Weatherproof your business against storm and cyber risks

With storm season approaching and the frequency of ransomware attacks increasing, there’s never been a better time to check your backup and disaster recovery systems. 

We asked our Solutions Architect Damian Wright, who helps build out disaster recovery plans for our clients, what businesses need to be aware of and some backup best practices to help protect against the unexpected.

Backup vs. disaster recovery

Companies often consider backups and disaster recovery plans to be one and the same, but in reality, there are subtle differences that can have real business impact. 

He says backups work to protect data, in the form of retention and compliance, while disaster recovery plans work to protect operations and ensure businesses are back up and running soon after disaster strikes.

Companies with a backup process make copies of the data, which helps with issues like accidental file deletion, file corruption, or when someone overwrites a file and wants to roll back to an older version.

Disaster recovery takes this a step further, replicating or ‘mirroring’ servers to other physical servers in another data centre or rented computer space (more on that below). That way, if your primary server is down, from say a natural disaster or ransomware attack, then your other server is ready to go.

“For companies relying solely on backups, it can take days or weeks to get back online, depending on the size of the attack. Disaster recovery is much faster to get your systems up and running,” Damian says.

“You can get down to 15 minutes, where you’re replicating every 15 minutes to the secondary site, but typically, organisations might replicate every hour or every night. 

“Some companies say they can’t afford to lose a single transaction, especially enterprises with high accountability.”

Damian says an active and working disaster recovery plan is crucial, especially when it comes to natural disasters like flooding or storm events, which can be unpredictable.

“That’s where disaster recovery is really important, helping make services available again so companies don’t have too much downtime, because for every day they’re not working, that’s a lot of lost revenue and productivity,” he says.

It’s not only for natural disasters that companies need a robust disaster recovery plan. Recent cyber attacks, like the Medibank Private cyber incident, highlight the importance of being proactive, not reactive in the face of disaster.

“We've had businesses where they didn't have a disaster recovery plan and they're sort of tossing up, ‘do I pay the ransom?’ and the ransom might be $100,000,” he says.

That’s where backups and solid disaster recovery plans can “save the day,” Damian says.

“Backups are like seatbelts, they don’t stop the car crashing, but they do save you.”

Backups: cloud vs. tape vs. hard drives

Backup processes have evolved over the years, from tape and hard drives through to cloud backups.

Damian says tapes are airgapped, making them one of the most reliable forms of protected backup, however they can be subject to tape rot. When it comes to disaster recovery, he says cloud-based and hybrid systems work best. 

“Cloud was historically a bit slower, depending on internet connection and the volume of data being backed up,” Damian says.

“But as people move to the cloud, it’s less of an operations risk because if everything’s available in the cloud then office workers, if they have power and internet at home, can work from home.

“We generally see a hybrid approach where companies will back up on-premise and then do a secondary copy that runs to the cloud in the background. They’ll send the bulk of data to the cloud and henceforth it’ll be incremental backups throughout the day.”

The backup system a company chooses depends on a few factors, says Damian, including the volume of data being backed up, the cost to store that volume of data, and the length of time companies want to store it. 

“We had a medical client and they had to store 99 years of data, so you get some outlier cases,” Damian says.

“You’ll also get organisations that just keep enough to get back the last six months. But generally, seven years is pretty typical.”

How often should you assess or test recovery plans?

Damian says companies should be checking their backups are running daily, and backing up as frequently as the business needs. 

“It’s really a business decision on how much risk a company wants to take on, because you’re only as good as your last backup,” he says.

“If something happens, depending on how far back you go back, two hours or two weeks or two months, you might have lost all that data that’s been put into the system since your last backup.

“Some businesses have really high requirements where they can only afford to lose an hour of work, or sometimes not even an hour. It really is a business decision, not an IT decision.”

Businesses should also be checking whether their backups are immutable and following the ‘3-2-1’ rule. 

“You should have three copies of your data on two different media types with one off-site copy,” Damian says.

“If you backup to the cloud, you can do something called immutability, where that backup can’t be deleted, not even by the person who created the backup.

“So if you set the immutability to 14 days, those backups are good for 14 days before they get deleted. They become more tamper proof.”

However, Damian says attackers also know backups are immutable, and can sometimes edit a company’s backup plan without the administrator knowing. That’s why partnering with a managed service provider, who can set up MFA and put multiple authorisation systems in place, can be a much-needed support for companies.

How Truis helps companies prepare for the unexpected

Backup management and disaster recovery planning is part of Truis’ wider managed services offering. 

“We monitor businesses’ backups using monitoring software and get an alert daily if a backup doesn't work,” he says.

“Then we set up a ticket and an engineer logs on and starts to rectify the issue.

“We also do a ‘full failover’ for some clients, where we fail over the whole system (at a set time within minimal disruptions), or we do what’s called a ‘bubble test’, where we test just some servers.”

With Truis, companies can also access options that would otherwise be unavailable to them. 

“We offer disaster recovery as a service, where we partner with providers, who don’t work with the public, who have subscription-based servers for rent,” Damian says.

“We can manage those subscriptions for our clients. This means a server will always be upgraded to the latest hardware, it’ll be patched, managed, secured. There are diesel backup generators, fire suppression, and cybersecurity systems all tied into the service.

“So instead of spending half a million on disaster recovery, you can just pay a subscription and have a managed and secure server.”

Would you like an assessment of your existing disaster recovery plan, or help building and running one for your business? Get in touch today to find out how our team can help you prepare for any situation and get you back up and running in no time.