Backup, disaster recovery and operational resilience are all words that get tossed around in discussions. But what are the differences between these, and what are the key points organizations need to make sure of? Let’s take a crack at navigating resilience and recovery in our digital age:
What’s the difference, really?
Backup
Backup protects recoverable copies of information. It is a copied version of your live system, ideally copied regularly on a set schedule, providing the possibility of rollbacks in the case of mishaps.
Disaster recovery
Disaster recovery is how you rebuild your systems – including applications, internal data, identities and structures – after any sort of critical event. This can include backups, but cannot be purely limited to them.
Operational resilience
Operational resilience is the question of how well your organization can continue operations after a critical event. This is a key question to address! Even if you are capable of full disaster recovery, if your business is non-operating during that process it can create major cashflow issues and possibly even sink smaller organizations.
How do you build these together?
Starting with backup, it is key your backups are hardened and capable of capturing all the necessary data. Microsoft’s ransomware guidance asks several pertinent questions, including one telling one: are backups of the application, configuration and data available, and are they regularly verified through restore exercises?
The importance here is if the backup captures only your data, or if it can reconstruct user identities and operational setup. If not, this is going to present a major recovery gap and extend the period it takes to fully reestablish your systems.
The other side of things is if the backups are hardened against interference. Nicolas Blank, CTO at NBConsult, has said that “Backups have to be designed on the assumption that an attacker will actively try to find, encrypt or delete them.” If your backups do not have an offline version and are not immutable, relying on them as the backbone of your recovery can lead organizations to be unprepared once a critical event occurs.
Key points
- Do not mistake “having a backup” with having resiliency
- Test your systems – don’t assume an untested backup restore will work
- Plan for redundancy – assume that things will go wrong and backups will be compromised
- Plan for resilience – have a process for continuing operations while undergoing recovery operations
Your Data in Your hands – With TECH-ARROW
by Matúš Koronthály
Image generated by Canva
