Posts

Business Continuity

Risk and Reward – Protecting the Value of Your Business

Business ContinuitySeveral weeks ago, in a town not far from our headquarters, a massive fire destroyed a building housing six small businesses.  Our local business journal followed up a few weeks after the disaster with a poll asking business owners how prepared they are for a major disaster.

  • Fewer than 50% of responding business owners feel that they are fully insured, have an emergency plan, and could be up and running in a few days.
  • 39% feel that it could take a month or so, but they could eventually reopen
  • 17% felt they would be out of business or would required state and local aid to survive

While not a scientific sampling, the results are alarming.  Alarming for a few reasons:

  • Even with insurance, it can take days or weeks to get authorization so you can move forward with your emergency plan.  Securing a new location and replacing fixtures, inventory, etc. takes time, as does recovering computer systems and data.
  • More than 50% of businesses closed for 7 days due to a disaster fail within 6 months of reopening.  While many businesses might re-open in a month, the future will be challenging.

Your Risks are Yours

A major fire in a block of retail and service businesses creates specific challenges, as do storms and floods.  Many more businesses, however, experience disasters equal or greater in scope even if they do not have the same level of physical damage. Some examples we have seen.

  • A distributor of customized office supplies lost all electronic business records for the past three years when they where hit by ransomware. The attack corrupted their on-site backup servers as well as their main file and database servers.
  • A news publisher lost all of their physical servers, firewalls, and networking equipment when a sprinkler head failed in their small equipment room.
  • A small plastics manufacturer lost the ability to use their process control systems when embedded Windows workstations were corrupted by a malware attack.

In each of these examples, businesses with customer commitments, production schedules, and deadlines were idled for days. For some, full recovery can take months.  Beyond the hard cost of recovering systems and data, these businesses suffered from soft cost losses.  Missed customer commitments, delayed invoicing and collections, and the time employees spent on the recovery effort all have lasting impacts on your business.

Business Continuity is a not just a good idea, it is a responsibility. 

As business owners, our employees, vendors, and customers count on us.  While people can empathize with the impact of a fire, there is less understanding for businesses that fall victim to cyber crime.  Malware, phishing, ransomware and other attacks are generally preventable when your team is alert and aware of the risks and when you put reasonable identity, data, and system protections in place. And since no protection is perfect, you need to be able to recover quickly enough for your business to continue operating smoothly.

Here is some food for thought:

  • Know Your RTO:  Understand how quickly your business needs to Return to Operational.  Maybe you can work on paper for a few days. Maybe you need to be up and running in a few hours because you are at a standstill until systems are back online. Your RTO goal will guide your decisions on what protection and recovery/continuity services are the right match for your needs and budget.
  • Assess Your Risk: Understand the different disaster scenarios and how they may impact your business.  Think about physical issues, such as loss of power and catastrophic system failures, as well as other disruptions, such as cyber attacks and potential actions by a disgruntled employee.
  • Watch Your Flank: Asses how different types of threats could impact your business.  We are beyond hiding our computers behind firewalls. We still have physical threats, but we also have threats focused on networks, user identities, access control, third party services, and data sources and services. Each threat vector needs a plan for protection, response, and recovery.
  • Factor in Humanity: We used to talk about balancing security with ease of use.  Today, the humanity equation is different as most IT disasters take advantage of human factors like our fundamental desire be helpful when asked. In many ways, your team is your best defense. They need to understand the risks, the methods of manipulation, and the signs that something is not quite “right”.  Your team needs to understand the value of inconveniences like multi-factor authentication and enhanced privacy and access controls — that these protect them as well as the company.

Your next step.

Contact us.  It is time for a serious conversation about protecting the value of your business.  A basic assessment of your business continuity profile will identify risks and gaps. From there, we can discuss improvements and their business value so you can make informed decisions that balance your risks, needs, and budget.  Business Continuity solutions — from disaster prevention through recovery — do not need to bust your budget.   For most business, changes in security settings on existing systems paired with modest, incremental services provide the protection and recover-ability you need.

Ransomware: Prevention versus Cure

Looking at the frequency and scope of ransomware attacks, and the number of small and midsize businesses falling victim, we remain surprised at how many SMBs are not yet taking steps to prevent the problem.

A Ransomware attack with no data loss can still cost your business $1,500 per employee, or more, in recovery costs and lost productivity.

Back in July, our 3T@3 Webcast focused on Ransomware, we published a Business Guide to Ransomware.  Both highlighted the need for CPR:

  • Communicate:
    • Educate and train employees on how not to fall victim; provide clear policies and procedures that reinforce positive behaviors.
  • Prevention:
    • Deploy technologies in support of your policies and procedures with multi-layered protection against malware and, specifically, ransomware.
  • Recover:
    • No prevention is perfect; have backup and continuity systems in place that enable a quick return to normal operations.

While most of the SMBs and schools we speak with understand and have some of the prevention and recovery solutions in place, the up-front education is missing. These businesses and schools remain vulnerable targets.


