levels on businesses. Some could be natural, like floods and other natural disasters. Others could come in the form of electrical fires, broken water pipes and failed air conditioning units.
According to Margaret Rouse, “A disaster recovery plan (DRP) is a documented, structured approach with instructions for responding to unplanned”.
This stepwise plan is composed of precautionary measures to minimize the effects of a disaster so that mission-critical functions can be restored in the quickest time possible in case the undesirable happens. DRP strives to analyse business processes and continuity needs.
In a bid to come up with a detailed DRP, corporates need to perform a business impact and risk analysis as well as ascertaining the recovery time objective.
In crafting and implementing the recovery strategy, organisations should consider such issues as, budget, human and material resources, physical facilities, management’s position on risks, available technology, data and supply chain.
New technologies that can make it easier to recover from disaster should be taken into account.
Let us take an instance to visualise what would happen today if disaster was to hit your organisation.
What would that action you take to recover be? How much loss would be envisaged? What could result in your disaster recovery plan failing be it natural or artificial, actual or simulated?
Information Security practitioners do not actually believe that their disaster recovery plans and solutions may actually fail when the need to invoke them comes.
The desirable scenario is for corporates to plan and prepare as well as test such eventualities for protection against the embarrassing scenarios of lengthy IT downtime that prevalently persist in information systems.
Budgetary constraints are the top-most hindrance to adequate DRP. Lack of planning in this regard can have untold repercussions if disaster was to strike today.
DRP is not prioritised as an essence to business drive and machinery but it is only on the day that all hell breaks loose and corporates risk losing out on all that they have invested in, be material, finance and human resources.
Human and material resources should adequately be set aside to respond to disasters and everyone has to know their roles and who to contact in any emergency. Our human resource should have adequate training to enable them to react accordingly.
Physical facilities that house our physical business arsenal should be adequately secured and have proper access channels in case of emergency.
Strategies and plans should be well documented to resuscitate business function in case the primary physical location has been hit by disaster for example fire has gutted down the infrastructure housing our data centre. Do we have an alternate site where we can fall back to? If so how often is it updated and replicated or synchronised to the primary site.
Data backup is a prerequisite for any system to function without hitches. Do we carry out regular backups and if so, have they ever been tested for integrity and functionality.
Are they in the required format so that they can be summoned to functionality once the primary data gets compromised?
Management’s position on risk is a big factor in DRP. Organisations have to weigh their risk appetite and determine to what extent they are willing to risk and what is paramount to the organisation in terms of what needs to be restored first in case of disaster.
What are the critical systems that the organisation needs to protect?
In this vein organisations have to play around with available technology and continuously update to meet current business and technology needs.
Obstacles to good DRP that could result in failure include but are not limited to data volumes and bandwidth restrictions, false DR test reports, reluctance to invoke DR solutions. Many companies are either slow or reluctant to use their Disaster Recovery solution at the point of failure.
Why then are we faced with costly and business crippling IT downtime incidents?
Human limitations rather than technology limitations sometimes becomes the obstacle. Why not outsource Africom services and stay connected.