From a business perspective, a disaster isn’t just a violent storm or terrorist attack that makes news headlines. Anything that makes normal operations difficult or impossible can be disastrous – Imagine that all of your customer files have evaporated, along with everyone’s email messages, pending customer orders and your entire accounts receivables database. This type of loss not only interrupts the flow of business but could halt it completely, and it poses a threat you can’t ignore.
Data recovery planning is essential for every business and should be part of an overall resiliency or business continuity plan. This plan will help you continue operations in the face of adverse incidents, big or small, and avoid catastrophic losses. At a high level data recovery planning can be broken down into three primary steps:
- Assess: Know and understand the value of your data and the impact loss would have on the business.
- Review: Research and analyze possible internal and external threats and triggers that could cause the need for data recovery. This can take the form of natural disasters and component loss, which are less common, as well as more common circumstances like data corruption, security incidents, or human error.
- Protect: Based on your assessment, you should know what kinds of adverse events to plan against. Use this knowledge to develop effective prevention and recovery solutions.
The Impact of Data Loss
Recovery planning starts with getting an accurate accounting of your data and applications and identifying what information is essential to business operations. This assessment will allow you to categorize information into critical versus non-critical assets, for instance, non-recoverable private data compared to information that is in the public domain.
But preparation goes beyond simply identifying these assets, you also need to understand the business consequences of losing this data. Your assessment should include a business impact analysis that calculates the dollars and cents costs of a single event on your business as well as each risks’ probability. Using this kind of math, you can arrive at a number that represents your “potential loss” – the quantifiable sum of everything that may be at risk in the event of a sudden disaster.
While we intuitively understand the consequences of large scale catastrophes, most of us fail to recognize the extent of a “silent” IT disaster unfolding under our virtual noses. According to IT complexity expert and ObjectWatch founder, Roger Sessions, organizations in the United States lose $1.2 trillion from IT failures every year – worldwide, the total comes to $6.2 trillion.
Unfortunately, companies tend to focus too much energy on the high impact low probability events and not enough attention on the higher probability events that can still have a significant impact. Disaster recovery assessment shouldn’t be limited to the consequences of a hurricane, earthquake or similar catastrophe. Lower profile but nevertheless important events – from software bugs to hardware failures, which can every bit as consequential as fire or flood, need to be considered as well.
Planning for Disaster
To ensure that your network can recover from data loss and avoid disruption, you need a combination of the right assessment, performance and testing in place. Here are three steps you should implement into your business continuity planning to ensure effective data recovery:
- Start by classifying risks. You should have various data loss templates based on different potential threats. Begin with a holistic view of your risks then look for the common denominators in these patterns. Map out two to four patterns; zeroing in on those with the highest probability.
- Get the right technology and tools. Ensure that you have the processes and technology in place to act on each risk pattern, this includes: backup and recovery; snapshots; and replication. Typically a good data recovery strategy consists of all of these technology solutions to cover any data loss scenario. Ideally you should have sophisticated monitoring in place with a tool that produces few or no false positives.
- Test, test, test. Any recovery plan is only as good as your last test – regularly test from an operations and technology perspective to expose your vulnerabilities, and make the unknown known BEFORE disaster strikes.
A resiliency plan can take many forms and may require specific industry considerations, but the most important part is simply creating one. It’s helpful to think of your data recovery plan as a journey, starting with the basics and becoming more refined with time. You may begin with two or three data recovery patterns across you data center and then as you mature your plan will become more specific to your business’ needs. Eventually, you’ll be able to take a more granular approach, moving from the common denominator to a more narrow focus on the data that is most important to your organization.