Earlier this October, we announced a strategic partnership with Privacy Ref, offering affordable Privacy Solutions for SMBs, including a subscription-based Privacy Education Program. For a small base fee and $10 per employee per year, we help ensure your team understands the risks, the importance of awareness, and how to avoid becoming a victim.

For a fraction of the cost of an attack, you can empower your team to avoid and prevent it from happening.

Contact us for more information.


 

 

Changing the Focus on Backup Protection

Recovery-Point-Objective-RPO
As we’ve stated before, “Backup is easy; Recovery is hard”.  Every business should, at this point, understand the risks of poor data backup and protection. The risks come from the types and amount of data that is lost and, if it can be recovered, how long that recovery takes. And remember, recovery often takes more effort than simply restoring files from a backup set.

Perspective = Priority

When looking at how well your backup system is protecting your business, two factors should be top of mind:

RTO: Recovery Time Objectives — How long will it take to return to normal operations. RTO is not just the time it takes to load your data back onto your systems, RTO includes the time it takes to repair and recreate damaged information and data created or modified since the last backup.

RPO: Restore Point Objectives — Your RPO determines how much data you are willing to lose, or can afford to lose. Most small and mid-size businesses backup daily. On average, a system failure will result in half a day of lost data. For an office worker editing a report, this is traumatic and inconvenient. For a manufacturer or retail business, half a day can represent hundreds or even thousands of orders and financial transactions.

As always, quicker RTOs and smaller RPOs come with trade-offs.  Recovery methods like image snapshots, for example, can provide rapid RTOs and small RPOs. In exchange, you are likely losing granularity — the ability to recovery individual files.

Understand the reasons  you are protecting your data.  Protection from system failure, in which you need to recovery a full server, lends itself to imaging and other snapshot methods.  Recovery of files or data lost to program error, malware, or user activity, needs a solution with granularity.

Start with an understanding of the type of protection you need and your RPOs and RTOs.  From there, you can pick the solutions (yes, you may want or need more than one method) for recovering data and your business.


We offer  a range data protection solutions, with a range of products, for on-premise and cloud-based data. Contact us for a free assessment of which type of solution is best for you.


 

 

Tuesday Take-Away: Your Backup System is (sort of) Irrelevant

As you may know, I participate in several on-line IT discussion forums.  Every few weeks, a new member will post a question like “I have an xyz server, what should I use for backups?”.  Seemingly helpful forum members quickly jump in and start throwing out vendor names, do-it-yourself solutions, discussions about NAS versus SAN and disk-to-disk versus disk-to-tape, and so on.

It makes me want to SCREAM?  Why?  Because …

What you use for backup is irrelevant unless you know what you are backing up, why, and how quickly you need to restore!

Said another way, before you pick ANY backup solution, you should know:

  • What you need to restore
  • Why you expect you will need to restore or recover it
  • How quickly you will need to restore or recover it

Note that the answers you provide may vary for the different types of data.  For example, you may be able to live without your accounting system for two days, so long as you can ship orders within 4 hours.   You may need current project files immediately, but could wait a week for projects completed more than a year ago.

Understanding your “Why”

When considering why you might need to restore or recovery information or systems, think of the full spectrum of activities that can go wrong.  As an informal set of definitions:

  • Restore operations are usually performed on individual files or small sets of data, often resulting from accidental overwrites, deletions, or component (disk) failures.
  • Recovery operations are usually geared for large data loss, such as a drive array failure or server loss due to a disaster.

The key difference, restore operations bring back select data from a specific point in time while recovery operations bring back entire systems or data environments.

For example, you might restore email messages accidentally deleted from a user’s account on an MS Exchange server.  If the disk array dies, however, you would need to recover the entire mailbox store for the server.

Backup/Recovery protects you from disaster; Backup/Restore protects you from component failures and user errors (or intentional misconduct).

How you backup for recovery will often differ than how you backup for  restore.

Backup solutions that efficiently restore data, are not optimized for recovery.  Most backup solutions designed for fast recovery, such as image snapshots, lack the ability to restore individual elements.  For the Exchange server, above, we would recommend running two backups — one designed for recovery and one for individual mailbox and message restores.

Additionally, backups for restore generally give you more retention points than backups for recovery.  Being able to select a specific time or version of data is a key feature for backup/restore solutions.

Understanding you “How Quickly”

How quickly you need your data depends on the data and your business.  Keep in mind that you do not need all of your data all at once.  Generally speaking, however, when you need to restore an active file or two, you want to be able to do this quickly.  While you want quick recovery as well, you are more likely to be bound by factors beyond your backup/recovery solution, such as purchasing new hardware or moving to temporary office space.

Focus first on how quickly you need to Return To Operations.  Your RTO will drive your selection and investment in backup/recovery solutions.  Once you have your RTO, identity the critical data and systems you need to get your business up and running.  Your RTO will be shorter than your window for full recovery, and includes only the critical subset you need to get up and running.

The shorter your RTO, the more expensive the solution.  A realistic RTO will prevent you from over-buying.

First Steps First

By first understanding your requirements — the what, why, and how fast — of your restore and recovery needs, you can select backup solutions that accurately match your needs and effectively protect your data and your business.  By defining your needs, your solution will be relevant and your investment well-made.