Disaster Preparedness for Information Technology

Transcription

1 Disaster Preparedness for Information Technology An overview of 4 main components to a disaster recovery plan. For owners or managers of professional offices. Written by Mark Haake, President of Reliance Technology Solutions

2 Introduction Businesses rely almost completely on their Information Technology (IT) infrastructure to operate. With the introduction of , accounting software, order processing software, time management software and a multitude of other computer programs, it s nearly impossible to be a successful business without reliable computers. Along with all of these applications comes a vast quantity of data that must be stored and protected from loss. The loss of a single QuickBooks company file could wreak complete havoc within an organization. This single file contains all customer data, sales history, sales tax data, expense history and nearly every other facet of a company s financial well-being. Protecting this, and other sensitive company data, is imperative. With such a heavy reliance on electronic records, business owners and executives must ensure that they have a secure, stable system in place that will allow quick recover of any, and all, lost electronic data. Business Continuity The goal for any disaster recovery plan is to recover as much data as possible, as quickly as possible. Ultimately, zero data loss is preferred. However, in nearly all cases there is a small amount of data that was generated since the last point-in-time backup. Therefore, a determination must be made in coordination with each business as to the frequency of backups that must be accomplished. For most companies, a failed system directly correlates to lost revenue. Additionally, the cost of the disaster recovery can be a major factor for most businesses. So, the ultimate goal is to provide as much redundancy and recoverability as possible, without making the solution cost prohibitive. Therefore, budget is also a major factor when developing a disaster recovery plan. Planning Process Business owners, as well as any other employees with a vested interest in the data, must be a part of the planning process. It is critical that all relevant data is identified and graded with regard to its importance to the company. This will help to determine what level of protection is required for some or all of the data. This will also identify which data needs to be recovered as quickly as possible, versus other data that is important, but doesn t necessarily require immediate recovery.

3 As with any business decision, a budget (immediate, as well as recurring) must be identified at the beginning of the planning process. There are numerous tools available at varying costs, some requiring a single, up-front payment, while others have recurring monthly fees associated with them. By determining the budget at the outset of the planning process, a realistic disaster recovery plan can be identified. Solutions Ultimately, a disaster recovery plan will entail four main components: 1. Security 2. Data/Hardware Redundancy 3. Onsite Backup 4. Offsite Backup Security This is often the most overlooked aspect of a disaster recovery plan. While most companies employ security solutions, they don t often tie it to disaster recovery. However, security breaches are a common cause of data loss and must be included in any disaster recovery plan. Briefly, the inclusion of a business-grade firewall is essential. While any firewall is better than no firewall, the off-the-shelf units available at local office supply stores are limited in their ability to control threats. Employing a business-grade firewall ensures a much higher degree of protection and control of the network Malware protection is also a requirement for ensuring data protection. The number of malicious programs propagated throughout the Internet dictate that anti-virus protection be implemented as another layer of protection. It s important to note that there is no anti-virus solution that is able to completely eliminate the introduction of malware. However, when used in a multi-layered approach, it significantly reduces the risk of infection. Lastly, drastically reducing spam is a very important step in protection valuable company data. A large number of spam s are accompanied by links to websites. In most cases, these are malicious websites that will attempt to install malware on the computers that are visiting them. By employing an anti-spam solution, businesses can greatly reduce their vulnerability.

4 Data/Hardware Redundancy Businesses with little tolerance for system downtime can employ redundant systems to ensure that a backup system can be brought online immediately after a system failure. Again, there are numerous solutions that can be utilitized with vastly varying costs associated with each. One of the most cost-effective methods of data redundancy is through the use of Redundant Array of Inexpensive Disks (RAID). RAID technology allows data to be either replicated or what is called striped across multiple hard drives. This technology ensures that even if a drive fails, the other remaining drives are able to continue to function will little or no impact upon performance. Once a replacement drive is procured, it is quickly added back to the existing RAID with little or no system down-time. Ultimately, a second, identical or nearly identical server could be procured that is kept in a state that replicates the operational server. In the event of a failure, the second server can either be brought online manually, or with additional software can be configured to take over automatically when it detects that the original (primary) server has gone offline. As one might imagine, this is a very costly solution and the cost would have to be fully justified by business need. Onsite Backup Onsite backups are a reasonably cost-effective method of backing of critical data and systems. They are also the most time efficient method of backup and recovery in the event of lost data. Onsite backups consist primarily of two methods file copying and volume imaging. File copying is exactly what is sounds like. Critical files are copied onto another device, whether an additional internal hard drive, a flash drive, or an external hard drive. The files are copied as they exist at the time of backup and may or may not be the latest version of the files. If changes occur to the files following the last backup, obviously the backed up copy will be missing whatever changes were made. Volume imaging is a little more complicated, but has significant advantages over file copies. Volume images take a snapshot in time of an entire drive, i.e. the C: drive of a PC or server. This snapshot can then be the basis of an entire backup scheme that can quickly backup any and all files that have changed since the last backup, while ignoring those that haven t. Additionally, volume imaging gets all files and system data within the backup. This means that if the hard drive of the server or PC has failed, the drive can be replaced and the entire image (snapshot) can be written to the new drive. This, in effect, makes the system exactly as it was at the time of the last snapshot. In other words, it s as if the drive never failed.

5 The major benefit to this ability is that there is no need to reinstall any programs or the operating system. These were all contained within the snapshot and are therefore recovered to the new drive. The alternative to this is a complete reinstallation of the operating system, reinstalling all programs that were installed, then copying all of the backed up data to the server. This could easily take several days to complete, as opposed to a few hours replacing the drive and then restoring the image. Offsite Backups Finally, offsite backups are a vital tool in the protection of company data. In most cases, offsite backups require payment of a monthly fee that is based on the amount of data being placed on the offsite backup systems. The cost of these backups vary greatly among vendors and by the features available. Offsite backups are considered the backup of last resort. The purpose of these should be to provide a secure method of storing the data in the event of a major, likely catastrophic, event such as fire, flood, tornado, etc. The previously mentioned methods of backup are meant to provide day-to-day recovery of files and systems for all other types of data loss. The reason for this is two-fold. In the event of such a major loss, there is very little chance that the systems, including backup systems, and facilities will still exist. Even if they do, it is unlikely that they will be usable in the near-term. However, most important is that the speed of transfer for offsite data is very slow. In many cases it can take as much as a week to transfer backup data to or from the offsite location. While the data can be expressed from the offsite company, there will still be the need to procure an alternate facility and/or new equipment to deploy. Conclusion Backing up systems and critical business data can be a daunting task at first glance. However, with the right planning and budget business owners can put into place a system that can provide great peace-of-mind by ensuring that all data and systems can be recovered in a timely manner.